Files
coursehub/schema.sql
T
Harwinder Sekhon 17a401c313 Harden auth, add subtitles, vendor all assets locally
- Session cookies are HttpOnly + SameSite=Lax (Secure on HTTPS), with
  strict session-ID mode; the CSRF token from GET api/auth.php must now
  accompany every state-changing request (X-CSRF-Token header, or a csrf
  body field for the sendBeacon progress save), rotated at login.
- Failed sign-ins are throttled per username and IP via login_attempts
  (created lazily, so existing installs need no migration): 5 failures a
  username / 20 an IP inside 15 minutes answer 429 with Retry-After.
- A video's sibling .srt now appears as a CC button in the player;
  captions.php converts it to WebVTT (comma timestamps, legacy encodings,
  and the already-VTT files with out-of-spec 6-digit fractions).
- Plyr and Inter ship in assets/vendor/ instead of coming from CDNs, and
  anime.js is gone along with all scripted animations and the motion
  setting — the app now runs with no internet access at all.
- .htaccess denies direct access to videos/, includes/, config.php and
  schema.sql, so video URLs cannot bypass login on Apache.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SePf61iazhCLJBefdRLBDm
2026-07-30 21:14:07 -04:00

113 lines
5.1 KiB
SQL

-- CourseHub schema (MySQL / MariaDB)
CREATE DATABASE IF NOT EXISTS coursehub CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
USE coursehub;
CREATE TABLE IF NOT EXISTS users (
id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
username VARCHAR(50) NOT NULL UNIQUE,
password_hash VARCHAR(255) NOT NULL,
created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
) ENGINE=InnoDB;
-- Failed sign-in attempts, for the login brute-force throttle. Rows older
-- than an hour are purged as new failures are recorded. Existing installs
-- get this table lazily on the first failed login.
CREATE TABLE IF NOT EXISTS login_attempts (
id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
username VARCHAR(50) NOT NULL,
ip VARCHAR(45) NOT NULL,
attempted_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
INDEX idx_la_user_time (username, attempted_at),
INDEX idx_la_ip_time (ip, attempted_at)
) ENGINE=InnoDB;
-- Small key/value store for app-wide facts (currently: when the last scan ran).
CREATE TABLE IF NOT EXISTS app_meta (
k VARCHAR(64) PRIMARY KEY,
v VARCHAR(255) NOT NULL,
updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
ON UPDATE CURRENT_TIMESTAMP
) ENGINE=InnoDB;
-- One row per directory found under VIDEOS_ROOT.
-- `path` is the relative path from VIDEOS_ROOT, e.g. "Course 1/Intro".
CREATE TABLE IF NOT EXISTS folders (
id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
parent_id INT UNSIGNED NULL,
name VARCHAR(255) NOT NULL,
path VARCHAR(700) NOT NULL UNIQUE,
depth INT UNSIGNED NOT NULL DEFAULT 0,
sort_order INT UNSIGNED NOT NULL DEFAULT 0,
is_missing TINYINT(1) NOT NULL DEFAULT 0,
created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
CONSTRAINT fk_folders_parent FOREIGN KEY (parent_id)
REFERENCES folders(id) ON DELETE CASCADE,
INDEX idx_folders_parent (parent_id)
) ENGINE=InnoDB;
CREATE TABLE IF NOT EXISTS videos (
id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
folder_id INT UNSIGNED NOT NULL,
name VARCHAR(255) NOT NULL, -- display name, filename without .mp4
filename VARCHAR(255) NOT NULL,
path VARCHAR(700) NOT NULL UNIQUE, -- relative path incl. filename
size_bytes BIGINT UNSIGNED NOT NULL DEFAULT 0,
duration_seconds FLOAT NULL, -- filled in by the player on first load
sort_order INT UNSIGNED NOT NULL DEFAULT 0,
is_missing TINYINT(1) NOT NULL DEFAULT 0,
created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
CONSTRAINT fk_videos_folder FOREIGN KEY (folder_id)
REFERENCES folders(id) ON DELETE CASCADE,
INDEX idx_videos_folder (folder_id)
) ENGINE=InnoDB;
-- One row per "*_quiz_solved.txt" file found next to the videos.
-- Questions/options are parsed from the file on demand; only the count is
-- cached here for progress math.
CREATE TABLE IF NOT EXISTS quizzes (
id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
folder_id INT UNSIGNED NOT NULL,
name VARCHAR(255) NOT NULL, -- filename without the _quiz_solved.txt suffix
filename VARCHAR(255) NOT NULL,
path VARCHAR(700) NOT NULL UNIQUE,
num_questions INT UNSIGNED NOT NULL DEFAULT 0,
sort_order INT UNSIGNED NOT NULL DEFAULT 0,
is_missing TINYINT(1) NOT NULL DEFAULT 0,
created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
CONSTRAINT fk_quizzes_folder FOREIGN KEY (folder_id)
REFERENCES folders(id) ON DELETE CASCADE,
INDEX idx_quizzes_folder (folder_id)
) ENGINE=InnoDB;
-- Per-user quiz results. completed = every question answered correctly
-- in a single attempt (sticky).
CREATE TABLE IF NOT EXISTS quiz_progress (
user_id INT UNSIGNED NOT NULL,
quiz_id INT UNSIGNED NOT NULL,
best_score INT UNSIGNED NOT NULL DEFAULT 0,
last_score INT UNSIGNED NOT NULL DEFAULT 0,
total_questions INT UNSIGNED NOT NULL DEFAULT 0,
attempts INT UNSIGNED NOT NULL DEFAULT 0,
completed TINYINT(1) NOT NULL DEFAULT 0,
updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
ON UPDATE CURRENT_TIMESTAMP,
PRIMARY KEY (user_id, quiz_id),
CONSTRAINT fk_qp_user FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
CONSTRAINT fk_qp_quiz FOREIGN KEY (quiz_id) REFERENCES quizzes(id) ON DELETE CASCADE
) ENGINE=InnoDB;
-- Per-user playback state: resume position + completion flag.
CREATE TABLE IF NOT EXISTS video_progress (
user_id INT UNSIGNED NOT NULL,
video_id INT UNSIGNED NOT NULL,
position_seconds FLOAT NOT NULL DEFAULT 0,
duration_seconds FLOAT NULL,
completed TINYINT(1) NOT NULL DEFAULT 0,
updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
ON UPDATE CURRENT_TIMESTAMP,
PRIMARY KEY (user_id, video_id),
CONSTRAINT fk_vp_user FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
CONSTRAINT fk_vp_video FOREIGN KEY (video_id) REFERENCES videos(id) ON DELETE CASCADE,
INDEX idx_vp_user_updated (user_id, updated_at)
) ENGINE=InnoDB;