Skip to content

Commit 6dc5f59

Browse files
jeffrey-corderojeffrey-cordero
committed
Final draft
1 parent 79b5e40 commit 6dc5f59

File tree

1 file changed

+31
-34
lines changed

1 file changed

+31
-34
lines changed

‎_docs/developer/rensselaer_center_for_open_source/2025_Jeffrey_Cordero.md‎

Lines changed: 31 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -3,40 +3,11 @@ title: Jeffrey Cordero
33
category: Developer > Rensselaer Center for Open Source (RCOS) > Summer 2025
44
---
55

6-
During my time this summer with Submitty, I contributed to the large-scale open-source academic platform, focusing on full-stack development, infrastructure modernization, and system security. This experience deepened my technical skills across frontend and backend technologies while expanding my understanding of systems design, type safety, and automated testing.
7-
8-
Beyond implementation work, I gained valuable experience in collaborative development by engaging in design discussions, reviewing code at scale, and helping shape practices that prioritize maintainability and reliability. These efforts strengthened my ability to think critically about long-term engineering impact in a complex, highly impactful codebase. The following sections highlight some of the most rewarding features I had the opportunity to work on this summer.
9-
10-
### WebSocket Security & Testing
11-
12-
I addressed a critical security flaw in the platform's WebSocket server by implementing a token-based authorization system ([#11634](https://github.com/Submitty/Submitty/pull/11634)). Previously, any user with a direct URL and valid login credentials could access any WebSocket page, posing a considerable risk for real-time student-instructor communications.
13-
14-
To resolve this, I designed a JSON Web Token (JWT)–based authorization layer, where the web server now generates short-lived, multi-use tokens scoped to specific pages. Each token ensures that WebSocket connections are established by authorized users, with permissions managed using a sliding window mechanism to handle expired pages. This approach cut the average WebSocket connection authentication time by approximately 90%.
15-
16-
```json
17-
{
18-
"iat": 1753797357.504631,
19-
"iss": "https://submitty.org/",
20-
"sub": "instructor",
21-
"authorized_pages": {
22-
"f25-sample-defaults": 1753800957,
23-
"f25-sample-chatrooms-1": 1753800957,
24-
"f25-sample-polls-3-instructor": 1753800912
25-
},
26-
"expire_time": 1753800957
27-
}
28-
```
29-
30-
In parallel, I introduced the first end-to-end test suite for WebSockets in the Discussion Forum ([#11873](https://github.com/Submitty/Submitty/pull/11873)). I expanded this with a comprehensive testing strategy that included PHP unit tests for backend logic and updates to Cypress tests to verify authorization-based WebSocket connections.
31-
32-
<div style="text-align: center; max-width: 100%; margin: auto;">
33-
<img src="../../../images/RCOS_report/2025_Jeffrey_Cordero/cypress-websocket-testing-example.png" alt="Cypress WebSocket Testing" />
34-
</div>
35-
6+
During my time with Submitty, I was a key contributor to the open-source academic platform, working on full-stack development, infrastructure modernization, and system security. My core contributions included enhancements to Notifications, Rainbow Grades, WebSockets, CI/CD improvements, and various bug fixes. I also participated extensively in pull request reviews across the entire tech stack, which deepened my experience with collaborative development, engaging in design discussions, reviewing code at scale, and promoting practices that emphasize maintainability and reliability. The following sections highlight some of the most interesting features I had the opportunity to build this summer.
367

378
### Notification System Enhancements
389

39-
To improve student communication, I implemented significant enhancements to the platform’s notification system, including automatically alerting students via in-platform notifications and email when grades are released ([#10358](https://github.com/Submitty/Submitty/pull/10358)) or when new assignments become available ([#11897](https://github.com/Submitty/Submitty/pull/11897)). These notifications are delivered by a reliable, hourly cron job that dispatches pending messages across all active courses.
10+
To improve student communication, I implemented significant enhancements to Submitty’s notification system. These included automatic in-platform and email alerts when grades are released ([#10358](https://github.com/Submitty/Submitty/pull/10358)) and when new assignments become available ([#11897](https://github.com/Submitty/Submitty/pull/11897)). A reliable hourly cron job now ensures the timely delivery of these messages across all active courses.
4011

