komalharshita-devpath-1846-1890

-rw-r--r-- 1 root root  3448 Nov  5 08:24 CODE_OF_CONDUCT.md
-rw-r--r-- 1 root root 12232 Nov  5 08:24 CONTRIBUTING.md
drwxr-xr-x 1 root root  4096 Nov  5 08:24 DevPath
-rw-r--r-- 1 root root   867 Nov  5 08:24 Dockerfile
-rw-r--r-- 1 root root  6372 Nov  5 08:24 LENIS_PR_FIXES.md
-rw-r--r-- 1 root root  1077 Nov  5 08:24 LICENSE
-
…[4310 chars omitted]…
sts/test_recommender_validation.py
tests/test_resource_url_validation.py
tests/test_sentinel_dataset_validator.py
tests/test_skill_progression.py
tests/test_starter_code_validator.py
tests/test_tiebreaker.py
tests/test_time_tracking.py
tests/test_url_validator.py
tools/__init__.py
utils/bookmark_manager.py
utils/certificate_generator.py
utils/discussion_manager.py
utils/progress_tracker.py
vercel.json

routes/progress_routes.py
src/app.py
src/config.py
src/errors/__init__.py
src/errors/handlers.py
src/models.py
src/routes/__init__.py
src/routes/admin_routes.py
src/routes/auth_routes.py
src/routes/github_routes.py
src/routes/main_routes.py
src/routes/scripts/benchmark_cache.py
src/seed_db.py
src/static/animations.css
src/static/animations.js
src/static/bookmarks.css
src/static/bookmarks.js
src/static/compare.js
src/static/data/skills.js
src/static/favicon.svg
src/static/og-banner.png
src/static/recently-viewed.js
src/static/recently_viewed.css
src/static/robots.txt
src/static/script.js
src/static/style.css
src/temp
…[826 chars omitted]…
te_limiter.py
src/utils/recommender.py
src/utils/roadmap_comparer.py
src/utils/skill_progression.py
src/utils/testing_utils.py
src/utils/time_tracking.py
src/utils/ui_enhancement.py
src/utils/url_validator.py
utils/bookmark_manager.py
utils/certificate_generator.py
utils/discussion_manager.py
utils/progress_tracker.py
    172 src/app.py
     20 DevPath/CHANGELOG.md
      0 DevPath/static
    192 total

import sys
import os
from dotenv import load_dotenv

# Ensure the root directory's .env is loaded even if run from a subfolder
root_dir = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
load_dotenv(os.path.join(root_dir, '.env'))

# Ensure the 'src' directory is in the python path for Vercel and root-level execution
sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))

from flask import Flask, session
from flask_wtf.csrf import CSRFProtect
from routes.main_routes import main
from r
…[5008 chars omitted]…
:
    """Proxy kept for backward compatibility with test_basic.py."""
    from errors.handlers import internal_server_error as _handler
    return _handler(error)


if __name__ == "__main__":

    import os
    debug_mode = os.environ.get("FLASK_DEBUG", "False").lower() in ("true", "1")
    app.run(
        host="0.0.0.0",
        port=int(os.environ.get("PORT", 5000)),
        debug=debug_mode,
    )

144:        interest=interest_filter,
209:        interest (str) - Web | Data
…[495 chars omitted]…
No projects are currently available for your selected interest areas. Please check back later."
256:        interest,
264:        diagnostic_message = diagnose_empty_state(skills, level, interest, time_availability)
539:            project.get("interest", ""),
 1222 src/routes/main_routes.py
   58 src/routes/auth_routes.py
  335 src/utils/skill_progression.py
  365 src/utils/code_review.py
 1980 total

from utils.learning_path import (
    create_learning_path,
    get_learning_path,
    update_learning_path,
    Pa
…[8630 chars omitted]…
        "error": "assessment_score must be between 0 and 100"
                }), 400
        except (ValueError, TypeError):
            return jsonify({
                "error": "assessment_score must be a number"
            }), 400

    skill_data = _skill_validator.record_skill_completion(
        user_id,
        skill_name,
        diff_enum,
        assessment_score
    )

    return jsonify({

    all_projects = load_all_projects()
    filtered_projects = []

    for p in all_projects:
        # Search text
        if search_query:
            searchable_text = (
                p.get("title", "") + " " + 
                p.get("description", "") + " " + 
                " ".join(p.get("skills", []))
…[5022 chars omitted]…
ents = _code_review_manager.get_review_comments(review_id)
883:        "review_id": review_id,
889:@main.route("/api/code-review/submission/<submission_id>/quality")
894:    score_data = _code_review_manager.get_code_quality_score(submission_id)
898:@main.route("/api/code-review/submission/<submission_id>/recommendations")
903:    recommendations = _code_review_manager.get_improvement_recommendations(

def validate_skill():
    """Validate if user can learn a skill at target difficulty level."""
    payload = request.get_json(silent=True)

    if not payload:
        return jsonify({"error": "Request body must be valid JSON."}), 400

    user_id = (payload.get("user_id") or "").strip()
    skill_name = (payload.get("skill") or "").strip()
    target_difficulty = (payload.get("difficulty") or "").strip()

    if not user_id or not skill_name or not target_difficulty:
        return jsonify({
            "error": "user_id, skill, 
…[8629 chars omitted]…
the
# cross-user exposure described in issue #736.
#
# Token transport: the X-Learning-Path-Token request header.
# Path identity:   the <path_id> URL segment (opaque, UUID-like string).
# ---------------------------------------------------------------------------

_TOKEN_HEADER = "X-Learning-Path-Token"
_MAX_DATA_BYTES = 64 * 1024  # 64 KB — guard against oversized payloads


def _extract_token(req):

    language = (payload.get("language") or "").strip()
    description = (payload.get("description") or "").strip()

    if not all([submission_id, user_id, project_id, code, language]):
        return jsonify({
            "error": "submission_id, user_id, project_id, code, and language are required"
        }), 400

    try:
        submission = _code_review_manager.submit_code(
            submission_id=submission
…[2005 chars omitted]…
         "error": "submission_id and reviewer_id are required"
        }), 400

    try:
        review = _code_review_manager.start_review(
            submission_id=submission_id,
            reviewer_id=reviewer_id,
        )
        return jsonify({
            "success": True,
            "review": review
        }), 201
    except ValueError as e:
        return jsonify({"error": str(e)}), 404

def login():
    from app import github
    # generate a redirect uri
    redirect_uri = url_for('auth.authorize', _external=True)
    return github.authorize_redirect(redirect_uri)

@auth_bp.route('/authorize')
def authorize():
    from app import github
    token = github.authorize_access_token()
    if not token:
        return redirect(ur
…[7397 chars omitted]…
th valid difficulty level."""
        validator = SkillProgressionValidator()
        result = validate_skill_progression(
            "user123",
            "Python",
            "beginner",
            validator
        )

        assert result["allowed"] is True
        assert result["skill"] == "Python"

    def test_invalid_difficulty_level(self):
        """Test with invalid difficulty level."""

256:            user_id="user_123",
286:            user_id="user_123",
315:            user_id="user_123",
  370 tests/test_code_review.py
  264 tests/test_skill_progression.py
   76 tests/conftest.py
  710 total
# tests/conftest.py
# Pytest configuration and shared fixtures for DevPath tests.

import sys
import os

# Allow imports from the project root and src/ when running tests
sys.path.insert(0, os.path.join(os.path.dirname(__file__), ".."))
sys
…[2098 chars omitted]…
xture(autouse=True)
def _reset_rate_limiter_state():
    """Clear rate-limit counters before every test.
 
    Without this, tests across different files that hit the same rate-limited route 
    would exhaust each other's request budget depending on test execution order, causing
    order-dependent 429 failures unrelated to what each test is actually checking.
    """
    reset_rate_limits()
    yield

_projects_cache = None
_projects_cache_time = 0.0
_CACHE_TTL_SECONDS = 300  # 5 minutes


def _cache_expired():
    """Return True if the cache is missing or older than _CACHE_TTL_SECONDS."""
    if _projects_cache is None:
        return True
    return (time.time() - _projects_cache_time) > _CACHE_TTL_SECONDS

def validate_projects(projects):
    """
    Validate project dataset integrity.

