- Upgrade next and eslint-config-next from 16.3.5 to 16.4.6. The older
version has critical advisories, which made the Docker build's
`pnpm audit --audit-level critical` step fail and blocked deploys.
- /api/videos/latest now reports whether the viewer can open each video;
the dashboard shows a lock and the reason instead of opening the player.
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Add GET /api/progress/all, which returns the signed-in user's progress
and merged watch segments for every video (or one playlist) using two
queries.
- Dashboard: replaces two sequential requests per video with a single
request on load
- Player sidebar: replaces one request per playlist video with a single
request per playlist
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Watch progress and unlocking:
- Player samples the playhead and reports the ranges actually played,
so skipped sections earn no credit and early plays are not lost
- Server merges ranges into compact segment rows; progress never regresses
- Single 80% unlock rule enforced server-side (lib/watch-progress.ts);
the Unlock button and automatic unlock now agree
- Lock state and progress bar update live from each progress save
- Playlist is derived from the video, so unlocks work for shared
playlists and for links from watch history and liked videos
- First/previous video decided by playlist position, not index numbers
Access control:
- Video API and HLS/MP4 routes require a signed-in viewer who is
enrolled and has the video unlocked; thumbnails require sign-in
- Enrolment sync reads course codes from the allow-list, not the request
- /api/admin/meta is admin-only
- Account status, role and levels are re-checked from the database
during a session, so deactivated students lose access within a minute
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
twotalesanimation