v2.5.0 — Mira Rebrand, 3-Card Flexing Studio, PWA Web Push, 80 MCP Tools, Security & Memory Optimization

Release Mira (UBSI API) v2.5.0: evolusi penuh ke identitas Mira (mira.muaraai.com), desain Semi Pixel-Art dengan maskot Mura, Studio Flexing 3 Kartu Ber-Badge, Native PWA Web Push, 80 dual-namespace MCP tools, serta audit keamanan & optimasi memori menyeluruh.

Highlights

• Rebranding ke Mira & Semi Pixel-Art Design System:
  • Migrasi domain utama ke mira.muaraai.com (dengan redirect 308 dari ubsi-api.muaraai.com).
  • Antarmuka Semi Pixel-Art selaras muaraai.com, ilustrasi maskot Mura pada status/empty states, dan showcase 6 layanan digital kampus.
  • Dukungan dual-prefix Personal API Key (muara_mira_<40_hex> & muara_ubsi_<40_hex>).
• Studio Flexing Nilai (3 Kartu & Sistem Badge Unik di /dashboard/nilai):
  • Kartu KHS: Maskot mura-nilai.png, badge SUMMA CUM LAUDE / CUM LAUDE TRACK / SCHOLAR SOLID / RISING ESTUARY (PixelCrown), IPK, SKS, total mutu, dan top mata kuliah KHS.
  • Rincian Nilai Murni: Maskot mura-kuis.png, badge ALL-ROUNDER ACE / EXAM SLAYER / IRON ATTENDANCE / ACTIVE CONTENDER (PixelShield), dan 4-Component Pixel Gauge (ABSEN 20%, TUGAS 25%, UTS 25%, UAS 30%).
  • Nilai Tugas MyBest: Maskot mura-tugas-done.png, badge TASK GRANDMASTER / ZERO DEADLINE / PERFECT 100 CLUB / MYBEST GRINDER (PixelBolt), rasio ketuntasan tugas, dan rata-rata skor per matkul.
• Fitur Akademik, PDF Viewer & PWA Web Push:
  • Ujian Online BSI (ujiankampusa SSO): Endpoint /v1/elearning/exams & /v1/elearning/exams/{exam_type} (latihan, uts, uas, her, dll.) + MCP tools.
  • Native PWA Web Push (VAPID RFC 8291/8292): Notifikasi push langsung ke browser/perangkat tanpa layanan pihak ketiga, pengingat H-1 (19:00 & 21:00 WIB), pengingat kelas segera mulai, dan pengingat absen berulang.
  • In-App PDF Viewer & Ringkasan Otomatis: Pratinjau PDF materi & tugas dengan pinch-zoom, ringkasan otomatis, serta pemeriksa tautan tugas Google Drive (/v1/tools/link-check).
  • Statistik Realtime (/v1/stats): Perhitungan rata-rata harian berbasis hari aktif riil, counter all-time monotonik, dan auto-refresh dashboard setiap 60 detik.
• 80 Dual-Namespace MCP Tools (mira_* & ubsi_*):
  • 40 tool utama mira_* + 40 alias kompatibilitas ubsi_*, prompt instalasi sekali klik untuk AGENTS.md, CLAUDE.md, dan SOUL.md.
• Deep Security Hardening (F-01 s/d F-14):
  • Keyed BLAKE2b KDF & hashing untuk Personal API Keys, blokir kebocoran kredensial di URL query string, sanitasi formula CSV/HTML, validasi ketat origin WebPush & SSRF DNS rebinding, proteksi CSRF/Referer pada mutasi, dan pengamanan transport MCP (streamable-http & sse).
• Deep Memory & Resource Optimization (M-01 s/d M-12):
  • Pembatasan FileCache (12 MB/worker + active TTL eviction), shared SSLContext & connection limits pada SessionPool ($O(1)$ OrderedDict LRU), @functools.lru_cache untuk objek kripto (Fernet, AESGCM, VAPID), shared httpx.AsyncClient + stateless_http=True + deduplikasi skema Pydantic di MCP Server, serta tuning MALLOC_ARENA_MAX=2 di PM2.

Kompatibilitas

• REST prefix tetap /v1 (gateway: api.muaraai.com/v1/mira dan api.muaraai.com/v1/ubsi-api).
• Seluruh API key lama (muara_ubsi_...) dan nama tool MCP lama (ubsi_*) tetap didukung penuh.