    Checks for:
    - Duplicate project IDs
    - Duplicate project titles (case-insensitive)
    - Missing required fields
    - Empty required string fields
    - Malformed resource URLs (logs a warning, does not raise)

    Raises:
        Valu
…[7973 chars omitted]…
Title (Z-A)</option>
                  <option value="id_desc" {% if sort == "id_desc" %}selected{% endif %}>Newest First</option>
34 Counter({'Data': 8, 'Web': 8, 'Education': 5, 'Games': 3, 'Automation': 3, 'Cybersecurity': 2, 'Mobile': 2, 'Backend': 1, 'Productivity': 1, 'DevOps': 1})
['Automation', 'Backend', 'Cybersecurity', 'Data', 'DevOps', 'Education', 'Games', 'Mobile', 'Productivity', 'Web']

n(data["projects"]) > 0, (
            "If 'message' is present alongside projects, projects must be "
            "non-empty so renderResults takes the success branch"
        )


def test_repeated_no_match_queries_are_consistent(client):
    """Multiple consecutive no-match queries must all return empty lists."""
    for _ in range(3):
        r = client.post("/api/recommend", json=NO_MATCH_PAYLOAD)

    description = db.Column(db.Text, nullable=False)
    
    # Store arrays as JSON
    skills = db.Column(db.JSON, nullable=False, default=list)
    features = db.Column(db.JSON, nullable=False, default=list)
    tech_stack = db.Column(db.JSON, nullable=False, default=list)
    roadmap = db.Column(db.JSON, nullable=False, default=list)
    resources = db.Column(db.JSON, nullable=True, default=list)
    starter_code = db.Column(db.String(500), nullable=True)

    def to_dict(self):
        """Convert the mode
…[3366 chars omitted]…
401
src/routes/main_routes.py:1173:        return jsonify({"error": "Forbidden: invalid token for this path."}), 403
src/app.py:124:    """Make current_user available to all templates."""
src/app.py:125:    user_id = session.get('user_id')
src/app.py:126:    current_user = None
src/app.py:129:        current_user = db.session.get(User, user_id)
src/app.py:130:    return dict(current_user=current_user)

        return jsonify({"error": "Project not found."}), 404

    validated = validate_resources(project.get("resources", []))
    return jsonify({
        "project_id": project_id,
        "resources": validated
    }), 200

@main.route("/project/<int:project_id>")
def project_detail(project_id):
    """Render the full detail page for a single project."""
    project = find_project_by_id(project_id)
    if not project:
        abort(404)
        
    return render_template("project.html", projec
…[8628 chars omitted]…
rogress:
        progress.data = payload["data"]
    else:
        progress = UserGameProgress(user_id=user_id, data=payload["data"])
        db.session.add(progress)

    db.session.commit()
    return jsonify({"message": "Progress saved successfully"}), 200

@main.route("/api/portfolio-analysis", methods=["POST"])
def portfolio_analysis():
    """
    Analyze the user's completed projects and return

class ReviewStatus(Enum):
    """Status of a code review."""
    PENDING = "pending"
    IN_PROGRESS = "in_progress"
    COMPLETED = "completed"
    CHANGES_REQUESTED = "changes_requested"


class CodeQualityCategory(Enum):
    """Categories for code quality assessment."""
    FUNCTIONALITY = "functionality"
    CODE_STYLE = "code_style"
    PERFORMANCE = "performance"
    SECURITY = "security"
    TESTING = "testing"
    DOCUMENTATION = "documentation"


FEEDBACK_TEMPLATES = {
    "functionality": {
        "excellent": "Code correctly implements all required functionality",
        "good": "Code implements functionality with m
…[8629 chars omitted]…
 >= 85:
            return "excellent"
        elif score >= 70:
            return "good"
        else:
            return "needs_improvement"

    def _get_reviews_for_submission(self, submission_id: str) -> List[str]:
        """Get all review IDs for a submission."""
        return [
            rid for rid, r in self.reviews.items()
            if r.get("submission_id") == submission_id
        ]

tests/tes
…[7952 chars omitted]…
 time_availability="Low"
    )
    assert score_partial < score_full, (
        f"Partial match ({score_partial}) should score less than full match ({score_full})"
    )


def test_score_coverage_ratio_exact_values():
    """Verify the coverage-weighted formula produces the correct numeric result."""
    project = {"skills": ["Python", "Flask"], "level": "Beginner", "interest": "Data", "time": "Low"}

def test_download_code_found():
    client = get_client()
    response = client.get("/project/1/download")
    assert response.status_code == 200




def test_project_progress_unauthenticated_get():
    """GET project progress should return 401 if unauthenticated."""
    client = get_client()
    response = client.get("/api/project/1/progress")
    assert response.status_code == 401
    assert b"Unauthorized" in response.data

def test_project_progress_unauthenticated_post():
    """POST project progress should return 401 if unauthenticated."""
    client = get_client()
    response = 
…[7317 chars omitted]…
r_handlers(app)
    """
    app.register_error_handler(400, bad_request)
    app.register_error_handler(403, forbidden)
    app.register_error_handler(404, page_not_found)
    app.register_error_handler(405, method_not_allowed)
    app.register_error_handler(429, too_many_requests)
    app.register_error_handler(500, internal_server_error)
    app.register_error_handler(Exception, unhandled_exception)

tests/test_pagination.py:81:    response = get_c
…[4850 chars omitted]…
hon", "Beginner", "machine learning/ai", "Low")
tests/test_recommender_validation.py:22:def test_validate_recommendation_inputs_rejects_unknown_interest():
tests/test_recommender_validation.py:25:    assert "Please select a valid area of interest." in errors
tests/test_sentinel_dataset_validator.py:20:        "interest": "Finance",
tests/test_starter_code_validator.py:20:        "interest": "Finance",

    """Explore route should return 200 OK and handle pagination."""
    client = get_client()
    response = client.get("/explore?page=1&per_page=5")
    assert response.status_code == 200
    html = response.data.decode("utf-8")
    assert "Explore All Projects" in html
    # The max per_page is 5, so there should be pagination controls or fewer items.
    assert 'class="project-card"' in html

def test_contact_page_renders_send_message_form():
    """Contact page should include the external form handler and required fields."""
    client = get_client()
    response = client.get("/contact")

    assert b'id="recommend-form"' in respon
…[3793 chars omitted]…
?per_page=5")
    assert response.status_code == 200
    card_count = response.data.count(b'class="project-card"')
    assert 0 < card_count <= 5
# requirements.txt — Python dependencies for DevPath
#
# Install all dependencies with:
#   pip install -r requirements.txt

# Web framework & Database
Flask==3.1.3
Flask-WTF==1.3.0
Flask-SQLAlchemy==3.1.1
Authlib==1.7.2
python-dotenv==1.2.2
requests==2.34.2

**Title:** Fix vertical alignment of form labels on mobile screens

**Description:**
On screen widths below 480px, the form labels in the recommendation form sit
too close to the input field below them. There is not enough visual separation
between the label text and the input border, making the form feel cramped.

**Expected Outcome:**
On all mobile screen sizes (tested at 375px and 414px), each label has at
least 8px of space below it before the input begins. The change should only
affect the mobile breakpoint and leave desktop spacing unchanged.

**Files to look at:**
- `static/style.css` — search for the `@media (max-width: 640px)` block
- `templates
…[8629 chars omitted]…
ep a Changelog](https://keepachangelog.com/en/1.0.0/).

## [Unreleased]

### Added

- Initial CHANGELOG.md setup for tracking project history
- Documentation structure for future contributor updates

### Changed

- Contributors are now expected to document user-facing changes in CHANGELOG.md

### Fixed

- Fixed an issue where skill chips on the homepage were unclickable due to JavaScript syntax errors

class SkillDifficulty(Enum):
    """Skill difficulty levels in progression order."""
    BEGINNER = 1
    INTERMEDIATE = 2
    ADVANCED = 3
    EXPERT = 4

    def __lt__(self, other):
        if not isinstance(other, SkillDifficulty):
            return NotImplemented
        return self.value < other.value

    def __le__(self, other):
        if not isinstance(other, SkillDifficulty):
            return NotImplemented
        return self.value <= other.value

    def __gt__(self, other):
        if not isinstance(other, SkillDifficulty):
            return NotImple
…[8628 chars omitted]…
_skill(user_id, skill_name, difficulty)

    return {
        "allowed": is_allowed,
        "skill": skill_name,
        "target_difficulty": target_difficulty,
        "message": error_msg or "Skill progression allowed",
        "prerequisites": (
            [p[0] for p in SKILL_PREREQUISITES.get(skill_name, {}).get(difficulty, [])]
            if not is_allowed
            else []
        ),
    }

    """Login route should redirect to GitHub."""
    client = get_client()
    response = client.get("/auth/login")
    assert response.status_code == 302
    assert "github.com/login/oauth/authorize" in response.headers["Location"]

def test_logout_redirect():
    ""
…[8628 chars omitted]…
 1, 80.0, 20)
        manager.record_progress("user_123", 2, 60.0, 30)
        result = manager.calculate_learning_metrics("user_123")
        assert result["items_completed"] == 2
        assert result["average_score"] == 70.0
        assert result["total_time_spent"] == 50
        assert result["learning_efficiency"] > 0


class TestEdgeCases:
    """Tests for edge cases and boundary conditions."""

