9ea0a8b039
Refinement pass on top of the validated v1.2 base.
Hardening / quick fixes
- Caddyfile.tpl: CSP / HSTS / X-Frame / Referrer-Policy / Permissions-Policy,
1 MiB request body cap, X-Forwarded-For pass-through; stock-Caddy compatible.
- auth.py: STUDENT_MAX_AGE 1y -> 30d.
- bootstrap.sh: stage 5 prepends `git config --add safe.directory` so the
re-bootstrap path no longer 'detected dubious ownership' faults.
- admin.js: drop the misleading `closedPayload?.state || session.state`
shim; state derives from session only.
Anti-cheat
- New `student_events` audit table; new POST /api/session/{sid}/event for
blur / visibility_hidden / focus / visibility_visible. quiz.js debounces
events at 1.5s and uses sendBeacon for visibility_hidden so the event
survives a navigation. Counts surface in admin presence + CSV export.
- First-claim-wins on join: add_participant raises DuplicateStudentId on
PK violation; route returns 409 + records a duplicate_join audit event
with attempted name + IP + UA. Admin dashboard surfaces a per-row red
badge for hits on real participants and a top-of-page alert for orphan
attempts.
- DELETE /admin/api/students/{id} as the recovery hatch: clears the
participant + submissions, kicks active WS sockets so a stale cookie
cannot continue submitting. quiz.js surfaces the FastAPI detail message
in the join form so users see the 'already in use' guidance.
Presence panel
- New presence_update WS message; in-process presence map keyed on
student_id tracks ws_count + last_seen_ms. Admin dashboard renders
per-student rows: connected/idle/dropped dot, blur+hidden+duplicate
badges, 'answered current Q' tick, and a clear-student button.
Projector view (public, read-only)
- /projector/?sid=..., GET /api/session/{sid}/projector, WS
/ws/projector/{sid}. Single self-contained projector_state snapshot
pushed on every state change. Public leaderboard strips student_id;
QR rendered server-side as data: URL (CSP-compliant).
- Includes per-Q answer histogram, 8-bucket response-time distribution,
10-bucket score distribution.
- static/projector.{html,css,js}: editorial-broadside design — masthead,
registration crosses, conic-gradient countdown ring, SVG stepped-area
score distribution with median tick, leaderboard row-stagger. Inherits
light/dark tokens from style.css; honours prefers-reduced-motion. No
scroll at 1366x768 / 1920x1080 / 3440x1440.
Tests
- tests/test_anti_cheat.py: blur logging + CSV count, unknown-kind 422,
unauthenticated event 401, duplicate-join 409 + audit, admin
clear-student happy + 404, server-side submit lockout regression.
- tests/test_projector.py: snapshot shape, leaderboard student_id
redaction, WS push on state change, 404 for unknown sid, page redirect
when no sid.
- Existing tests updated for the new presence_update snapshot frame +
CSV header columns + first-claim-wins refusal of re-key.
57/57 pytest green; smoke-tested locally end-to-end.
41 lines
2.0 KiB
Smarty
41 lines
2.0 KiB
Smarty
__DOMAIN__ {
|
|
encode gzip
|
|
|
|
# Cap request bodies. Pool JSON is the largest legitimate payload and
|
|
# tops out well under 1 MiB; cap at 1 MiB so abusive uploads (large
|
|
# blobs to /admin/api/* or pathological websocket frames pretending to
|
|
# be HTTP) get rejected at the edge before reaching uvicorn.
|
|
request_body {
|
|
max_size 1MB
|
|
}
|
|
|
|
# /admin/login is rate-limited at the app layer (rate_limit.py:
|
|
# 10/min/IP). A Caddy-edge limiter would be defense in depth, but
|
|
# would require the non-stock `caddy-ratelimit` plugin; we keep this
|
|
# bootstrap stock-Caddy-compatible.
|
|
|
|
# Security headers. CSP allows Google Fonts (used by style.css) and
|
|
# WebSocket back to the same origin; everything else is self-only.
|
|
# X-Frame-Options DENY prevents clickjacking the admin into an iframe.
|
|
# HSTS pin (1y, includeSubDomains, preload) so once a browser has
|
|
# talked HTTPS to this host it refuses HTTP downgrades; safe because
|
|
# the host is HTTPS-only.
|
|
header {
|
|
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
|
X-Content-Type-Options "nosniff"
|
|
X-Frame-Options "DENY"
|
|
Referrer-Policy "strict-origin-when-cross-origin"
|
|
Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=(), usb=()"
|
|
Content-Security-Policy "default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; script-src 'self'; connect-src 'self' wss://__DOMAIN__ ws://__DOMAIN__; frame-ancestors 'none'; base-uri 'self'; form-action 'self'"
|
|
# Server header leaks Caddy version; strip it.
|
|
-Server
|
|
}
|
|
|
|
reverse_proxy 127.0.0.1:8001 {
|
|
# Pass real client IP downstream so app-layer rate-limit + audit
|
|
# logs see the actual student IP (not 127.0.0.1).
|
|
header_up X-Forwarded-For {http.request.remote.host}
|
|
header_up X-Real-IP {http.request.remote.host}
|
|
}
|
|
}
|