Verifikasi

• Backend: 337 pytest tests (100% offline) lulus.
• Frontend: Next.js 15.5.28 production build (28 static/dynamic routes) lulus.
• Knowledge Graph: 2.348 nodes & 5.185 edges tersinkronisasi via graphify.

Kontributor

• Yuken Velino (@Curzyori) - Co-Founder & Lead Developer
• Verzio (@MyKineID) - Co-Founder & Core Contributor
• M Raffli Aldiansyah (@Seeyaa77) - Co-Founder & Core Contributor

Full Changelog: v2.0.0...v2.5.0

v2.0.0 — UBSI API Academic Command Center, 38-Tool MCP Server & Installable PWA

Release UBSI API v2.0.0: command center akademik, REST API, dan MCP Server untuk 6 layanan digital UBSI.

Highlights

• Dashboard Academic Command Center (Next.js 15): jadwal, tugas, presensi, bahan ajar, kuis, diskusi, nilai/KHS, KRS, kartu ujian, berita, OPAC, API keys, webhook notifikasi, dan sesi keamanan.
• REST API diperluas: StudentV2 (14 endpoint), MyBest Elearning (21 endpoint), layanan publik, stats, dan public API docs (/v1/docs).
• Universal MCP Server (38 tools, Streamable HTTP) untuk Claude Code, Cursor, Codex CLI, Hermes, dan AI agent lain.
• Multi-account notifications: webhook channels per mahasiswa, 7 kategori notifikasi, deduplikasi Redis, background workers, dan testing channel.
• Security: Personal API Key (muara_ubsi_...), session AES-256-GCM Redis, masking secret webhook/token, isolasi multi-tenant per-NIM, anti-SSRF, dan rate limiting.
• Installable PWA: manifest, safe maskable icons, service worker static-only (tanpa menyimpan data akademik), offline fallback, live GitHub star count.
• UI/UX: Fluid Currents Light, responsif 360px+, keyboard/Escape/focus states, dan DMCA/HKI page.
• Cleanup: penghapusan fastlogin legacy, dead fixtures, dan artefak desain lama.

Kompatibilitas

• REST prefix tetap /v1 (gateway: api.muaraai.com/v1/ubsi-api).
• Arsitektur auth berubah dari vault lama ke session + Personal API Key.

Verifikasi

• Backend: 181 pytest tests (100% offline) lulus.
• Frontend: Next.js 15 production build 25 routes lulus.
• Live: API v2.0.0 dan 38 MCP tools terverifikasi di gateway produksi.

Kontributor

• Yuken Velino (@Curzyori) - Lead Developer
• Verzio (@MyKineID) - Core Contributor
• M Raffli Aldiansyah (@Seeyaa77) - Core Contributor

Full Changelog: v1.1.7...v2.0.0

v1.1.7 — Dual-Mode Auth, Supabase Vault AES-256, API Gateway, Anti-SSRF & Proxy Pool

Release v1.1.7 — Dual-Mode Auth, Supabase Vault AES-256, API Gateway, Anti-SSRF & Proxy Pool

👥 Core Contributors

• Yuken Velino (@Curzyori) — Lead Developer & Creator
• M Raffli Aldiansyah (@Seeyaa77) — Core Contributor
• Verzio (@MyKineID) — Core Contributor

---

🚀 Key Highlights & Milestones

1. Dual-Mode Authentication & Multi-Tenancy Architecture

• Standalone / Self-Host Mode: Pengembang yang meng-clone repositori tetap dapat menjalankan backend secara offline dan lokal hanya bermodalkan 1 Master Key (API_KEY) di .env dengan unmetered rate limits tanpa dependensi database eksternal.
• Cloud Hosted Mode (Muara AI): Mendukung Member Key (muara_live_...) yang terikat pada kredensial mahasiswa terenkripsi kuat (AES-256-GCM) di Supabase Vault.
• Sub-millisecond Redis Caching: Kredensial vault di-cache in-memory di Redis (TTL 10 menit), memangkas latensi query DB mendekati 0 ms.
• 3-Tier Credential Resolution: Hirarki dependensi otomatis: Member Vault (request.state) > Manual Developer Headers (X-Elearning-NIM, X-Studentv2-NIM) > Local .env.

2. Unified API Gateway (api.muaraai.com/v1/ubsi-api/*)

• Rute resmi gateway live di server produksi Tencent Cloud VPS melalui reverse proxy Caddy dan Cloudflare DNS.
• Konfigurasi ROOT_PATH=/v1/ubsi-api otomatis menyesuaikan dokumentasi Swagger UI (/docs) dan skema OpenAPI tanpa path ganda.

