Milestone 6: private Academy media storage

[botsarefuture]

Purpose

Complete the Educational Media Pipeline by letting authors upload teaching files without touching source code while keeping drafts private and published delivery immutable.

What changed

• adds a separate Academy GridFS bucket with a 100 MB per-file limit
• streams uploads through a bounded spool and verifies conservative MIME signatures
• computes SHA-256 checksums and deduplicates matching uploads
• keeps uploaded files private until a published media revision references them
• serves published files with immutable caching, ETags, conditional requests, and byte ranges
• adds author upload controls for teaching files and WebVTT captions
• validates the pathway illustration replacement and Finnish localized metadata through staging
• marks Milestone 6 complete and records storage limits and orphan cleanup debt

Security and privacy

Teaching assets stay same-origin and never share the encrypted learner-recording bucket. SVG and arbitrary MIME types are rejected. PDF files download as attachments. Draft file ids return 404 publicly.

Validation

• npm test (32 tests)
• PYTHONPATH=server python3 -m unittest discover -s server -p "test_*.py" (25 tests)
• npm run build
• npm run check:version
• live staging upload remained 404 before publication
• duplicate upload returned the same immutable file id
• author → reviewer → publisher replacement v2 and Finnish localization workflows
• exact lesson v2 and course v2 publication and learner rendering from GridFS
• byte-for-byte delivery, checksum ETag, 304, and 206 range response
• browser audit at 390px with no overflow and 44px upload action

Known limitations

Abandoned draft uploads need a scheduled cleanup job. GridFS is suitable for the current free curriculum, but very large or high-traffic video should later use the documented storage adapter boundary.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.