            "interest": "Web",
            "time": "Low",
            "description": "A test project",
            "skills": "python, flask",
            "tech_stack": "Python, Flask",
            "features": "Feature 1, Feature 2",
            "roadmap": "Step 1, Step 2",
            "resources": "http://example.com",
            "starter_code": ""
        })
        assert response.status_code == 302
        assert "/admin" in response.headers["Loc
…[4804 chars omitted]…
ue.status_code = 422
        mock_put.return_value.status_code = 201
        
        response = client.post("/project/1000/export_github")
        
        assert response.status_code == 302
        assert "github.com/testuser/DevPath-Starter-valid-code" in response.headers["Location"]



def test_sitemap_includes_compare():
    """Sitemap should include the compare page."""
    client = get_client()

if start_idx != -1 and end_idx != -1:
    new_body = """
  <main class="container" style="padding-top: 120px; padding-bottom: 60px; min-height: 80vh;">
    <h1 style="margin-bottom: 1rem;">Explore All Projects</h1>
    <p style="color: var(--text-muted); margin-bottom: 2rem;">Browse our entire catalog of projects, filter by difficulty or interest, and find your next coding challenge.</p>
    
    <div style="display: flex; 
…[8117 chars omitted]…
 adjusting your filters or search term.</p>
          <a href="/explore" class="btn-try-again">Clear Filters</a>
        </div>
        {% endif %}
      </section>
    </div>
  </main>
"""
    new_body = new_body.replace("{% end从业%}", "{% endfor %}")
    content = content[:start_idx] + new_body + content[end_idx:]

with open("src/templates/explore.html", "w") as f:
    f.write(content)

print("Done")

578:          <a href="/explore?page={{ page + 1 }}&per_page=12&search={{ search }}&level={{ level }}&interest={{ interest }}&time={{ time }}&sort={{ sort }}" class="btn-view-code-sm" style="text-decoration: none;">Next &rarr;</a>

    req = urllib.request.Request(
        'https://api.github.com/repos/komalharshita/devpath/pulls',
        data=data,
        headers={'Authorization': f'token {GH_TOKEN}', 'Content-Type': 'application/json'}
    )
    try:
        resp = urllib.request.urlopen(req)
        pr = json.loads(resp.read())
        print(f"PR #{pr['number']} ({issue_num}): {pr['html_url']}")
        return pr['number']
    except urllib.error.HTTPError as e:
        body_err = e.read()
        print(f"HTTP {e.code} for #{issue_num}: {body_err.decode()}")
        return None

# PR 1417
create_pr(1417, 'pr-tm-1417',
    'fi
…[601 chars omitted]…
st` line.\n- Removed the duplicate `from flask import has_request_context` line.\n- Kept `has_request_context` in the main Flask import line.\n\n## Impact it Made\n\n- Removes dead code and eliminates duplicate imports.\n- Follows Python import hygiene best practices.\n- Makes the file cleaner and easier to maintain.\n\n## Note: Please assign this PR to the `tmdeveloper007` account.\n\nCloses #1417'
)

    
    paginated_projects = filtered_projects[start_idx:end_idx]

    # Also pass filter dropdown options to UI
    available_levels = get_available_levels()
    available_interests = get_available_interests()
    stats = get_project_stats()
    
    return render_template(
        "explore.html",
        projects=paginated_projects,
        page=page,
        total_pages=total_pages,
        total_items=total_items,
        search=search_query,
        level=level_filter,
        interest=interest_filter,
        time=time_filter,
        sort=sort_by,
        available_levels=available_levels,
        available_interests=available_interests,
        stats=stats,

from utils.rate_limiter import rate_limit
from utils.learning_path import (
    create_learning_path,
    get_learning_path,
    upd
…[3837 chars omitted]…
error:
883:        return auth_error
918:    _, auth_error = _acting_user()
919:    if auth_error:
920:        return auth_error
950:    _, auth_error = _acting_user()
951:    if auth_error:
952:        return auth_error
967:    _, auth_error = _acting_user()
968:    if auth_error:
969:        return auth_error
980:    _, auth_error = _acting_user()
981:    if auth_error:
982:        return auth_error

    return current_app.json.response(*args, **kwargs)  # type: ignore[return-value]
          
…[2710 chars omitted]…
58, in iterencode
    return _iterencode(o, 0)
           ^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/flask/json/provider.py", line 121, in _default
    raise TypeError(f"Object of type {type(o).__name__} is not JSON serializable")
TypeError: Object of type SkillDifficulty is not JSON serializable

anonymous cases ok
authenticated own cases ok
cross-user cases ok
explore cases ok

    if not payload:
        return jsonify({"error": "Request body must be valid JSON."}), 400

    user_id, auth_error = _acting_user(payload.get("user_id"))
    if auth_error:
        return auth_error

    skill_name = (payload.get("skill") or "").strip()
    target_difficulty = (payload.get("difficulty") or "").strip()

    if not skill_name or not target_difficulty:
        return jsonify({
            "error": "user_id, skill, and difficulty are req
…[2562 chars omitted]…
_acting_user(user_id)
    if auth_error:
        return auth_error

    skill = skill.strip()

    if not skill:
        return jsonify({"error": "user_id and skill are required"}), 400

    next_skill = _skill_validator.get_recommended_next_skill(user_id, skill)

    if not next_skill:
        return jsonify({
            "user_id": user_id,
            "skill": skill,
            "next_skill": None,

 
+
+def _unauthorized_response():
+    """Return the standard JSON response for anonymous API callers."""
+    return jsonify({"error": "Unauthorized"}), 401
+
+
+def _forbidden_response():
+    """Return the standard JSON response for cross-user API requests."""
+    return jsonify({"error": "Forbidden"}), 4
…[8629 chars omitted]…
or = _acting_user()
+    if auth_error:
+        return auth_error
+
     submission_id = submission_id.strip()
 
+    submission = _code_review_manager.get_submission(submission_id)
+    if submission and not _user_can_view_submission(submission, user_id):
+        return _forbidden_response()
+
     recommendations = _code_review_manager.get_improvement_recommendations(
         submission_id
     )

-                  <option value="automation" {% if interest == "automation" %}selected{% endif %}>Automatio
…[8629 chars omitted]…
-----------------------------------------------
# Learning path API
#
# Endpoints for reading and writing a user's learning path data.  Every
# request must supply the owner token that was returned when the path was
# first created.  Requests with a missing or wrong token are rejected with
# 403 Forbidden before any data is read or modified, closing the
# cross-user exposure described in issue #736.
#

        """Push Flask application context and setup/seed DB for testing."""
        basedir = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
        test_db_path = os.path.join(basedir, "data", "test_devpath.db")
        app.config['SQLALCHEMY_DATABASE_URI'] = "sqlite:///" + test_db_path
    
        with app.app_context():
            from models import db
>           db.drop_all()


…[3050 chars omitted]…
 error at: https://sqlalche.me/e/21/e3q8)

/usr/local/lib/python3.12/site-packages/sqlalchemy/engine/default.py:1192: OperationalError
=========================== short test summary info ============================
ERROR tests/test_basic.py::test_parse_skills - sqlalchemy.exc.OperationalErro...
!!!!!!!!!!!!!!!!!!!!!!!!!! stopping after 1 failures !!!!!!!!!!!!!!!!!!!!!!!!!!!
3 passed, 1 error in 1.78s

