Changelog

Last updated on 2026-09-15

2026-09-15 — Security Hardening

Added SET search_path = '' to all SECURITY DEFINER functions (get_user_role, is_admin, is_instructor_or_above, is_student_or_above, handle_new_user, update_course_student_count, update_course_rating, log_audit, award_xp, update_thread_reply_count)
Hardcoded 'student' role in handle_new_user() trigger -- role is never read from signup metadata
Added column-level grants on profiles table -- users can only update full_name, avatar_url, headline, bio, location, and social link columns
Restricted lesson access via RLS -- lessons only visible to enrolled users, free preview, instructors, or admins
Restricted enrollment inserts to instructors and admins via RLS (client enrollment goes through Server Actions)
Added enrollment update column restriction to last_accessed_at only

Added drop_all.sql for clean database resets (drops triggers, tables, functions, storage policies, and auth.users)
Added ON CONFLICT (id) DO NOTHING to storage bucket inserts for idempotent re-runs
Optimized middleware to skip Supabase API calls on public routes (prevents 504 timeouts on Vercel)

55 routes across Student (23), Instructor (11), Admin (12), Auth (3), and Public pages
38 Supabase tables with migrations, RLS, triggers, and seed data
Three-role RLS -- student, instructor, and admin with scoped data access
Supabase Auth -- email/password, Google OAuth, GitHub OAuth, password reset
17 server action files -- complete CRUD for all entities
Course management -- courses, modules, lessons with CRUD
Quiz engine -- JSONB questions, scoring, pass/fail, time tracking
Gamification -- XP, badges, certificates, leaderboard, streak
Community -- discussions, live sessions, study groups, messages
Student tools -- bookmarks, notes, calendar, notifications, billing
Instructor portal -- course management, curriculum builder, revenue, analytics
Admin portal -- user management, approvals, coupons, audit log, settings
Analytics -- enrollment trends, revenue, daily metrics
Light & dark mode with oklch design tokens
WCAG AA across all screens

Built on the LMS Kit frontend-only template (39 routes), extended to 55 routes with a complete Supabase backend.

FAQ