Merge pull request #2647 from Vacademy-io/feature/tts-speech-cache

.github/workflows/bbb-pool-manage.yml

@@ -335,6 +335,34 @@ jobs:
           sed -i "s|defaultUploadedPresentation=https://[^/]*/|defaultUploadedPresentation=https://$DOMAIN/|g" \
               /etc/bigbluebutton/bbb-web.properties 2>/dev/null || true
 
+          # Step 6: TURN / coturn — NOT covered by the sweep in Step 2.
+          # That sweep walks directories and filters by extension; /etc/turnserver.conf
+          # is under none of those directories and /etc/haproxy/haproxy.cfg matches none
+          # of those extensions, so the snapshot's build-time IP survived here on EVERY
+          # restore. coturn then cannot bind a foreign address and exits, which silently
+          # kills audio/video for every learner behind a UDP-blocking firewall while
+          # everyone on a permissive network is unaffected.
+          if [ -f /etc/turnserver.conf ]; then
+            for old in $(grep -oP '^\s*(listening-ip|relay-ip|allowed-peer-ip)=\K[\d.]+' \
+                         /etc/turnserver.conf 2>/dev/null | grep -v '^127\.' | sort -u); do
+              if [ "$old" != "$NEW_IP" ]; then
+                echo "  TURN: $old -> $NEW_IP"
+                sed -i "s/\b$old\b/$NEW_IP/g" /etc/turnserver.conf
+              fi
+            done
+            grep -q '^listening-ip=127\.0\.0\.1' /etc/turnserver.conf || \
+              sed -i "/^listening-ip=$NEW_IP/a listening-ip=127.0.0.1" /etc/turnserver.conf
+            systemctl restart coturn 2>/dev/null || true
+            echo "  coturn: $(systemctl is-active coturn 2>/dev/null)"
+          fi
+
+          # Pin haproxy's TURN backend to loopback — IP-proof from here on.
+          if [ -f /etc/haproxy/haproxy.cfg ]; then
+            sed -i 's|^\(\s*server localhost \)[0-9.]\+:3478|\1127.0.0.1:3478|' /etc/haproxy/haproxy.cfg
+            haproxy -c -f /etc/haproxy/haproxy.cfg >/dev/null 2>&1 \
+              && systemctl reload haproxy 2>/dev/null || echo "  WARNING: haproxy config test failed"
+          fi
+
           echo "BBB IP fix complete: $DOMAIN ($NEW_IP)"
           SCRIPT
 
@@ -368,17 +396,16 @@ jobs:
           SSH_OPTS="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=15"
 
           echo "[${{ matrix.slug }}] Shipping recording hook + heal service + health dashboard files to $IP"
-          ssh $SSH_OPTS root@$IP "mkdir -p /tmp/vacademy-bbb"
-          scp $SSH_OPTS \
-            bigbluebutton-server/post-publish-s3-upload.sh \
-            bigbluebutton-server/install-recording-hook.sh \
-            bigbluebutton-server/bbb-heal-service.py \
-            bigbluebutton-server/bbb-heal-service.service \
-            bigbluebutton-server/vacademy-heal.nginx \
-            bigbluebutton-server/bbb-health-dashboard.py \
-            bigbluebutton-server/bbb-health-dashboard.service \
-            bigbluebutton-server/vacademy-health.nginx \
-            root@$IP:/tmp/vacademy-bbb/
+          # Copy the WHOLE directory rather than a hand-maintained file list.
+          # install-recording-hook.sh reads several paths relative to its own
+          # directory — systemd/bbb-rap-resque-worker.service.d/lowprio.conf, the
+          # highprio.conf drop-ins, bbb-recording-drain.sh, bbb-rap-autotune.sh and
+          # their units — none of which were in the old explicit list, so step 9/10
+          # died on `cp: cannot stat` and took the whole start job down with it.
+          # A recursive copy means adding a file to the repo can never again break
+          # the daily start.
+          ssh $SSH_OPTS root@$IP "rm -rf /tmp/vacademy-bbb && mkdir -p /tmp/vacademy-bbb"
+          scp -r $SSH_OPTS bigbluebutton-server/* root@$IP:/tmp/vacademy-bbb/
 