-rw-r--r-- 1 root root    83 Nov  5 08:24 package-lock.json
-rw-r--r-- 1 root root 56777 Nov  5 08:24 projects.json
-rw-r--r-- 1 root root   322 Nov  5 08:24 skill_graph.json

    payload = request.get_json(silent=True)

    if not payload:
        return jsonify({"error": "Request body must be valid JSON."}), 400

    user_id, auth_error = _acting_user(payload.get("user_id"))
    if auth_error:
        return auth_error

    skill_name = (payload.get("skill") or "").strip()
    target_difficulty = (payload.get("difficulty") or "").strip()

    if not skill_name or not target_difficulty:
        return jsonify({
            "error": "user_id, skill, and difficulty are required"
        }), 400

    
…[8629 chars omitted]…
------------------------------------------------------------

_TOKEN_HEADER = "X-Learning-Path-Token"
_MAX_DATA_BYTES = 64 * 1024  # 64 KB — guard against oversized payloads


def _extract_token(req):
    """Return the bearer token from the request header, or None if absent."""
    return req.headers.get(_TOKEN_HEADER, "").strip() or None


@main.route("/api/learning-path/<path_id>", methods=["POST"])

import math
import re
from collections import Counter
import functools

import json
import os
…[3244 chars omitted]…
d lowercase."""
    return s.strip().lower()

# Keep the old name alive so score_single_project() and any external callers
# that reference SKILL_ALIASES continue to work without modification.
SKILL_ALIASES = SKILL_SYNONYMS

def parse_skill_entries(skills_string):
    """Parse skills with optional per-skill proficiency levels."""
    if not skills_string or not skills_string.strip():
        return []

ERROR tests/test_skill_progression.py::TestSkillDifficulty::test_difficulty_ordering
ERROR tests/test_skill_progression.py::TestSkillProgressionValidator::test_record_skill_completion
ERROR tests/test_skill_progression.py::TestValidateSkillProgression::test_missing_prerequisites_listed
ERROR tests/test_skill_progression.py::TestSk
…[134 chars omitted]…
ts/test_code_review.py::TestCodeReviewManager::test_start_review_invalid_submission
ERROR tests/test_code_review.py::TestCodeReviewManager::test_complete_review_invalid_review_id
ERROR tests/test_code_review.py::TestCodeReviewManager::test_score_category_invalid_score
31 passed, 11 errors in 87.00s (0:01:26)
 M rewrite_explore.py
 M src/app.py
 M src/routes/main_routes.py
 M src/templates/explore.html

                  <option value="devops" >DevOps</option>
                  
                  <option value="education" >Education</option>
                  
                  <option value="games" >Games</option>
                  
                  <option value="mobile" >Mobile</option>
                  
                  <option value="productivity" >Productivity</option>
                  
                  <option value="web" >Web</option>
                  
                </select>

 .github/ISSUE_TEMPLATE/documentation.yml           |   56 +
 .github/ISSUE_TEMPLATE/feature_request.yml         |   88 +
 .github/ISSUE_TEMPLATE/good_first_issue.yml        |  101 +
 .github/config.yml                                 |   13 +
 .github/dependabot.yml                             |   28 +
 .github/labeler.yml                                |   39 +
 .github/workflows/assign.yml                       |   60 +
 .github/workflows/auto-file-labels.yml  
…[710 chars omitted]…
UE_TEMPLATE/feature_request.yml
.github/ISSUE_TEMPLATE/good_first_issue.yml
.github/labeler.yml
.github/workflows/assign.yml
.github/workflows/auto-file-labels.yml
.github/workflows/auto-label-issues.yml
.github/workflows/auto-label-prs.yml
.github/workflows/deploy.yml
.github/workflows/greetings.yml
.github/workflows/issue-management.yml
.github/workflows/python-app.yml
.github/workflows/security.yml

  contents: read

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
    - name: Checkout repository
      uses: actions/checkout@v7

    - name: Set up Python
      uses: actions/setup-python@v7
      with:
        python-version: "3.11"

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements.txt
        if [ -f requirements-dev.txt ]; then pip install -r requirements-dev.txt; fi
        pip install flake8 pytest

    - name: Lint code (non-blocking)
      run: |
        flake8 . --exit-zer
…[416 chars omitted]…
: Analyze
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
    - name: Checkout repository
      uses: actions/checkout@v7

    - name: Initialize CodeQL
      uses: github/codeql-action/init@v4
      with:
        languages: 'python, javascript'

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v4

import sys
import os
import secrets

import pytest

sys.path.insert(0, os.path.join(os.path.dirname(__file__), ".."))
sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "src"))

from utils.learning_path import (
    create_learning_path,
    get_learning_path,
    update_learning_path,
    path_exists,
    _clear_all,
    PathNotFoundError,
    PathAlreadyExistsError,
    Authorization
…[8629 chars omitted]…
(self):
        token = make_token()
        self._seed("upd-route-6", token, {})
        client = get_client()
        response = client.put(
            "/api/learning-path/upd-route-6",
            data="bad body",
            content_type="text/plain",
            headers={TOKEN_HEADER: token},
        )
        assert response.status_code == 400

    def test_put_malformed_json_returns_400(self):

./starter_code/hotel_management.py:24:    - Handling basic business logic (billing, availability).
./tests/test_no_results_reset.py:50:    "interest": "Machine Learning/AI",
./tests/test_recommender_validation.py:17:    errors = validate_recommendation_inputs("Python", "Beginner", "machine learning/ai", "Low")

from utils.learning_path import (
    create_learning_path,
    get_learning_path,
    update_learning_path,
    PathNotFoundError,
    PathAlreadyExistsError,
    AuthorizationError,
)
from co
…[195 chars omitted]…
lligence",
    "cloud computing",
}

def interest_has_no_projects(interest):
    return interest and interest.strip().lower() in NO_PROJECT_INTERESTS

# Create the Blueprint that app.py will register
main = Blueprint("main", __name__)


@main.route("/")
def index():
    """Render the homepage with the skill input form and dynamic stats."""
Files data/main_routes.py and src/routes/main_routes.py differ

                  
                  <option value="education" >Education</option>
                  
                  <option value="games" >Games</option>
                  
                  <option value="mobile" >Mobile</option>
                  
                  <option value="productivity" >Productivity</option>
                  
                  <option value="web" >Web</option>
                  
                </select>

125:def test_bookmarks_js_content_type(client):
131:def test_bookmarks_css_served(client):
139:def test_bookmarks_js_contains_saved_key(client):
145:def test_bookmarks_js_contains_session_key(client):
151:def test_bookmarks_js_exposes_public_api(client):
157:def test_bookmarks_js_save_function(client):
163:def test_bookmarks_js_remove_function(cli
…[2629 chars omitted]…
ts must include level, time, skills — used by save() metadata."""
    response = client.post("/api/recommend", json={
        "skills": "Python",
        "level": "Beginner",
        "interest": "Data",
        "time": "Low"
    })
    data = response.get_json()
    for project in data["projects"]:
        assert "level"  in project
        assert "time"   in project
        assert "skills" in project

tests/test_bookmarks.py::test_recommend_form_present PASSED              [ 18%]
tests/test_bookmarks.py::test_skills_hidden_input_present PASSED         [ 21%]
tests/test_bookmarks.py::test_level_select_present PASSED                [
…[1361 chars omitted]…
SED [ 78%]
tests/test_bookmarks.py::test_script_js_served PASSED                    [ 81%]
tests/test_bookmarks.py::test_script_js_has_saved_projects_key PASSED    [ 84%]
tests/test_bookmarks.py::test_security_headers_on_homepage PASSED        [ 87%]
tests/test_bookmarks.py::test_security_headers_on_static_js PASSED       [ 90%]
tests/test_bookmarks.py::test_recommend_api_still_returns_projects rc:124

import time
from collections import defaultdict
from functools import wraps

from flask import request
from werkzeug.exceptions import TooManyRequests

# (client_id, endpoint) -> list[float] of request timestamps in the window.
_request_log = defaultdict(list)


def _client_ident
…[1195 chars omitted]…
e between tests)."""
    _request_log.clear()12:from utils.rate_limiter import rate_limit
286:@rate_limit(max_requests=10, window_seconds=60)
453:@rate_limit(max_requests=20, window_seconds=60)
606:@rate_limit(max_requests=30, window_seconds=60)
1125:@rate_limit(max_requests=10, window_seconds=60)
1167:@rate_limit(max_requests=20, window_seconds=60)
1197:@rate_limit(max_requests=10, window_seconds=60)

        return jsonify(result), 400

    return jsonify(result), 200

@main.route("/health")
def health_check():
    """
    Returns server status. Useful for uptime monitors and Docker health checks.
    """
    return jsonify({
        "status": "ok",
        "version": os.getenv("APP_VERSION", "1.0.0")
    }), 200


