Maxim Dolgolyov
76883b569c
- backend/src/permissions/registry.js: single source of truth (PERMISSIONS map) with all 24 keys (16 teacher + 8 student, student keys also cover free_student). Exports isKnown(), listKeys(), byRole(), buildDefaultsMap(). - auth.js: PERM_DEFAULTS now sourced from registry.buildDefaultsMap(); new perm() helper validates key at registration time (crashes early on typos). requirePermission() unchanged — backward compat preserved. - permissionsController.js: ALL_PERMISSIONS now built from registry.byRole(); inline 24-entry array removed. API response shape unchanged. - check-route-auth.js: validates every requirePermission/perm call key against registry; lists unknown keys as errors before exit. perm() added to GUARDS list so it counts as route protection. Discrepancy noted: auth.js had free_student with same 8 keys as student; permissionsController never seeded free_student rows. Registry documents this via roles:[] array; buildDefaultsMap() correctly covers free_student. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
backend/scripts
Operational scripts for LearnSpace backend.
Cron setup (production)
# Daily backup at 4am
0 4 * * * /path/to/repo/backend/scripts/backup.sh
# Weekly verification at 6am Sunday (cron mails on non-zero exit)
0 6 * * 0 /path/to/repo/backend/scripts/verify-backup.sh
Scripts
backup.sh
Creates a safe SQLite snapshot via VACUUM INTO. Keeps last 7 backups (configurable via KEEP=14).
./backup.sh # default: ../data/learnspace.db → ../../backups/
./backup.sh /path/to/db /path/to/backups
KEEP=14 ./backup.sh
verify-backup.sh
Restores the latest backup to /tmp, runs PRAGMA integrity_check, compares row counts vs production.
Exit codes:
0— all checks passed2— no backup files found3— latest backup older than 48h (backup job may have stopped)4—integrity_checkfailed (backup is corrupt)5— user count diverged >5% from production
./verify-backup.sh
BACKUP_DIR=/custom/backups PROD_DB=/custom/db.sqlite ./verify-backup.sh
check-route-auth.js
Scans src/routes/*.js for :id-bearing routes without an auth-guard middleware.
Fails if new unprotected routes exceed the current baseline.
npm run lint:routes
import-content.js (coming in Task 8)
Imports question collections from YAML manifests into the database.
npm run import:content -- ../content/phys/ct-2024.yaml
Deploy order (first time / fresh server)
npm install
npm run migrate
npm run seed:permissions
npm start