From 3179ad0b3b78ca263aeecfa18eb50ff317ef65da Mon Sep 17 00:00:00 2001 From: Zareian Date: Thu, 17 Sep 2026 23:49:05 +0330 Subject: [PATCH] stop printing the content browser's title twice MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ویو `title` را به کانتکست می‌دهد و admin/base.html خودش آن را هم در مسیرِ راهنما و هم به‌عنوان

صفحه رندر می‌کند. قالب یک

دستی هم داشت، پس عنوان دو بار پشتِ هم چاپ می‌شد. دستی برداشته شد؛ عنوانِ تبِ مرورگر و مسیرِ راهنما دست‌نخورده می‌مانند چون هر دو از همان `title` می‌آیند. بخشِ وضعیت در CLAUDE.md هم به‌روز شد: می‌گفت سرور کدِ قدیمی و دیتابیسِ خالی دارد، که دیگر درست نیست. به‌جایش چیزی نوشته شد که دفعه‌ی بعد به درد بخورد — اینکه فایلِ روی دیسک یعنی فایلِ مستقر‌شده نیست، و چه چیزهایی عمداً باز مانده. Co-Authored-By: Claude Opus 5 --- CLAUDE.md | 46 ++++++++++++++------ content/templates/admin/content/browser.html | 4 +- 2 files changed, 36 insertions(+), 14 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index d6f0512..f1d141f 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -275,22 +275,42 @@ preferred setup, because there is then no key to leak. **Never let the server ru `django-insecure-…` fallback from `config/settings.py`: that string is committed here, so anyone who can read this repo can forge a token for any user.** -## State as of 2026-09-17 — read this first +## State as of 2026-09-17 (evening) — read this first -**Backend is done and verified; nothing is blocked on us.** The full game loop was driven -end to end against a fresh database with `DEBUG=0`: grades → login → set grade → home → -node quiz → submit answer → CORS header for the frontend origin. `main` is pushed and -clean at `16d3d9f`; 435 tests green. +**The server is live and running current code.** `main` is at the latest commit, the +service `gunicorn-mathapp` was restarted against it, and `/api/health` reports +`grades: 6, lessons: 1928, questions: 1441`. `/api/nodes/1/quiz` returns a real +four-question quiz. 435 tests green. -Two things are blocked on other people, and both are worth checking before assuming a bug: +What that took, and the lessons worth keeping: -1. **The server still runs pre-16d3d9f code with an empty database.** `git pull && - ./deploy.sh` brings both code and content. Verify with `curl /api/health` — it should - report `questions: 1441`. A 404 there means the pull never landed. -2. **The frontend is not wired to any API.** `src/api/` was merged (PR #1) but is - imported nowhere; `QuestionScreen` in `App.tsx` still renders four hardcoded - multiplication questions. **PR #3** (`zareian/api-client-2`, 3 commits) is still open on - upstream. Until someone connects the screens, none of the 1,441 questions are visible. +1. **The server ran two-day-old code while every file on disk was current.** The pull and + `seed_content` had happened; the service had simply never been restarted, so gunicorn + still served the code it loaded on Sep 15. WhiteNoise builds its static-file index at + startup too, which is why `collectstatic` had run and the admin panel still had no CSS. + **A file on disk is not a deployed file.** Check + `systemctl show -p ActiveEnterTimestamp` before believing anything. +2. **`deploy.sh` reported success while this was true.** It health-checked a public URL + that the *old* process answered with 200. It now compares the service start time + before and after, and exits non-zero when the restart did not happen. +3. **Two files had been hand-edited on the server** (`config/urls.py`, `deploy.sh`), both + only to add a trailing slash to the health route. That is why `git pull` kept + conflicting. `api/health/` is now registered upstream alongside `api/health`, so the + edits were reverted and are not needed again. + +Still open, and deliberately not acted on: + +- **`DJANGO_SECRET_KEY` on the server is the `django-insecure-…` fallback committed in + `config/settings.py`.** Auth tokens are signed with it, so anyone who can read this repo + can forge one. Fixing it means removing the key from `.env` *and* from the systemd unit + and letting settings generate one. The owner decided this is the server admin's call, + not ours. `manage.py check --deploy` flags it as `security.W009` on every release. +- `CACHE_URL` is unset, so rate limiting is per-worker (`LocMemCache`). Redis is already + running on the box at `127.0.0.1:6379`; `db0` belongs to another app, `db1` is free. +- The frontend is still not wired to any API. `src/api/` was merged (PR #1) but is + imported nowhere; `QuestionScreen` in `App.tsx` still renders four hardcoded + multiplication questions, and **PR #3** (`zareian/api-client-2`) is still open upstream. + Until someone connects the screens, none of the 1,441 questions are visible to a user. The frontend's `Question` type carries a `type` field that nothing reads, and `count_objects` in `Question.TYPE_CHOICES` is an empty shell — no rows, no serializer diff --git a/content/templates/admin/content/browser.html b/content/templates/admin/content/browser.html index 2addfde..02754c6 100644 --- a/content/templates/admin/content/browser.html +++ b/content/templates/admin/content/browser.html @@ -40,7 +40,9 @@
-

مرورِ محتوا

+ {# عنوان اینجا تکرار نمی‌شود: ویو `title` را به کانتکست می‌دهد و + admin/base.html خودش آن را به‌عنوان

صفحه و در مسیر راهنما + رندر می‌کند. یک

دستی اینجا یعنی همان عنوان دو بار پشتِ هم. #}

از راست به چپ انتخاب کنید تا به سوال‌ها برسید.