@main.route("/api/recommend", methods=["POST"])
@rate_limit(max_requests=10, window_seconds=60)
def recommend():
    """
    Accept a 
…[1424 chars omitted]…
ne crashes
    if not skills:
        return jsonify({"error": "Please enter at least one skill to get recommendations."}), 400

    # Validate before running the recommendation engine
    errors = validate_recommendation_inputs(skills, level, interest, time_availability)
    if errors:
        # Return only the first error to keep the UI message clean
        return jsonify({"error": errors[0]}), 400

    return ScoringResult(score, synergy_multiplier > 1.0, match_details)

# ---------------------------------------------------------------------------
# Skill graph helpers
# ---------------------------------------------------------------------------

_cached_skill_graph = None

def _load_skill_graph():
    """Load skill_graph.json from data/. Returns empty dict on failure."""
    global _cached_skill_graph
    if _cached_skill_graph is not None:
        return _cached_skill_graph

    path = os.path.j
…[8628 chars omitted]…
els import db, User
    from utils.data_loader import find_project_by_id
    
    user_id = session.get('user_id')
    if not user_id:
        return redirect(url_for('auth.login'))
        
    user = db.session.get(User, user_id)
    if not user:
        session.pop('user_id', None)
        return redirect(url_for('auth.login'))
        
    # Hydrate bookmarked projects
    bookmarked_projects = []

  File "/usr/local/lib/python3.12/site-packages/werkzeug/test.py", line 992 in run_wsgi_app
  File "/usr/local/lib/python3.12/site-packages/werkzeug/test.py", line 1120 in open
  File "/usr/local/lib/python3.12/site-packages/flask/testing.py", line 235 in open
  File "/usr/local/lib/python3.12/site-packages/werkzeug/test.py", line 1171 in post
  File "<stdin>", line 8 in <module>

def test_recommend_api_internal_failure(monkeypatch):
    """Recommendation engine failures should not crash the API."""

    import routes.main_routes as main_routes

    def broken(*args, **kwargs):
        raise RuntimeError("forced failure")

    monkeypatch.setattr(
        main_routes,
        "get_recommendations",
        broken
    )

    client = get_client()

    response = client.post(
        "/api/recommend",
        json={
            "skills": "Python",
            "level": "Beginner",
            "interest": "Data",
            "time": "Low"
        }

get_review_feedback                 auth=True
get_code_quality_score              auth=True
get_code_recommendations            auth=True

+    add_review_comment,
+    score_review_category,
+    complete_code_review,
 )
 csrf.exempt(recommend)
 csrf.exempt(save_user_game_progress)
 csrf.exempt(update_project_progress)
 csrf.exempt(portfolio_analysis)
+# Skill-progression and code-review APIs are JSON-only and authenticated;
+# exempt them from form CSRF so anonymous callers reach the auth layer and
+# receive the documented 401 response rather than a CSRF 400.
+csrf.exempt(validate_skill)
+csrf.exempt(record_skill_completion)
+csrf.exempt(submit_code_for_review)
+csrf.exempt(start
…[8628 chars omitted]…
       return jsonify({
             "error": "submission_id, user_id, project_id, code, and language are required"
         }), 400
@@ -713,12 +850,19 @@ def submit_code_for_review():
 @main.route("/api/code-review/submission/<submission_id>")
 def get_submission(submission_id):
     """Get submission details."""
+    user_id, auth_error = _acting_user()
+    if auth_error:
+        return auth_error

-rw-r--r-- 1 root root  1960 Nov  2 13:16 CHANGELOG.md
-rw-r--r-- 1 root root  3448 Nov  2 13:16 CODE_OF_CONDUCT.md
-rw-r--r-- 1 root root 12232 Nov  2 13:16 CONTRIBUTING.md
drwxr-xr-x 1 root root  4096 Nov  2 13:16 DevPath
-rw-r--r-- 1 root root   867 Nov  2 13:16 Dockerfile
-rw-r--r-- 1 root root  6372 Nov  2 13:16 LENIS_PR_FIXES.md
-rw-r--r-- 1 root root  1077 Nov  2 13:16 LIC
…[4584 chars omitted]…
ation.py
./tests/test_resource_url_validation.py
./tests/test_sentinel_dataset_validator.py
./tests/test_skill_progression.py
./tests/test_starter_code_validator.py
./tests/test_tiebreaker.py
./tests/test_time_tracking.py
./tests/test_url_validator.py
./tools/__init__.py
./utils/bookmark_manager.py
./utils/certificate_generator.py
./utils/discussion_manager.py
./utils/progress_tracker.py
./vercel.json

src/routes/github_routes.py
src/routes/main_routes.py
src/routes/scripts/benchmark_cache.py
src/seed_db.py
src/static/animations.css
src/static/animations.js
src/static/bookmarks.css
src/static/bookmarks.js
src/static/compare.js
src/static/data/skills.js
src/static/favicon.svg
src/static/og-banner.png
src/static/recently-viewed.js
src/static/recently_viewed.css
src/static/robots.txt
src/static/script.js
src/static/style.css
src/templates/400.html
src/templates/403.html
src/templates/404.html
src/templates/405.html
src/templates/429.html
src/templates/500.html
src/templates/admin/dashboard.html
src/templates/admin/form.h
…[475 chars omitted]…
/file_server.py
src/utils/learning_path.py
src/utils/ml_recommender.py
src/utils/pagination.py
src/utils/portfolio_analyzer.py
src/utils/privacy.py
src/utils/rate_limiter.py
src/utils/recommender.py
src/utils/roadmap_comparer.py
src/utils/skill_progression.py
src/utils/testing_utils.py
src/utils/time_tracking.py
src/utils/ui_enhancement.py
src/utils/url_validator.py
bash: line 8: rg: command not found

progression.sort(key=lambda x: x["gap_score"], reverse=True)
src/utils/recommender.py:551:    return progression[:3]
src/utils/recommender.py:563:    A missing file is a soft failure — the recommender still works,
src/utils/recommender.py:582:def _get_related(recommended_ids, all_projects, cluster_data):
src/utils/recommender.py:584:    Find projects in the same cluster(s) as the recommended projects,

from utils.learning_path import (
    create_learning_path,
    get_learning_path,
    update_learning_path,
    Pa
…[8630 chars omitted]…
  user_id="user_123",
            project_id=1,
            code="test code",
            language="python",
        )
        review = review_manager.start_review(
            submission_id="sub_001",
            reviewer_id="reviewer_001",
        )

        review_manager.score_category(
            review_id=review["review_id"],
            category="functionality",
            score=90,
        )

171:def compare_roadmaps_api():
189:@main.route("/health")
190:def health_check():
200:@main.route("/api/recommend", methods=["POST"])
202:def recommend():
291:@main.route("/api/project/<int:project_id>/resources")
292:def project_resources(project_id):
320:@main.route("/project/<int:project_id>")
321:def project_detail(project_id):
329:@main.route("/profile")
330:def profile():
353:@main.route("/project/<int:project_id>/code")
354:def view_code(project_id):
367:@main.route("/project/<int:project_id>/download")
369:def download_code(project_id):
384:@main.route("/project/<int:p
…[8629 chars omitted]…
er-progress", methods=["POST"])
src/routes/main_routes.py:1098:def save_user_game_progress():
src/routes/main_routes.py:1117:@main.route("/api/portfolio-analysis", methods=["POST"])
src/routes/main_routes.py:1118:def portfolio_analysis():
src/routes/main_routes.py:1151:@main.route("/api/learning-path/<path_id>/analytics", methods=["GET"])
src/routes/main_routes.py:1152:def get_path_analytics(path_id):

    return render_template("index.html", stats=stats, available_levels=available_levels, available_interests=available_interests, config=Config)

@main.route("/explore")
def explore():
    """Render the explore page with server-side pagination, filtering, and sorting."""
  
…[8630 chars omitted]…
to login if unauthenticated."""
tests/test_basic.py:904:    assert "/auth/login" in response.headers["Location"]
tests/test_basic.py:916:    assert "/auth/login" in response.headers["Location"]
tests/test_basic.py:922:            sess['user_id'] = 1  # Assuming user 1 is not admin
tests/test_basic.py:946:            sess['user_id'] = 2
tests/test_basic.py:1007:def test_export_github_unauthenticated():

_projects_cache = None
_projects_cache_time = 0.0
_CACHE_TTL_SECONDS = 300  # 5 minutes


def _cache_expired():
    """Return True if the cache is missing or older than _CACHE_TTL_SECONDS."""
    if _projects_cache is None:
        return True
    return (time.time() - _projects_cache_time) > _CACHE_TTL_SECONDS

def validate_projects(projects):
    """
    Validate project dataset integrity.