           # Read BBB secret from the running server — no need to store per-server secrets in GitHub
           echo "[${{ matrix.slug }}] Reading BBB secret from server"
@@ -404,6 +431,105 @@ jobs:
 
           echo "[${{ matrix.slug }}] Recording hook + heal service + health dashboard synced successfully"
 
+      - name: Sync per-institute custom live-class domains
+        # Aliases resolve to the PRIMARY pool server only (BbbServerRouter.isPrimary),
+        # so there is nothing to do on any other server in the pool.
+        #
+        # `!cancelled()` deliberately decouples this from the recording-hook step:
+        # those are unrelated concerns, and a recording-pipeline problem should not
+        # leave an institute's live-class domain pointing at a dead IP. The job still
+        # reports failure if the earlier step failed.
+        if: "!cancelled() && steps.check.outputs.skip != 'true' && matrix.priority == 1"
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.BBB_SSH_PRIVATE_KEY }}
+          INTERNAL_SERVICE_TOKEN: ${{ secrets.INTERNAL_SERVICE_TOKEN }}
+          CF_TOKEN: ${{ secrets.BBB_CLOUDFLARE_API_TOKEN }}
+          VACADEMY_BACKEND_URL: ${{ vars.VACADEMY_BACKEND_URL }}
+        run: |
+          set -uo pipefail
+          # GitHub runs this step as `bash -e {0}`, so ANY failing command — a jq
+          # parse error, a transient curl — aborts before the explicit guards below
+          # can turn it into a warning. This step does its own error handling and
+          # decides deliberately what is fatal, so -e is turned off here.
+          set +e
+          IP="${{ steps.poweron.outputs.server_ip }}"
+          [ -z "$IP" ] && IP="${{ steps.create.outputs.server_ip }}"
+          BACKEND_URL="${VACADEMY_BACKEND_URL:-https://backend-stage.vacademy.io}"
+
+          mkdir -p ~/.ssh; echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa; chmod 600 ~/.ssh/id_rsa
+          SSH_OPTS="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=15"
+
+          # ── Fetch the configured hostnames from admin_core ──────────────
+          RESP=$(curl -s --max-time 30 -w '\n%{http_code}' \
+            -H "X-Internal-Service-Token: $INTERNAL_SERVICE_TOKEN" \
+            "$BACKEND_URL/admin-core-service/bbb/custom-domains" || true)
+          CODE=$(echo "$RESP" | tail -1)
+          BODY=$(echo "$RESP" | sed '$d')
+
+          if [ "$CODE" != "200" ]; then
+            # Deliberately a SKIP, not a failure and not an empty list. Running the
+            # installer with no aliases would reset server_name to canonical-only and
+            # take working institute domains offline just because the API blipped.
+            echo "::warning::Could not fetch custom domains (HTTP $CODE) — leaving the snapshot's existing domain config untouched."
+            exit 0
+          fi
+
+          DOMAINS=$(echo "$BODY" | jq -r '.domains[]?' | tr '\n' ' ')
+          echo "[${{ matrix.slug }}] custom domains: ${DOMAINS:-<none>}"
+
+          # ── Point each alias at this server's new IP ────────────────────
+          if [ -n "$DOMAINS" ]; then
+            ZONES=$(curl -s --max-time 30 -H "Authorization: Bearer $CF_TOKEN" \
+              "${{ env.CF_API }}/zones?per_page=50" | jq -c '[.result[] | {name, id}]')
