forgia · dev log

Engineering log for the forgia LMS platform.

• 23 Jul 26
  A Content-Security-Policy, and Three Things It Caught Before Shipping

  A CSP header allowlisting our own scripts plus Paddle and Bunny, shipped report-only first — which is exactly what caught a frame-src fallback misunderstanding, a Paddle CDN subdomain, and Course thumbnails actually living on Backblaze B2, not local disk.

  securityphoenixplugpaddlebunny
• 20 Jul 26
  A Real Front Door

  The root route stops being a dev-only nav page and becomes a public Landing Page — nav, hero, methodology, instructor bio, and a live course catalog — while reusing the exact catalog card and Paddle pricing already built for /catalog.

  liveviewphoenixgettextpaddledesign-system
• 13 Jul 26
  The Price That Lied: Dropping the Local Integer

  A Course stored its price as an integer. That integer was wrong for most of the people who saw it — and it was also secretly deciding whether the Course was free. This slice deletes the column, replaces it with an explicit Pricing model, and lets Paddle be the only thing that ever prints a number.

  ectoliveviewpaddledddmigrations
• 21 Jun 26
  Selling a paid course: Paddle, a webhook, and the art of waiting

  A Student can now buy a paid Course. The interesting parts aren't the Buy button — they're the decisions underneath: the price you see is Paddle's, not ours (localized by IP); access is granted only by a signature-verified webhook, never by the browser saying "I paid"; and because that webhook is asynchronous, the panel shows a "Finalizing…" state that polls itself into "Continue Learning" with no refresh. Plus the idempotency that makes a double-delivered webhook a no-op.

  slicepaymentspaddlewebhookenrollmentliveviewddd