3. Pre-Validation Endpoint (POST /v1/auth/verify)

• Endpoint verifikasi login real-time ke students.bsi.ac.id dan elearning.bsi.ac.id secara paralel sebelum kredensial disimpan ke dalam vault.
• Diproteksi khusus Master Key dan rate limit ketat 5 percobaan/menit per-NIM untuk mencegah brute-force dan melindungi IP server dari pemblokiran kampus.

4. Scraper Proxy Manager & Sticky Pool Rotation

• Mendukung format bare ip:port, ip:port:user:pass, user:pass@ip:port, dan protokol socks5://.
• Sticky Session per-NIM: Khusus modul SIAKAD & MyBest Elearning, proxy dialokasikan secara deterministik berbasis hash NIM agar sesi login mahasiswa tidak terputus (anti-session hijacking).
• Rotating Proxy: Modul publik (Berita, Perpus, Repo, Jurnal) otomatis merotasi proxy pool secara acak.

5. Keamanan & Hardening Menyeluruh (Anti-SSRF)

• Validasi URL webhook dengan memblokir alamat loopback (localhost, 127.0.0.1), link-local metadata cloud (169.254.169.254), dan subnet privat RFC 1918.
• Seluruh tabel Supabase diproteksi Row Level Security (RLS) dengan subquery (SELECT auth.uid()) dan view security_invoker = true (0 security lints).
• Master Key diverifikasi konstan waktu (secrets.compare_digest), dan file .env dikunci izin chmod 600.

6. Peningkatan Modul Elearning

• Auto-solver captcha SVG teks dinamis dengan fallback hitungan matematika.
• Rekapitulasi nilai tugas & kuis per pertemuan 1 s/d 16 (/v1/elearning/grades dan /courses/{id}/grades).
• ID kursus deterministik permanen berbasis {kode}:{hari}:{jam}:{ruang} dan dukungan query via kode matkul langsung (101, 104).

---

🧪 Testing & Verification

• 126 Unit & Integration Tests Passed (100% offline, 0 failures, 3.49s).
• TypeScript & Build Check: npx tsc --noEmit 0 errors, Next.js 15 compiled successfully.
• AST Hygiene: 0 unused imports, 0 dead functions.

---

📦 Commits & PRs Included

• PR #13: fix(elearning): support new SVG text captcha on login page
• PR #14: feat(elearning): add per-meeting grades recap endpoints
• PR #15: refactor(elearning): clean up JSON responses, fix kelompok_praktek bug, enrich presence headers, and aggregate assignments
• PR #16: feat(web): redesign landing page to light glassmorphism style
• PR #17: docs: remove auto-attendance write operations from public roadmap
• PR #18: docs(readme): compact contributors section into card layout
• PR #19: fix(elearning): make course id deterministic and allow querying grades by course code
• PR #20: fix(web): use 92EEFF ocean cyan, 3d glass cards, dark badge pill, and remove loader card
• PR #21: docs(readme): shorten Muhammad Raffli Aldiansyah to M Raffli Aldiansyah
• PR #22: chore: ignore /docs/superpowers directory and untrack spec/plan files
• PR #23: feat(web): add gh icon to star pill, darken 3d pyramid card, and add ubsi api info
• PR #24: feat(auth): add Dual-Mode authentication, Supabase AES-256 vault, and ROOT_PATH gateway
• PR #25: fix(security): prevent SSRF and restrict news webhook test endpoint to master key
• PR #26: fix(deps): support dynamic env overrides and mockable elearning pool client
• PR #27: docs: update Caddyfile template for api.muaraai.com gateway routing
• PR #28: feat(auth): add POST /v1/auth/verify credential pre-validation with per-NIM rate limiting
• PR #29: feat(proxy): add single proxy and rotating proxy pool with auto format normalization
• PR #30: refactor: remove dead code and eliminate unused imports across backend modules

Full Changelog: v1.1.5...v1.1.7

v1.1.5 — Landing Page, Students Domain Migration & Multi-Channel News Broadcaster

Ringkasan Rilis v1.1.5

Rilis v1.1.5 menghadirkan ekspansi besar pada ekosistem UBSI API: peluncuran resmi frontend landing page Next.js 15, migrasi upstream domain SIAKAD ke students.bsi.ac.id, fitur broadcast berita multi-channel (Discord, Telegram, Custom Webhook), penambahan tim inti, panduan operasional AI Agent (AGENT.md), dan peningkatan test suite menjadi 78 automated tests.

