From 136be2d9370e9e6f06d2a71c2e87a24df171a327 Mon Sep 17 00:00:00 2001 From: Adriaan Jacquet Date: Sun, 23 Mar 2025 16:12:14 +0100 Subject: [PATCH 001/128] feat: tests voor backend/controllers/classes.ts geimplementeerd (FALEN NOG DOOR FOUTEN IN CODE) --- backend/tests/controllers/classes.test.ts | 149 ++++++++++++++++++++++ 1 file changed, 149 insertions(+) create mode 100644 backend/tests/controllers/classes.test.ts diff --git a/backend/tests/controllers/classes.test.ts b/backend/tests/controllers/classes.test.ts new file mode 100644 index 00000000..03952e53 --- /dev/null +++ b/backend/tests/controllers/classes.test.ts @@ -0,0 +1,149 @@ +import { setupTestApp } from '../setup-tests.js'; +import { describe, it, expect, beforeAll, beforeEach, vi, Mock } from 'vitest'; +import { createClassHandler, getClassHandler, getClassStudentsHandler, getTeacherInvitationsHandler } from '../../src/controllers/classes.js'; +import { Request, Response } from 'express'; +import { getClassTeacherInvitations } from '../../src/services/class.js'; + +async function fetchClass(id: string) { + const data = await fetch(`localhost:3000/class/${id}`); + return data; +} + +vi.mock('./getClass', () => ({ + getClass: vi.fn(), +})); + +describe('Class controllers', () => { + let req: Partial; + let res: Partial; + + let jsonMock: Mock; + let statusMock: Mock; + + beforeAll(async () => { + await setupTestApp(); + }); + + beforeEach(async () => { + jsonMock = vi.fn(); + statusMock = vi.fn().mockReturnThis(); + + res = { + json: jsonMock, + status: statusMock, + }; + }); + + it('should return 404 and error if class is not found', async () => { + req = { + params: { id: 'doesnotexist'}, + } + + await getClassHandler(req as Request, res as Response); + + expect(statusMock).toHaveBeenCalledWith(404); + expect(jsonMock).toHaveBeenCalledWith({ error: 'Class not found' }); + }); + + it('should return 200 if class is not found', async () => { + req = { + params: { id: 'id01'}, + } + + await getClassHandler(req as Request, res as Response); + + // status can either not be called or called with code 200 + expect( + statusMock.mock.calls.length === 0 || statusMock.mock.calls.some(([arg]) => arg === 200) + ).toBe(true); + }); + + it('should return 201 for creating a new class', async () => { + req = { + body: { displayName: 'coolenieuweklas' }, + }; + + await createClassHandler(req as Request, res as Response); + + expect(statusMock).toHaveBeenCalledWith(201); + // TODO: return json should be a classDTO and not named (fixed in #130) + //expect(jsonMock).toHaveBeenCalledWith(); + + // TODO: check if class is actually added to db + }); + it.todo('return json should be a classDTO and not named (fixed in #130)') + it.todo('check if class is actually added to db'); + + it('should return 400 for trying to create a class without name', async () => { + req = { + body: {}, + }; + + await createClassHandler(req as Request, res as Response); + + expect(statusMock).toHaveBeenCalledWith(400); + expect(jsonMock).toHaveBeenCalledWith({ error: 'Missing one or more required fields: displayName' }); + }); + + it('should return a list of students when calling getClassStudentsHandler', async () => { + req = { + params: { id: 'id01' }, + query: {}, + }; + + await getClassStudentsHandler(req as Request, res as Response); + + expect(jsonMock).toHaveBeenCalledWith({ students: [ + 'DireStraits', + 'Nirvana', + 'Noordkaap', + 'PinkFloyd', + 'SmashingPumpkins', + 'TheDoors', + 'Tool' + ]}); + }); + + it('should return 404 not found when calling getClassStudentsHandler on a non-existent class', async () => { + req = { + params: { id: 'doesnotexist' }, + query: {}, + }; + + await getClassStudentsHandler(req as Request, res as Response); + + // will fail until code is fixed + expect(statusMock).toHaveBeenCalledWith(404); + expect(jsonMock).toHaveBeenCalledWith({ error: 'Class not found' }); + }); + + it('should return 200 and a list of teacher-invitations', async () => { + req = { + params: { id: 'id01' }, + query: {}, + }; + + await getTeacherInvitationsHandler(req as Request, res as Response); + + expect(jsonMock).toHaveBeenCalledWith({"invitations": [ + { + "class": "id01", + "receiver": "LimpBizkit", + "sender": "FooFighters", + } + ]}); + }); + + it('should return 404 not found when calling teacher-invitations on a non-existent class', async () => { + req = { + params: { id: 'doesnotexist' }, + query: {}, + }; + + await getTeacherInvitationsHandler(req as Request, res as Response); + + // will fail until code is fixed + expect(statusMock).toHaveBeenCalledWith(404); + expect(jsonMock).toHaveBeenCalledWith({ error: 'Class not found' }); + }); +}) \ No newline at end of file From 9648f31cfdcff65f17d2a8d38cfbc630743d050b Mon Sep 17 00:00:00 2001 From: Adriaan Jacquet Date: Sun, 23 Mar 2025 18:55:08 +0100 Subject: [PATCH 002/128] feat: tests voor backend/controllers/groups.ts geimplementeerd (4 FAILS) --- backend/src/controllers/groups.ts | 9 +- backend/tests/controllers/classes.test.ts | 22 ++- backend/tests/controllers/group.test.ts | 157 ++++++++++++++++++++++ 3 files changed, 174 insertions(+), 14 deletions(-) create mode 100644 backend/tests/controllers/group.test.ts diff --git a/backend/src/controllers/groups.ts b/backend/src/controllers/groups.ts index b7bfd212..da1cde39 100644 --- a/backend/src/controllers/groups.ts +++ b/backend/src/controllers/groups.ts @@ -2,14 +2,7 @@ import { Request, Response } from 'express'; import { createGroup, getAllGroups, getGroup, getGroupSubmissions } from '../services/groups.js'; import { GroupDTO } from '../interfaces/group.js'; -// Typescript is annoywith with parameter forwarding from class.ts -interface GroupParams { - classid: string; - assignmentid: string; - groupid?: string; -} - -export async function getGroupHandler(req: Request, res: Response): Promise { +export async function getGroupHandler(req: Request, res: Response): Promise { const classId = req.params.classid; const full = req.query.full === 'true'; const assignmentId = +req.params.assignmentid; diff --git a/backend/tests/controllers/classes.test.ts b/backend/tests/controllers/classes.test.ts index 03952e53..b20abae5 100644 --- a/backend/tests/controllers/classes.test.ts +++ b/backend/tests/controllers/classes.test.ts @@ -1,18 +1,14 @@ import { setupTestApp } from '../setup-tests.js'; import { describe, it, expect, beforeAll, beforeEach, vi, Mock } from 'vitest'; -import { createClassHandler, getClassHandler, getClassStudentsHandler, getTeacherInvitationsHandler } from '../../src/controllers/classes.js'; +import { createClassHandler, getAllClassesHandler, getClassHandler, getClassStudentsHandler, getTeacherInvitationsHandler } from '../../src/controllers/classes.js'; import { Request, Response } from 'express'; -import { getClassTeacherInvitations } from '../../src/services/class.js'; +import { getAllClasses } from '../../src/services/class.js'; async function fetchClass(id: string) { const data = await fetch(`localhost:3000/class/${id}`); return data; } -vi.mock('./getClass', () => ({ - getClass: vi.fn(), -})); - describe('Class controllers', () => { let req: Partial; let res: Partial; @@ -146,4 +142,18 @@ describe('Class controllers', () => { expect(statusMock).toHaveBeenCalledWith(404); expect(jsonMock).toHaveBeenCalledWith({ error: 'Class not found' }); }); + + it('should return a list of classes', async () => { + req = { + query: {}, + }; + + await getAllClassesHandler(req as Request, res as Response); + + expect(jsonMock).toHaveBeenCalled(); + + const result = jsonMock.mock.lastCall![0]; + + expect("classes" in result).toBeTruthy(); + }) }) \ No newline at end of file diff --git a/backend/tests/controllers/group.test.ts b/backend/tests/controllers/group.test.ts new file mode 100644 index 00000000..6b4b95a4 --- /dev/null +++ b/backend/tests/controllers/group.test.ts @@ -0,0 +1,157 @@ +import { setupTestApp } from '../setup-tests.js'; +import { describe, it, expect, beforeAll, beforeEach, vi, Mock } from 'vitest'; +import { Request, Response } from 'express'; +import { createGroupHandler, getAllGroupsHandler, getGroupHandler, getGroupSubmissionsHandler } from '../../src/controllers/groups.js'; +import { G } from 'vitest/dist/chunks/reporters.66aFHiyX.js'; + +async function test404( + req: Partial> , + res: Partial, + handler: (req: Request, res: Response) => Promise, + expectedMessage: string +) { + await handler(req as Request, res as Response); + + expect(res.status).toHaveBeenCalledWith(404); + expect(res.json).toHaveBeenCalledWith({ error: expectedMessage }); +} + +function createRequestObject(classid: string, assignmentid: string, groupNumber: string) { + return { + params: { + classid: classid, + assignmentid: assignmentid, // should not exist + groupid: groupNumber, // should not exist + }, + query: {}, + }; +} + +describe('Group controllers', () => { + let req: Partial; + let res: Partial; + + let jsonMock: Mock; + let statusMock: Mock; + + beforeAll(async () => { + await setupTestApp(); + }); + + beforeEach(async () => { + jsonMock = vi.fn(); + statusMock = vi.fn().mockReturnThis(); + + res = { + json: jsonMock, + status: statusMock, + }; + }); + + it('should return 404 not found on a non-existing group', async () => { + req = { + params: { + classid: 'id01', + assignmentid: '1', + groupid: '42000', // should not exist + }, + query: {}, + }; + + await getGroupHandler(req as Request, res as Response); + + expect(statusMock).toHaveBeenCalledWith(404); + expect(jsonMock).toHaveBeenCalledWith({ error: 'Group not found' }); + }); + + it('should return 404 not found on a non-existing assignment', async () => { + req = { + params: { + classid: 'id01', + assignmentid: '1000', // should not exist + groupid: '42000', // should not exist + }, + query: {}, + }; + + await getGroupHandler(req as Request, res as Response); + + expect(statusMock).toHaveBeenCalledWith(404); + expect(jsonMock).toHaveBeenCalledWith({ error: 'Assignment not found' }); + }); + + it('should return 404 not found ont a non-existing class', async () => { + req = { + params: { + classid: 'doesnotexist', // should not exist + assignmentid: '1000', // should not exist + groupid: '42000', // should not exist + }, + query: {}, + }; + + await getGroupHandler(req as Request, res as Response); + + expect(statusMock).toHaveBeenCalledWith(404); + expect(jsonMock).toHaveBeenCalledWith({ error: 'Class not found' }); + }); + + it('should return an existing group', async () => { + req = createRequestObject('id01', '1', '1'); + + await getGroupHandler(req as Request, res as Response); + + expect(jsonMock).toHaveBeenCalledWith({ + assignment: 1, + groupNumber: 1, + members: [ 'DireStraits', 'Noordkaap' ] + }); + }); + + + it('should return a 201 when creating a group', async () => { + req = createRequestObject('id01', '1', 'irrelevant'); + req.body = { + members: [ + 'NoordKaap', + 'DireStraits', + ] + }; + + await createGroupHandler(req as Request, res as Response); + + expect(statusMock).toHaveBeenCalledWith(201); + expect(jsonMock).toHaveBeenCalled(); + + const result = jsonMock.mock.lastCall![0]; + + expect("assignment" in result).toBeTruthy(); + expect("groupNumber" in result).toBeTruthy(); + expect("members" in result).toBeTruthy(); + }); + + it('should return the submissions for a group', async () => { + req = createRequestObject('id01', '1', '1'); + + await getGroupSubmissionsHandler(req as Request, res as Response); + + expect(jsonMock).toHaveBeenCalled(); + + const result = jsonMock.mock.lastCall![0]; + + expect("submissions" in result).toBeTruthy(); + expect(typeof(result.submissions)).toBe(typeof([])); + }); + + it('should return a list of groups for an assignment', async () => { + req = createRequestObject('id01', '1', '1'); + + await getAllGroupsHandler(req as Request, res as Response); + + expect(jsonMock).toHaveBeenCalled(); + + const result = jsonMock.mock.lastCall![0]; + + expect("groups" in result).toBeTruthy(); + }); +}); From 58bfa9047441e81ce29457a5aec90aeec70863b7 Mon Sep 17 00:00:00 2001 From: Adriaan Jacquet Date: Sun, 23 Mar 2025 18:56:54 +0100 Subject: [PATCH 003/128] fix: overbodige comment verwijderd --- backend/tests/controllers/group.test.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/backend/tests/controllers/group.test.ts b/backend/tests/controllers/group.test.ts index 6b4b95a4..8cfbd0d3 100644 --- a/backend/tests/controllers/group.test.ts +++ b/backend/tests/controllers/group.test.ts @@ -20,8 +20,8 @@ function createRequestObject(classid: string, assignmentid: string, groupNumber: return { params: { classid: classid, - assignmentid: assignmentid, // should not exist - groupid: groupNumber, // should not exist + assignmentid: assignmentid, + groupid: groupNumber, }, query: {}, }; From dbe7807f4aff78f730668787f8ee235301b1968a Mon Sep 17 00:00:00 2001 From: Adriaan Jacquet Date: Sun, 23 Mar 2025 20:49:09 +0100 Subject: [PATCH 004/128] feat: testen voor assignment controller geimplementeerd --- backend/tests/controllers/assignments.test.ts | 96 +++++++++++++++++++ backend/tests/controllers/classes.test.ts | 7 +- backend/tests/controllers/group.test.ts | 13 --- 3 files changed, 97 insertions(+), 19 deletions(-) create mode 100644 backend/tests/controllers/assignments.test.ts diff --git a/backend/tests/controllers/assignments.test.ts b/backend/tests/controllers/assignments.test.ts new file mode 100644 index 00000000..bb9d80ed --- /dev/null +++ b/backend/tests/controllers/assignments.test.ts @@ -0,0 +1,96 @@ +import { setupTestApp } from '../setup-tests.js'; +import { describe, it, expect, beforeAll, beforeEach, vi, Mock } from 'vitest'; +import { Request, Response } from 'express'; +import { getAssignmentHandler, getAllAssignmentsHandler, getAssignmentsSubmissionsHandler } from '../../src/controllers/assignments.js'; + +function createRequestObject(classid: string, assignmentid: string) { + return { + params: { + classid: classid, + id: assignmentid, + }, + query: {}, + }; +} + +function checkReturnList(jsonMock: Mock, listName: string) { + expect(jsonMock).toHaveBeenCalled(); + + const result = jsonMock.mock.lastCall![0]; + + expect(listName in result).toBeTruthy(); +} + +function checkReturn404(jsonMock: Mock, statusMock: Mock) { + expect(statusMock).toHaveBeenCalledWith(404); + expect(jsonMock).toHaveBeenCalled(); +} + +describe('Assignment controllers', () => { + let req: Partial; + let res: Partial; + + let jsonMock: Mock; + let statusMock: Mock; + + beforeAll(async () => { + await setupTestApp(); + }); + + beforeEach(async () => { + jsonMock = vi.fn(); + statusMock = vi.fn().mockReturnThis(); + + res = { + json: jsonMock, + status: statusMock, + }; + }); + + it('should return a 404 when trying to find a non-existent assignment', async () => { + req = createRequestObject('id01', '43000'); // should not exist + + await getAssignmentHandler(req as Request, res as Response); + + checkReturn404(jsonMock, statusMock); + }); + + it('should return a 404 when trying to find an assignment on a non-existing class', async () => { + req = createRequestObject('doesnotexist', '1'); // should not exist + + await getAssignmentHandler(req as Request, res as Response); + + checkReturn404(jsonMock, statusMock); + }); + + it('should return an assignment', async () => { + req = createRequestObject('id01', '1'); + + await getAssignmentHandler(req as Request, res as Response); + + expect(jsonMock).toHaveBeenCalledWith({ + id: 1, + class: 'id01', + title: 'dire straits', + description: 'reading', + learningPath: 'id02', + language: 'en' + }); + }); + + it('should return a list of assignments', async () => { + req = createRequestObject('id01', 'irrelevant'); + + await