| <!DOCTYPE html> |
| <html> |
| <head> |
| <meta charset="utf-8"> |
| <title>REC Durgapur '88 Directory - Feature & User Guide</title> |
| <style> |
| @page { |
| size: A4; |
| margin: 2.5cm; |
| } |
| body { |
| font-family: 'DejaVu Sans', 'Helvetica Neue', Arial, sans-serif; |
| color: #2d3748; |
| line-height: 1.6; |
| font-size: 11pt; |
| } |
| h1 { |
| font-size: 22pt; |
| color: #1a365d; |
| text-align: center; |
| border-bottom: 3px solid #2b6cb0; |
| padding-bottom: 12px; |
| margin-top: 0; |
| margin-bottom: 30px; |
| } |
| h2 { |
| font-size: 15pt; |
| color: #2b6cb0; |
| margin-top: 30px; |
| margin-bottom: 12px; |
| border-bottom: 1px solid #e2e8f0; |
| padding-bottom: 6px; |
| } |
| h3 { |
| font-size: 12pt; |
| color: #4a5568; |
| margin-top: 20px; |
| margin-bottom: 8px; |
| font-weight: bold; |
| } |
| p { |
| margin-bottom: 12px; |
| text-align: justify; |
| } |
| ul { |
| margin-bottom: 15px; |
| padding-left: 20px; |
| } |
| li { |
| margin-bottom: 6px; |
| } |
| code { |
| font-family: 'DejaVu Sans Mono', Courier, monospace; |
| background-color: #f7fafc; |
| padding: 2px 5px; |
| border: 1px solid #e2e8f0; |
| border-radius: 3px; |
| font-size: 9.5pt; |
| } |
| pre { |
| background-color: #f7fafc; |
| padding: 12px; |
| border: 1px solid #e2e8f0; |
| border-radius: 6px; |
| margin-bottom: 15px; |
| } |
| pre code { |
| background-color: transparent; |
| padding: 0; |
| border: none; |
| font-size: 9pt; |
| } |
| .alert-box { |
| background-color: #ebf8ff; |
| border-left: 4px solid #3182ce; |
| padding: 12px 16px; |
| margin-top: 15px; |
| margin-bottom: 15px; |
| border-radius: 0 6px 6px 0; |
| } |
| .alert-box p { |
| margin: 0; |
| font-size: 10.5pt; |
| color: #2b6cb0; |
| } |
| .alert-box strong { |
| color: #2c5282; |
| } |
| .footer { |
| margin-top: 40px; |
| border-top: 1px solid #e2e8f0; |
| padding-top: 10px; |
| font-size: 9pt; |
| color: #718096; |
| text-align: center; |
| } |
| </style> |
| </head> |
| <body> |
|
|
| <h1>🎓 REC Durgapur '88 Directory — Feature & User Guide</h1> |
|
|
| <p>Welcome to the <strong>NIT Durgapur (formerly REC) Batch of 1988 Yearbook & Directory</strong>! This platform provides a secure, GDPR-compliant yearbook directory for alumni classmates.</p> |
|
|
| <p>This guide describes all yearbook features, local/Hugging Face Space integration, data synchronization procedures, and core security details.</p> |
|
|
| <h2>1. Access & Sign-In Guide</h2> |
|
|
| <h3>Secure Authentication</h3> |
| <p>The platform implements a strict <strong>Two-Factor Authentication (2FA)</strong> standard to safeguard all alumni profiles.</p> |
| <ul> |
| <li><strong>Login Credentials</strong>: Classmates can log in using either their unique <strong>6-digit ID</strong> (e.g., <code>123456</code>) or their registered <strong>Email Address</strong>.</li> |
| <li><strong>First-Time Sign-In</strong>: |
| <ul> |
| <li>If a classmate has not set a password, they will be automatically redirected to the <strong>Password Setup Screen</strong> to establish a secure password.</li> |
| <li>After setting a password, the system forces <strong>2FA Enrollment</strong> by presenting a custom QR code. Scan the QR code using any authenticator app (e.g., Google Authenticator, Microsoft Authenticator) and verify the 6-digit OTP code to complete registration.</li> |
| </ul> |
| </li> |
| <li><strong>Subsequent Sign-In</strong>: Enter your Username/Email and Password, solve the visual CAPTCHA, and then submit the 6-digit Time-Based One-Time Password (TOTP) from your authenticator app.</li> |
| </ul> |
|
|