---

🌟 Fitur & Pembaruan Utama

1. 🌐 Landing Page Modern Next.js 15 (/web)

• Arsitektur Monorepo: Subfolder /web independen berbasis Next.js 15 App Router, React 19, Tailwind CSS, shadcn/ui, dan Anime.js.
• Live Production: Terhubung dengan domain resmi https://ubsi-api.muaraai.com (dan backup ubsi-api-web.vercel.app).
• Deep Water Theme: Palet warna Midnight Oceanic Navy (#0A1220) dengan aksen Teal (#2DD4BF).
• Zero External CDN: 100% font mandiri (.woff2) di web/public/fonts/ (Space Grotesk, Inter, JetBrains Mono).
• Interactive Code Showcase: Terminal interaktif dengan tab cURL, Python, TypeScript, dan response JSON 6 mata kuliah aktif MyBest Elearning.
• Dynamic OpenGraph: Pembuatan banner sosial 1200x630 dinamis via @vercel/og Edge runtime (/opengraph-image).
• Anti-Slop & Taste Quality Gate: Lolos audit ketat (zero em-dash, zero horizontal overflow 360px, drawer Escape listener, skip-to-content link, kontras WCAG AAA 15.86:1).

2. 📡 Migrasi Upstream SIAKAD ke students.bsi.ac.id

• Memperbarui upstream target dari domain lama studentv2.bsi.ac.id (yang kini me-return 302 redirect dan menghilangkan data form login) ke domain baru https://students.bsi.ac.id.
• Seluruh endpoint /v1/studentv2/* (Jadwal, Nilai, Berita, Pengumuman, Dashboard) kembali berfungsi normal dan terverifikasi 100%.

3. 📢 Multi-Channel News Broadcaster & Webhooks

• Background Worker: Pemantauan otomatis artikel baru di news.bsi.ac.id setiap 10 menit (NEWS_WEBHOOK_INTERVAL).
• Cold-Start Anti-Spam: Redis set ubsi:news:seen_ids (TTL 30 hari) mencegah banjir notifikasi saat server baru pertama kali dihidupkan.
• 3 Channel Pengiriman Sekaligus:
  • Discord Webhook (DISCORD_WEBHOOK_URL): Rich Embed warna Teal dengan banner cover, author, dan link artikel.
  • Telegram Bot API (TELEGRAM_BOT_TOKEN & TELEGRAM_CHAT_ID): Pesan berformat HTML (tersanitasi dari error parsing &, <, >) beserta foto artikel via sendPhoto.
  • Custom Webhook (NEWS_WEBHOOK_URL): Payload JSON terstandarisasi untuk bot WhatsApp Ciel atau sistem kustom.
• Endpoint Uji Coba: POST /v1/news/webhook/test?channel=all|discord|telegram|custom.

4. 👥 Tim Inti, Komunitas & Tata Kelola AI Agent

• Repositori resmi berstatus PUBLIC di bawah organisasi MuaraAI/UBSI-API.
• Profil kontributor inti di README & Web: Yuken Velino (@Curzyori), Verzio (@MyKineID), dan Muhammad Raffli Aldiansyah (@Seeyaa77).
• Berkas AGENT.md (dan symlink AGENTS.md) sebagai panduan etika, aturan isolasi credential, dan alur kontribusi wajib untuk AI Coding Agent.
• Peningkatan scripts/deploy.sh dengan aturan exclude rsync (web/, anti-slop/, graphify-out/).

5. 🧪 Kualitas & Pengujian Backend

• Test suite diperluas menjadi 78 automated tests (semuanya berjalan 100% offline terhadap fixture snapshot HTML kampus di tests/fixtures/).
• Waktu eksekusi pengujian super cepat (~2.8 detik).

v1.1.0 — Security, Remote Ingress & Architectural Refactor

What's Changed in v1.1.0

👥 Contributors in this Release

• Yuken Velino (@Curzyori) — Lead Developer & Creator
• Verzio (@MyKineID) — Contributor (PR #2, PR #3, PR #4)

---

🔀 Merged Pull Requests

• PR #2: feat: pool sesi per NIM dan endpoint dashboard paralel by @MyKineID in https://github.com/Curzyori/UBSI-API/pull/2
• PR #3: feat: elearning pool + native async, stale-while-revalidate, metrics by @MyKineID in https://github.com/Curzyori/UBSI-API/pull/3
• PR #4: refactor: helper cached_endpoint, hapus duplikasi 223 baris by @MyKineID in https://github.com/Curzyori/UBSI-API/pull/4

---

🔒 Security & Mandatory Authentication

• Mandatory X-API-Key: Full access protection across all private endpoints using constant-time comparison (secrets.compare_digest) to prevent timing attacks.
• Fail-Fast Startup: Server terminates boot with an informative error if API_KEY is not provided in production .env.
• Selective Health Probe Whitelist: /health remains accessible without keys for monitoring probes (Uptime Kuma, Caddy, Cloudflare, deploy script), with trailing-slash resilience (/health/).
• Strict File Permissions: Automated chmod 600 enforcement on .env files across deployment pipelines.