getAllAssignmentsHandler(req as Request, res as Response); + + checkReturnList(jsonMock, "assignments"); + }); + + it('should return a list of submissions for an assignment', async () => { + req = createRequestObject('id01', '1'); + + await getAssignmentsSubmissionsHandler(req as Request, res as Response); + + checkReturnList(jsonMock, "submissions"); + }) +}) diff --git a/backend/tests/controllers/classes.test.ts b/backend/tests/controllers/classes.test.ts index b20abae5..f91c5e67 100644 --- a/backend/tests/controllers/classes.test.ts +++ b/backend/tests/controllers/classes.test.ts @@ -4,11 +4,6 @@ import { createClassHandler, getAllClassesHandler, getClassHandler, getClassStud import { Request, Response } from 'express'; import { getAllClasses } from '../../src/services/class.js'; -async function fetchClass(id: string) { - const data = await fetch(`localhost:3000/class/${id}`); - return data; -} - describe('Class controllers', () => { let req: Partial; let res: Partial; @@ -156,4 +151,4 @@ describe('Class controllers', () => { expect("classes" in result).toBeTruthy(); }) -}) \ No newline at end of file +}) diff --git a/backend/tests/controllers/group.test.ts b/backend/tests/controllers/group.test.ts index 8cfbd0d3..5d3b3542 100644 --- a/backend/tests/controllers/group.test.ts +++ b/backend/tests/controllers/group.test.ts @@ -2,19 +2,6 @@ import { setupTestApp } from '../setup-tests.js'; import { describe, it, expect, beforeAll, beforeEach, vi, Mock } from 'vitest'; import { Request, Response } from 'express'; import { createGroupHandler, getAllGroupsHandler, getGroupHandler, getGroupSubmissionsHandler } from '../../src/controllers/groups.js'; -import { G } from 'vitest/dist/chunks/reporters.66aFHiyX.js'; - -async function test404( - req: Partial> , - res: Partial, - handler: (req: Request, res: Response) => Promise, - expectedMessage: string -) { - await handler(req as Request, res as Response); - - expect(res.status).toHaveBeenCalledWith(404); - expect(res.json).toHaveBeenCalledWith({ error: expectedMessage }); -} function createRequestObject(classid: string, assignmentid: string, groupNumber: string) { return { From 19317868c725b04c3f74d9521b03a8d1638484bc Mon Sep 17 00:00:00 2001 From: Adriaan Jacquet Date: Sun, 23 Mar 2025 20:50:52 +0100 Subject: [PATCH 005/128] fix: assignmentParam type errors gefixt --- backend/src/controllers/assignments.ts | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/backend/src/controllers/assignments.ts b/backend/src/controllers/assignments.ts index 03332469..6aa9eefb 100644 --- a/backend/src/controllers/assignments.ts +++ b/backend/src/controllers/assignments.ts @@ -3,12 +3,7 @@ import { createAssignment, getAllAssignments, getAssignment, getAssignmentsSubmi import { AssignmentDTO } from '../interfaces/assignment.js'; // Typescript is annoy with with parameter forwarding from class.ts -interface AssignmentParams { - classid: string; - id: string; -} - -export async function getAllAssignmentsHandler(req: Request, res: Response): Promise { +export async function getAllAssignmentsHandler(req: Request, res: Response): Promise { const classid = req.params.classid; const full = req.query.full === 'true'; @@ -19,7 +14,7 @@ export async function getAllAssignmentsHandler(req: Request, r }); } -export async function createAssignmentHandler(req: Request, res: Response): Promise { +export async function createAssignmentHandler(req: Request, res: Response): Promise { const classid = req.params.classid; const assignmentData = req.body as AssignmentDTO; @@ -40,7 +35,7 @@ export async function createAssignmentHandler(req: Request, re res.status(201).json({ assignment: assignment }); } -export async function getAssignmentHandler(req: Request, res: Response): Promise { +export async function getAssignmentHandler(req: Request, res: Response): Promise { const id = +req.params.id; const classid = req.params.classid; @@ -59,7 +54,7 @@ export async function getAssignmentHandler(req: Request, res: res.json(assignment); } -export async function getAssignmentsSubmissionsHandler(req: Request, res: Response): Promise { +export async function getAssignmentsSubmissionsHandler(req: Request, res: Response): Promise { const classid = req.params.classid; const assignmentNumber = +req.params.id; From ef8bc71018e250b20858a7cdb128ee2a338d4214 Mon Sep 17 00:00:00 2001 From: Adriaan Jacquet Date: Sat, 29 Mar 2025 20:32:39 +0100 Subject: [PATCH 006/128] fix: bestandsnaam groups.test.ts consistent gemaakt --- backend/tests/controllers/{group.test.ts => groups.test.ts} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename backend/tests/controllers/{group.test.ts => groups.test.ts} (100%) diff --git a/backend/tests/controllers/group.test.ts b/backend/tests/controllers/groups.test.ts similarity index 100% rename from backend/tests/controllers/group.test.ts rename to backend/tests/controllers/groups.test.ts From c9739a14205055344a0ef8081e89490c9cf61d12 Mon Sep 17 00:00:00 2001 From: Adriaan Jacquet Date: Sat, 29 Mar 2025 21:10:04 +0100 Subject: [PATCH 007/128] feat: qol functies toegevoegd, tests voor submissions aan het schrijven --- backend/tests/controllers/qol.ts | 12 ++++ backend/tests/controllers/submissions.test.ts | 72 +++++++++++++++++++ 2 files changed, 84 insertions(+) create mode 100644 backend/tests/controllers/qol.ts create mode 100644 backend/tests/controllers/submissions.test.ts diff --git a/backend/tests/controllers/qol.ts b/backend/tests/controllers/qol.ts new file mode 100644 index 00000000..984b7c58 --- /dev/null +++ b/backend/tests/controllers/qol.ts @@ -0,0 +1,12 @@ +export function checkReturnList(jsonMock: Mock, listName: string) { + expect(jsonMock).toHaveBeenCalled(); + + const result = jsonMock.mock.lastCall![0]; + + expect(listName in result).toBeTruthy(); +} + +export function checkReturn404(jsonMock: Mock, statusMock: Mock) { + expect(statusMock).toHaveBeenCalledWith(404); + expect(jsonMock).toHaveBeenCalled(); +} diff --git a/backend/tests/controllers/submissions.test.ts b/backend/tests/controllers/submissions.test.ts new file mode 100644 index 00000000..442f81c5 --- /dev/null +++ b/backend/tests/controllers/submissions.test.ts @@ -0,0 +1,72 @@ +import { setupTestApp } from '../setup-tests.js'; +import { describe, it, expect, beforeAll, beforeEach, vi, Mock } from 'vitest'; +import { getSubmissionHandler } from '../../src/controllers/submissions.js'; +import { Request, Response } from 'express'; +import { checkReturn404, checkReturnList } from './qol.js'; + + +function createRequestObject(hruid: string, submissionNumber: string) { + return { + params: { + hruid: hruid, + id: submissionNumber, + }, + query: { + language: 'nl', + version: '1', + }, + } +} + +describe('Submission controllers', () => { + let req: Partial; + let res: Partial; + + let jsonMock: Mock; + let statusMock: Mock; + + beforeAll(async () => { + await setupTestApp(); + }); + + beforeEach(async () => { + jsonMock = vi.fn(); + statusMock = vi.fn().mockReturnThis(); + + res = { + json: jsonMock, + status: statusMock, + }; + }); + + it('should return a 404 and error if submission is not found', async () => { + req = createRequestObject('id01', '1000000'); + + await getSubmissionHandler(req as Request, res as Response); + + checkReturn404(jsonMock, statusMock); + }); + + it('should return a 404 and error if learningobject is not found', async () => { + req = createRequestObject('doesnotexist', '1000000'); + + await getSubmissionHandler(req as Request, res as Response); + + checkReturn404(jsonMock, statusMock); + }); + + it('should return an existing submission', async () => { + req = createRequestObject('id01', '1'); + + await getSubmissionHandler(req as Request, res as Response); + + console.log(jsonMock.mock.lastCall![0]); + // TODO + }); + + it('should return a list of submissions for a learning object', async () => { + req = createRequestObject('id01', 'irrelevant'); + + }); +}); + From f0eb4822d928b8ab1f140d1c63977045193b9c19 Mon Sep 17 00:00:00 2001 From: Adriaan Jacquet Date: Sat, 29 Mar 2025 21:10:57 +0100 Subject: [PATCH 008/128] feat: getallsubmissions endpoint toegevoegd --- backend/src/controllers/submissions.ts | 21 ++++++++++++------- .../data/assignments/submission-repository.ts | 8 +++++++ backend/src/services/submissions.ts | 13 ++++++++++++ backend/tests/controllers/assignments.test.ts | 14 +------------ 4 files changed, 36 insertions(+), 20 deletions(-) diff --git a/backend/src/controllers/submissions.ts b/backend/src/controllers/submissions.ts index 1e66dbe9..ee5841d2 100644 --- a/backend/src/controllers/submissions.ts +++ b/backend/src/controllers/submissions.ts @@ -1,14 +1,9 @@ import { Request, Response } from 'express'; -import { createSubmission, deleteSubmission, getSubmission } from '../services/submissions.js'; +import { createSubmission, deleteSubmission, getAllSubmissions, getSubmission } from '../services/submissions.js'; import { Language, languageMap } from '../entities/content/language.js'; import { SubmissionDTO } from '../interfaces/submission'; -interface SubmissionParams { - hruid: string; - id: number; -} - -export async function getSubmissionHandler(req: Request, res: Response): Promise { +export async function getSubmissionHandler(req: Request, res: Response): Promise { const lohruid = req.params.hruid; const submissionNumber = +req.params.id; @@ -17,6 +12,7 @@ export async function getSubmissionHandler(req: Request, res: return; } + const lang = languageMap[req.query.language as string] || Language.Dutch; const version = (req.query.version || 1) as number; @@ -30,6 +26,17 @@ export async function getSubmissionHandler(req: Request, res: res.json(submission); } +export async function getAllSubmissionsHandler(req: Request, res: Response): Promise { + const lohruid = req.params.hruid; + + const lang = languageMap[req.query.language as string] || Language.Dutch; + const version = (req.query.version || 1) as number; + + const submissions = await getAllSubmissions(lohruid, lang, version); + + res.json({ submissions: submissions }); +} + export async function createSubmissionHandler(req: Request, res: Response) { const submissionDTO = req.body as SubmissionDTO; diff --git a/backend/src/data/assignments/submission-repository.ts b/backend/src/data/assignments/submission-repository.ts index 251823fa..e7b51e13 100644 --- a/backend/src/data/assignments/submission-repository.ts +++ b/backend/src/data/assignments/submission-repository.ts @@ -14,6 +14,14 @@ export class SubmissionRepository extends DwengoEntityRepository { }); } + public findSubmissionsByLearningObject(loId: LearningObjectIdentifier): Promise { + return this.find({ + learningObjectHruid: loId.hruid, + learningObjectLanguage: loId.language, + learningObjectVersion: loId.version, + }) + } + public findMostRecentSubmissionForStudent(loId: LearningObjectIdentifier, submitter: Student): Promise { return this.findOne( { diff --git a/backend/src/services/submissions.ts b/backend/src/services/submissions.ts index a8fa96c7..a0863375 100644 --- a/backend/src/services/submissions.ts +++ b/backend/src/services/submissions.ts @@ -21,6 +21,19 @@ export async function getSubmission( return mapToSubmissionDTO(submission); } +export async function getAllSubmissions( + lohruid: string, + language: Language, + version: number, +): Promise { + const loId = new LearningObjectIdentifier(lohruid, language, version); + + const submissionRepository = getSubmissionRepository(); + const submissions = await submissionRepository.findSubmissionsByLearningObject(loId); + + return submissions.map(mapToSubmissionDTO); +} + export async function createSubmission(submissionDTO: SubmissionDTO) { const submissionRepository = getSubmissionRepository(); const submission = mapToSubmission(submissionDTO); diff --git a/backend/tests/controllers/assignments.test.ts b/backend/tests/controllers/assignments.test.ts index bb9d80ed..38e73e17 100644 --- a/backend/tests/controllers/assignments.test.ts +++ b/backend/tests/controllers/assignments.test.ts @@ -2,6 +2,7 @@ import { setupTestApp } from '../setup-tests.js'; import { describe, it, expect, beforeAll, beforeEach, vi, Mock } from 'vitest'; import { Request, Response } from 'express'; import { getAssignmentHandler, getAllAssignmentsHandler, getAssignmentsSubmissionsHandler } from '../../src/controllers/assignments.js'; +import { checkReturn404, checkReturnList } from './qol.js' function createRequestObject(classid: string, assignmentid: string) { return { @@ -13,19 +14,6 @@ function createRequestObject(classid: string, assignmentid: string) { }; } -function checkReturnList(jsonMock: Mock, listName: string) { - expect(jsonMock).toHaveBeenCalled(); - - const result = jsonMock.mock.lastCall![0]; - - expect(listName in result).toBeTruthy(); -} - -function checkReturn404(jsonMock: Mock, statusMock: Mock) { - expect(statusMock).toHaveBeenCalledWith(404); - expect(jsonMock).toHaveBeenCalled(); -} - describe('Assignment controllers', () => { let req: Partial; let res: Partial; From 7a443c06868b3d03443e5c30470a4abf86c5d214 Mon Sep 17 00:00:00 2001 From: Adriaan Jacquet Date: Sat, 29 Mar 2025 21:56:56 +0100 Subject: [PATCH 009/128] feat: testen voor submissions geimplementeerd --- .../data/assignments/submission-repository.ts | 15 +++++++++------ backend/tests/controllers/qol.ts | 10 +++++++--- backend/tests/controllers/submissions.test.ts | 16 +++++++++++----- 3 files changed, 27 insertions(+), 14 deletions(-) diff --git a/backend/src/data/assignments/submission-repository.ts b/backend/src/data/assignments/submission-repository.ts index e7b51e13..96f196f6 100644 --- a/backend/src/data/assignments/submission-repository.ts +++ b/backend/src/data/assignments/submission-repository.ts @@ -6,12 +6,15 @@ import { Student } from '../../entities/users/student.entity.js'; export class SubmissionRepository extends DwengoEntityRepository { public findSubmissionByLearningObjectAndSubmissionNumber(loId: LearningObjectIdentifier, submissionNumber: number): Promise { - return this.findOne({ - learningObjectHruid: loId.hruid, - learningObjectLanguage: loId.language, - learningObjectVersion: loId.version, - submissionNumber: submissionNumber, - }); + return this.findOne( + { + learningObjectHruid: loId.hruid, + learningObjectLanguage: loId.language, + learningObjectVersion: loId.version, + submissionNumber: submissionNumber, + }, + { populate: ['submitter', 'onBehalfOf'] }, + ); } public findSubmissionsByLearningObject(loId: LearningObjectIdentifier): Promise { diff --git a/backend/tests/controllers/qol.ts b/backend/tests/controllers/qol.ts index 984b7c58..08f73f79 100644 --- a/backend/tests/controllers/qol.ts +++ b/backend/tests/controllers/qol.ts @@ -1,12 +1,16 @@ -export function checkReturnList(jsonMock: Mock, listName: string) { +export function checkReturnList(jsonMock: Mock, listName: string, length?: number) { expect(jsonMock).toHaveBeenCalled(); const result = jsonMock.mock.lastCall![0]; expect(listName in result).toBeTruthy(); + + if (length) { + expect(result[listName].length).toBe(length); + } } export function checkReturn404(jsonMock: Mock, statusMock: Mock) { - expect(statusMock).toHaveBeenCalledWith(404); - expect(jsonMock).toHaveBeenCalled(); + expect(statusMock).toHaveBeenCalledWith(404); + expect(jsonMock).toHaveBeenCalled(); } diff --git a/backend/tests/controllers/submissions.test.ts b/backend/tests/controllers/submissions.test.ts index 442f81c5..20e69847 100644 --- a/backend/tests/controllers/submissions.test.ts +++ b/backend/tests/controllers/submissions.test.ts @@ -1,8 +1,10 @@ import { setupTestApp } from '../setup-tests.js'; import { describe, it, expect, beforeAll, beforeEach, vi, Mock } from 'vitest'; -import { getSubmissionHandler } from '../../src/controllers/submissions.js'; +import { getSubmissionHandler, getAllSubmissionsHandler } from '../../src/controllers/submissions.js'; import { Request, Response } from 'express'; import { checkReturn404, checkReturnList } from './qol.js'; +import { getSubmission } from '../../src/services/submissions.js'; +import { Language } from '../../src/entities/content/language.js'; function createRequestObject(hruid: string, submissionNumber: string) { @@ -12,7 +14,7 @@ function createRequestObject(hruid: string, submissionNumber: string) { id: submissionNumber, }, query: { - language: 'nl', + language: 'en', version: '1', }, } @@ -60,13 +62,17 @@ describe('Submission controllers', () => { await getSubmissionHandler(req as Request, res as Response); - console.log(jsonMock.mock.lastCall![0]); - // TODO + const expectedResult = await getSubmission('id01', Language.English, 1, 1); + + expect(jsonMock.mock.lastCall![0]).toStrictEqual(expectedResult); }); it('should return a list of submissions for a learning object', async () => { - req = createRequestObject('id01', 'irrelevant'); + req = createRequestObject('id02', 'irrelevant'); + await getAllSubmissionsHandler(req as Request, res as Response); + + checkReturnList(jsonMock, 'submissions', 2); }); }); From 943dd04e977714c7ef8560240d789986aff958f6 Mon Sep 17 00:00:00 2001 From: Adriaan Jacquet Date: Sat, 29 Mar 2025 22:28:52 +0100 Subject: [PATCH 010/128] fix: gefaalde testen voor class controller gefixt --- backend/src/controllers/classes.ts | 14 ++++++++-- backend/src/data/users/student-repository.ts | 4 +++ backend/src/services/class.ts | 27 ++++++++++---------- backend/tests/controllers/classes.test.ts | 17 +++--------- 4 files changed, 33 insertions(+), 29 deletions(-) diff --git a/backend/src/controllers/classes.ts b/backend/src/controllers/classes.ts index ca2f5698..65548cf5 100644 --- a/backend/src/controllers/classes.ts +++ b/backend/src/controllers/classes.ts @@ -1,5 +1,5 @@ import { Request, Response } from 'express'; -import { createClass, getAllClasses, getClass, getClassStudents, getClassStudentsIds, getClassTeacherInvitations } from '../services/class.js'; +import { createClass, getAllClasses, getClass, getClassStudents, getClassTeacherInvitations } from '../services/class.js'; import { ClassDTO } from '../interfaces/class.js'; export async function getAllClassesHandler(req: Request, res: Response): Promise { @@ -58,7 +58,12 @@ export async function getClassStudentsHandler(req: Request, res: Response): Prom const classId = req.params.id; const full = req.query.full === 'true'; - const students = full ? await getClassStudents(classId) : await getClassStudentsIds(classId); + const students = await getClassStudents(classId, full); + + if (!students) { + res.status(404).json({ error: 'Class not found' }); + return; + } res.json({ students: students, @@ -71,6 +76,11 @@ export async function getTeacherInvitationsHandler(req: Request, res: Response): const invitations = await getClassTeacherInvitations(classId, full); + if (!invitations) { + res.status(404).json({ error: 'Class not found' }); + return; + } + res.json({ invitations: invitations, }); diff --git a/backend/src/data/users/student-repository.ts b/backend/src/data/users/student-repository.ts index 0792678d..f35fd153 100644 --- a/backend/src/data/users/student-repository.ts +++ b/backend/src/data/users/student-repository.ts @@ -1,3 +1,4 @@ +import { Class } from '../../entities/classes/class.entity.js'; import { Student } from '../../entities/users/student.entity.js'; import { User } from '../../entities/users/user.entity.js'; import { DwengoEntityRepository } from '../dwengo-entity-repository.js'; @@ -9,6 +10,9 @@ export class StudentRepository extends DwengoEntityRepository { public findByUsername(username: string): Promise { return this.findOne({ username: username }); } + public findByClass(cls: Class): Promise { + return this.find({ classes: cls }); + } public deleteByUsername(username: string): Promise { return this.deleteWhere({ username: username }); } diff --git a/backend/src/services/class.ts b/backend/src/services/class.ts index 9f6e1efe..bc2984fc 100644 --- a/backend/src/services/class.ts +++ b/backend/src/services/class.ts @@ -4,6 +4,7 @@ import { ClassDTO, mapToClassDTO } from '../interfaces/class.js'; import { mapToStudentDTO, StudentDTO } from '../interfaces/student.js'; import { mapToTeacherInvitationDTO, mapToTeacherInvitationDTOIds, TeacherInvitationDTO } from '../interfaces/teacher-invitation.js'; import { getLogger } from '../logging/initalize.js'; +import { getStudent } from './students.js'; const logger = getLogger(); @@ -60,32 +61,30 @@ export async function getClass(classId: string): Promise { return mapToClassDTO(cls); } -async function fetchClassStudents(classId: string): Promise { +export async function getClassStudents(classId: string, full: boolean): Promise { const classRepository = getClassRepository(); const cls = await classRepository.findById(classId); if (!cls) { - return []; + return null; } - return cls.students.map(mapToStudentDTO); + const studentRepository = getStudentRepository(); + const students = await studentRepository.findByClass(cls); + + if (full) { + return cls.students.map(mapToStudentDTO); + } + + return students.map((student) => student.username); } -export async function getClassStudents(classId: string): Promise { - return await fetchClassStudents(classId); -} - -export async function getClassStudentsIds(classId: string): Promise { - const students: StudentDTO[] = await fetchClassStudents(classId); - return students.map((student) => student.username); -} - -export async function getClassTeacherInvitations(classId: string, full: boolean): Promise { +export async function getClassTeacherInvitations(classId: string, full: boolean): Promise { const classRepository = getClassRepository(); const cls = await classRepository.findById(classId); if (!cls) { - return []; + return null; } const teacherInvitationRepository = getTeacherInvitationRepository(); diff --git a/backend/tests/controllers/classes.test.ts b/backend/tests/controllers/classes.test.ts index f91c5e67..a5a27a5e 100644 --- a/backend/tests/controllers/classes.test.ts +++ b/backend/tests/controllers/classes.test.ts @@ -3,6 +3,7 @@ import { describe, it, expect, beforeAll, beforeEach, vi, Mock } from 'vitest'; import { createClassHandler, getAllClassesHandler, getClassHandler, getClassStudentsHandler, getTeacherInvitationsHandler } from '../../src/controllers/classes.js'; import { Request, Response } from 'express'; import { getAllClasses } from '../../src/services/class.js'; +import { checkReturnList, checkReturn404 } from './qol.js'; describe('Class controllers', () => { let req: Partial; @@ -84,15 +85,7 @@ describe('Class controllers', () => { await getClassStudentsHandler(req as Request, res as Response); - expect(jsonMock).toHaveBeenCalledWith({ students: [ - 'DireStraits', - 'Nirvana', - 'Noordkaap', - 'PinkFloyd', - 'SmashingPumpkins', - 'TheDoors', - 'Tool' - ]}); + checkReturnList(jsonMock, 'students'); }); it('should return 404 not found when calling getClassStudentsHandler on a non-existent class', async () => { @@ -102,8 +95,7 @@ describe('Class controllers', () => { }; await getClassStudentsHandler(req as Request, res as Response); - - // will fail until code is fixed + expect(statusMock).toHaveBeenCalledWith(404); expect(jsonMock).toHaveBeenCalledWith({ error: 'Class not found' }); }); @@ -133,9 +125,8 @@ describe('Class controllers', () => { await getTeacherInvitationsHandler(req as Request, res as Response); - // will fail until code is fixed - expect(statusMock).toHaveBeenCalledWith(404); expect(jsonMock).toHaveBeenCalledWith({ error: 'Class not found' }); + expect(statusMock).toHaveBeenCalledWith(404); }); it('should return a list of classes', async () => { From bede00df8106f1a277e051c635a19c227d24ccf1 Mon Sep 17 00:00:00 2001 From: Adriaan Jacquet Date: Sat, 29 Mar 2025 23:06:03 +0100 Subject: [PATCH 011/128] fix: gefaalde testen gefixt voor group controller --- backend/src/controllers/groups.ts | 4 ++++ backend/tests/controllers/groups.test.ts | 6 +++--- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/backend/src/controllers/groups.ts b/backend/src/controllers/groups.ts index da1cde39..81b62a49 100644 --- a/backend/src/controllers/groups.ts +++ b/backend/src/controllers/groups.ts @@ -21,6 +21,10 @@ export async function getGroupHandler(req: Request, res: Response): Promise { await getGroupHandler(req as Request, res as Response); expect(statusMock).toHaveBeenCalledWith(404); - expect(jsonMock).toHaveBeenCalledWith({ error: 'Group not found' }); + expect(jsonMock).toHaveBeenCalled(); }); it('should return 404 not found on a non-existing assignment', async () => { @@ -64,7 +64,7 @@ describe('Group controllers', () => { await getGroupHandler(req as Request, res as Response); expect(statusMock).toHaveBeenCalledWith(404); - expect(jsonMock).toHaveBeenCalledWith({ error: 'Assignment not found' }); + expect(jsonMock).toHaveBeenCalled(); }); it('should return 404 not found ont a non-existing class', async () => { @@ -80,7 +80,7 @@ describe('Group controllers', () => { await getGroupHandler(req as Request, res as Response); expect(statusMock).toHaveBeenCalledWith(404); - expect(jsonMock).toHaveBeenCalledWith({ error: 'Class not found' }); + expect(jsonMock).toHaveBeenCalled(); }); it('should return an existing group', async () => { From fe51c2d1ecb40702a4b944d3b3a717015c18f31a Mon Sep 17 00:00:00 2001 From: Adriaan Jacquet Date: Sun, 30 Mar 2025 17:00:55 +0200 Subject: [PATCH 012/128] fix: correcte error handling in question controller backend --- backend/src/controllers/questions.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/backend/src/controllers/questions.ts b/backend/src/controllers/questions.ts index 00a51329..217994f6 100644 --- a/backend/src/controllers/questions.ts +++ b/backend/src/controllers/questions.ts @@ -106,13 +106,14 @@ export async function deleteQuestionHandler(req: Request, res: Response): Promis const questionId = getQuestionId(req, res); if (!questionId) { + res.json(404).json({ error: 'Question not found' }); return; } const question = await deleteQuestion(questionId); if (!question) { - res.status(400).json({ error: 'Could not find nor delete question' }); + res.status(404).json({ error: 'Could not find nor delete question' }); } else { res.json(question); } From 6cb8a1b98fbd05baaad5ebc7d019dd9eaf71c5f7 Mon Sep 17 00:00:00 2001 From: Gerald Schmittinger Date: Tue, 8 Apr 2025 13:07:54 +0200 Subject: [PATCH 013/128] feat(backend): Endpoints voor studenten beschermd --- backend/src/middleware/auth/auth.ts | 45 +++---------------- .../src/middleware/auth/checks/auth-checks.ts | 38 ++++++++++++++++ .../auth/checks/class-auth-checks.ts | 22 +++++++++ .../auth/checks/user-auth-checks.ts | 10 +++++ backend/src/routes/auth.ts | 3 +- backend/src/routes/student-join-requests.ts | 12 +++-- backend/src/routes/students.ts | 15 ++++--- 7 files changed, 93 insertions(+), 52 deletions(-) create mode 100644 backend/src/middleware/auth/checks/auth-checks.ts create mode 100644 backend/src/middleware/auth/checks/class-auth-checks.ts create mode 100644 backend/src/middleware/auth/checks/user-auth-checks.ts diff --git a/backend/src/middleware/auth/auth.ts b/backend/src/middleware/auth/auth.ts index a91932ea..54354a55 100644 --- a/backend/src/middleware/auth/auth.ts +++ b/backend/src/middleware/auth/auth.ts @@ -1,13 +1,11 @@ -import { envVars, getEnvVar } from '../../util/envVars.js'; -import { expressjwt } from 'express-jwt'; +import {envVars, getEnvVar} from '../../util/envVars.js'; +import {expressjwt} from 'express-jwt'; import * as jwt from 'jsonwebtoken'; -import { JwtPayload } from 'jsonwebtoken'; +import {JwtPayload} from 'jsonwebtoken'; import jwksClient from 'jwks-rsa'; import * as express from 'express'; -import { AuthenticatedRequest } from './authenticated-request.js'; -import { AuthenticationInfo } from './authentication-info.js'; -import { UnauthorizedException } from '../../exceptions/unauthorized-exception.js'; -import { ForbiddenException } from '../../exceptions/forbidden-exception.js'; +import {AuthenticatedRequest} from './authenticated-request.js'; +import {AuthenticationInfo} from './authentication-info.js'; const JWKS_CACHE = true; const JWKS_RATE_LIMIT = true; @@ -108,36 +106,3 @@ function addAuthenticationInfo(req: AuthenticatedRequest, _res: express.Response } export const authenticateUser = [verifyJwtToken, addAuthenticationInfo]; - -/** - * Middleware which rejects unauthenticated users (with HTTP 401) and authenticated users which do not fulfill - * the given access condition. - * @param accessCondition Predicate over the current AuthenticationInfo. Access is only granted when this evaluates - * to true. - */ -export function authorize(accessCondition: (auth: AuthenticationInfo) => boolean) { - return (req: AuthenticatedRequest, _res: express.Response, next: express.NextFunction): void => { - if (!req.auth) { - throw new UnauthorizedException(); - } else if (!accessCondition(req.auth)) { - throw new ForbiddenException(); - } else { - next(); - } - }; -} - -/** - * Middleware which rejects all unauthenticated users, but accepts all authenticated users. - */ -export const authenticatedOnly = authorize((_) => true); - -/** - * Middleware which rejects requests from unauthenticated users or users that aren't students. - */ -export const studentsOnly = authorize((auth) => auth.accountType === 'student'); - -/** - * Middleware which rejects requests from unauthenticated users or users that aren't teachers. - */ -export const teachersOnly = authorize((auth) => auth.accountType === 'teacher'); diff --git a/backend/src/middleware/auth/checks/auth-checks.ts b/backend/src/middleware/auth/checks/auth-checks.ts new file mode 100644 index 00000000..bf15e551 --- /dev/null +++ b/backend/src/middleware/auth/checks/auth-checks.ts @@ -0,0 +1,38 @@ +import {AuthenticationInfo} from "../authentication-info"; +import {AuthenticatedRequest} from "../authenticated-request"; +import * as express from "express"; +import {UnauthorizedException} from "../../../exceptions/unauthorized-exception"; +import {ForbiddenException} from "../../../exceptions/forbidden-exception"; + +/** + * Middleware which rejects unauthenticated users (with HTTP 401) and authenticated users which do not fulfill + * the given access condition. + * @param accessCondition Predicate over the current AuthenticationInfo. Access is only granted when this evaluates + * to true. + */ +export function authorize( + accessCondition: (auth: AuthenticationInfo, req: AuthenticatedRequest) => boolean | Promise +) { + return async (req: AuthenticatedRequest, _res: express.Response, next: express.NextFunction): Promise => { + if (!req.auth) { + throw new UnauthorizedException(); + } else if (!await accessCondition(req.auth, req)) { + throw new ForbiddenException(); + } else { + next(); + } + }; +} + +/** + * Middleware which rejects all unauthenticated users, but accepts all authenticated users. + */ +export const authenticatedOnly = authorize((_) => true); +/** + * Middleware which rejects requests from unauthenticated users or users that aren't students. + */ +export const studentsOnly = authorize((auth) => auth.accountType === 'student'); +/** + * Middleware which rejects requests from unauthenticated users or users that aren't teachers. + */ +export const teachersOnly = authorize((auth) => auth.accountType === 'teacher'); diff --git a/backend/src/middleware/auth/checks/class-auth-checks.ts