| <h3>Visual Image CAPTCHA</h3> |
| <ul> |
| <li>To protect the system against automated bots and credential stuffing, a visual <strong>6-character image CAPTCHA</strong> is displayed on the login screen.</li> |
| <li>Every captcha contains a minimum of <strong>2 letters and 2 digits</strong>.</li> |
| <li>The captcha image is custom-rendered with cream-themed backgrounds, noise lines, and points to block OCR readers.</li> |
| <li>You can click the <strong>"Refresh CAPTCHA"</strong> button to load a new code if the current code is hard to read.</li> |
| </ul> |
|
|
| <h2>2. Directory Features & Profile Management</h2> |
|
|
| <p>Once logged in, standard alumni can view the yearbook directory and update their personal profile.</p> |
|
|
| <h3>The Batchmates Yearbook Directory</h3> |
| <ul> |
| <li>Click <strong>Batchmates</strong> in the menu navigation bar to browse alumni cards.</li> |
| <li><strong>Profile Cards</strong>: Displays classmate profiles containing contact details, organization, spouse name, children names, and photo collages. Use the left and right navigation arrows to scroll.</li> |
| <li><strong>Search Bar</strong>: Use the search bar to query classmate profiles instantly.</li> |
| <li><strong>Self-Profile Restricting</strong>: To satisfy strict data privacy rules, only <strong>your own</strong> profile card allows modifications. Other classmate profiles are read-only.</li> |
| </ul> |
|
|
| <h3>Profile Customization & Visual Layouts</h3> |
| <ul> |
| <li><strong>Photo Upload & Compression</strong>: |
| <ul> |
| <li>You can upload up to <strong>5 classmate photos</strong> and <strong>5 family photos</strong> (5+5 layout).</li> |
| <li>The backend automatically scales down and compresses uploaded photos to under <strong>100KB</strong> before storing them securely as encrypted binary blobs.</li> |
| <li>If more than 5 photos are uploaded, the system applies a <strong>FIFO (First-In, First-Out)</strong> rule, removing the oldest image to accommodate the new one.</li> |
| <li>Multiple photos are dynamically layered together in an <strong>overlapping collage visual</strong> on your profile card.</li> |
| </ul> |
| </li> |
| <li><strong>Phone Formatting & Country Codes</strong>: |
| <ul> |
| <li>A country code dropdown (showing numerical prefixes, e.g., <code>+91</code> default for India) is provided.</li> |
| <li>A custom Javascript formatter automatically adds a <strong>space after the 5th number</strong> in the input text box on-screen.</li> |
| </ul> |
| </li> |
| <li><strong>Retired Status</strong>: Next to the "Last Organization & Designation" text box on the same line, a <strong>Retired?</strong> checkbox is available to flag retirement.</li> |
| </ul> |
|
|
| <h2>3. Administrative Capabilities</h2> |
|
|
| <p>Users with administrative privileges (<code>is_admin = 1</code>) have access to the <strong>Admin Dashboard</strong>:</p> |
| <ul> |
| <li><strong>Account Management</strong>: View classmate user accounts, lock or unlock profiles, and reset passwords or 2FA credentials.</li> |
| <li><strong>Console Request Logger</strong>: werkzeug logs are suppressed in the console, while successful/failed sign-in attempts, profile changes, and sync events are logged for audit purposes.</li> |
| <li><strong>Security Audit Logs</strong>: The admin dashboard displays recent system log entries from the database, tracking IP addresses, actions, timestamps, and status details.</li> |
| </ul> |
|
|
| <h2>4. Advanced Security Hardening</h2> |
|
|
| <p>The application is hardened according to OWASP Top 10 web security standards:</p> |
| <ul> |
