Prioritized PR merge plan (2026-04-12)

[A1L13N]

This issue tracks all pull requests in alphaonelabs/learn. GitHub automatically shows the live status of each PR below. PRs are ordered roughly by priority (security → correctness → performance → features → docs).

PR Status Tracker

🔒 Security & Auth

• fix: harden security — configurable CORS origin, role escalation, unauthenticated seed #26 fix: harden security — configurable CORS origin, role escalation, unauthenticated seed
• fix: add token expiry and timing-safe password check #23 fix: add token expiry and timing-safe password check
• fix: block join role escalation and add username format validation #30 fix: block join role escalation and add username format validation
• fix: prevent duplicate submissions and harden join idempotency #35 fix: prevent duplicate submissions and harden join idempotency

🐛 Bug Fixes

• fix: password minlength mismatch and add email validation #24 fix: password minlength mismatch and add email validation
• fix: align password minlength in UI with backend validation #33 fix: align password minlength in UI with backend validation
• fix: Resolve Web Crypto AES-GCM Map conversion bug during encryption #27 fix: Resolve Web Crypto AES-GCM Map conversion bug during encryption

⚡ Performance

• perf: fix N+1 tag queries in activities and dashboard APIs #31 perf: fix N+1 tag queries in activities and dashboard APIs

✨ Features

• feat: add course assignment system with submissions and grading #25 feat: add course assignment system with submissions and grading
• feat: enhance dashboard with student progress tracking and session attendance #21 feat: enhance dashboard with student progress tracking and session attendance
• feat: add activity discussion/comments system with threaded replies #20 feat: add activity discussion/comments system with threaded replies
• feat: add peer connections system with requests, accept/decline, and dashboard UI #29 feat: add peer connections system with requests, accept/decline, and dashboard UI
• Activity and Session Editable Functionality #18 Activity and Session Editable Functionality
• Add Cloudflare Workers AI chat assistant to homepage #9 Add Cloudflare Workers AI chat assistant to homepage
• Perfectly organized worker.py into 8 files total #17 Perfectly organized worker.py into 8 files total
• env for contributors + auto update DB_ID in wrangler.toml #10 env for contributors + auto update DB_ID in wrangler.toml

📚 Docs & Setup

• docs: improve setup documentation and add .env.sample template #32 docs: improve setup documentation and add .env.sample template
• Docs: Added Contributing.md #37 Docs: Added Contributing.md

GitHub automatically renders the live open/merged/closed status for each #PR reference above. No manual updates needed!

[A1L13N]

@copilot update this issue to show the pr status

[A1L13N]

@coderabbitai update this issue to show the or status

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Get issue `#38` details
gh issue view 38 --repo alphaonelabs/learn

echo "---"
# Search for PRs that reference issue `#38`
gh pr list --repo alphaonelabs/learn --state all --search "#38" --json number,title,state,url,mergedAt,createdAt,author
echo "---"
# Also search for PRs mentioning issue 38 in body
gh pr list --repo alphaonelabs/learn --state all --json number,title,state,url,mergedAt,body,createdAt --limit 50 | python3 -c "
import json, sys
prs = json.load(sys.stdin)
for pr in prs:
    if '38' in str(pr.get('body','')) or '#38' in str(pr.get('body','')):
        print(json.dumps({k: pr[k] for k in ['number','title','state','url','mergedAt','createdAt']}, indent=2))
"

Length of output: 4374

---

🏁 Script executed:

#!/bin/bash
# Get current status of all PRs listed in issue `#38`
gh pr list --repo alphaonelabs/learn --state all \
  --json number,title,state,mergedAt,url,author \
  --limit 100 | python3 -c "
import json, sys
prs = json.load(sys.stdin)
tracked = {9,10,17,18,20,21,23,24,25,26,27,29,30,31,32,33,35,37}
pr_map = {pr['number']: pr for pr in prs if pr['number'] in tracked}
for n in sorted(tracked):
    if n in pr_map:
        p = pr_map[n]
        status = 'MERGED' if p['mergedAt'] else p['state']
        print(f\"#{n}: {status} — {p['title']}\")
    else:
        print(f'#{n}: NOT FOUND')
"

Length of output: 1319

---

🏁 Script executed:

#!/bin/bash
# Update issue `#38` with current PR statuses
gh issue edit 38 --repo alphaonelabs/learn --body "This issue documents the current open pull requests in \`alphaonelabs/learn\`, ranked by importance for merging as of 2026-04-12. The ranking considers security, correctness, performance, core features, and then documentation/refactor work.