b/backend/src/middleware/auth/checks/class-auth-checks.ts new file mode 100644 index 00000000..6c92e190 --- /dev/null +++ b/backend/src/middleware/auth/checks/class-auth-checks.ts @@ -0,0 +1,22 @@ +import {authorize} from "./auth-checks"; +import {AuthenticationInfo} from "../authentication-info"; +import {AuthenticatedRequest} from "../authenticated-request"; +import {getClassesByTeacher} from "../../../services/teachers"; + +/** + * To be used on a request with path parameters username and classId. + * Only allows requests whose username parameter is equal to the username of the user who is logged in and requests + * whose classId parameter references a class the logged-in user is a teacher of. + */ +export const onlyAllowStudentHimselfAndTeachersOfClass = authorize( + async (auth: AuthenticationInfo, req: AuthenticatedRequest) => { + if (req.params.username === auth.username) { + return true; + } else if (auth.accountType === "teacher") { + const classes: string[] = (await getClassesByTeacher(auth.username, false)) as string[]; + return req.params.classId in classes; + } else { + return false; + } + } +); diff --git a/backend/src/middleware/auth/checks/user-auth-checks.ts b/backend/src/middleware/auth/checks/user-auth-checks.ts new file mode 100644 index 00000000..10814eb8 --- /dev/null +++ b/backend/src/middleware/auth/checks/user-auth-checks.ts @@ -0,0 +1,10 @@ +import {authorize} from "./auth-checks"; +import {AuthenticationInfo} from "../authentication-info"; +import {AuthenticatedRequest} from "../authenticated-request"; + +/** + * Only allow the user whose username is in the path parameter "username" to access the endpoint. + */ +export const onlyAllowUserHimself = authorize( + (auth: AuthenticationInfo, req: AuthenticatedRequest) => req.params.username === auth.username +); diff --git a/backend/src/routes/auth.ts b/backend/src/routes/auth.ts index 4a1f27d2..8c4ab450 100644 --- a/backend/src/routes/auth.ts +++ b/backend/src/routes/auth.ts @@ -1,6 +1,7 @@ import express from 'express'; import { getFrontendAuthConfig } from '../controllers/auth.js'; -import { authenticatedOnly, studentsOnly, teachersOnly } from '../middleware/auth/auth.js'; +import {authenticatedOnly, studentsOnly, teachersOnly} from "../middleware/auth/checks/auth-checks"; + const router = express.Router(); // Returns auth configuration for frontend diff --git a/backend/src/routes/student-join-requests.ts b/backend/src/routes/student-join-requests.ts index daf79f09..66a6c75e 100644 --- a/backend/src/routes/student-join-requests.ts +++ b/backend/src/routes/student-join-requests.ts @@ -5,15 +5,19 @@ import { getStudentRequestHandler, getStudentRequestsHandler, } from '../controllers/students.js'; +import {onlyAllowUserHimself} from "../middleware/auth/checks/user-auth-checks"; +import {onlyAllowStudentHimselfAndTeachersOfClass} from "../middleware/auth/checks/class-auth-checks"; + +// Under /:username/joinRequests/ const router = express.Router({ mergeParams: true }); -router.get('/', getStudentRequestsHandler); +router.get('/', onlyAllowUserHimself, getStudentRequestsHandler); -router.post('/', createStudentRequestHandler); +router.post('/', onlyAllowUserHimself, createStudentRequestHandler); -router.get('/:classId', getStudentRequestHandler); +router.get('/:classId', onlyAllowStudentHimselfAndTeachersOfClass, getStudentRequestHandler); -router.delete('/:classId', deleteClassJoinRequestHandler); +router.delete('/:classId', onlyAllowStudentHimselfAndTeachersOfClass, deleteClassJoinRequestHandler); export default router; diff --git a/backend/src/routes/students.ts b/backend/src/routes/students.ts index 0f5d5349..54b0d894 100644 --- a/backend/src/routes/students.ts +++ b/backend/src/routes/students.ts @@ -11,6 +11,7 @@ import { getStudentSubmissionsHandler, } from '../controllers/students.js'; import joinRequestRouter from './student-join-requests.js'; +import {onlyAllowUserHimself} from "../middleware/auth/checks/user-auth-checks"; const router = express.Router(); @@ -19,25 +20,25 @@ router.get('/', getAllStudentsHandler); router.post('/', createStudentHandler); -router.delete('/:username', deleteStudentHandler); +router.delete('/:username', onlyAllowUserHimself, deleteStudentHandler); // Information about a student's profile -router.get('/:username', getStudentHandler); +router.get('/:username', onlyAllowUserHimself, getStudentHandler); // The list of classes a student is in -router.get('/:username/classes', getStudentClassesHandler); +router.get('/:username/classes', onlyAllowUserHimself, getStudentClassesHandler); // The list of submissions a student has made -router.get('/:username/submissions', getStudentSubmissionsHandler); +router.get('/:username/submissions', onlyAllowUserHimself, getStudentSubmissionsHandler); // The list of assignments a student has -router.get('/:username/assignments', getStudentAssignmentsHandler); +router.get('/:username/assignments', onlyAllowUserHimself, getStudentAssignmentsHandler); // The list of groups a student is in -router.get('/:username/groups', getStudentGroupsHandler); +router.get('/:username/groups', onlyAllowUserHimself, getStudentGroupsHandler); // A list of questions a user has created -router.get('/:username/questions', getStudentQuestionsHandler); +router.get('/:username/questions', onlyAllowUserHimself, getStudentQuestionsHandler); router.use('/:username/joinRequests', joinRequestRouter); From 9339eca9cfa9fc9d9f0c87106565603b7a516878 Mon Sep 17 00:00:00 2001 From: Gerald Schmittinger Date: Tue, 8 Apr 2025 14:24:57 +0200 Subject: [PATCH 014/128] feat: Mechanisme voor automatische aanmaak en update van accounts aangemaakt. --- backend/src/controllers/auth.ts | 30 ++++++++++++++++++- .../src/middleware/auth/checks/auth-checks.ts | 5 ++++ .../auth/checks/class-auth-checks.ts | 19 ++++++++++-- backend/src/routes/auth.ts | 10 ++++--- backend/src/routes/students.ts | 7 +++-- backend/src/routes/teachers.ts | 21 +++++++------ backend/src/services/students.ts | 4 +-- backend/src/services/teachers.ts | 4 +-- frontend/src/services/auth/auth-service.ts | 7 +++++ 9 files changed, 84 insertions(+), 23 deletions(-) diff --git a/backend/src/controllers/auth.ts b/backend/src/controllers/auth.ts index b87eaf7b..e30a412e 100644 --- a/backend/src/controllers/auth.ts +++ b/backend/src/controllers/auth.ts @@ -1,4 +1,9 @@ import { envVars, getEnvVar } from '../util/envVars.js'; +import {AuthenticatedRequest} from "../middleware/auth/authenticated-request"; +import {createStudent} from "../services/students"; +import {AuthenticationInfo} from "../middleware/auth/authentication-info"; +import {Request, Response} from "express"; +import {createTeacher} from "../services/teachers"; interface FrontendIdpConfig { authority: string; @@ -15,7 +20,7 @@ interface FrontendAuthConfig { const SCOPE = 'openid profile email'; const RESPONSE_TYPE = 'code'; -export function getFrontendAuthConfig(): FrontendAuthConfig { +function getFrontendAuthConfig(): FrontendAuthConfig { return { student: { authority: getEnvVar(envVars.IdpStudentUrl), @@ -31,3 +36,26 @@ export function getFrontendAuthConfig(): FrontendAuthConfig { }, }; } + +export function handleGetFrontendAuthConfig(_req: Request, res: Response): void { + res.json(getFrontendAuthConfig()); +} + +export async function handleHello(req: AuthenticatedRequest) { + const auth: AuthenticationInfo = req.auth!; + if (auth.accountType === "teacher") { + await createTeacher({ + id: auth.username, + username: auth.username, + firstName: auth.firstName ?? "", + lastName: auth.lastName ?? "", + }, true); + } else { + await createStudent({ + id: auth.username, + username: auth.username, + firstName: auth.firstName ?? "", + lastName: auth.lastName ?? "", + }, true); + } +} diff --git a/backend/src/middleware/auth/checks/auth-checks.ts b/backend/src/middleware/auth/checks/auth-checks.ts index bf15e551..ee70c109 100644 --- a/backend/src/middleware/auth/checks/auth-checks.ts +++ b/backend/src/middleware/auth/checks/auth-checks.ts @@ -36,3 +36,8 @@ export const studentsOnly = authorize((auth) => auth.accountType === 'student'); * Middleware which rejects requests from unauthenticated users or users that aren't teachers. */ export const teachersOnly = authorize((auth) => auth.accountType === 'teacher'); +/** + * Middleware which is to be used on requests no normal user should be able to execute. + * Since there is no concept of administrator accounts yet, currently, those requests will always be blocked. + */ +export const adminOnly = authorize(() => false); diff --git a/backend/src/middleware/auth/checks/class-auth-checks.ts b/backend/src/middleware/auth/checks/class-auth-checks.ts index 6c92e190..13adf4a8 100644 --- a/backend/src/middleware/auth/checks/class-auth-checks.ts +++ b/backend/src/middleware/auth/checks/class-auth-checks.ts @@ -1,7 +1,12 @@ import {authorize} from "./auth-checks"; import {AuthenticationInfo} from "../authentication-info"; import {AuthenticatedRequest} from "../authenticated-request"; -import {getClassesByTeacher} from "../../../services/teachers"; +import {getClass} from "../../../services/classes"; + +async function teaches(teacherUsername: string, classId: string) { + const clazz = await getClass(classId); + return clazz != null && teacherUsername in clazz.teachers; +} /** * To be used on a request with path parameters username and classId. @@ -13,10 +18,18 @@ export const onlyAllowStudentHimselfAndTeachersOfClass = authorize( if (req.params.username === auth.username) { return true; } else if (auth.accountType === "teacher") { - const classes: string[] = (await getClassesByTeacher(auth.username, false)) as string[]; - return req.params.classId in classes; + return teaches(auth.username, req.params.classId); } else { return false; } } ); + +/** + * Only let the request pass through if its path parameter "username" is the username of the currently logged-in + * teacher and the path parameter "classId" refers to a class the teacher teaches. + */ +export const onlyAllowTeacherOfClass = authorize( + async (auth: AuthenticationInfo, req: AuthenticatedRequest) => + req.params.username === auth.username && teaches(auth.username, req.params.classId), +); diff --git a/backend/src/routes/auth.ts b/backend/src/routes/auth.ts index 8c4ab450..7f204076 100644 --- a/backend/src/routes/auth.ts +++ b/backend/src/routes/auth.ts @@ -1,13 +1,15 @@ import express from 'express'; -import { getFrontendAuthConfig } from '../controllers/auth.js'; +import {handleGetFrontendAuthConfig, handleHello} from '../controllers/auth.js'; import {authenticatedOnly, studentsOnly, teachersOnly} from "../middleware/auth/checks/auth-checks"; const router = express.Router(); // Returns auth configuration for frontend -router.get('/config', (_req, res) => { - res.json(getFrontendAuthConfig()); -}); +router.get('/config', handleGetFrontendAuthConfig); + +// This endpoint is called by the client when the user has just logged in. +// It creates or updates the user entity based on the authentication data the endpoint was called with. +router.post('/hello', authenticatedOnly, handleHello); router.get('/testAuthenticatedOnly', authenticatedOnly, (_req, res) => { /* #swagger.security = [{ "student": [ ] }, { "teacher": [ ] }] */ diff --git a/backend/src/routes/students.ts b/backend/src/routes/students.ts index 54b0d894..e378e6ea 100644 --- a/backend/src/routes/students.ts +++ b/backend/src/routes/students.ts @@ -12,13 +12,16 @@ import { } from '../controllers/students.js'; import joinRequestRouter from './student-join-requests.js'; import {onlyAllowUserHimself} from "../middleware/auth/checks/user-auth-checks"; +import {adminOnly} from "../middleware/auth/checks/auth-checks"; const router = express.Router(); // Root endpoint used to search objects -router.get('/', getAllStudentsHandler); +router.get('/', adminOnly, getAllStudentsHandler); -router.post('/', createStudentHandler); +// Users will be created automatically when some resource is created for them. Therefore, this endpoint +// can only be used by an administrator. +router.post('/', adminOnly, createStudentHandler); router.delete('/:username', onlyAllowUserHimself, deleteStudentHandler); diff --git a/backend/src/routes/teachers.ts b/backend/src/routes/teachers.ts index a6106a80..3e463500 100644 --- a/backend/src/routes/teachers.ts +++ b/backend/src/routes/teachers.ts @@ -10,26 +10,29 @@ import { getTeacherStudentHandler, updateStudentJoinRequestHandler, } from '../controllers/teachers.js'; +import {adminOnly} from "../middleware/auth/checks/auth-checks"; +import {onlyAllowUserHimself} from "../middleware/auth/checks/user-auth-checks"; +import {onlyAllowTeacherOfClass} from "../middleware/auth/checks/class-auth-checks"; const router = express.Router(); // Root endpoint used to search objects -router.get('/', getAllTeachersHandler); +router.get('/', adminOnly, getAllTeachersHandler); -router.post('/', createTeacherHandler); +router.post('/', adminOnly, createTeacherHandler); -router.get('/:username', getTeacherHandler); +router.get('/:username', onlyAllowUserHimself, getTeacherHandler); -router.delete('/:username', deleteTeacherHandler); +router.delete('/:username', onlyAllowUserHimself, deleteTeacherHandler); -router.get('/:username/classes', getTeacherClassHandler); +router.get('/:username/classes', onlyAllowUserHimself, getTeacherClassHandler); -router.get('/:username/students', getTeacherStudentHandler); +router.get('/:username/students', onlyAllowUserHimself, getTeacherStudentHandler); -router.get('/:username/questions', getTeacherQuestionHandler); +router.get('/:username/questions', onlyAllowUserHimself, getTeacherQuestionHandler); -router.get('/:username/joinRequests/:classId', getStudentJoinRequestHandler); +router.get('/:username/joinRequests/:classId', onlyAllowTeacherOfClass, getStudentJoinRequestHandler); -router.put('/:username/joinRequests/:classId/:studentUsername', updateStudentJoinRequestHandler); +router.put('/:username/joinRequests/:classId/:studentUsername', onlyAllowTeacherOfClass, updateStudentJoinRequestHandler); // Invitations to other classes a teacher received router.get('/:id/invitations', (_req, res) => { diff --git a/backend/src/services/students.ts b/backend/src/services/students.ts index 960edb93..6158a0f8 100644 --- a/backend/src/services/students.ts +++ b/backend/src/services/students.ts @@ -52,11 +52,11 @@ export async function getStudent(username: string): Promise { return mapToStudentDTO(user); } -export async function createStudent(userData: StudentDTO): Promise { +export async function createStudent(userData: StudentDTO, allowUpdate: boolean = false): Promise { const studentRepository = getStudentRepository(); const newStudent = mapToStudent(userData); - await studentRepository.save(newStudent, { preventOverwrite: true }); + await studentRepository.save(newStudent, { preventOverwrite: !allowUpdate }); return userData; } diff --git a/backend/src/services/teachers.ts b/backend/src/services/teachers.ts index 1b7643fb..501f03f0 100644 --- a/backend/src/services/teachers.ts +++ b/backend/src/services/teachers.ts @@ -56,11 +56,11 @@ export async function getTeacher(username: string): Promise { return mapToTeacherDTO(user); } -export async function createTeacher(userData: TeacherDTO): Promise { +export async function createTeacher(userData: TeacherDTO, update?: boolean): Promise { const teacherRepository: TeacherRepository = getTeacherRepository(); const newTeacher = mapToTeacher(userData); - await teacherRepository.save(newTeacher, { preventOverwrite: true }); + await teacherRepository.save(newTeacher, { preventOverwrite: !update }); return mapToTeacherDTO(newTeacher); } diff --git