Allow missing course IDs in learn-progress allowlist

[umarjaved204]

Allow missing course IDs in the learn-progress allowlist

Problem

The frontend syncs progress, quiz answers, notes and XP for 109 courses, but only 54 course IDs were allowlisted in src/modules/auth/constants/courseIds.js.

For the other 55 courses, assertCourseId rejected every progress request with 400 "Unknown courseId". Signed-in learners' progress for those courses was never saved to their account; the frontend silently fell back to browser storage.

Affected courses include all PHP (except Fundamentals), Laravel, Go (except Fundamentals), PowerShell, Batchfile, Windows Scripting, Quantum, Q#, most C#, Rust, CSS/HTML and several JS/C++/Ruby courses.

Changes

• src/modules/auth/constants/courseIds.js: added the 55 missing IDs, grouped with the existing IDs for each language. No existing IDs removed or renamed.
• ruby-oop is intentionally not added. That course is currently a copy of Ruby on Rails on the frontend and is being handled separately.

Checked

• No other backend code hard-codes course IDs:
  • courseId in LearnerProgress is a plain String with no enum.
  • Daily XP doesn't validate course IDs.
  • assertCourseId (progress + annotations) is the only check.
• /learn/progress/merge reported these failures per course inside a 200 response, which is why they went unnoticed.

Testing

• COURSE_IDS: 109 entries, 109 unique.
• isValidCourseId returns true for all 55 new IDs and all 54 existing IDs; ruby-oop is still rejected with 400.
• The frontend's 109 course IDs all match the allowlist exactly.
• Local server + local MongoDB, with a test user:
  • POST /learn/:courseId/progress/engagement returns 200 for php-oop, laravel-basics, ruby-on-rails, go-fundamentals, powershell-fundamentals, batchfile-projects, quantum-algorithms and qsharp-fundamentals (previously 400).
  • ruby-oop still returns 400.
  • /learn/progress/merge saves php-mysql and returns "Unknown courseId" for ruby-oop.
• Browser test on PHP OOP: engagement requests are no longer rejected as an unknown course.

Known issues (existing, not caused by this PR, to be fixed separately)

• Duplicate saves: the frontend sends each quiz save twice; the second gets 409 Conflict and is lost. Frontend fix in progress.
• Overlapping saves: withCourse rejects overlapping saves with 409 instead of retrying.
• First answer lost: the first quiz answer saved for a new lesson is lost (upsertEngagementEntry modifies the entry object after it has been added to the array).

Deployment

Takes effect for users only after the backend is deployed to Vercel. Deploy this before the matching frontend registry changes.

[vercel]

@umarjaved204 is attempting to deploy a commit to the seno-quantum-coder's projects Team on Vercel.

A member of the Team first needs to authorize it.