fix: block client INSERT/DELETE on leaderboard to prevent score forgery (#1925) - #1931

Process completed with exit code 1.

AssertionError: expected 'Profile photo exceeds 2MB limit.' to match /5mb/i - Expected: /5mb/i + Received: "Profile photo exceeds 2MB limit." ❯ tests/uploadPhoto.test.js:236:28

AssertionError: expected 'https://mock.supabase.co/storage/v1/o…' to match /profile-user-948-test-/ - Expected: /profile-user-948-test-/ + Received: "https://mock.supabase.co/storage/v1/object/public/mock/user-948-test/1785876478454_ddb47e01-616a-46f8-af1d-d4c12d195852.png" ❯ tests/uploadPhoto.test.js:170:30

AssertionError: expected '# api documentation\n\nthe peer learn…' to contain 'magic byte' - Expected + Received - magic byte + # api documentation + + the peer learning platform primarily relies on the **supabase javascript client** for interacting with the database, and a custom **node.js express backend** for secure external api interactions (like the ai assistant). + + ## supabase client apis + + most data operations are performed directly from the react frontend using the `supabase-js` client. rls (row-level security) policies in the database ensure these requests are secure. + + ### example: fetching study sessions + ```typescript + import { supabase } from '@/integrations/supabase/client'; + + const fetchsessions = async () => { + const { data, error } = await supabase + .from('study_sessions') + .select('*, profiles(username, avatar_url)') + .order('created_at', { ascending: false }); + + if (error) console.error(error); + return data; + }; + ``` + + ### example: sending a chat message + ```typescript + const sendmessage = async (sessionid: string, content: string, userid: string) => { + const { error } = await supabase + .from('chat_messages') + .insert({ + session_id: sessionid, + content: content, + sender_id: userid + }); + }; + ``` + + ## custom node.js api (ai integration) + + for operations requiring secure handling of external api keys (e.g., openai/openrouter), requests are sent to our custom backend. + + ### `post /api/ai/summary` + + generates an ai summary of a chat session. + + **endpoint**: `http://localhost:5000/api/ai/summary` + **headers**: + - `authorization`: `bearer <supabase jwt token>` + + **request body**: + ```json + { + "messages": [ + {"role": "user", "content": "how does react context work?"}, + {"role": "assistant", "content": "react context provides a way to pass data through the component tree without having to pass props down manually at every level."} + ] + } + ``` + + **response**: + ```json + { + "summary": "the user asked about react context, and the assistant explained that it is used to avoid prop drilling." + } + ``` + + **security & rate limiting**: + - requires a valid supabase jwt token. + - protected by a custom, in-house rate limiter middleware (`backend/middlewares/ratelimiter.js`) to prevent abuse. + + ## cron routes (`/api/cron`) + + these endpoints are triggered by a scheduled cron job and protected by the `cron_secret` environment variable. + + **auth**: `authorization: bearer <cron_secret>` + + all cron requests must supply the `cron_secret` token in the `authorization` header. requests without a valid `cron_secret` receive a `401 unauthorized` response. + + ### `post /api/cron/dispatch-notifications` + + atomically claims a batch of pending push notifications (up to 100) and dispatches them to subscribed devices. uses `push_claimed_at` to prevent concurrent invocations from double-delivering the same notification. + + **response**: + ```json + { "sent": 5, "processed": 5 } + ``` + + ### `post /api/cron/reminders` + + finds upcoming study sessions starting within the next 15 minutes and inserts `session_reminder` notifications for all participants. + + **response**: + ```json + { "inserted": 3 } + ``` + + ### `post /api/cron/mentorship-reminders` + + finds incomplete mentorship milestones that are due or overdue within the next 24 hours and inserts `mentorship_reminder` notifications for mentor and mentee. + + **response**: + ```json + { "inserted": 2 } + ``` + + ## notification routes (`/api/notifications`) + + these endpoints support two authentication modes: `webhook_secret` for server-to-server calls, and a standard supabase jwt for user-initiated calls. + + **auth**: `authorization: bearer <webhook_secret>` or valid supabase jwt token. + + requests carrying a valid `webhook_secret` bypass user-level auth. requests without a `webhook_secret` fall back to the standard `requireauth` middleware which validates the supabase jwt. + + ### `post /api/notifications/send-push` + + sends a browser push