+            for HOST in $DOMAINS; do
+              # Longest-suffix match, so sub.school.co.in picks school.co.in.
+              # `. as $z` matters: inside `$h | endswith(...)` the input is the
+              # STRING $h, so a bare .name there indexes a string and jq errors out,
+              # which would silently send every host down the warn-and-skip path.
+              ZONE_ID=$(echo "$ZONES" | jq -r --arg h "$HOST" \
+                '[.[] | . as $z | select(($h == $z.name) or ($h | endswith("." + $z.name)))]
+                 | sort_by(.name | length) | last | .id // empty')
+              if [ -z "$ZONE_ID" ]; then
+                echo "::warning::No Cloudflare zone for $HOST — skipping its DNS record."
+                continue
+              fi
+              REC=$(curl -s -H "Authorization: Bearer $CF_TOKEN" \
+                "${{ env.CF_API }}/zones/$ZONE_ID/dns_records?type=A&name=$HOST" | jq -r '.result[0].id // empty')
+              # proxied:false is required — WebRTC negotiates media against the real
+              # origin IP, which an orange-cloud record would hide.
+              DATA="{\"type\":\"A\",\"name\":\"$HOST\",\"content\":\"$IP\",\"ttl\":120,\"proxied\":false}"
+              if [ -n "$REC" ]; then
+                OK=$(curl -s -X PUT "${{ env.CF_API }}/zones/$ZONE_ID/dns_records/$REC" \
+                  -H "Authorization: Bearer $CF_TOKEN" -H "Content-Type: application/json" -d "$DATA" | jq -r '.success')
+              else
+                OK=$(curl -s -X POST "${{ env.CF_API }}/zones/$ZONE_ID/dns_records" \
+                  -H "Authorization: Bearer $CF_TOKEN" -H "Content-Type: application/json" -d "$DATA" | jq -r '.success')
+              fi
+              if [ "$OK" = "true" ]; then
+                echo "  $HOST -> $IP"
+              else
+                echo "::warning::DNS update failed for $HOST (Cloudflare success=${OK:-<no response>})"
+              fi
+            done
+          fi
+
+          # ── Refresh the DNS-01 credentials, then apply on the box ───────
+          printf 'dns_cloudflare_api_token = %s\n' "$CF_TOKEN" | \
+            ssh $SSH_OPTS root@$IP 'umask 077; cat > /etc/letsencrypt/cloudflare.ini && chmod 600 /etc/letsencrypt/cloudflare.ini' \
+            || echo "::warning::Could not refresh cloudflare.ini — certificate expansion may be skipped on the box."
+
+          if ! scp $SSH_OPTS bigbluebutton-server/install-custom-domains.sh root@$IP:/tmp/; then
+            echo "::error::Could not copy install-custom-domains.sh to $IP"
+            exit 1
+          fi
+          CSV=$(echo "$DOMAINS" | tr ' ' ',' | sed 's/,$//')
+          # This one IS fatal: nginx server_name and the certificate are what make
+          # the alias reachable at all, and the script rolls itself back on failure.
+          if ! ssh $SSH_OPTS root@$IP "bash /tmp/install-custom-domains.sh '${{ matrix.domain }}' '$CSV'"; then
+            echo "::error::install-custom-domains.sh failed on $IP — the canonical domain is unaffected, but institute domains may not be served."
+            exit 1
+          fi
+
       - name: Summary
         if: steps.check.outputs.skip != 'true'
         run: |

