[yt314]

Summary

Follow-up to #65: a dependency security fix, three more large units split up, and tests for paths that had none. Behavior is unchanged.

Unit	Before	After
System.Security.Cryptography.Pkcs	10.0.0 (1 high, 1 moderate advisory)	10.0.13, vulnerability scan clean
TalmidonDbContext.cs	693 lines	145 lines + 22 IEntityTypeConfiguration classes
AuthController.cs	388 lines, uses DbContext directly	186 lines, HTTP only
student-detail.component.ts / .html	427 / 331 lines	240 / 193 lines
Backend tests	295	300
Frontend tests	89	105

Changes

Dependency security fix

• MimeKit 4.18.1 (via MailKit) pulls in System.Security.Cryptography.Pkcs 10.0.0, which has two advisories: GHSA-846f-f764-76mx (high) and GHSA-2fmv-rv2c-59x7 (moderate).
• Even the latest MimeKit only requires >= 10.0.0, so upgrading MailKit wouldn't help. A direct reference to 10.0.13 in Talmidon.Infrastructure lifts it, with a comment explaining why the reference exists.
• dotnet list package --vulnerable --include-transitive is now clean for all three projects.

EF configuration: one class per entity (Data/Configurations/)

• Each entity has its own IEntityTypeConfiguration class, applied with ApplyConfigurationsFromAssembly. The fluent bodies were moved verbatim.
• This also fixes a naming problem: ConfigureTeacher used to configure CalendarEvent, ContactRequest, SiteFeedback and SubjectSuggestion as well.
• The context now holds only tenant isolation: the query filters and the TenantId enforcement on save.
• No migration is needed. Model.ToDebugString() and GenerateCreateScript() are byte-identical before and after. To confirm the comparison catches changes, I made a deliberate one-character change (a max length 4000 → 4001), saw it in the diff, and reverted it.

Auth (Services/Auth/)

• New tests first (LogoutAndResendTests), for the two endpoints that had none. They passed against the old code before the refactor:
  • Logout: revokes the caller's refresh token, leaves someone else's token working, and rejects anonymous calls.
  • Resend confirmation: sends a new email only for an unconfirmed account, nothing for a confirmed or unknown address, and returns an identical response body in every case.
• The controller's logic moved into four services:
  • RefreshTokens: issue, rotate (with reuse detection that revokes the whole token family), revoke one (owner only), revoke all.
  • TenantResolver: the user's tenant by role.
  • AuthEmails: confirmation and password-reset emails, plus the Base64Url token encode/decode the links use.
  • TeacherRegistration: creates the user, role and teacher record in one transaction.
• All response messages and the anti-enumeration behavior are unchanged. The confirmation link still prefers App:ApiBaseUrl over the request host.
• ServiceError gains Unauthorized.
• The duplicated doc comment on ConfirmEmail is merged into one.

Frontend: student card

• StudentNotesCardComponent and StudentResourcesCardComponent were extracted from student-detail. Each had its own state, form, dialog and service, tied to the page only by the student id.
• shared/dates/date-only.util.ts replaces three identical copies of toDateOnly (in students-list, student-detail and payments-list).
• students-list was intentionally not split. Its methods are short, and its two dialogs are coupled on purpose by focus-handling code that stops "required" errors from flashing while a dialog opens. I added tests for its contact-request flow instead.

Testing

• Backend: dotnet test, 300 of 300 pass.
• Frontend: ng test, 105 of 105 pass (16 new). ng build is clean.
  • The two cards: create vs. update, validation, "visible to student" implying "visible to parent", URL trimming and the http-only check, delete only after confirmation.
  • toDateOnly: uses local time, not toISOString(), which would give the previous day in Israel for a midnight date.
  • students-list contact-request flow, which had no tests: the parent form is pre-filled, the new parent is linked to the student form, and the request is marked handled after saving. A deleted request falls back to a plain student form.
• Browser (Playwright against the running API): 11 of 11 checks pass. Adding, editing and deleting a note (including the visibility tick), rejecting an invalid URL, adding a resource, and no page errors.

Notes for reviewers

• Each commit stands on its own. Commit 5's message says all three toDateOnly copies were replaced; the student-detail one actually landed in commit 6. Each commit builds on its own.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
talmidon	Ready	Preview	Oct 21, 2026 8:25am UTC