AssertionError: expected '# API Documentation\n\nThe Peer Learn…' to contain '/api/users/upload-photo' - Expected + Received - /api/users/upload-photo + # API Documentation + + The Peer Learning Platform primarily relies on the **Supabase JavaScript Client** for interacting with the database, and a custom **Node.js Express Backend** for secure external API interactions (like the AI assistant). + + ## Supabase Client APIs + + Most data operations are performed directly from the React frontend using the `supabase-js` client. RLS (Row-Level Security) policies in the database ensure these requests are secure. + + ### Example: Fetching Study Sessions + ```typescript + import { supabase } from '@/integrations/supabase/client'; + + const fetchSessions = async () => { + const { data, error } = await supabase + .from('study_sessions') + .select('*, profiles(username, avatar_url)') + .order('created_at', { ascending: false }); + + if (error) console.error(error); + return data; + }; + ``` + + ### Example: Sending a Chat Message + ```typescript + const sendMessage = async (sessionId: string, content: string, userId: string) => { + const { error } = await supabase + .from('chat_messages') + .insert({ + session_id: sessionId, + content: content, + sender_id: userId + }); + }; + ``` + + ## Custom Node.js API (AI Integration) + + For operations requiring secure handling of external API keys (e.g., OpenAI/OpenRouter), requests are sent to our custom backend. + + ### `POST /api/ai/summary` + + Generates an AI summary of a chat session. + + **Endpoint**: `http://localhost:5000/api/ai/summary` + **Headers**: + - `Authorization`: `*** JWT Token>` + + **Request Body**: + ```json + { + "messages": [ + {"role": "user", "content": "How does React context work?"}, + {"role": "assistant", "content": "React context provides a way to pass data through the component tree without having to pass props down manually at every level."} + ] + } + ``` + + **Response**: + ```json + { + "summary": "The user asked about React Context, and the assistant explained that it is used to avoid prop drilling." + } + ``` + + **Security & Rate Limiting**: + - Requires a valid Supabase JWT token. + - Protected by a custom, in-house rate limiter middleware (`backend/middlewares/rateLimiter.js`) to prevent abuse. + + ## Cron Routes (`/api/cron`) + + These endpoints are triggered by a scheduled cron job and protected by the `CRON_SECRET` environment variable. + + **Auth**: `Authorization: *** + + All cron requests must supply the `CRON_SECRET` token in the `Authorization` header. Requests without a valid `CRON_SECRET` receive a `401 Unauthorized` response. + + ### `POST /api/cron/dispatch-notifications` + + Atomically claims a batch of pending push notifications (up to 100) and dispatches them to subscribed devices. Uses `push_claimed_at` to prevent concurrent invocations from double-delivering the same notification. + + **Response**: + ```json + { "sent": 5, "processed": 5 } + ``` + + ### `POST /api/cron/reminders` + + Finds upcoming study sessions starting within the next 15 minutes and inserts `session_reminder` notifications for all participants. + + **Response**: + ```json + { "inserted": 3 } + ``` + + ### `POST /api/cron/mentorship-reminders` + + Finds incomplete mentorship milestones that are due or overdue within the next 24 hours and inserts `mentorship_reminder` notifications for mentor and mentee. + + **Response**: + ```json + { "inserted": 2 } + ``` + + ## Notification Routes (`/api/notifications`) + + These endpoints support two authentication modes: `WEBHOOK_SECRET` for server-to-server calls, and a standard Supabase JWT for user-initiated calls. + + **Auth**: `Authorization: *** OR valid Supabase JWT token. + + Requests carrying a valid `WEBHOOK_SECRET` bypass user-level auth. Requests without a `WEBHOOK_SECRET` fall back to the standard `requireAuth` middleware which validates the Supabase JWT. + + ### `POST /api/notifications/send-push` + + Sends a browser push notification to all subscr

