Thanks for looking. This is a small project with a deliberately small surface — the aim is that a non-profit can read the whole thing in an afternoon and trust it with their compliance records.
npm install
npm run seed # demo organization
npm run dev
npm testnpm run sample-course writes a valid SCORM 1.2 package to test uploads with.
Add a test with your fix. Nearly every test in the suite exists because something broke in a way
nobody noticed for a while — a GET route that ended sessions when the browser prefetched it, a
timestamp comparison that hid anything dated today, a button whose name React quietly reassigned.
Those are the bugs worth guarding against, and they're invisible without a test that drives the
thing the way a browser does.
Prefer plain HTML. Forms post, GET never changes state, and everything should work with
JavaScript disabled. This is not nostalgia: two of the worst bugs in this project's history came
from clever client-side form handling that failed silently.
Keep the learner side boring. The learner experience is four things: sign in, see what's due, do it, leave. Features belong on the administrator side unless they make those four things simpler.
Comments explain why, not what. If a line looks odd, the comment should say what goes wrong without it.
- SCORM 2004 support
- Alerting when a backup fails
- Time zones for due dates, rather than UTC throughout
- Object storage for packages, so large uploads work on hosts that cap request bodies
- Accessibility review of the learner pages
- Translations
Please report vulnerabilities privately — see SECURITY.md.