### Ranked PRs (highest → lowest priority)

| Status | PR | Title |
|--------|-----|-------|
| 🔄 Open | [`#26`](https://github.com/alphaonelabs/learn/pull/26) | **fix: harden security — configurable CORS origin, role escalation, unauthenticated seed** |
| 🔄 Open | [`#23`](https://github.com/alphaonelabs/learn/pull/23) | **fix: add token expiry and timing-safe password check** |
| 🔄 Open | [`#30`](https://github.com/alphaonelabs/learn/pull/30) | **fix: block join role escalation and add username format validation** |
| 🔄 Open | [`#35`](https://github.com/alphaonelabs/learn/pull/35) | **fix: prevent duplicate submissions and harden join idempotency** |
| ✅ Merged | [`#27`](https://github.com/alphaonelabs/learn/pull/27) | **fix: Resolve Web Crypto AES-GCM Map conversion bug during encryption** |
| 🔄 Open | [`#31`](https://github.com/alphaonelabs/learn/pull/31) | **perf: fix N+1 tag queries in activities and dashboard APIs** |
| 🔄 Open | [`#24`](https://github.com/alphaonelabs/learn/pull/24) | **fix: password minlength mismatch and add email validation** |
| 🔄 Open | [`#33`](https://github.com/alphaonelabs/learn/pull/33) | **fix: align password minlength in UI with backend validation** |
| 🔄 Open | [`#25`](https://github.com/alphaonelabs/learn/pull/25) | **feat: add course assignment system with submissions and grading** |
| 🔄 Open | [`#21`](https://github.com/alphaonelabs/learn/pull/21) | **feat: enhance dashboard with student progress tracking and session attendance** |
| 🔄 Open | [`#20`](https://github.com/alphaonelabs/learn/pull/20) | **feat: add activity discussion/comments system with threaded replies** |
| 🔄 Open | [`#29`](https://github.com/alphaonelabs/learn/pull/29) | **feat: add peer connections system with requests, accept/decline, and dashboard UI** |
| 🔄 Open | [`#18`](https://github.com/alphaonelabs/learn/pull/18) | **Activity and Session Editable Functionality** |
| 🔄 Open | [`#9`](https://github.com/alphaonelabs/learn/pull/9) | **Add Cloudflare Workers AI chat assistant to homepage** |
| 🔄 Open | [`#17`](https://github.com/alphaonelabs/learn/pull/17) | **Perfectly organized worker.py into 8 files total** |
| 🔄 Open | [`#10`](https://github.com/alphaonelabs/learn/pull/10) | **env for contributors + auto update DB_ID in wrangler.toml** |
| 🔄 Open | [`#32`](https://github.com/alphaonelabs/learn/pull/32) | **docs: improve setup documentation and add .env.sample template** |
| 🔄 Open | [`#37`](https://github.com/alphaonelabs/learn/pull/37) | **Docs: Added Contributing.md** |

> _Last updated: 2026-04-12. If your goals/priorities change (MVP, launch, cost, security audit, etc.), reorder as needed. Suggest updates or check off as PRs are merged!_"

Length of output: 47

---

@A1L13N, issue #38 has been updated! Here's a summary of the current PR statuses:

Status	Count
✅ Merged	1 (#27)
🔄 Open	17 (#9, #10, #17, #18, #20, #21, #23, #24, #25, #26, #29, #30, #31, #32, #33, #35, #37)

The issue body has been reformatted into a clean status table with emoji indicators for each PR's current state. #27 (fix: Resolve Web Crypto AES-GCM Map conversion bug during encryption) is the only PR that has been merged so far. All other 17 PRs remain open and are ranked by priority as before.

[A1L13N]

@coderabbitai I mean using the correct syntax so it automatically updates

[coderabbitai]

🧩 Analysis chain

@A1L13N, understood! You're referring to GitHub's native tasklist/checklist syntax with PR references (e.g., - [ ] #26``). GitHub automatically renders the live status icon (🟢 open / 🟣 merged / 🔴 closed) next to each referenced PR number — no manual updates needed!

Let me reformat the issue body with that syntax now.

---

🏁 Script executed:

#!/bin/bash
# Update issue `#38` using GitHub tasklist syntax with PR references
# GitHub auto-renders live status icons for referenced PRs/issues

gh issue edit 38 --repo alphaonelabs/learn --body "This issue tracks all pull requests in \`alphaonelabs/learn\`. GitHub automatically shows the live status of each PR below. PRs are ordered roughly by priority (security → correctness → performance → features → docs).

### PR Status Tracker

**🔒 Security & Auth**
- [ ] `#26` fix: harden security — configurable CORS origin, role escalation, unauthenticated seed
- [ ] `#23` fix: add token expiry and timing-safe password check
- [ ] `#30` fix: block join role escalation and add username format validation
- [ ] `#35` fix: prevent duplicate submissions and harden join idempotency

**🐛 Bug Fixes**
- [ ] `#27` fix: Resolve Web Crypto AES-GCM Map conversion bug during encryption
- [ ] `#24` fix: password minlength mismatch and add email validation
- [ ] `#33` fix: align password minlength in UI with backend validation

**⚡ Performance**
- [ ] `#31` perf: fix N+1 tag queries in activities and dashboard APIs

**✨ Features**
- [ ] `#25` feat: add course assignment system with submissions and grading
- [ ] `#21` feat: enhance dashboard with student progress tracking and session attendance
- [ ] `#20` feat: add activity discussion/comments system with threaded replies
- [ ] `#29` feat: add peer connections system with requests, accept/decline, and dashboard UI
- [ ] `#18` Activity and Session Editable Functionality
- [ ] `#9` Add Cloudflare Workers AI chat assistant to homepage
- [ ] `#17` Perfectly organized worker.py into 8 files total
- [ ] `#10` env for contributors + auto update DB_ID in wrangler.toml

**📚 Docs & Setup**
- [ ] `#32` docs: improve setup documentation and add .env.sample template
- [ ] `#37` Docs: Added Contributing.md

> GitHub automatically renders the live open/merged/closed status for each \`#PR\` reference above. No manual updates needed!"

Length of output: 47

---

@A1L13N, done! Issue #38 has been updated with the correct GitHub syntax.

Each PR is now referenced as - [ ] #NUMBER`` — GitHub automatically renders a live status icon next to every PR number that reflects its current state:

• 🟢 Open
• 🟣 Merged
• 🔴 Closed

No more manual updates needed — as PRs get merged or closed, the status icons will update on their own! 🎉