From ea566d7c2d2ed92887634e29fdfb2ae660846242 Mon Sep 17 00:00:00 2001
From: HEKPYTO <zoonyanapat@gmail.com>
Date: Thu, 22 Oct 2026 03:45:46 +0700
Subject: [PATCH] fix: remove the unused markdown preview endpoint

The preview endpoint compiled the caller's markdown on the server, without
authentication and without a size limit. The MDX compile is CPU bound and
runs on the event loop of the server, so one large request stops every
route of the application from being served, and a large enough one
exhausts the Node heap and kills the process.

Nothing in the site uses it: the /render page is its only caller and no
page, test, script or workflow links to it, so the pair is removed instead
of being bounded. The markdown that the site does serve - task statements,
solutions and assessment instructions - is compiled by
src/lib/renderMarkdown.ts and is not affected.
---
 src/app/api/render/route.ts | 17 -----------
 src/app/render/page.tsx     | 58 -------------------------------------
 2 files changed, 75 deletions(-)
 delete mode 100644 src/app/api/render/route.ts
 delete mode 100644 src/app/render/page.tsx

diff --git a/src/app/api/render/route.ts b/src/app/api/render/route.ts
deleted file mode 100644
index 72e439550..000000000
--- a/src/app/api/render/route.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-import { NextRequest } from 'next/server'
-
-import { mdxToHtml } from '@/lib/renderMarkdown'
-import { badRequest, json } from '@/utils/apiResponse'
-
-export async function POST(req: NextRequest) {
-  const body = await req.json()
-
-  const { content } = body
-
-  if (!('content' in body) || typeof content !== 'string') {
-    return badRequest()
-  }
-
-  const mdxSource = await mdxToHtml(content)
-  return json(mdxSource)
-}
diff --git a/src/app/render/page.tsx b/src/app/render/page.tsx
deleted file mode 100644
index 764d00c7c..000000000
--- a/src/app/render/page.tsx
+++ /dev/null
@@ -1,58 +0,0 @@
-'use client'
-
-import { useState } from 'react'
-
-import { MDXRemote, MDXRemoteSerializeResult } from 'next-mdx-remote'
-
-import components from '@/components/common/MDXComponents'
-
-import 'katex/dist/katex.min.css'
-
-export default function Render() {
-  const [md, setMd] = useState('')
-  const [loading, setLoading] = useState(false)
-
-  const [rendered, setRendered] = useState<MDXRemoteSerializeResult>()
-
-  async function render() {
-    setLoading(true)
-    const res = await fetch('/api/render', {
-      method: 'POST',
-      body: JSON.stringify({ content: md })
-    })
-    setRendered(await res.json())
-    setLoading(false)
-  }
-
-  return (
-    <div className="flex w-screen flex-col items-center gap-4 py-4">
-      <div>
-        <button
-          className="trasition-colors mt-4 inline rounded-md bg-prog-primary-500 px-9 py-2.5 text-lg font-bold text-white hover:bg-prog-primary-600"
-          onClick={() => render()}
-          disabled={loading}
-        >
-          Render
-        </button>
-      </div>
-
-      <div className="flex w-screen items-start justify-between px-8">
-        <textarea
-          className="w-[45vw] rounded-md border border-black p-2"
-          cols={80}
-          rows={100}
-          value={md}
-          onChange={e => setMd(e.currentTarget.value)}
-        />
-
-        <article className="prose w-[45vw] max-w-none dark:prose-invert dark:prose-headings:text-white">
-          {loading ? (
-            <h1>Loading...</h1>
-          ) : (
-            rendered && <MDXRemote {...rendered} components={components} />
-          )}
-        </article>
-      </div>
-    </div>
-  )
-}