a/frontend/src/services/auth/auth-service.ts b/frontend/src/services/auth/auth-service.ts index 977e1dbf..0cb62803 100644 --- a/frontend/src/services/auth/auth-service.ts +++ b/frontend/src/services/auth/auth-service.ts @@ -29,6 +29,10 @@ const authState = reactive({ activeRole: authStorage.getActiveRole() || null, }); +async function sendHello(): Promise { + return apiClient.post("/auth/hello"); +} + /** * Load the information about who is currently logged in from the IDP. */ @@ -41,6 +45,8 @@ async function loadUser(): Promise { authState.user = user; authState.accessToken = user?.access_token || null; authState.activeRole = activeRole || null; + + await sendHello(); return user; } @@ -72,6 +78,7 @@ async function handleLoginCallback(): Promise { throw new Error("Login callback received, but the user is not logging in!"); } authState.user = (await (await getUserManagers())[activeRole].signinCallback()) || null; + await sendHello(); } /** From 22523262344eac9be7ee6a598ccc556f5b6befc6 Mon Sep 17 00:00:00 2001 From: Gerald Schmittinger Date: Tue, 8 Apr 2025 15:45:20 +0200 Subject: [PATCH 015/128] feat(backend): Endpoints van klassen en leerkrachten beschermd. --- backend/src/controllers/auth.ts | 2 +- .../auth/checks/class-auth-checks.ts | 23 +++++++++++++++++++ backend/src/routes/classes.ts | 12 ++++++---- 3 files changed, 31 insertions(+), 6 deletions(-) diff --git a/backend/src/controllers/auth.ts b/backend/src/controllers/auth.ts index e30a412e..4df138c1 100644 --- a/backend/src/controllers/auth.ts +++ b/backend/src/controllers/auth.ts @@ -41,7 +41,7 @@ export function handleGetFrontendAuthConfig(_req: Request, res: Response): void res.json(getFrontendAuthConfig()); } -export async function handleHello(req: AuthenticatedRequest) { +export async function handleHello(req: AuthenticatedRequest): Promise { const auth: AuthenticationInfo = req.auth!; if (auth.accountType === "teacher") { await createTeacher({ diff --git a/backend/src/middleware/auth/checks/class-auth-checks.ts b/backend/src/middleware/auth/checks/class-auth-checks.ts index 13adf4a8..f51cf740 100644 --- a/backend/src/middleware/auth/checks/class-auth-checks.ts +++ b/backend/src/middleware/auth/checks/class-auth-checks.ts @@ -33,3 +33,26 @@ export const onlyAllowTeacherOfClass = authorize( async (auth: AuthenticationInfo, req: AuthenticatedRequest) => req.params.username === auth.username && teaches(auth.username, req.params.classId), ); + +/** + * Only let the request pass through if the class id in it refers to a class the current user is in (as a student + * or teacher) + */ +function createOnlyAllowIfInClass(onlyTeacher: boolean) { + return authorize( + async (auth: AuthenticationInfo, req: AuthenticatedRequest) => { + const classId = req.params.classId ?? req.params.classid ?? req.params.id; + const clazz = await getClass(classId); + if (clazz == null) { + return false; + } else if (onlyTeacher || auth.accountType === "teacher") { + return auth.username in clazz.teachers; + } else { + return auth.username in clazz.students; + } + } + ); +} + +export const onlyAllowIfInClass = createOnlyAllowIfInClass(false); +export const onlyAllowIfTeacherInClass = createOnlyAllowIfInClass(true); diff --git a/backend/src/routes/classes.ts b/backend/src/routes/classes.ts index e0972988..f2dd7686 100644 --- a/backend/src/routes/classes.ts +++ b/backend/src/routes/classes.ts @@ -7,20 +7,22 @@ import { getTeacherInvitationsHandler, } from '../controllers/classes.js'; import assignmentRouter from './assignments.js'; +import {adminOnly, teachersOnly} from "../middleware/auth/checks/auth-checks"; +import {onlyAllowIfInClass, onlyAllowIfTeacherInClass} from "../middleware/auth/checks/class-auth-checks"; const router = express.Router(); // Root endpoint used to search objects -router.get('/', getAllClassesHandler); +router.get('/', adminOnly, getAllClassesHandler); -router.post('/', createClassHandler); +router.post('/', teachersOnly, createClassHandler); // Information about an class with id 'id' -router.get('/:id', getClassHandler); +router.get('/:id', onlyAllowIfInClass, getClassHandler); -router.get('/:id/teacher-invitations', getTeacherInvitationsHandler); +router.get('/:id/teacher-invitations', onlyAllowIfTeacherInClass, getTeacherInvitationsHandler); -router.get('/:id/students', getClassStudentsHandler); +router.get('/:id/students', onlyAllowIfInClass, getClassStudentsHandler); router.use('/:classid/assignments', assignmentRouter); From a1ce8a209c15a378674c10ccdca5b1125774ae8c Mon Sep 17 00:00:00 2001 From: Gerald Schmittinger Date: Tue, 8 Apr 2025 15:46:39 +0200 Subject: [PATCH 016/128] feat(backend): Endpoints van thema's beschermd --- backend/src/routes/themes.ts | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/backend/src/routes/themes.ts b/backend/src/routes/themes.ts index b135d44f..089c5d46 100644 --- a/backend/src/routes/themes.ts +++ b/backend/src/routes/themes.ts @@ -1,14 +1,15 @@ import express from 'express'; import { getThemesHandler, getHruidsByThemeHandler } from '../controllers/themes.js'; +import {authenticatedOnly} from "../middleware/auth/checks/auth-checks"; const router = express.Router(); // Query: language // Route to fetch list of {key, title, description, image} themes in their respective language -router.get('/', getThemesHandler); +router.get('/', authenticatedOnly, getThemesHandler); // Arg: theme (key) // Route to fetch list of hruids based on theme -router.get('/:theme', getHruidsByThemeHandler); +router.get('/:theme', authenticatedOnly, getHruidsByThemeHandler); export default router; From bc2cd145ab7d96e9b07d7ecd2339095231269e50 Mon Sep 17 00:00:00 2001 From: Gerald Schmittinger Date: Tue, 8 Apr 2025 16:58:14 +0200 Subject: [PATCH 017/128] feat(backend): Endpoints van assignments en groepen beschermd. --- backend/src/controllers/assignments.ts | 2 +- .../auth/authenticated-request.d.ts | 9 +++- .../auth/checks/assignment-auth-checks.ts | 26 ++++++++++ .../src/middleware/auth/checks/auth-checks.ts | 9 ++-- .../auth/checks/class-auth-checks.ts | 51 +++++++++++-------- .../auth/checks/group-auth-checker.ts | 24 +++++++++ backend/src/routes/assignments.ts | 13 +++-- backend/src/routes/classes.ts | 4 +- backend/src/routes/groups.ts | 7 +-- backend/src/routes/students.ts | 2 +- backend/src/services/students.ts | 2 +- 11 files changed, 111 insertions(+), 38 deletions(-) create mode 100644 backend/src/middleware/auth/checks/assignment-auth-checks.ts create mode 100644 backend/src/middleware/auth/checks/group-auth-checker.ts diff --git a/backend/src/controllers/assignments.ts b/backend/src/controllers/assignments.ts index 1520fc10..d92def19 100644 --- a/backend/src/controllers/assignments.ts +++ b/backend/src/controllers/assignments.ts @@ -3,7 +3,7 @@ import { createAssignment, getAllAssignments, getAssignment, getAssignmentsSubmi import { AssignmentDTO } from '@dwengo-1/common/interfaces/assignment'; // Typescript is annoying with parameter forwarding from class.ts -interface AssignmentParams { +export interface AssignmentParams { classid: string; id: string; } diff --git a/backend/src/middleware/auth/authenticated-request.d.ts b/backend/src/middleware/auth/authenticated-request.d.ts index 9737fa7e..c0049dc7 100644 --- a/backend/src/middleware/auth/authenticated-request.d.ts +++ b/backend/src/middleware/auth/authenticated-request.d.ts @@ -1,8 +1,15 @@ import { Request } from 'express'; import { JwtPayload } from 'jsonwebtoken'; import { AuthenticationInfo } from './authentication-info.js'; +import * as core from "express-serve-static-core"; -export interface AuthenticatedRequest extends Request { +export interface AuthenticatedRequest< + P = core.ParamsDictionary, + ResBody = unknown, + ReqBody = unknown, + ReqQuery = core.Query, + Locals extends Record = Record, +> extends Request { // Properties are optional since the user is not necessarily authenticated. jwtPayload?: JwtPayload; auth?: AuthenticationInfo; diff --git a/backend/src/middleware/auth/checks/assignment-auth-checks.ts b/backend/src/middleware/auth/checks/assignment-auth-checks.ts new file mode 100644 index 00000000..a9bbe87f --- /dev/null +++ b/backend/src/middleware/auth/checks/assignment-auth-checks.ts @@ -0,0 +1,26 @@ +import {authorize} from "./auth-checks"; +import {getAssignment} from "../../../services/assignments"; +import {getClass} from "../../../services/classes"; +import {getAllGroups} from "../../../services/groups"; + +/** + * Expects the path to contain the path parameters 'classId' and 'id' (meaning the ID of the assignment). + * Only allows requests from users who are + * - either teachers of the class the assignment was posted in, + * - or students in a group of the assignment. + */ +export const onlyAllowIfHasAccessToAssignment = authorize( + async (auth, req) => { + const { classid: classId, id: assignmentId } = req.params as { classid: string, id: number }; + const assignment = await getAssignment(classId, assignmentId); + if (assignment === null) { + return false; + } else if (auth.accountType === "teacher") { + const clazz = await getClass(assignment.class); + return auth.username in clazz!.teachers; + } else { + const groups = await getAllGroups(classId, assignmentId, false); + return groups.some(group => auth.username in (group.members as string[])); + } + } +); diff --git a/backend/src/middleware/auth/checks/auth-checks.ts b/backend/src/middleware/auth/checks/auth-checks.ts index ee70c109..d14e8dee 100644 --- a/backend/src/middleware/auth/checks/auth-checks.ts +++ b/backend/src/middleware/auth/checks/auth-checks.ts @@ -3,6 +3,7 @@ import {AuthenticatedRequest} from "../authenticated-request"; import * as express from "express"; import {UnauthorizedException} from "../../../exceptions/unauthorized-exception"; import {ForbiddenException} from "../../../exceptions/forbidden-exception"; +import {RequestHandler} from "express"; /** * Middleware which rejects unauthenticated users (with HTTP 401) and authenticated users which do not fulfill @@ -10,10 +11,10 @@ import {ForbiddenException} from "../../../exceptions/forbidden-exception"; * @param accessCondition Predicate over the current AuthenticationInfo. Access is only granted when this evaluates * to true. */ -export function authorize( - accessCondition: (auth: AuthenticationInfo, req: AuthenticatedRequest) => boolean | Promise -) { - return async (req: AuthenticatedRequest, _res: express.Response, next: express.NextFunction): Promise => { +export function authorize>( + accessCondition: (auth: AuthenticationInfo, req: AuthenticatedRequest) => boolean | Promise +): RequestHandler { + return async (req: AuthenticatedRequest, _res: express.Response, next: express.NextFunction): Promise => { if (!req.auth) { throw new UnauthorizedException(); } else if (!await accessCondition(req.auth, req)) { diff --git a/backend/src/middleware/auth/checks/class-auth-checks.ts b/backend/src/middleware/auth/checks/class-auth-checks.ts index f51cf740..c89a263f 100644 --- a/backend/src/middleware/auth/checks/class-auth-checks.ts +++ b/backend/src/middleware/auth/checks/class-auth-checks.ts @@ -3,9 +3,9 @@ import {AuthenticationInfo} from "../authentication-info"; import {AuthenticatedRequest} from "../authenticated-request"; import {getClass} from "../../../services/classes"; -async function teaches(teacherUsername: string, classId: string) { +async function teaches(teacherUsername: string, classId: string): Promise { const clazz = await getClass(classId); - return clazz != null && teacherUsername in clazz.teachers; + return clazz !== null && teacherUsername in clazz.teachers; } /** @@ -19,9 +19,9 @@ export const onlyAllowStudentHimselfAndTeachersOfClass = authorize( return true; } else if (auth.accountType === "teacher") { return teaches(auth.username, req.params.classId); - } else { - return false; } + return false; + } ); @@ -38,21 +38,32 @@ export const onlyAllowTeacherOfClass = authorize( * Only let the request pass through if the class id in it refers to a class the current user is in (as a student * or teacher) */ -function createOnlyAllowIfInClass(onlyTeacher: boolean) { - return authorize( - async (auth: AuthenticationInfo, req: AuthenticatedRequest) => { - const classId = req.params.classId ?? req.params.classid ?? req.params.id; - const clazz = await getClass(classId); - if (clazz == null) { - return false; - } else if (onlyTeacher || auth.accountType === "teacher") { - return auth.username in clazz.teachers; - } else { - return auth.username in clazz.students; - } +export const onlyAllowIfInClass = authorize( + async (auth: AuthenticationInfo, req: AuthenticatedRequest) => { + const classId = req.params.classId ?? req.params.classid ?? req.params.id; + const clazz = await getClass(classId); + if (clazz === null) { + return false; + } else if (auth.accountType === "teacher") { + return auth.username in clazz.teachers; } - ); -} + return auth.username in clazz.students; + } +); -export const onlyAllowIfInClass = createOnlyAllowIfInClass(false); -export const onlyAllowIfTeacherInClass = createOnlyAllowIfInClass(true); +/** + * Only allows the request to pass if the 'class' property in its body is a class the current user is a member of. + */ +export const onlyAllowOwnClassInBody = authorize( + async (auth, req) => { + const classId = (req.body as {class: string})?.class; + const clazz = await getClass(classId); + + if (clazz === null) { + return false; + } else if (auth.accountType === "teacher") { + return auth.username in clazz.teachers; + } + return auth.username in clazz.students; + } +); diff --git a/backend/src/middleware/auth/checks/group-auth-checker.ts b/backend/src/middleware/auth/checks/group-auth-checker.ts new file mode 100644 index 00000000..f62ab3b9 --- /dev/null +++ b/backend/src/middleware/auth/checks/group-auth-checker.ts @@ -0,0 +1,24 @@ +import {authorize} from "./auth-checks"; +import {getClass} from "../../../services/classes"; +import {getGroup} from "../../../services/groups"; + +/** + * Expects the path to contain the path parameters 'classid', 'assignmentid' and 'groupid'. + * Only allows requests from users who are + * - either teachers of the class the assignment for the group was posted in, + * - or students in the group + */ +export const onlyAllowIfHasAccessToGroup = authorize( + async (auth, req) => { + const { classid: classId, assignmentid: assignmentId, groupid: groupId } = + req.params as { classid: string, assignmentid: number, groupid: number }; + + if (auth.accountType === "teacher") { + const clazz = await getClass(classId); + return auth.username in clazz!.teachers; + } else { // user is student + const group = await getGroup(classId, assignmentId, groupId, false); + return group === null ? false : auth.username in (group.members as string[]); + } + } +); diff --git a/backend/src/routes/assignments.ts b/backend/src/routes/assignments.ts index 3652dcc6..4db12769 100644 --- a/backend/src/routes/assignments.ts +++ b/backend/src/routes/assignments.ts @@ -6,20 +6,23 @@ import { getAssignmentsSubmissionsHandler, } from '../controllers/assignments.js'; import groupRouter from './groups.js'; +import {adminOnly, teachersOnly} from "../middleware/auth/checks/auth-checks"; +import {onlyAllowOwnClassInBody} from "../middleware/auth/checks/class-auth-checks"; +import {onlyAllowIfHasAccessToAssignment} from "../middleware/auth/checks/assignment-auth-checks"; const router = express.Router({ mergeParams: true }); // Root endpoint used to search objects -router.get('/', getAllAssignmentsHandler); +router.get('/', adminOnly, getAllAssignmentsHandler); -router.post('/', createAssignmentHandler); +router.post('/', teachersOnly, onlyAllowOwnClassInBody, createAssignmentHandler); // Information