    Checks for:
    - Duplicate project IDs
    - Duplicate project titles (case-insensitive)
    - Missing required fields
    - Empty required string fields
    - Malformed resource URLs (logs a warning, does not raise)

    Raises:
        Valu
…[8630 chars omitted]…
ame-ancestors 'none'"
    )

    return response


# Expose the 500 handler at module level so existing tests can import it
# directly:  from app import app, internal_server_error
def internal_server_error(error):
    """Proxy kept for backward compatibility with test_basic.py."""
    from errors.handlers import internal_server_error as _handler
    return _handler(error)


if __name__ == "__main__":

      var errDiv = document.createElement('div');
      errDiv.style.position = 'fixed';
      errDiv.style.top = '0';
      errDiv.style.left = '0';
      errDiv.style.width = '100%';
      errDiv.style.background = 'red';
      errDiv.style.color = 'white';
      errDiv.style.zIndex = '999999';
      errDiv.style.padding = '20px';
      errDiv.textContent = 'JS ERROR: ' + e.message + ' at ' + e.filename + ':' + e.lineno;
      document.body.appendChild(er
…[8630 chars omitted]…
ore"] == 77.5
        assert completed["status"] == ReviewStatus.CHANGES_REQUESTED.value

    def test_get_review_comments(self, review_manager):
        """Test retrieving all comments for a review."""
        review_manager.submit_code(
            submission_id="sub_001",
            user_id="user_123",
            project_id=1,
            code="test code",
            language="python",
        )

        return jsonify({"error": "Request body must be valid JSON."}), 400

    user_id = (payload.get("user_id") or "").strip()
    skill_name = (payload.get("skill") or "").strip()
    target_difficulty = (payload.get("difficulty") or "").strip()

    if not user_id or not skill_name or not target_difficulty:
        return jsonify({
            "error": "user_id, skill, and difficulty are required"
        }), 400

    result = validate_skill_progression(
        user_id,
        skill_name,
        target_difficulty,
        _skill_valida
…[8629 chars omitted]…
payloads


def _extract_token(req):
    """Return the bearer token from the request header, or None if absent."""
    return req.headers.get(_TOKEN_HEADER, "").strip() or None


@main.route("/api/learning-path/<path_id>", methods=["POST"])
@rate_limit(max_requests=10, window_seconds=60)
def create_path(path_id):
    """Create a new learning path and bind it to the supplied token.

    Request headers:

        return jsonify({"error": "Request body must be valid JSON."}), 400

    submission_id = (payload.get("submission_id") or "").strip()
    user_id = (payload.get("user_id") or "").strip()
    project_id = payload.get("project_id")
    code = (payload.get("code") or "").strip()
    language = (payload.get("language") or "").strip()
    description = (payload.get("description") or "").strip()

    if not all([submission_id, user_id, project_id, code, language]):
        return jsonify({
            "error": "submission_id, user_id, project_id, code, and language are required"
        }), 
…[8629 chars omitted]…
     """
        Get the recommended next skill level for a user to pursue.

        Returns:
            (skill_name, next_difficulty) or None if at expert level
        """
        user_skills = self.get_user_skills(user_id)

        if skill_name not in user_skills:
            return None

        current_difficulty = user_skills[skill_name].get("difficulty")
        if current_difficulty is None:

467-        <div class="sidebar-card">
468-          <h3 class="sidebar-card-title">Filters</h3>
469-          <form method="GET" action="/explore" id="explore-filter-form">
470-         
…[8630 chars omitted]…
r_handlers(app)
    """
    app.register_error_handler(400, bad_request)
    app.register_error_handler(403, forbidden)
    app.register_error_handler(404, page_not_found)
    app.register_error_handler(405, method_not_allowed)
    app.register_error_handler(429, too_many_requests)
    app.register_error_handler(500, internal_server_error)
    app.register_error_handler(Exception, unhandled_exception)

def login():
    from app import github
    # generate a redirect uri
    redirect_uri = url_for('auth.authorize', _external=True)
    return github.authorize_redirect(redirect_uri)

@auth_bp.route('/authorize')
def authorize():
    from app import github
    token = github.authorize_access_token()
    if not token:
        return redirect(ur
…[8629 chars omitted]…
xture(autouse=True)
def _reset_rate_limiter_state():
    """Clear rate-limit counters before every test.
 
    Without this, tests across different files that hit the same rate-limited route 
    would exhaust each other's request budget depending on test execution order, causing
    order-dependent 429 failures unrelated to what each test is actually checking.
    """
    reset_rate_limits()
    yield

class ReviewStatus(Enum):
    """Status of a code review."""
    PENDING = "pending"
    IN_PROGRESS = "in_progress"
    COMPLETED = "completed"
    CHANGES_REQUESTED = "changes_requested"


class CodeQualityCategory(Enum):
    """Categories for code quality assessment."""
    FUNCTIONALITY = "functionality"
    CODE_STYLE = "code_style"
    PERFORMANCE = "performance"
    SECURITY = "security"
    TESTING = "testing"
    DOCUMENTATION = "documentation"


FEEDBACK_TEMPLATES = {
    "functionality": {
        "excellent": "Code correctly implements all required functionality",
        "good": "Code implements functionality with m
…[8630 chars omitted]…
       line_number=1,
            code_snippet="code 1",
            feedback="Comment 1",
        )
        review_manager.add_feedback_comment(
            review_id=review["review_id"],
            line_number=5,
            code_snippet="code 5",
            feedback="Comment 5",
        )

        comments = review_manager.get_review_comments(review["review_id"])
        assert len(comments) == 2

        review = {
            "review_id": review_id,
            "submission_id": submission_id,
            "reviewer_id": reviewer_id,
            "started_at": datetime.now(timezone.utc).isoformat(),
            "completed_at": None,
            "status": ReviewStatus.IN_PROGRESS.value,
            "overall_score": None,
            "category_scores": {},
            "issues_found": [],
        }

        self.reviews[review_id] = review
        su
…[8628 chars omitted]…
.BEGINNER),
            ("JavaScript", SkillDifficulty.INTERMEDIATE),
        ],
        SkillDifficulty.ADVANCED: [
            ("Node.js", SkillDifficulty.INTERMEDIATE),
            ("JavaScript", SkillDifficulty.ADVANCED),
        ],
        SkillDifficulty.EXPERT: [
            ("Node.js", SkillDifficulty.ADVANCED),
            ("JavaScript", SkillDifficulty.EXPERT),
        ],
    },
    "SQL": {

    SECRET_KEY = os.getenv("SECRET_KEY", "change-this-secret-in-production")
    
    # Base URL for the application - used for OG tags and canonical URLs
    # Can be overridden via environment variable for different deployments
    BASE_URL = os.getenv("BASE_URL", "https://mydevpath-github.vercel.app")
    # Security and Session
    SECRET_KEY = os.getenv("SECRET_KEY", "dev_secret_key_change_in_production")
    
    # GitHub OAuth Settings
    GITHUB_CLIENT_ID = os.getenv("GITHUB_CLIENT_ID", "dummy_client_id")
    GITHUB_CLIENT_SECRET = os.getenv("GITH
…[1177 chars omitted]…
('/')}{cls.OG_IMAGE_PATH}"
    
    @classmethod
    def get_base_url(cls):
        """Return the base URL without trailing slash."""
        return cls.BASE_URL.rstrip("/")
tests/test_basic.py:442:    """Explore route should return 200 OK and handle pagination."""
tests/test_basic.py:447:    assert "Explore All Projects" in html
tests/test_no_results_reset.py:50:    "interest": "Machine Learning/AI",

def test_repeated_match_queries_are_consistent(client):
    """Multiple consecutive match queries must all return the same projects."""
    results = []
    for _ in range(3):
        r = client.post("/api/recommend", json=MATCH_PAYLOAD)
        results.append([p["id"] for p in r.get_json()["projects"]])
    assert results[0] == results[1] == results[2], (