AssertionError: expected '# API Documentation\n\nThe Peer Learn…' to contain '/api/upload' - Expected + Received - /api/upload + # API Documentation + + The Peer Learning Platform primarily relies on the **Supabase JavaScript Client** for interacting with the database, and a custom **Node.js Express Backend** for secure external API interactions (like the AI assistant). + + ## Supabase Client APIs + + Most data operations are performed directly from the React frontend using the `supabase-js` client. RLS (Row-Level Security) policies in the database ensure these requests are secure. + + ### Example: Fetching Study Sessions + ```typescript + import { supabase } from '@/integrations/supabase/client'; + + const fetchSessions = async () => { + const { data, error } = await supabase + .from('study_sessions') + .select('*, profiles(username, avatar_url)') + .order('created_at', { ascending: false }); + + if (error) console.error(error); + return data; + }; + ``` + + ### Example: Sending a Chat Message + ```typescript + const sendMessage = async (sessionId: string, content: string, userId: string) => { + const { error } = await supabase + .from('chat_messages') + .insert({ + session_id: sessionId, + content: content, + sender_id: userId + }); + }; + ``` + + ## Custom Node.js API (AI Integration) + + For operations requiring secure handling of external API keys (e.g., OpenAI/OpenRouter), requests are sent to our custom backend. + + ### `POST /api/ai/summary` + + Generates an AI summary of a chat session. + + **Endpoint**: `http://localhost:5000/api/ai/summary` + **Headers**: + - `Authorization`: `*** JWT Token>` + + **Request Body**: + ```json + { + "messages": [ + {"role": "user", "content": "How does React context work?"}, + {"role": "assistant", "content": "React context provides a way to pass data through the component tree without having to pass props down manually at every level."} + ] + } + ``` + + **Response**: + ```json + { + "summary": "The user asked about React Context, and the assistant explained that it is used to avoid prop drilling." + } + ``` + + **Security & Rate Limiting**: + - Requires a valid Supabase JWT token. + - Protected by a custom, in-house rate limiter middleware (`backend/middlewares/rateLimiter.js`) to prevent abuse. + + ## Cron Routes (`/api/cron`) + + These endpoints are triggered by a scheduled cron job and protected by the `CRON_SECRET` environment variable. + + **Auth**: `Authorization: *** + + All cron requests must supply the `CRON_SECRET` token in the `Authorization` header. Requests without a valid `CRON_SECRET` receive a `401 Unauthorized` response. + + ### `POST /api/cron/dispatch-notifications` + + Atomically claims a batch of pending push notifications (up to 100) and dispatches them to subscribed devices. Uses `push_claimed_at` to prevent concurrent invocations from double-delivering the same notification. + + **Response**: + ```json + { "sent": 5, "processed": 5 } + ``` + + ### `POST /api/cron/reminders` + + Finds upcoming study sessions starting within the next 15 minutes and inserts `session_reminder` notifications for all participants. + + **Response**: + ```json + { "inserted": 3 } + ``` + + ### `POST /api/cron/mentorship-reminders` + + Finds incomplete mentorship milestones that are due or overdue within the next 24 hours and inserts `mentorship_reminder` notifications for mentor and mentee. + + **Response**: + ```json + { "inserted": 2 } + ``` + + ## Notification Routes (`/api/notifications`) + + These endpoints support two authentication modes: `WEBHOOK_SECRET` for server-to-server calls, and a standard Supabase JWT for user-initiated calls. + + **Auth**: `Authorization: *** OR valid Supabase JWT token. + + Requests carrying a valid `WEBHOOK_SECRET` bypass user-level auth. Requests without a `WEBHOOK_SECRET` fall back to the standard `requireAuth` middleware which validates the Supabase JWT. + + ### `POST /api/notifications/send-push` + + Sends a browser push notification to all subscribed devices for a given

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Fast refresh only works when a file only exports components. Use a new file to share constants or functions between components

Fast refresh only works when a file only exports components. Use a new file to share constants or functions between components

Fast refresh only works when a file only exports components. Use a new file to share constants or functions between components