.github/workflows/build-zoe-appx.yml

@@ -1,6 +1,6 @@
-name: Build ZOE Edtech AppX (Microsoft Store)
+name: Build ZOE Online School AppX (Microsoft Store)
 
-# Builds the ZOE Edtech Windows Store package (.appx, x64 + ia32) on a Windows
+# Builds the ZOE Online School Windows Store package (.appx, x64 + ia32) on a Windows
 # runner and uploads it as a downloadable artifact. AppX packaging needs the
 # Windows SDK (makeappx), which only exists on Windows — hence windows-latest.
 #
@@ -71,7 +71,37 @@ jobs:
         run: |
           rm -rf electron/app
           cp -r dist electron/app
-          echo '{"flavor":"zoe"}' > electron/electron-flavor.json
+          # otaAppId must be the STORE bundle id — ota.ts falls back to
+          # app.getName() without it, which never matches an OTA target_app_ids.
+          echo '{"flavor":"zoe","otaAppId":"com.zoeedtech.app"}' > electron/electron-flavor.json
+          # Which web bundle is baked in. Without this ota.ts falls back to the
+          # ELECTRON package version (1.0.x), a different numbering space, so
+          # every OTA bundle looks newer and the fresh builtin bundle is
+          # immediately replaced by an older one on first launch.
+          node -p "require('./package.json').version" | tr -d '\n' > electron/app/ota-bundle-version.txt
+          cat electron/app/ota-bundle-version.txt
+
+      # electron/package.json is checked in with Shiksha Nation's identity and is
+      # rewritten per flavor at build time — build-windows-zoe.sh does this and CI
+      # used to skip it, so the ZOE package shipped as name "Shiksha_Nation".
+      # That is not cosmetic: on Windows app.getName() resolves to package.json
+      # productName ?? name, and userData is %APPDATA%\<that name> — so ZOE and
+      # Shiksha Nation shared one localStorage, cookie jar and OTA cache on any PC
+      # with both installed. Keep this identical to build-windows-zoe.sh.
+      - name: Patch package.json for ZOE
+        working-directory: frontend-learner-dashboard-app/electron
+        shell: bash
+        run: |
+          node -e "
+          const fs = require('fs');
+          const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+          pkg.name = 'ZOE_Online_School';
+          pkg.productName = 'ZOE Online School';
+          pkg.description = 'ZOE Global Online School — AI-Powered Learning Platform';
+          pkg.author = { name: 'ZOE Global Online School', email: 'support@zoeedtech.com' };
+          fs.writeFileSync('package.json', JSON.stringify(pkg, null, 2) + '\n');
+          "
+          node -p "'name=' + require('./package.json').name + ' productName=' + require('./package.json').productName + ' author=' + require('./package.json').author.name"
 
       - name: Install electron dependencies
         working-directory: frontend-learner-dashboard-app/electron
@@ -93,7 +123,7 @@ jobs:
       - name: Upload AppX artifacts
         uses: actions/upload-artifact@v4
         with:
-          name: zoe-edtech-appx
+          name: zoe-online-school-appx
           path: |
             frontend-learner-dashboard-app/electron/dist-store/*.appx
             frontend-learner-dashboard-app/electron/dist-store/*.appxbundle

.github/workflows/maven-publish-admin-core-service.yml

@@ -150,6 +150,7 @@ jobs:
             META_LOGIN_CONFIG_ENABLED=${{ secrets.META_LOGIN_CONFIG_ENABLED || 'false' }} \
             OAUTH_TOKEN_ENCRYPTION_KEY=${{ secrets.OAUTH_TOKEN_ENCRYPTION_KEY }} \
             AI_SERVICE_INTERNAL_TOKEN=${{ secrets.INTERNAL_SERVICE_TOKEN }} \
+            INTERNAL_SERVICE_TOKEN=${{ secrets.INTERNAL_SERVICE_TOKEN }} \
             YOUTUBE_OAUTH_CLIENT_ID=${{ secrets.ORG_YOUTUBE_OAUTH_CLIENT_ID }} \
             YOUTUBE_OAUTH_CLIENT_SECRET=${{ secrets.ORG_YOUTUBE_OAUTH_CLIENT_SECRET }} \
             YOUTUBE_OAUTH_REDIRECT_URI=${{ secrets.ORG_YOUTUBE_OAUTH_REDIRECT_URI }} \

.gitignore

@@ -159,3 +159,4 @@ vacademy_devops/hetzner/values-prod-hetzner.yaml
 
 # Local dev config per service (hardcoded secrets for terminal runs) — never commit
 **/src/main/resources/application-local.properties
+loadtest/answer-sheet.pdf

admin_core_service/src/main/java/vacademy/io/admin_core_service/core/config/ApplicationSecurityConfig.java