…[8629 chars omitted]…
    db.session.commit()
        return redirect(url_for('admin.dashboard'))
        
    return render_template('admin/form.html', project=project)

@admin_bp.route('/projects/<int:id>/delete', methods=['POST'])
def delete_project(id):
    project = db.session.get(Project, id)
    if project:
        db.session.delete(project)
        db.session.commit()
    return redirect(url_for('admin.dashboard'))

…[2093 chars omitted]…
t "python" in project.skills
            project_id = project.id
            
        # Update
        response = client.post(f"/admin/projects/{project_id}/edit", data={
            "title": "Updated Test Project",
            "level": "Intermediate",
            "interest": "Data",
            "time": "Medium",
            "description": "Updated description",
            "skills": "python, pandas",

    rv = self.preprocess_request()
         ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/flask/app.py", line 1291, in preprocess_request
    rv = self.ensure_sync(before_func)()
    
…[2097 chars omitted]…
00 {'error': 'Bad request.', 'reference': '6d1c652d'}
/api/skill-progression/user/victim 200 {'proficiency': {'average_score': 0, 'levels_distribution': {}, 'proficiency_rating': 'Novice', 'total_skills_completed': 0}, 'skills': {}, 'user_id': 'victim'}
/api/code-review/submit 400 {'error': 'Bad request.', 'reference': '53fdc906'}
/api/code-review/submission/repro 404 {'error': 'Submission not found'}

        recommend_changes: bool = False,
    ) -> Dict:
        """
        Complete a code review.

        Args:
            review_id: Review ID
            summary: Summary of review findings
            recommend_changes: Whether changes are recommended

        Returns:
            Completed review data
        """
        if review_id not in self.reviews:
            raise ValueError(f"Review {review_id} not found")

        review = self.reviews[review_id]
        scores = [s["score"] for s in review["category_scores"].values()]
        overall_score = sum(sco
…[4738 chars omitted]…
view/submission/<submission_id>/quality")
898:@main.route("/api/code-review/submission/<submission_id>/recommendations")
25:from flask_wtf.csrf import CSRFProtect
95:csrf = CSRFProtect(app)
108:csrf.exempt(recommend)
109:csrf.exempt(save_user_game_progress)
110:csrf.exempt(update_project_progress)
111:csrf.exempt(portfolio_analysis)
41:    app.config["SQLALCHEMY_DATABASE_URI"] = f"sqlite:///{db_path}"

import sys
import os
from dotenv import load_dotenv

# Ensure the root directory's .env is loaded even if run from a subfolder
root_dir = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
load_dotenv(os.path.join(root_dir, '.env'))

# Ensure the 'src' directory is in the python path for Vercel and root-level execution
sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))

from flask import Flask, session
from flask_wtf.csrf import CSRFProtect
from routes.main_routes import main
from r
…[4241 chars omitted]…
 app.config['WTF_CSRF_ENABLED'] = False
./tests/test_basic.py:43:    app.config["WTF_CSRF_ENABLED"] = False
./tests/test_basic.py:431:    app.config["WTF_CSRF_ENABLED"] = False
./tests/test_csrf_json_api.py:17:    app.config["WTF_CSRF_ENABLED"] = True
./tests/test_csrf_json_api.py:23:        app.config["WTF_CSRF_ENABLED"] = False
./tests/test_pagination.py:15:    app.config["WTF_CSRF_ENABLED"] = False

    return current_app.json.response(*args, **kwargs)  # type: ignore[return-value]
          
…[5209 chars omitted]…
ciency_rating': 'Novice', 'total_skills_completed': 0}, 'skills': {}, 'user_id': 'bob'}
authenticated cross-user submission -> 201 {'submission': {'code': 'secret', 'description': '', 'language': 'python', 'metrics': {}, 'project_id': 1, 'review_count': 0, 'review_status': 'pending', 'submission_id': 'cross-repro', 'submitted_at': '2026-11-02T13:31:19.568581+00:00', 'user_id': 'bob'}, 'success': True}

@pytest.fixture
def csrf_client():
    """Test client with Flask-WTF CSRF protection fully enabled."""
    app.config["WTF_CSRF_ENABLED"] = True
    app.config["TESTING"] = True
    try:
        with app.test_client() as client:
            yield client
    finally:
        app.config["WTF_CSRF_ENABLED"] = False


def test_recommend_json_post_works_with_csrf_enabled(csrf_client):
    """/api/recommend must return its normal JSON response (not 400 CSRF)."""
    resp = csrf_client.post(
        "/api/recommend",
…[8629 chars omitted]…
OCITY_FAST_THRESHOLD = 0.8


@main.route("/api/learning-path/<path_id>/analytics", methods=["GET"])
def get_path_analytics(path_id):
    """
    Calculate time analytics and velocity for a specific learning path.
    
    Requires X-Learning-Path-Token header for authorization.
    Expected data structure in path['progress']:
    {
        "project_id": {"completed": bool, "actual_hours": float}
    }

            bp = Blueprint(...)
            csrf.exempt(bp)

        """

        if isinstance(view, Blueprint):
            self._exempt_blueprints.add(view)
            return view

        if isinstance(view, str):
            view_location = view
        else:
            view_location = ".".join((view.__module__, view.__name__))

        self._exempt_views.add(view_location)
        return view

    def protect(self, apply_exemptions=False):
        """Validate CSRF on the current request.

        When ``apply_exemptions`` is ``True``, views and blueprints marked with
        :meth:`exempt` are skipped. This lets you combine a
…[597 chars omitted]…
config["WTF_CSRF_SSL_STRICT"]:
            if not request.referrer:
                self._error_response("The referrer header is missing.")

            good_referrer = f"https://{request.host}/"

            if not same_origin(request.referrer, good_referrer):
                self._error_response("The referrer does not match the host.")

        g.csrf_valid = True  # mark this request as CSRF valid

260-        completed_skills = len(user_skills)
261-        scores = [
262-            s.get("assessment_score")
263-            for s in user_skills.values()
264-            if s.get("assessment_score") is not None
265-        ]
266-        average_score = sum(scores) / len(scores) if scores else 0
267-
268-        levels_distribution = {}
269-        for skill, data in user_skills.items():
270-            difficulty = data.
…[1828 chars omitted]…
-    return {
326-        "allowed": is_allowed,
327-        "skill": skill_name,
328-        "target_difficulty": target_difficulty,
329-        "message": error_msg or "Skill progression allowed",
330-        "prerequisites": (
331-            [p[0] for p in SKILL_PREREQUISITES.get(skill_name, {}).get(difficulty, [])]
332-            if not is_allowed
333-            else []
334-        ),
335-    }

+        if not session.get("user_id"):
+            return jsonify({"error": "Unauthorized"}), 401
+
+
+def _authenticated_user_id():
+    """Return the active session identity in a consistent string form."""
+    user_id = session.get("user_id")
+    return str(user_id) if user_id is not None else None
+
+
+def _authorize_user_id(requested_user_id=None):
+    """Bind user-scoped operations to t
…[8629 chars omitted]…
i" %}selected{% endif %}>Machine Learning/AI</option>
+                  {% for i in available_interests %}
+                  <option value="{{ i | lower }}" {% if interest == i | lower %}selected{% endif %}>{{ i }}</option>
+                  {% endfor %}
                 </select>
               </div>
             </div>
 M data/devpath.db
 M src/routes/main_routes.py
 M src/templates/explore.html

from utils.learning_path import (
    create_learning_path,
    get_learning_path,
    update_learning_path,
    Pa
…[8630 chars omitted]…
sing or wrong token are rejected with
# 403 Forbidden before any data is read or modified, closing the
# cross-user exposure described in issue #736.
#
# Token transport: the X-Learning-Path-Token request header.
# Path identity:   the <path_id> URL segment (opaque, UUID-like string).
# ---------------------------------------------------------------------------

_TOKEN_HEADER = "X-Learning-Path-Token"

    payload = request.get_json(silent=True)

    if not payload:
        return jsonify({"error": "Request body must be valid JSON."}), 400

    if not isinstance(payload, dict):
        return jsonify({"error": "Request body must be a JSON object."}), 400

    user_id, authorization_error = _authorize_user_id(payload.get("user_id"))
    if authorization_error:
        return authorization_error

    skill_name = (payload.get("skill") or "").strip()
    target_difficulty = (payload.get("difficulty") or "").strip()

    if not skill_name 
…[8629 chars omitted]…
w_comment,
    score_review_category,
    complete_code_review,
    get_review_feedback,
    get_code_quality_score,
    get_code_recommendations,
):
    csrf.exempt(json_api_view)

