-
-
Notifications
You must be signed in to change notification settings - Fork 4
Release v1.0.5 #374
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Release v1.0.5 #374
Changes from all commits
2c77e2a
4dd23b2
cf43f36
e07941e
006b39b
6e3526f
9130df1
3a59b4e
d6697f4
fe667af
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
This file was deleted.
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,31 @@ | ||||||||||||||||||||||||
| import { NextResponse } from 'next/server'; | ||||||||||||||||||||||||
|
|
||||||||||||||||||||||||
| import { getUserQuizzesProgress } from '@/db/queries/quizzes/quiz'; | ||||||||||||||||||||||||
| import { getCurrentUser } from '@/lib/auth'; | ||||||||||||||||||||||||
|
|
||||||||||||||||||||||||
| export const runtime = 'nodejs'; | ||||||||||||||||||||||||
|
|
||||||||||||||||||||||||
| export async function GET() { | ||||||||||||||||||||||||
| const user = await getCurrentUser(); | ||||||||||||||||||||||||
|
|
||||||||||||||||||||||||
| if (!user?.id) { | ||||||||||||||||||||||||
| return NextResponse.json({}, { | ||||||||||||||||||||||||
| headers: { 'Cache-Control': 'no-store' }, | ||||||||||||||||||||||||
| }); | ||||||||||||||||||||||||
| } | ||||||||||||||||||||||||
|
|
||||||||||||||||||||||||
| const rawProgress = await getUserQuizzesProgress(user.id); | ||||||||||||||||||||||||
| const progressMap: Record<string, { bestScore: number; totalQuestions: number; attemptsCount: number }> = {}; | ||||||||||||||||||||||||
|
|
||||||||||||||||||||||||
| for (const [quizId, progress] of rawProgress) { | ||||||||||||||||||||||||
| progressMap[quizId] = { | ||||||||||||||||||||||||
| bestScore: progress.bestScore, | ||||||||||||||||||||||||
|
Comment on lines
+18
to
+22
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Prevent prototype pollution in dynamic key mapping. 🔒 Proposed fix- const progressMap: Record<string, { bestScore: number; totalQuestions: number; attemptsCount: number }> = {};
+ const progressMap: Record<string, { bestScore: number; totalQuestions: number; attemptsCount: number }> =
+ Object.create(null);📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||
| totalQuestions: progress.totalQuestions, | ||||||||||||||||||||||||
| attemptsCount: progress.attemptsCount, | ||||||||||||||||||||||||
| }; | ||||||||||||||||||||||||
| } | ||||||||||||||||||||||||
|
|
||||||||||||||||||||||||
| return NextResponse.json(progressMap, { | ||||||||||||||||||||||||
| headers: { 'Cache-Control': 'no-store' }, | ||||||||||||||||||||||||
| }); | ||||||||||||||||||||||||
| } | ||||||||||||||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Avoid returning authorization role from stale token claims.
Line 8-Line 9 now return role directly from JWT session payload. If a user is downgraded/deleted in DB, this endpoint can continue exposing outdated auth state until token expiry.
✅ Safer approach (DB-backed role)
🤖 Prompt for AI Agents