@@ -113,6 +113,12 @@ public class ApplicationSecurityConfig {
             "/admin-core-service/live-sessions/provider/meeting/recording/complete",
             // BBB server pool management (server-to-server from community_service, no JWT)
             "/admin-core-service/bbb/pool/**",
+            // BBB custom live-class domains, read by the pool start workflow.
+            // No JWT, but NOT unauthenticated: BbbCustomDomainController itself
+            // requires the shared X-Internal-Service-Token. Note the path must not
+            // contain the word "internal" — InternalAuthFilter substring-matches the
+            // URI and would demand clientName + Signature instead.
+            "/admin-core-service/bbb/custom-domains",
             // Zoom webhook callback (no JWT — verified by per-account HMAC signature)
             "/admin-core-service/live-sessions/provider/meeting/zoom-callback/**",
             // "Connect with Zoom" OAuth redirect (no JWT — CSRF-protected by the state record)

admin_core_service/src/main/java/vacademy/io/admin_core_service/core/crypto/EncryptedJsonMapConverter.java

@@ -0,0 +1,50 @@
+package vacademy.io.admin_core_service.core.crypto;
+
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import jakarta.persistence.AttributeConverter;
+import jakarta.persistence.Converter;
+import vacademy.io.common.exceptions.VacademyException;
+
+import java.util.Map;
+
+/**
+ * JPA converter storing a {@code Map<String,Object>} as an encrypted JSON TEXT
+ * column (used for hr_employee_profile.statutory_info, which V480 converted
+ * from jsonb to TEXT). Legacy rows holding plaintext JSON parse through
+ * unchanged and are encrypted on next write.
+ */
+@Converter
+public class EncryptedJsonMapConverter implements AttributeConverter<Map<String, Object>, String> {
+
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+    private static final TypeReference<Map<String, Object>> MAP_TYPE = new TypeReference<>() {};
+
+    @Override
+    public String convertToDatabaseColumn(Map<String, Object> attribute) {
+        if (attribute == null) {
+            return null;
+        }
+        try {
+            String json = MAPPER.writeValueAsString(attribute);
+            HrFieldCipher cipher = HrFieldCipher.instance();
+            return cipher != null ? cipher.encryptField(json) : json;
+        } catch (Exception e) {
+            throw new VacademyException("Failed to serialize statutory info: " + e.getMessage());
+        }
+    }
+
+    @Override
+    public Map<String, Object> convertToEntityAttribute(String dbData) {
+        if (dbData == null || dbData.isBlank()) {
+            return null;
+        }
+        try {
+            HrFieldCipher cipher = HrFieldCipher.instance();
+            String json = cipher != null ? cipher.decryptField(dbData) : dbData;
+            return MAPPER.readValue(json, MAP_TYPE);
+        } catch (Exception e) {
+            throw new VacademyException("Failed to read statutory info: " + e.getMessage());
+        }
+    }
+}

admin_core_service/src/main/java/vacademy/io/admin_core_service/core/crypto/EncryptedStringConverter.java

@@ -0,0 +1,26 @@
+package vacademy.io.admin_core_service.core.crypto;
+
+import jakarta.persistence.AttributeConverter;
+import jakarta.persistence.Converter;
+
+/**
+ * JPA converter encrypting a String column at rest via {@link HrFieldCipher}.
+ * Apply explicitly ({@code @Convert(converter = EncryptedStringConverter.class)})
+ * on PII fields — never autoApply. Legacy plaintext rows (no ENCv1: prefix)
+ * read through unchanged and are encrypted on next write.
+ */
+@Converter
+public class EncryptedStringConverter implements AttributeConverter<String, String> {
+
+    @Override
+    public String convertToDatabaseColumn(String attribute) {
+        HrFieldCipher cipher = HrFieldCipher.instance();
+        return cipher != null ? cipher.encryptField(attribute) : attribute;
+    }
+
+    @Override
+    public String convertToEntityAttribute(String dbData) {
+        HrFieldCipher cipher = HrFieldCipher.instance();
+        return cipher != null ? cipher.decryptField(dbData) : dbData;
+    }
+}