# Register all routes defined in the main Blueprint (This handles your '/' route!)
app.register_blueprint(main)
app.register_blueprint(github_bp)

# Register the global error boundary (handles 400, 403, 404, 405, 429, 500,

32-        assert SkillDifficulty.INTERMEDIATE.value == 2
33-        assert SkillDifficulty.ADVANCED.value == 3
34-        assert SkillDifficulty.EXPERT.value == 4
35-
36-
37:class TestSkillProgressionValidator:
38-    """Tests for SkillProgressionValidator."""
39-
40-    def test_can_learn_beginner_without_prerequisites(self, 
…[8630 chars omitted]…
     return ownership_error
    if not review:
        return jsonify({"error": f"Review {review_id} not found"}), 404

    payload = request.get_json(silent=True)

    if not payload:
        return jsonify({"error": "Request body must be valid JSON."}), 400

    category = (payload.get("category") or "").strip()
    score = payload.get("score")
    feedback = (payload.get("feedback") or "").strip()

E       AssertionError: Expected at most 3 results, got 25
E       assert 25 <= 3
E        +  where 25 = len([{'id': 5, 'title': 'Portfolio Website', 'level': 'Beginner', 'interest': 'Web', ...}, {'id': 2, 'title': 'Weather Das...: 'Web', ...
…[8628 chars omitted]…
ion' thrown while requesting HEAD https://huggingface.co/sentence-transformers/all-MiniLM-L6-v2/resolve/main/config.json
=========================== short test summary info ============================
FAILED tests/test_basic.py::test_get_recommendations_max_three - AssertionErr...
!!!!!!!!!!!!!!!!!!!!!!!!!! stopping after 1 failures !!!!!!!!!!!!!!!!!!!!!!!!!!!
1 failed, 54 passed in 156.11s (0:02:36)

     portfolio_analysis,
+    validate_skill,
+    record_skill_completion,
+    get_user_progression,
+    get_next_skill,
+    submit_code_for_review,
+    get_submission,
+    get_user_code_submissions,
+    get_project_code_submissions,
+    start_code_review,
+    add_review_comment,
+    score_review_category,
+    complete_code_review,
+    get_review_feedback,
+    get_code_quality_score,
+    get_co
…[8629 chars omitted]…
     <option value="machine learning/ai" {% if interest == "machine learning/ai" %}selected{% endif %}>Machine Learning/AI</option>
+                  {% for i in available_interests %}
+                  <option value="{{ i | lower }}" {% if interest == i | lower %}selected{% endif %}>{{ i }}</option>
+                  {% endfor %}
                 </select>
               </div>
             </div>

        user_id,
        skill_name,
        target_difficulty,
        _skill_validator
    )

    return jsonify(result), 200 if result["allowed"] else 400


@main.route("/api/skill-progression/record", methods=["POST"])
def record_skill_completion():
    """Record user completion of a skill at given difficulty level."""
    payload = request.get_json(silent=True)

    if not payload:
        return jsonify({"error": "Request body must be valid JSON."}), 400

    if not isinstance(payload, dict):
        return jsoni
…[8629 chars omitted]…

1217:@main.route("/api/project/<int:project_id>/progress", methods=["GET"])
1228:@main.route("/api/project/<int:project_id>/progress", methods=["POST"])
1254:@main.route("/api/user-progress", methods=["GET"])
1263:@main.route("/api/user-progress", methods=["POST"])
1283:@main.route("/api/portfolio-analysis", methods=["POST"])
1317:@main.route("/api/learning-path/<path_id>/analytics", methods=["GET"])

779-
780-    if not all([submission_id, project_id, code, language]):
781-        return jsonify({
782-            "error": "submission_id, project_id, code, and language are required"
783-        }), 400
784-
785:    existing_submission, ownership_error = _owned_submission(
786-        submission_id, user_id
787-    )
788-    if ownership_error:
789-        return ownership_error
790-
791-    try:
792-        submission = _code_review_manager.submit_code(
793-            submission_id=submission_id,
79
…[1863 chars omitted]…
     submission
847-        for submission in _code_review_manager.get_project_submissions(project_id)
848-        if str(submission.get("user_id")) == user_id
849-    ]
850-    return jsonify({
851-        "project_id": project_id,
852-        "submissions": submissions,
853-        "count": len(submissions)
854-    }), 200
855-
 M src/app.py
 M src/routes/main_routes.py
 M src/templates/explore.html

    sess = self.registry()
           ^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/sqlalchemy/util/_collections.py", line 605, in __call__
    key = self.scopefunc()
          ^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.
…[276 chars omitted]…
_current_object
    raise RuntimeError(unbound_message) from None
RuntimeError: Working outside of application context.

This typically means that you attempted to use functionality that needed
the current application. To solve this, set up an application context
with app.app_context(). See the documentation for more information.
 M src/app.py
 M src/routes/main_routes.py
 M src/templates/explore.html

src/app.py:155:1: E302 expected 2 blank lines, found 1
src/routes/main_routes.py:6:89: E501 line too long (140 > 88 characters)
src/routes/main_routes.py:8:89: E501 li
…[4351 chars omitted]…
302 expected 2 blank lines, found 1
src/routes/main_routes.py:1130:89: E501 line too long (96 > 88 characters)
src/routes/main_routes.py:1203:89: E501 line too long (96 > 88 characters)
src/routes/main_routes.py:1217:1: E302 expected 2 blank lines, found 1
src/routes/main_routes.py:1224:89: E501 line too long (94 > 88 characters)
 M src/app.py
 M src/routes/main_routes.py
 M src/templates/explore.html

252-      margin-bottom: 0.75rem;
253-      opacity: 0.5;
254-    }
255-
256:    .empty-completed p {
257-      margin: 0;
258-      font-weight: 500;
259-    }
260-
261:    .empty-completed span {
262-      font-size: 0.75rem;
263-    }
264-
265-    /* Tabs */
266-    .la-tabs {
267-      display: flex;
268-      gap: 0.5rem;
269-      margin-bottom: 1rem;
270-      border-bottom: 1px solid var(--border, #e5e7eb);
271-      padding-bottom: 0.5rem;
272-    }
273-
274-    .la-tab {
275-      background: none;
276-      border: none;
277-      padding: 0.5rem 1rem;
278-      font-size: 0.85rem;
279-      font-weight: 500;
280- 
…[1600 chars omitted]…
588-        <span class="footer-logo">Dev<span class="footer-logo-accent">Path</span></span>
589-        <p class="footer-tagline">Open source. Built for learners, by learners.</p>
590-        <p class="footer-tagline">Helping developers find meaningful projects to build their skills.</p>
591-      </div>
592-
593-      <div class="footer-col">
594-        <h4 class="footer-col-title">Quick Links</h4>

 M src/templates/explore.html

src/routes/main_routes.py:155:43: W291 traili
…[1824 chars omitted]…
g (94 > 88 characters)
src/routes/main_routes.py:1374:64: E261 at least two spaces before inline comment
src/routes/main_routes.py:1376:89: E501 line too long (111 > 88 characters)
src/routes/main_routes.py:1378:89: E501 line too long (100 > 88 characters)
src/routes/main_routes.py:1385:89: E501 line too long (96 > 88 characters)
 M src/app.py
 M src/routes/main_routes.py
 M src/templates/explore.html

+    add_review_comment,
+    score_review_category,
+    complete_code_review,
 )
-csrf.exempt(recommend)
-csrf.exempt(save_user_game_progress)
-csrf.exempt(update_project_progress)
-csrf.exempt(portfolio_analysis)
+for json_api_view in (
+    recommend,
+    save_user_game_progress,
+    update_project_progress,
+    portfolio_analysis,
+    validate_skill,
+    record_skill_completion,
+    submit_code_for_review,
+    start_code_review,
+    add_review_comment,
+    score_review_category,
+    complete_code_review,
+):
+    csrf.exempt(json_a
…[8629 chars omitted]…
ing/ai" %}selected{% endif %}>Machine Learning/AI</option>
+                  {% for i in available_interests %}
+                  <option value="{{ i | lower }}" {% if interest == i | lower %}selected{% endif %}>{{ i }}</option>
+                  {% endfor %}
                 </select>
               </div>
             </div>
 M src/app.py
 M src/routes/main_routes.py
 M src/templates/explore.html