| <li><strong>5-Minute Authentication Timeout</strong>: A strict 5-minute timeout is enforced between the password verification step and the OTP/TOTP verification step. If the timeout expires, the temporary session is invalidated.</li> |
| <li><strong>Derived Session Secrets</strong>: Session keys are derived cryptographically from your private database encryption key on startup, avoiding hardcoded configuration values.</li> |
| <li><strong>Session Cookie Hardening</strong>: Includes <code>HttpOnly=True</code> (stops XSS-based cookie access), <code>SameSite='Lax'</code> (defends against CSRF), and <code>Secure=True</code> transport parameters in production.</li> |
| <li><strong>Brute-Force Account Lockout</strong>: If an account records <strong>5 failed login attempts</strong> (password or OTP) within a 15-minute window, the account is automatically locked (<code>active = 0</code>). The administrator must unlock it.</li> |
| <li><strong>HTTP Response Security Headers</strong>: Every page load automatically serves defense-in-depth headers: |
| <ul> |
| <li><code>Content-Security-Policy</code></li> |
| <li><code>X-Frame-Options: DENY</code> (Clickjacking defense)</li> |
| <li><code>X-Content-Type-Options: nosniff</code> (MIME-sniffing defense)</li> |
| <li><code>Referrer-Policy: strict-origin-when-cross-origin</code></li> |
| </ul> |
| </li> |
| <li><strong>File Permissions</strong>: SQLite databases and key files are locked down to owner-only read/write permissions (<code>chmod 600</code>) upon initialization.</li> |
| </ul> |
|
|
| <h2>5. Hugging Face Dataset & State Synchronization</h2> |
|
|
| <p>Because Hugging Face Space environments are ephemeral and restart regularly, all application state (databases, keys, and images) is replicated in a private Hugging Face Dataset repository: <code>Sam-max1/recdgp88_data</code>.</p> |
|
|
| <h3>Automated Restoration & Crash Suspension (Space Mode)</h3> |
| <ul> |
| <li>During startup on Hugging Face, the app automatically downloads the active databases and keys.</li> |
| <li><strong>Crash Prevention</strong>: If the app fails to connect or download files from the HF dataset, <strong>it will warn on the console and suspend execution indefinitely</strong> instead of initializing blank databases. This prevents data loss.</li> |
| </ul> |
|
|
| <h3>Command Line Sync Utility</h3> |
| <p>To sync databases between your local environment and the Hugging Face Dataset, use the sync script:</p> |
| <pre><code># 1. Sync local databases/keys to Hugging Face Dataset (Upload) |
| python3 recdgp88_hfdataset_sync.py -fw |
|
|
| # 2. Sync Hugging Face Dataset databases/keys to local machine (Download) |
| # (Automatically backs up existing local databases to recdgp88/backup/ first) |
| python3 recdgp88_hfdataset_sync.py -rev |
|
|
| # 3. Create a backup of local databases/keys |
| python3 recdgp88_hfdataset_sync.py -bkup |
|
|
| # 4. Restore local databases/keys from local backup directory |
| python3 recdgp88_hfdataset_sync.py -res</code></pre> |
|
|
| <div class="alert-box"> |
| <p><strong>Important Warning:</strong> To comply with security guidelines, the Excel classmate directory seed file (<code>REC_Durgapur_1988_Directory_V1.0_04Jun26.xlsx</code>) and raw databases <strong>MUST NOT</strong> be pushed to the Hugging Face Space repository. Database and key replication are handled strictly via the private Dataset repository.</p> |
| </div> |
|
|
| <div class="footer"> |
| REC Durgapur Batch of 1988 Yearbook Directory • Technical User Guide • A4 Document Format |
| </div> |
|
|
| </body> |
| </html> |
|
|