4112
```
4213
[Submitty sample] Grade Released: Grading Homework PDF
@@ -51,24 +22,50 @@ Please refer to the course syllabus for contact information for your teaching st
5122
Update your email notification settings for this course here: http://localhost:1511/courses/s25/sample/notifications/settings
5223
```
5324

54-
To support these improvements, I also built dedicated Cypress test suites for email delivery ([#11878](https://github.com/Submitty/Submitty/pull/11878)) and user notification preferences ([#11913](https://github.com/Submitty/Submitty/pull/11913)). These tests validate key user flows, such as editing preferences and verifying delivery status, laying the groundwork for future testing around user communications.
25+
To support these improvements, I also built dedicated Cypress test suites for email delivery ([#11878](https://github.com/Submitty/Submitty/pull/11878)) and notification preferences ([#11913](https://github.com/Submitty/Submitty/pull/11913)). These tests lay the foundation for more robust future testing of the notification system.
5526

5627
<div style="text-align: center; max-width: 100%; margin: auto;">
5728
<img src="../../../images/RCOS_report/2025_Jeffrey_Cordero/cypress-notifications-testing-example.png" alt="Cypress Notification Testing" />
5829
</div>
5930

6031
### Rainbow Grades Nightly Build
6132

62-
Previously, the Rainbow Grades summary page could become outdated unless instructors manually triggered a rebuild. To streamline this process, I enhanced the nightly summary generation script to automatically update the instructor customization file and submit the build process before generating new summaries ([#11496](https://github.com/Submitty/Submitty/pull/11496)), ensuring students now have continuous access to the most up-to-date grade reports.
33+
Previously, the Rainbow Grades summary page could become outdated unless instructors manually triggered a rebuild. To streamline this process, I enhanced the nightly summary generation script to automatically trigger the build process before generating new summaries ([#11496](https://github.com/Submitty/Submitty/pull/11496)). As a result, students now have continuous access to up-to-date grade reports each day.
6334

6435
```bash
6536
$ python3 sbin/generate_grade_summaries.py f25 sample submitty_daemon
6637
Successfully selected the manual customization for f25.sample
6738
Successfully submitted the Rainbow Grades build process for f25.sample
68-
Successfully completed the Rainbow Grades build process for f25.sample - {'status': 'success', 'data': '...'}
39+
Successfully completed the Rainbow Grades build process for f25.sample
6940
Successfully generated grade summaries for f25.sample
7041
```
7142

7243
<div style="text-align: center; max-width: 100%; margin: auto;">
7344
<img src="../../../images/RCOS_report/2025_Jeffrey_Cordero/rainbow-grades-nightly-build.png" alt="Rainbow Grades Nightly Build" />
7445
</div>
46+
47+
### WebSocket Security & Testing
48+
49+
I addressed a critical security flaw in the platform's WebSocket server by implementing a token-based authorization system ([#11634](https://github.com/Submitty/Submitty/pull/11634)). Previously, any user with a direct URL and valid login credentials could access any WebSocket page, posing a considerable risk for real-time student-instructor communications.
50+
51+
To mitigate this, I designed a JSON Web Token (JWT)–based authorization layer. The web server now generates short-lived, multi-use tokens scoped to specific pages. These tokens ensure WebSocket connections are established only by authorized users with access managed through a sliding window mechanism that gracefully handles expired pages, reducing the average WebSocket authentication time by approximately 90%.
52+
53+
```json
54+
{
55+
"iat": 1753797357.504631,
56+
"iss": "https://submitty.org/",
57+
"sub": "instructor",
58+
"authorized_pages": {
59+
"f25-sample-defaults": 1753800957,
60+
"f25-sample-chatrooms-1": 1753800957,
61+
"f25-sample-polls-3-instructor": 1753800912
62+
},
63+
"expire_time": 1753800957
64+
}
65+
```
66+
67+
Alongside these changes, I introduced the platform’s first end-to-end WebSocket test suite in the Discussion Forum ([#11873](https://github.com/Submitty/Submitty/pull/11873)), which was part of a broader testing strategy including new PHP unit tests for backend logic and Cypress end-to-end tests to verify secure, token-based WebSocket connections.
68+
69+
<div style="text-align: center; max-width: 100%; margin: auto;">
70+
<img src="../../../images/RCOS_report/2025_Jeffrey_Cordero/cypress-websocket-testing-example.png" alt="Cypress WebSocket Testing" />
71+
</div>

0 commit comments

Comments
 (0)