🌐 Dual-Path Remote Access & Reverse Proxy Support

• Dual Remote Ingress: Production-ready configuration templates provided for Caddy (automated Let's Encrypt HTTPS), Nginx, and Cloudflare Tunnel (cloudflared). See docs/remote-access.md.
• Real Client IP Rate Limiter: Multi-tier header resolution (CF-Connecting-IP -> X-Forwarded-For -> client host) validated against TRUSTED_PROXIES to ensure fair 60 req/min limits without IP collision.
• Integrated CORS Support: Fully configurable CORSMiddleware enabling modern browser-based web dashboards.

🧹 Architectural Refactoring & Unified SWR

• Generic Cached Endpoint Helper: Adopted cached_endpoint() across all 6 campus modules (studentv2, elearning, elibrary, news, repository, ejournal), eliminating over 300 lines of duplicated caching/locking boilerplate.
• Full Stale-While-Revalidate (SWR): Sub-35ms instant response times using Last-Known-Good offline cache while refreshing data in the background.
• Automated Session Cleanup: Background eviction task running every 5 minutes in lifespan to evict idle per-NIM scraper sessions and prevent memory leaks.
• Unified Awaitable Execution: Generic support for both native async coroutines and threadpool executors via inspect.isawaitable.

🧪 Test Suite & Quality

• Total 71 Automated Tests PASSED (100% Green, 0 Warnings).
• Full offline HTML fixtures and transparent autouse test harness.

---

Full Changelog (Diff & Compare): Curzyori/UBSI-API@v1.0.0...v1.1.0

v1.0.0 — Initial Production Release

UBSI API v1.0.0 — Initial Production Release

Rilis perdana resmi UBSI API (Unofficial REST API Aggregator untuk layanan kampus Universitas Bina Sarana Informatika).

✨ Fitur & Layanan Utama (6 Modul)

• StudentV2 (SIAKAD): Jadwal kuliah semester aktif, nilai murni lengkap, pengumuman internal PDF, dan arsip berita.
• MyBest LMS (Elearning): Kartu matkul, pemecah math captcha login otomatis, presensi hadir perkuliahan, tugas aktif & riwayat nilai/submission, berkas silabus/modul ZIP, dan kuis online.
• Elibrary (Perpustakaan): Pencarian katalog OPAC, detail metadata buku, dan ketersediaan stok fisik rak dengan 60s exponential retry.
• News Portal: Integrasi native WordPress REST API (news.bsi.ac.id/wp-json/wp/v2/posts?_embed=1) untuk artikel berita kampus.
• Repository: Publikasi penelitian dan tugas akhir mahasiswa di EPrints.
• EJournal: Katalog 16 jurnal ilmiah akademik resmi UBSI via jalur OAI bypass.

🛡️ Keamanan & Anti-Ban

• Localhost Security Boundary: Binds eksklusif ke 127.0.0.1:8300 (nol port terbuka ke publik).
• Two-Tier Redis Cache (DB 2): TTL berjenjang (Jadwal 2j, Nilai 30m, Tugas 10m) + Last-Known-Good offline fallback (stale: true).
• Single-Flight Mutex: Mencegah spamming paralel terhadap server kampus.
• Chrome TLS Impersonation: Menggunakan Scrapling & curl-cffi dengan fingerprint Chrome desktop asli.
• Rate Limiting: 60 req/menit via Redis sliding window counter.

📚 Dokumentasi & Legalitas

• Dokumentasi modular di folder docs/ (api.md, architecture.md, anti-ban.md, deploy.md).
• Berkas legal lengkap: SECURITY.md, DMCA.md, CONTRIBUTING.md, dan LICENSE (MIT).
• Author: Yuken Velino (@Curzyori) — NIM 15260767, Kelas 15.1C.30, Informatika, FTI UBSI Kampus Kota Pontianak.

🧪 Pengujian

• 46 unit & integration tests lulus 100% via Pytest.
• Live CLI Smoke Test lulus 7/7 checks.