Block a user
Epic: build the full parent-approval book model (upload approval chain, ApprovedBy audit, parent family/staff-uploads view, auto-Public-on-approval)
[Security][Backend][Books] Private books are listable and downloadable by any authenticated user — /api/book/all and /api/book/{id}/file have no visibility/ownership check
Part 1 of 2 in progress — backend PR spikersoft-backend#331 (feat/book-read-authz, open, not yet merged).
This ticket has…
EPUB sidebar chapter nav is off by one (loads the page before the chapter)
[New Feature] Space game: procedural shader-based asteroid scan cutscene (replaces pre-rendered video)
[Security][Backend][Books] Private books are listable and downloadable by any authenticated user — /api/book/all and /api/book/{id}/file have no visibility/ownership check
[Bug][Prod][Reader] Every bookmark operation 500s — UserBookmark.UserId is ObjectId but requests are keyed by Keycloak username
Activity-coverage page: content hidden under fixed menu bar; user scope requires raw KeycloakUserId
[Bug][CI][Infra] #584 not fixed — deploy job's git pull runs unprivileged on a root-owned /mnt/infrastructure, so every infra deploy silently ships a stale stack
[Bug][Prod][Uploads] Large book/video uploads quarantined as "Virus detected" — ClamAV 25 MiB scan cap < the app's 100 MB upload limit
[Bug][Prod][GPU] image-description fails every page — idle-unload races in-flight inference, batch_decode on a None processor
Correction on severity: it is intermittent, not total. When pages flow steadily the model stays loaded and descriptions succeed (~1-2 min each). The failure drops only the **first request…
[Bug][Prod][GPU] image-description fails every page — idle-unload races in-flight inference, batch_decode on a None processor
[Bug][Prod][Uploads] Large book/video uploads quarantined as "Virus detected" — ClamAV 25 MiB scan cap < the app's 100 MB upload limit
PRs open (not yet merged):
- spikersoft-backend #318 — nClam MaxStreamSize + scan-error-vs-virus labeling
- spikersoft-infrastructure #117 — clamd StreamMaxLength/MaxFileSize 128M, MaxScanSize…
[Bug][Infra][MinIO] file-movement's metadata-svc key can't write the quarantine bucket (Access Denied) — blocks #526/#529 cutover (epic #413)
[Bug][Frontend] es→en language toggle leaves server-localized content in Spanish (lesson names et al.) — fetch-once surfaces never re-pull on locale change
[Bug][Frontend] es→en language toggle leaves server-localized content in Spanish (lesson names et al.) — fetch-once surfaces never re-pull on locale change
Resolved in spikersoft-angular PR #196 (merged to master). New @spikersoft/platform-content-locale primitive (ContentLocaleService signal + onContentLocaleChange edge hook); the three…
[Bug][Prod][Uploads] Large book/video uploads quarantined as "Virus detected" — ClamAV 25 MiB scan cap < the app's 100 MB upload limit
[Bug][Frontend] es→en language toggle leaves server-localized content in Spanish (lesson names et al.) — fetch-once surfaces never re-pull on locale change
[Security][Infra] OpenBao: centralize public Let's Encrypt cert storage/distribution in Bao (Traefik acme.json → KV; mailserver + consumers pull) (epic #543)
[Bug][CI][Registry] #548 was closed but its fix NEVER LANDED — all 23 of 23 multi-arch workflows still --amend mutable :amd64/:arm64v8 tags, and the cancelled-run window from #590 makes mixed-commit :latest reachable today
Partial hardening landed: spikersoft-backend PR #317 (merged) gives the coderunner workflow the concurrency guard the other multi-arch workflows already carry (PR runs cancel, master runs queue…
[Bug][Angular][Backend] Lesson-video and geography-media URLs are root-relative, so the browser asks nginx (learn.spikersoft.com) — which serves index.html with a 200 into the <video> element, never the media