about an assignment with id 'id' -router.get('/:id', getAssignmentHandler); +router.get('/:id', onlyAllowIfHasAccessToAssignment, getAssignmentHandler); -router.get('/:id/submissions', getAssignmentsSubmissionsHandler); +router.get('/:id/submissions', onlyAllowIfHasAccessToAssignment, getAssignmentsSubmissionsHandler); -router.get('/:id/questions', (_req, res) => { +router.get('/:id/questions', onlyAllowIfHasAccessToAssignment, (_req, res) => { res.json({ questions: ['0'], }); diff --git a/backend/src/routes/classes.ts b/backend/src/routes/classes.ts index f2dd7686..36ba82e1 100644 --- a/backend/src/routes/classes.ts +++ b/backend/src/routes/classes.ts @@ -8,7 +8,7 @@ import { } from '../controllers/classes.js'; import assignmentRouter from './assignments.js'; import {adminOnly, teachersOnly} from "../middleware/auth/checks/auth-checks"; -import {onlyAllowIfInClass, onlyAllowIfTeacherInClass} from "../middleware/auth/checks/class-auth-checks"; +import {onlyAllowIfInClass} from "../middleware/auth/checks/class-auth-checks"; const router = express.Router(); @@ -20,7 +20,7 @@ router.post('/', teachersOnly, createClassHandler); // Information about an class with id 'id' router.get('/:id', onlyAllowIfInClass, getClassHandler); -router.get('/:id/teacher-invitations', onlyAllowIfTeacherInClass, getTeacherInvitationsHandler); +router.get('/:id/teacher-invitations', teachersOnly, onlyAllowIfInClass, getTeacherInvitationsHandler); router.get('/:id/students', onlyAllowIfInClass, getClassStudentsHandler); diff --git a/backend/src/routes/groups.ts b/backend/src/routes/groups.ts index 1486edce..e8e83fb2 100644 --- a/backend/src/routes/groups.ts +++ b/backend/src/routes/groups.ts @@ -1,5 +1,6 @@ import express from 'express'; import { createGroupHandler, getAllGroupsHandler, getGroupHandler, getGroupSubmissionsHandler } from '../controllers/groups.js'; +import {onlyAllowIfHasAccessToGroup} from "../middleware/auth/checks/group-auth-checker"; const router = express.Router({ mergeParams: true }); @@ -9,12 +10,12 @@ router.get('/', getAllGroupsHandler); router.post('/', createGroupHandler); // Information about a group (members, ... [TODO DOC]) -router.get('/:groupid', getGroupHandler); +router.get('/:groupid', onlyAllowIfHasAccessToGroup, getGroupHandler); -router.get('/:groupid/submissions', getGroupSubmissionsHandler); +router.get('/:groupid/submissions', onlyAllowIfHasAccessToGroup, getGroupSubmissionsHandler); // The list of questions a group has made -router.get('/:id/questions', (_req, res) => { +router.get('/:groupid/questions', onlyAllowIfHasAccessToGroup, (_req, res) => { res.json({ questions: ['0'], }); diff --git a/backend/src/routes/students.ts b/backend/src/routes/students.ts index e378e6ea..04d260b4 100644 --- a/backend/src/routes/students.ts +++ b/backend/src/routes/students.ts @@ -20,7 +20,7 @@ const router = express.Router(); router.get('/', adminOnly, getAllStudentsHandler); // Users will be created automatically when some resource is created for them. Therefore, this endpoint -// can only be used by an administrator. +// Can only be used by an administrator. router.post('/', adminOnly, createStudentHandler); router.delete('/:username', onlyAllowUserHimself, deleteStudentHandler); diff --git a/backend/src/services/students.ts b/backend/src/services/students.ts index 6158a0f8..ed951a5a 100644 --- a/backend/src/services/students.ts +++ b/backend/src/services/students.ts @@ -52,7 +52,7 @@ export async function getStudent(username: string): Promise { return mapToStudentDTO(user); } -export async function createStudent(userData: StudentDTO, allowUpdate: boolean = false): Promise { +export async function createStudent(userData: StudentDTO, allowUpdate = false): Promise { const studentRepository = getStudentRepository(); const newStudent = mapToStudent(userData); From fb3c37ce5a2e84136c146bcd9a861695eb332f5f Mon Sep 17 00:00:00 2001 From: Gerald Schmittinger Date: Wed, 9 Apr 2025 19:51:15 +0200 Subject: [PATCH 018/128] fix(backend): Merge-conflicten opgelost. --- backend/src/controllers/questions.ts | 73 ++++++++++--------- backend/src/interfaces/question.ts | 2 +- .../checks/learning-content-auth-checks.ts | 23 ++++++ backend/src/routes/groups.ts | 6 +- backend/src/routes/learning-objects.ts | 9 ++- backend/src/routes/learning-paths.ts | 3 +- backend/src/services/questions.ts | 11 +-- common/src/interfaces/question.ts | 1 + 8 files changed, 79 insertions(+), 49 deletions(-) create mode 100644 backend/src/middleware/auth/checks/learning-content-auth-checks.ts diff --git a/backend/src/controllers/questions.ts b/backend/src/controllers/questions.ts index 282c90b8..cc677dba 100644 --- a/backend/src/controllers/questions.ts +++ b/backend/src/controllers/questions.ts @@ -7,11 +7,12 @@ import { getQuestion, getQuestionsAboutLearningObjectInAssignment, updateQuestion, } from '../services/questions.js'; -import { FALLBACK_LANG, FALLBACK_SEQ_NUM } from '../config.js'; +import {FALLBACK_LANG, FALLBACK_SEQ_NUM, FALLBACK_VERSION_NUM} from '../config.js'; import { LearningObjectIdentifier } from '../entities/content/learning-object-identifier.js'; import { QuestionData, QuestionDTO, QuestionId } from '@dwengo-1/common/interfaces/question'; import { Language } from '@dwengo-1/common/util/language'; import {requireFields} from "./error-helper"; +import {BadRequestException} from "../exceptions/bad-request-exception"; export function getLearningObjectId(hruid: string, version: string, lang: string): LearningObjectIdentifier { return { @@ -28,7 +29,7 @@ export function getQuestionId(learningObjectIdentifier: LearningObjectIdentifier }; } -function getQuestionId(req: Request, res: Response): QuestionId | null { +function getQuestionIdFromRequest(req: Request): QuestionId | null { const seq = req.params.seq; const hruid = req.params.hruid; const version = req.params.version; @@ -39,10 +40,7 @@ function getQuestionId(req: Request, res: Response): QuestionId | null { return null; } - return { - learningObjectIdentifier, - sequenceNumber: seq ? Number(seq) : FALLBACK_SEQ_NUM, - }; + return getQuestionId(learningObjectIdentifier, seq); } export async function getAllQuestionsHandler(req: Request, res: Response): Promise { @@ -52,16 +50,22 @@ export async function getAllQuestionsHandler(req: Request, res: Response): Promi const full = req.query.full === 'true'; requireFields({ hruid }); + const assignmentId = parseInt(req.query.assignmentId as string); + + if (isNaN(assignmentId)) { + throw new BadRequestException("The assignment ID must be a number."); + } + const learningObjectId = getLearningObjectId(hruid, version, language); let questions: QuestionDTO[] | QuestionId[]; if (req.query.classId && req.query.assignmentId) { questions = await getQuestionsAboutLearningObjectInAssignment( learningObjectId, - req.query.classId, - req.query.assignmentId, + req.query.classId as string, + parseInt(req.query.assignmentId as string), full ?? false, - req.query.forStudent + req.query.forStudent as string | undefined ); } else { questions = await getAllQuestions(learningObjectId, full ?? false); @@ -70,40 +74,37 @@ export async function getAllQuestionsHandler(req: Request, res: Response): Promi res.json({ questions }); } - export async function getQuestionHandler(req: Request, res: Response): Promise { - const hruid = req.params.hruid; - const version = req.params.version; - const language = req.query.lang as string; - const seq = req.params.seq; - requireFields({ hruid }); +export async function getQuestionHandler(req: Request, res: Response): Promise { + const hruid = req.params.hruid; + const version = req.params.version; + const language = req.query.lang as string; + const seq = req.params.seq; + requireFields({ hruid }); - const learningObjectId = getLearningObjectId(hruid, version, language); - const questionId = getQuestionId(learningObjectId, seq); + const learningObjectId = getLearningObjectId(hruid, version, language); + const questionId = getQuestionId(learningObjectId, seq); - const question = await getQuestion(questionId); + const question = await getQuestion(questionId); - res.json({ question }); + res.json({ question }); +} + +export async function getQuestionAnswersHandler(req: Request, res: Response): Promise { + const questionId = getQuestionIdFromRequest(req); + const full = req.query.full; + + if (!questionId) { + return; } - export async function getQuestionAnswersHandler( - req: Request, - res: Response - ): Promise { - const questionId = getQuestionId(req, res); - const full = req.query.full; + const answers = await getAnswersByQuestion(questionId, full === "true"); - if (!questionId) { - return; - } - - const answers = await getAnswersByQuestion(questionId, full); - - if (!answers) { - res.status(404).json({ error: `Questions not found` }); - } else { - res.json({ answers: answers }); - } + if (!answers) { + res.status(404).json({ error: `Questions not found` }); + } else { + res.json({ answers: answers }); } +} export async function createQuestionHandler(req: Request, res: Response): Promise { const hruid = req.params.hruid; diff --git a/backend/src/interfaces/question.ts b/backend/src/interfaces/question.ts index b4e58db7..ac334506 100644 --- a/backend/src/interfaces/question.ts +++ b/backend/src/interfaces/question.ts @@ -1,9 +1,9 @@ import { Question } from '../entities/questions/question.entity.js'; import { mapToStudentDTO } from './student.js'; import { QuestionDTO, QuestionId } from '@dwengo-1/common/interfaces/question'; -import { LearningObjectIdentifier } from '@dwengo-1/common/interfaces/learning-content'; import { mapToGroupDTOId } from './group'; import { LearningObjectIdentifierDTO } from '@dwengo-1/common/interfaces/learning-content'; +import {LearningObjectIdentifier} from "../entities/content/learning-object-identifier"; function getLearningObjectIdentifier(question: Question): LearningObjectIdentifierDTO { return { diff --git a/backend/src/middleware/auth/checks/learning-content-auth-checks.ts b/backend/src/middleware/auth/checks/learning-content-auth-checks.ts new file mode 100644 index 00000000..57a3021d --- /dev/null +++ b/backend/src/middleware/auth/checks/learning-content-auth-checks.ts @@ -0,0 +1,23 @@ +import {authorize} from "./auth-checks"; +import {AuthenticationInfo} from "../authentication-info"; +import {AuthenticatedRequest} from "../authenticated-request"; +import {getGroup} from "../../../services/groups"; + +/** + * Only allows requests whose learning path personalization query parameters ('forGroup' / 'assignmentNo' / 'classId') + * are + * - either not set + * - or set to a group the user is in, + * - or set to anything if the user is a teacher. + */ +export const onlyAllowPersonalizationForOwnGroup = authorize( + async (auth: AuthenticationInfo, req: AuthenticatedRequest) => { + const {forGroup, assignmentNo, classId} = req.params; + if (forGroup && assignmentNo && classId) { + const group = getGroup(forGroup, parseInt(assignmentNo), classId, false); + + } else { + return true; + } + } +); diff --git a/backend/src/routes/groups.ts b/backend/src/routes/groups.ts index e8e83fb2..93500eb3 100644 --- a/backend/src/routes/groups.ts +++ b/backend/src/routes/groups.ts @@ -1,13 +1,15 @@ import express from 'express'; import { createGroupHandler, getAllGroupsHandler, getGroupHandler, getGroupSubmissionsHandler } from '../controllers/groups.js'; import {onlyAllowIfHasAccessToGroup} from "../middleware/auth/checks/group-auth-checker"; +import {teachersOnly} from "../middleware/auth/checks/auth-checks"; +import {onlyAllowIfHasAccessToAssignment} from "../middleware/auth/checks/assignment-auth-checks"; const router = express.Router({ mergeParams: true }); // Root endpoint used to search objects -router.get('/', getAllGroupsHandler); +router.get('/', onlyAllowIfHasAccessToAssignment, getAllGroupsHandler); -router.post('/', createGroupHandler); +router.post('/', teachersOnly, onlyAllowIfHasAccessToAssignment, createGroupHandler); // Information about a group (members, ... [TODO DOC]) router.get('/:groupid', onlyAllowIfHasAccessToGroup, getGroupHandler); diff --git a/backend/src/routes/learning-objects.ts b/backend/src/routes/learning-objects.ts index 7532765b..fb65d9cd 100644 --- a/backend/src/routes/learning-objects.ts +++ b/backend/src/routes/learning-objects.ts @@ -3,6 +3,7 @@ import { getAllLearningObjects, getAttachment, getLearningObject, getLearningObj import submissionRoutes from './submissions.js'; import questionRoutes from './questions.js'; +import {authenticatedOnly} from "../middleware/auth/checks/auth-checks"; const router = express.Router(); @@ -16,13 +17,13 @@ const router = express.Router(); // Route 2: list of object data // Example 2: http://localhost:3000/learningObject?full=true&hruid=un_artificiele_intelligentie -router.get('/', getAllLearningObjects); +router.get('/', authenticatedOnly, getAllLearningObjects); // Parameter: hruid of learning object // Query: language // Route to fetch data of one learning object based on its hruid // Example: http://localhost:3000/learningObject/un_ai7 -router.get('/:hruid', getLearningObject); +router.get('/:hruid', authenticatedOnly, getLearningObject); router.use('/:hruid/submissions', submissionRoutes); @@ -32,12 +33,12 @@ router.use('/:hruid/:version/questions', questionRoutes); // Query: language, version (optional) // Route to fetch the HTML rendering of one learning object based on its hruid. // Example: http://localhost:3000/learningObject/un_ai7/html -router.get('/:hruid/html', getLearningObjectHTML); +router.get('/:hruid/html', authenticatedOnly, getLearningObjectHTML); // Parameter: hruid of learning object, name of attachment. // Query: language, version (optional). // Route to get the raw data of the attachment for one learning object based on its hruid. // Example: http://localhost:3000/learningObject/u_test/attachment/testimage.png -router.get('/:hruid/html/:attachmentName', getAttachment); +router.get('/:hruid/html/:attachmentName', authenticatedOnly, getAttachment); export default router; diff --git a/backend/src/routes/learning-paths.ts b/backend/src/routes/learning-paths.ts index efe17312..ad079551 100644 --- a/backend/src/routes/learning-paths.ts +++ b/backend/src/routes/learning-paths.ts @@ -1,5 +1,6 @@ import express from 'express'; import { getLearningPaths } from '../controllers/learning-paths.js'; +import {authenticatedOnly} from "../middleware/auth/checks/auth-checks"; const router = express.Router(); @@ -22,6 +23,6 @@ const router = express.Router(); // Route to fetch learning paths based on a theme // Example: http://localhost:3000/learningPath?theme=kiks -router.get('/', getLearningPaths); +router.get('/', authenticatedOnly, getLearningPaths); export default router; diff --git a/backend/src/services/questions.ts b/backend/src/services/questions.ts index 45bfa750..9c719472 100644 --- a/backend/src/services/questions.ts +++ b/backend/src/services/questions.ts @@ -11,11 +11,13 @@ import { mapToAnswerDTO, mapToAnswerDTOId } from '../interfaces/answer.js'; import { QuestionRepository } from '../data/questions/question-repository.js'; import { LearningObjectIdentifier } from '../entities/content/learning-object-identifier.js'; import { mapToStudent } from '../interfaces/student.js'; -import { QuestionDTO, QuestionId } from '@dwengo-1/common/interfaces/question'; +import {QuestionData, QuestionDTO, QuestionId} from '@dwengo-1/common/interfaces/question'; import { AnswerDTO, AnswerId } from '@dwengo-1/common/interfaces/answer'; import {fetchStudent} from "./students"; import {mapToAssignment} from "../interfaces/assignment"; import { NotFoundException } from '../exceptions/not-found-exception.js'; +import {AssignmentDTO} from "@dwengo-1/common/interfaces/assignment"; +import {FALLBACK_VERSION_NUM} from "../config"; export async function getQuestionsAboutLearningObjectInAssignment( loId: LearningObjectIdentifier, @@ -90,10 +92,9 @@ export async function createQuestion(loId: LearningObjectIdentifier, questionDat const author = await fetchStudent(questionData.author!); const content = questionData.content; - const clazz = await getClassRepository().findById((questionDTO.inGroup.assignment as AssignmentDTO).class); - let questionDTO; - const assignment = mapToAssignment(questionDTO.inGroup.assignment as AssignmentDTO, clazz!); - const inGroup = await getGroupRepository().findByAssignmentAndGroupNumber(assignment, questionDTO.inGroup.groupNumber); + const clazz = await getClassRepository().findById((questionData.inGroup.assignment as AssignmentDTO).class); + const assignment = mapToAssignment(questionData.inGroup.assignment as AssignmentDTO, clazz!); + const inGroup = (await getGroupRepository().findByAssignmentAndGroupNumber(assignment, questionData.inGroup.groupNumber))!; const question = await questionRepository.createQuestion({ loId, diff --git a/common/src/interfaces/question.ts b/common/src/interfaces/question.ts index 582e12dd..2d681fc0 100644 --- a/common/src/interfaces/question.ts +++ b/common/src/interfaces/question.ts @@ -13,6 +13,7 @@ export interface QuestionDTO { export interface QuestionData { author?: string; + inGroup: GroupDTO; content: string; } From f671341bad962c3f59a3cbaae2f54aa89bfb9af3 Mon Sep 17 00:00:00 2001 From: Gabriellvl Date: Fri, 18 Apr 2025 22:33:22 +0200 Subject: [PATCH 019/128] feat: teacher invitation middelware + extra error catchings --- .../src/controllers/teacher-invitations.ts | 5 ++++ .../auth/checks/teacher-invitation-checks.ts | 23 +++++++++++++++++++ backend/src/routes/teacher-invitations.ts | 16 +++++++++---- backend/src/services/teacher-invitations.ts | 4 ++++ 4 files changed, 43 insertions(+), 5 deletions(-) create mode 100644 backend/src/middleware/auth/checks/teacher-invitation-checks.ts diff --git a/backend/src/controllers/teacher-invitations.ts b/backend/src/controllers/teacher-invitations.ts index 4956f3e2..c69415ec 100644 --- a/backend/src/controllers/teacher-invitations.ts +++ b/backend/src/controllers/teacher-invitations.ts @@ -2,6 +2,7 @@ import { Request, Response } from 'express'; import { requireFields } from './error-helper'; import { createInvitation, deleteInvitation, getAllInvitations, getInvitation, updateInvitation } from '../services/teacher-invitations'; import { TeacherInvitationData } from '@dwengo-1/common/interfaces/teacher-invitation'; +import {ConflictException} from "../exceptions/conflict-exception"; export async function getAllInvitationsHandler(req: Request, res: Response): Promise { const username = req.params.username; @@ -30,6 +31,10 @@ export async function createInvitationHandler(req: Request, res: Response): Prom const classId = req.body.class; requireFields({ sender, receiver, classId }); + if (sender === receiver){ + throw new ConflictException("Cannot send an invitation to yourself"); + } + const data = req.body as TeacherInvitationData; const invitation = await createInvitation(data); diff --git a/backend/src/middleware/auth/checks/teacher-invitation-checks.ts b/backend/src/middleware/auth/checks/teacher-invitation-checks.ts new file mode 100644 index 00000000..6ebc8512 --- /dev/null +++ b/backend/src/middleware/auth/checks/teacher-invitation-checks.ts @@ -0,0 +1,23 @@ +import {authorize} from "./auth-checks"; +import {AuthenticationInfo} from "../authentication-info"; +import {AuthenticatedRequest} from "../authenticated-request"; + +export const onlyAllowSenderOrReceiver = authorize( + (auth: AuthenticationInfo, req: AuthenticatedRequest) => + req.params.sender === auth.username || req.params.receiver === auth.username +); + +export const onlyAllowSender = authorize( + (auth: AuthenticationInfo, req: AuthenticatedRequest) => + req.params.sender === auth.username +); + +export const onlyAllowSenderBody = authorize( + (auth: AuthenticationInfo, req: AuthenticatedRequest) => + req.body.sender === auth.username +); + +export const onlyAllowReceiverBody = authorize( + (auth: AuthenticationInfo, req: AuthenticatedRequest) => + req.body.receiver === auth.username +); diff --git a/backend/src/routes/teacher-invitations.ts b/backend/src/routes/teacher-invitations.ts index 772b1351..fe0b924f 100644 --- a/backend/src/routes/teacher-invitations.ts +++ b/backend/src/routes/teacher-invitations.ts @@ -6,17 +6,23 @@ import { getInvitationHandler, updateInvitationHandler, } from '../controllers/teacher-invitations'; +import {onlyAllowUserHimself} from "../middleware/auth/checks/user-auth-checks"; +import { + onlyAllowReceiverBody, onlyAllowSender, + onlyAllowSenderBody, + onlyAllowSenderOrReceiver +} from "../middleware/auth/checks/teacher-invitation-checks"; const router = express.Router({ mergeParams: true }); -router.get('/:username', getAllInvitationsHandler); +router.get('/:username', onlyAllowUserHimself, getAllInvitationsHandler); -router.get('/:sender/:receiver/:classId', getInvitationHandler); +router.get('/:sender/:receiver/:classId', onlyAllowSenderOrReceiver ,getInvitationHandler); -router.post('/', createInvitationHandler); +router.post('/', onlyAllowSenderBody, createInvitationHandler); -router.put('/', updateInvitationHandler); +router.put('/', onlyAllowReceiverBody, updateInvitationHandler); -router.delete('/:sender/:receiver/:classId', deleteInvitationHandler); +router.delete('/:sender/:receiver/:classId', onlyAllowSender, deleteInvitationHandler); export default router; diff --git a/backend/src/services/teacher-invitations.ts b/backend/src/services/teacher-invitations.ts index 07f61bae..c50e00b1 100644 --- a/backend/src/services/teacher-invitations.ts +++ b/backend/src/services/teacher-invitations.ts @@ -32,6 +32,10 @@ export async function createInvitation(data: TeacherInvitationData): Promise Date: Fri, 18 Apr 2025 23:28:55 +0200 Subject: [PATCH 020/128] feat: question + answer checks --- .../middleware/auth/checks/question-checks.ts | 48 +++++++++++++++++++ backend/src/routes/answers.ts | 13 +++-- backend/src/routes/questions.ts | 15 ++++-- backend/src/services/answers.ts | 2 +- 4 files changed, 67 insertions(+), 11 deletions(-) create mode 100644 backend/src/middleware/auth/checks/question-checks.ts diff --git a/backend/src/middleware/auth/checks/question-checks.ts b/backend/src/middleware/auth/checks/question-checks.ts new file mode 100644 index 00000000..63b47e7b --- /dev/null +++ b/backend/src/middleware/auth/checks/question-checks.ts @@ -0,0 +1,48 @@ +import {authorize} from "./auth-checks"; +import {AuthenticationInfo} from "../authentication-info"; +import {AuthenticatedRequest} from "../authenticated-request"; +import {requireFields} from "../../../controllers/error-helper"; +import {getLearningObjectId, getQuestionId} from "../../../controllers/questions"; +import {fetchQuestion} from "../../../services/questions"; +import {FALLBACK_SEQ_NUM} from "../../../config"; +import {fetchAnswer} from "../../../services/answers"; + +export const onlyAllowAuthor = authorize( + (auth: AuthenticationInfo, req: AuthenticatedRequest) => req.body.author === auth.username +); + +export const onlyAllowAuthorRequest = authorize( + (auth: AuthenticationInfo, req: AuthenticatedRequest) => { + const hruid = req.params.hruid; + const version = req.params.version; + const language = req.query.lang as string; + const seq = req.params.seq; + requireFields({ hruid }); + + const learningObjectId = getLearningObjectId(hruid, version, language); + const questionId = getQuestionId(learningObjectId, seq); + + const question = await fetchQuestion(questionId); + + return question.author.username == auth.username; + } +); + +export const onlyAllowAuthorRequestAnswer = authorize( + (auth: AuthenticationInfo, req: AuthenticatedRequest) => { + const hruid = req.params.hruid; + const version = req.params.version; + const language = req.query.lang as string; + const seq = req.params.seq; + const seqAnswer = req.params.seqAnswer; + requireFields({ hruid }); + + const learningObjectId = getLearningObjectId(hruid, version, language); + const questionId = getQuestionId(learningObjectId, seq); + + const sequenceNumber = Number(seqAnswer) || FALLBACK_SEQ_NUM; + const answer = await fetchAnswer(questionId, sequenceNumber); + + return answer.author.username == auth.username; + } +); diff --git a/backend/src/routes/answers.ts b/backend/src/routes/answers.ts index b74f76a0..0f11c173 100644 --- a/backend/src/routes/answers.ts +++ b/backend/src/routes/answers.ts @@ -1,16 +1,19 @@ import express from 'express'; import { createAnswerHandler, deleteAnswerHandler, getAnswerHandler, getAllAnswersHandler, updateAnswerHandler } from '../controllers/answers.js'; +import {adminOnly, authenticatedOnly, teachersOnly} from "../middleware/auth/checks/auth-checks"; +import {onlyAllowAuthor, onlyAllowAuthorRequestAnswer} from "../middleware/auth/checks/question-checks"; + const router = express.Router({ mergeParams: true }); -router.get('/', getAllAnswersHandler); +router.get('/', adminOnly, getAllAnswersHandler); -router.post('/', createAnswerHandler); +router.post('/', teachersOnly, onlyAllowAuthor, createAnswerHandler); -router.get('/:seqAnswer', getAnswerHandler); +router.get('/:seqAnswer', authenticatedOnly, getAnswerHandler); -router.delete('/:seqAnswer', deleteAnswerHandler); +router.delete('/:seqAnswer', teachersOnly, onlyAllowAuthorRequestAnswer, deleteAnswerHandler); -router.put('/:seqAnswer', updateAnswerHandler); +router.put('/:seqAnswer', teachersOnly, onlyAllowAuthorRequestAnswer, updateAnswerHandler); export default router; diff --git a/backend/src/routes/questions.ts b/backend/src/routes/questions.ts index 5135c197..287a242b 100644 --- a/backend/src/routes/questions.ts +++ b/backend/src/routes/questions.ts @@ -1,20 +1,25 @@ import express from 'express'; import { createQuestionHandler, deleteQuestionHandler, getAllQuestionsHandler, getQuestionHandler } from '../controllers/questions.js'; import answerRoutes from './answers.js'; +import {adminOnly, authenticatedOnly, studentsOnly} from "../middleware/auth/checks/auth-checks"; +import {updateAnswerHandler} from "../controllers/answers"; +import {onlyAllowAuthor, onlyAllowAuthorRequest} from "../middleware/auth/checks/question-checks"; const router = express.Router({ mergeParams: true }); // Query language // Root endpoint used to search objects -router.get('/', getAllQuestionsHandler); +router.get('/', adminOnly, getAllQuestionsHandler); -router.post('/', createQuestionHandler); - -router.delete('/:seq', deleteQuestionHandler); +router.post('/', studentsOnly, onlyAllowAuthor, createQuestionHandler); // Information about a question with id -router.get('/:seq', getQuestionHandler); +router.get('/:seq', authenticatedOnly, getQuestionHandler); // TODO every body in group + teachers? + +router.delete('/:seq', studentsOnly, onlyAllowAuthorRequest, deleteQuestionHandler); + +router.put("/:seq", studentsOnly, onlyAllowAuthorRequest, updateAnswerHandler); router.use('/:seq/answers', answerRoutes); diff --git a/backend/src/services/answers.ts b/backend/src/services/answers.ts index ab603883..7ec5773a 100644 --- a/backend/src/services/answers.ts +++ b/backend/src/services/answers.ts @@ -34,7 +34,7 @@ export async function createAnswer(questionId: QuestionId, answerData: AnswerDat return mapToAnswerDTO(answer); } -async function fetchAnswer(questionId: QuestionId, sequenceNumber: number): Promise { +export async function fetchAnswer(questionId: QuestionId, sequenceNumber: number): Promise { const answerRepository = getAnswerRepository(); const question = await fetchQuestion(questionId); const answer = await answerRepository.findAnswer(question, sequenceNumber); From 566bb5a5fb4003bc6ee2363485614339421b414d Mon Sep 17 00:00:00 2001 From: Gabriellvl Date: Sat, 19 Apr 2025 10:58:49 +0200 Subject: [PATCH 021/128] fix: add question in group check + extra create question errors service --- .../middleware/auth/checks/question-checks.ts | 24 +++++++++++++++++++ backend/src/routes/answers.ts | 8 +++++-- backend/src/routes/questions.ts | 8 +++++-- backend/src/services/questions.ts | 13 ++++++++-- 4 files changed, 47 insertions(+), 6 deletions(-) diff --git a/backend/src/middleware/auth/checks/question-checks.ts b/backend/src/middleware/auth/checks/question-checks.ts index 63b47e7b..bfe76061 100644 --- a/backend/src/middleware/auth/checks/question-checks.ts +++ b/backend/src/middleware/auth/checks/question-checks.ts @@ -6,6 +6,7 @@ import {getLearningObjectId, getQuestionId} from "../../../controllers/questions import {fetchQuestion} from "../../../services/questions"; import {FALLBACK_SEQ_NUM} from "../../../config"; import {fetchAnswer} from "../../../services/answers"; +import {mapToUsername} from "../../../interfaces/user"; export const onlyAllowAuthor = authorize( (auth: AuthenticationInfo, req: AuthenticatedRequest) => req.body.author === auth.username @@ -46,3 +47,26 @@ export const onlyAllowAuthorRequestAnswer = authorize( return answer.author.username == auth.username; } ); + +export const onlyAllowIfHasAccessToQuestion = authorize( + async (auth, req) => { + const hruid = req.params.hruid; + const version = req.params.version; + const language = req.query.lang as string; + const seq = req.params.seq; + requireFields({ hruid }); + + const learningObjectId = getLearningObjectId(hruid, version, language); + const questionId = getQuestionId(learningObjectId, seq); + + const question = await fetchQuestion(questionId); + const group = question.inGroup; + + if (auth.accountType === "teacher") { + const cls = group.assignment.within; // TODO check if contains full objects + return cls.teachers.map(mapToUsername).includes(auth.username); + } else { // user is student + return group.members.map(mapToUsername).includes(auth.username); + } + } +); diff --git a/backend/src/routes/answers.ts b/backend/src/routes/answers.ts index 0f11c173..2571c56d 100644 --- a/backend/src/routes/answers.ts +++ b/backend/src/routes/answers.ts @@ -1,7 +1,11 @@ import express from 'express'; import { createAnswerHandler, deleteAnswerHandler, getAnswerHandler, getAllAnswersHandler, updateAnswerHandler } from '../controllers/answers.js'; import {adminOnly, authenticatedOnly, teachersOnly} from "../middleware/auth/checks/auth-checks"; -import {onlyAllowAuthor, onlyAllowAuthorRequestAnswer} from "../middleware/auth/checks/question-checks"; +import { + onlyAllowAuthor, + onlyAllowAuthorRequestAnswer, + onlyAllowIfHasAccessToQuestion +} from "../middleware/auth/checks/question-checks"; const router = express.Router({ mergeParams: true }); @@ -10,7 +14,7 @@ router.get('/', adminOnly, getAllAnswersHandler); router.post('/', teachersOnly, onlyAllowAuthor, createAnswerHandler); -router.get('/:seqAnswer', authenticatedOnly, getAnswerHandler); +router.get('/:seqAnswer', onlyAllowIfHasAccessToQuestion, getAnswerHandler); router.delete('/:seqAnswer', teachersOnly, onlyAllowAuthorRequestAnswer, deleteAnswerHandler); diff --git a/backend/src/routes/questions.ts b/backend/src/routes/questions.ts index 287a242b..1363ae1a 100644 --- a/backend/src/routes/questions.ts +++ b/backend/src/routes/questions.ts @@ -3,7 +3,11 @@ import { createQuestionHandler, deleteQuestionHandler, getAllQuestionsHandler, g import answerRoutes from './answers.js'; import {adminOnly, authenticatedOnly, studentsOnly} from "../middleware/auth/checks/auth-checks"; import {updateAnswerHandler} from "../controllers/answers"; -import {onlyAllowAuthor, onlyAllowAuthorRequest} from "../middleware/auth/checks/question-checks"; +import { + onlyAllowAuthor, + onlyAllowAuthorRequest, + onlyAllowIfHasAccessToQuestion +} from "../middleware/auth/checks/question-checks"; const router = express.Router({ mergeParams: true }); @@ -15,7 +19,7 @@ router.get('/', adminOnly, getAllQuestionsHandler); router.post('/', studentsOnly, onlyAllowAuthor, createQuestionHandler); // Information about a question with id -router.get('/:seq', authenticatedOnly, getQuestionHandler); // TODO every body in group + teachers? +router.get('/:seq', onlyAllowIfHasAccessToQuestion, getQuestionHandler); router.delete('/:seq', studentsOnly, onlyAllowAuthorRequest, deleteQuestionHandler); diff --git a/backend/src/services/questions.ts b/backend/src/services/questions.ts index 49bf9e92..38f12689 100644 --- a/backend/src/services/questions.ts +++ b/backend/src/services/questions.ts @@ -12,6 +12,7 @@ import { AssignmentDTO } from '@dwengo-1/common/interfaces/assignment'; import { fetchStudent } from './students.js'; import { NotFoundException } from '../exceptions/not-found-exception'; import { FALLBACK_VERSION_NUM } from '../config.js'; +import {ConflictException} from "../exceptions/conflict-exception"; export async function getQuestionsAboutLearningObjectInAssignment( loId: LearningObjectIdentifier, @@ -88,12 +89,20 @@ export async function createQuestion(loId: LearningObjectIdentifier, questionDat const clazz = await getClassRepository().findById((questionData.inGroup.assignment as AssignmentDTO).within); const assignment = mapToAssignment(questionData.inGroup.assignment as AssignmentDTO, clazz!); - const inGroup = await getGroupRepository().findByAssignmentAndGroupNumber(assignment, questionData.inGroup.groupNumber); + const group = await getGroupRepository().findByAssignmentAndGroupNumber(assignment, questionData.inGroup.groupNumber); + + if (!group){ + throw new NotFoundException("Group with id and assignment not found"); + } + + if (! group.members.contains(author)) { + throw new ConflictException("Author is not part of this group"); + } const question = await questionRepository.createQuestion({ loId, author, - inGroup: inGroup!, + inGroup: group!, content, }); From cb4f6a512df065aa5aaa972c85b5383017775961 Mon Sep 17 00:00:00 2001 From: Gabriellvl Date: Sat, 19 Apr 2025 11:01:26 +0200 Subject: [PATCH 022/128] fix: includes check + gebruik fetches service laag --- backend/src/interfaces/user.ts | 4 +++ .../auth/checks/assignment-auth-checks.ts | 17 +++++------ .../auth/checks/class-auth-checks.ts | 29 +++++++++---------- .../auth/checks/group-auth-checker.ts | 13 +++++---- backend/src/services/students.ts | 3 +- backend/src/services/teachers.ts | 3 +- backend/tests/controllers/teachers.test.ts | 5 ++-- 7 files changed, 38 insertions(+), 36 deletions(-) diff --git a/backend/src/interfaces/user.ts b/backend/src/interfaces/user.ts index f4413b5e..88252a1e 100644 --- a/backend/src/interfaces/user.ts +++ b/backend/src/interfaces/user.ts @@ -10,6 +10,10 @@ export function mapToUserDTO(user: User): UserDTO { }; } +export function mapToUsername(user: {username: string}): string { + return user.username; +} + export function mapToUser(userData: UserDTO, userInstance: T): T { userInstance.username = userData.username; userInstance.firstName = userData.firstName; diff --git a/backend/src/middleware/auth/checks/assignment-auth-checks.ts b/backend/src/middleware/auth/checks/assignment-auth-checks.ts index a9bbe87f..e9b284c4 100644 --- a/backend/src/middleware/auth/checks/assignment-auth-checks.ts +++ b/backend/src/middleware/auth/checks/assignment-auth-checks.ts @@ -1,7 +1,8 @@ import {authorize} from "./auth-checks"; -import {getAssignment} from "../../../services/assignments"; -import {getClass} from "../../../services/classes"; +import {fetchAssignment, getAssignment} from "../../../services/assignments"; +import {fetchClass, getClass} from "../../../services/classes"; import {getAllGroups} from "../../../services/groups"; +import {mapToUsername} from "../../../interfaces/user"; /** * Expects the path to contain the path parameters 'classId' and 'id' (meaning the ID of the assignment). @@ -12,15 +13,13 @@ import {getAllGroups} from "../../../services/groups"; export const onlyAllowIfHasAccessToAssignment = authorize( async (auth, req) => { const { classid: classId, id: assignmentId } = req.params as { classid: string, id: number }; - const assignment = await getAssignment(classId, assignmentId); - if (assignment === null) { - return false; - } else if (auth.accountType === "teacher") { - const clazz = await getClass(assignment.class); - return auth.username in clazz!.teachers; + const assignment = await fetchAssignment(classId, assignmentId); + if (auth.accountType === "teacher") { + const clazz = await fetchClass(assignment.class); + return clazz.teachers.map(mapToUsername).includes(auth.username); } else { const groups = await getAllGroups(classId, assignmentId, false); - return groups.some(group => auth.username in (group.members as string[])); + return groups.some(group => group.members.map(mapToUsername).includes(auth.username) ); } } ); diff --git a/backend/src/middleware/auth/checks/class-auth-checks.ts b/backend/src/middleware/auth/checks/class-auth-checks.ts index c89a263f..1f8e685b 100644 --- a/backend/src/middleware/auth/checks/class-auth-checks.ts +++ b/backend/src/middleware/auth/checks/class-auth-checks.ts @@ -1,11 +1,12 @@ import {authorize} from "./auth-checks"; import {AuthenticationInfo} from "../authentication-info"; import {AuthenticatedRequest} from "../authenticated-request"; -import {getClass} from "../../../services/classes"; +import {fetchClass, getClass} from "../../../services/classes"; +import {mapToUsername} from "../../../interfaces/user"; async function teaches(teacherUsername: string, classId: string): Promise { - const clazz = await getClass(classId); - return clazz !== null && teacherUsername in clazz.teachers; + const clazz = await fetchClass(classId); + return clazz.teachers.map(mapToUsername).includes(teacherUsername); } /** @@ -20,7 +21,7 @@ export const onlyAllowStudentHimselfAndTeachersOfClass = authorize( } else if (auth.accountType === "teacher") { return teaches(auth.username, req.params.classId); } - return false; + return false; } ); @@ -41,13 +42,11 @@ export const onlyAllowTeacherOfClass = authorize( export const onlyAllowIfInClass = authorize( async (auth: AuthenticationInfo, req: AuthenticatedRequest) => { const classId = req.params.classId ?? req.params.classid ?? req.params.id; - const clazz = await getClass(classId); - if (clazz === null) { - return false; - } else if (auth.accountType === "teacher") { - return auth.username in clazz.teachers; + const clazz = await fetchClass(classId); + if (auth.accountType === "teacher") { + return clazz.teachers.map(mapToUsername).includes(auth.username); } - return auth.username in clazz.students; + return clazz.students.map(mapToUsername).includes(auth.username); } ); @@ -57,13 +56,11 @@ export const onlyAllowIfInClass = authorize( export const onlyAllowOwnClassInBody = authorize( async (auth, req) => { const classId = (req.body as {class: string})?.class; - const clazz = await getClass(classId); + const clazz = await fetchClass(classId); - if (clazz === null) { - return false; - } else if (auth.accountType === "teacher") { - return auth.username in clazz.teachers; + if (auth.accountType === "teacher") { + return clazz.teachers.map(mapToUsername).includes(auth.username); } - return auth.username in clazz.students; + return clazz.students.map(mapToUsername).includes(auth.username); } ); diff --git a/backend/src/middleware/auth/checks/group-auth-checker.ts b/backend/src/middleware/auth/checks/group-auth-checker.ts index f62ab3b9..0f42741e 100644 --- a/backend/src/middleware/auth/checks/group-auth-checker.ts +++ b/backend/src/middleware/auth/checks/group-auth-checker.ts @@ -1,6 +1,7 @@ import {authorize} from "./auth-checks"; -import {getClass} from "../../../services/classes"; -import {getGroup} from "../../../services/groups"; +import {fetchClass, getClass} from "../../../services/classes"; +import {fetchGroup, getGroup} from "../../../services/groups"; +import {mapToUsername} from "../../../interfaces/user"; /** * Expects the path to contain the path parameters 'classid', 'assignmentid' and 'groupid'. @@ -14,11 +15,11 @@ export const onlyAllowIfHasAccessToGroup = authorize( req.params as { classid: string, assignmentid: number, groupid: number }; if (auth.accountType === "teacher") { - const clazz = await getClass(classId); - return auth.username in clazz!.teachers; + const clazz = await fetchClass(classId); + return clazz.teachers.map(mapToUsername).includes(auth.username); } else { // user is student - const group = await getGroup(classId, assignmentId, groupId, false); - return group === null ? false : auth.username in (group.members as string[]); + const group = await fetchGroup(classId, assignmentId, groupId, false); + return clazz.students.map(mapToUsername).includes(auth.username); } } ); diff --git a/backend/src/services/students.ts b/backend/src/services/students.ts index 31dee851..7101960f 100644 --- a/backend/src/services/students.ts +++ b/backend/src/services/students.ts @@ -25,6 +25,7 @@ import { QuestionDTO, QuestionId } from '@dwengo-1/common/interfaces/question'; import { ClassJoinRequestDTO } from '@dwengo-1/common/interfaces/class-join-request'; import { ConflictException } from '../exceptions/conflict-exception.js'; import { Submission } from '../entities/assignments/submission.entity'; +import {mapToUsername} from "../interfaces/user"; export async function getAllStudents(full: boolean): Promise { const studentRepository = getStudentRepository(); @@ -34,7 +35,7 @@ export async function getAllStudents(full: boolean): Promise user.username); + return users.map(mapToUsername); } export async function fetchStudent(username: string): Promise { diff --git a/backend/src/services/teachers.ts b/backend/src/services/teachers.ts index a0e6c7a7..a76f88b7 100644 --- a/backend/src/services/teachers.ts +++ b/backend/src/services/teachers.ts @@ -30,6 +30,7 @@ import { QuestionDTO, QuestionId } from '@dwengo-1/common/interfaces/question'; import { ClassJoinRequestDTO } from '@dwengo-1/common/interfaces/class-join-request'; import { ClassStatus } from '@dwengo-1/common/util/class-join-request'; import { ConflictException } from '../exceptions/conflict-exception.js'; +import {mapToUsername} from "../interfaces/user"; export async function getAllTeachers(full: boolean): Promise { const teacherRepository: TeacherRepository = getTeacherRepository(); @@ -38,7 +39,7 @@ export async function getAllTeachers(full: boolean): Promise user.username); + return users.map(mapToUsername); } export async function fetchTeacher(username: string): Promise { diff --git a/backend/tests/controllers/teachers.test.ts b/backend/tests/controllers/teachers.test.ts index a73a79a5..39e59d6f 100644 --- a/backend/tests/controllers/teachers.test.ts +++ b/backend/tests/controllers/teachers.test.ts @@ -96,7 +96,7 @@ describe('Teacher controllers', () => { }); it('Teacher list', async () => { - req = { query: { full: 'true' } }; + req = { query: { full: 'false' } }; await getAllTeachersHandler(req as Request, res as Response); @@ -104,8 +104,7 @@ describe('Teacher controllers', () => { const result = jsonMock.mock.lastCall?.[0]; - const teacherUsernames = result.teachers.map((s: TeacherDTO) => s.username); - expect(teacherUsernames).toContain('testleerkracht1'); + expect(result.teachers).toContain('testleerkracht1'); expect(result.teachers).toHaveLength(5); }); From 9102268be1f9af14b9e452eb069f05ae3860bda6 Mon Sep 17 00:00:00 2001 From: Adriaan Jacquet Date: Tue, 22 Apr 2025 15:34:37 +0200 Subject: [PATCH 023/128] feat: assignment permissies geupdate --- .../auth/checks/assignment-auth-checks.ts | 13 +++++------ backend/src/routes/assignments.ts | 22 +++++-------------- backend/src/services/groups.ts | 9 ++++++++ 3 files changed, 21 insertions(+), 23 deletions(-) diff --git a/backend/src/middleware/auth/checks/assignment-auth-checks.ts b/backend/src/middleware/auth/checks/assignment-auth-checks.ts index e9b284c4..11199bb1 100644 --- a/backend/src/middleware/auth/checks/assignment-auth-checks.ts +++ b/backend/src/middleware/auth/checks/assignment-auth-checks.ts @@ -1,7 +1,7 @@ import {authorize} from "./auth-checks"; -import {fetchAssignment, getAssignment} from "../../../services/assignments"; -import {fetchClass, getClass} from "../../../services/classes"; -import {getAllGroups} from "../../../services/groups"; +import {fetchAssignment} from "../../../services/assignments"; +import {fetchClass} from "../../../services/classes"; +import {fetchAllGroups} from "../../../services/groups"; import {mapToUsername} from "../../../interfaces/user"; /** @@ -13,13 +13,12 @@ import {mapToUsername} from "../../../interfaces/user"; export const onlyAllowIfHasAccessToAssignment = authorize( async (auth, req) => { const { classid: classId, id: assignmentId } = req.params as { classid: string, id: number }; - const assignment = await fetchAssignment(classId, assignmentId); if (auth.accountType === "teacher") { - const clazz = await fetchClass(assignment.class); + const clazz = await fetchClass(classId); return clazz.teachers.map(mapToUsername).includes(auth.username); } else { - const groups = await getAllGroups(classId, assignmentId, false); - return groups.some(group => group.members.map(mapToUsername).includes(auth.username) ); + const groups = await fetchAllGroups(classId, assignmentId); + return groups.some(group => group.members.map((member) => member.username).includes(auth.username) ); } } ); diff --git a/backend/src/routes/assignments.ts b/backend/src/routes/assignments.ts index 5173a274..8bf42022 100644 --- a/backend/src/routes/assignments.ts +++ b/backend/src/routes/assignments.ts @@ -9,32 +9,22 @@ import { } from '../controllers/assignments.js'; import groupRouter from './groups.js'; import {adminOnly, teachersOnly} from "../middleware/auth/checks/auth-checks"; -import {onlyAllowOwnClassInBody} from "../middleware/auth/checks/class-auth-checks"; +import {onlyAllowIfInClass, onlyAllowOwnClassInBody} from "../middleware/auth/checks/class-auth-checks"; import {onlyAllowIfHasAccessToAssignment} from "../middleware/auth/checks/assignment-auth-checks"; const router = express.Router({ mergeParams: true }); -router.get('/', getAllAssignmentsHandler); -// Root endpoint used to search objects -router.get('/', adminOnly, getAllAssignmentsHandler); +router.get('/', teachersOnly, onlyAllowIfInClass, getAllAssignmentsHandler); -router.post('/', teachersOnly, onlyAllowOwnClassInBody, createAssignmentHandler); +router.post('/', teachersOnly, onlyAllowIfInClass, createAssignmentHandler); -router.get('/:id', getAssignmentHandler); -// Information about an assignment with id 'id' router.get('/:id', onlyAllowIfHasAccessToAssignment, getAssignmentHandler); -router.put('/:id', putAssignmentHandler); +router.put('/:id', teachersOnly, onlyAllowIfHasAccessToAssignment, putAssignmentHandler); -router.delete('/:id', deleteAssignmentHandler); +router.delete('/:id', teachersOnly, onlyAllowIfHasAccessToAssignment, deleteAssignmentHandler); -router.get('/:id/submissions', onlyAllowIfHasAccessToAssignment, getAssignmentsSubmissionsHandler); - -router.get('/:id/questions', onlyAllowIfHasAccessToAssignment, (_req, res) => { - res.json({ - questions: ['0'], - }); -}); +router.get('/:id/submissions', teachersOnly, onlyAllowIfHasAccessToAssignment, getAssignmentsSubmissionsHandler); router.use('/:assignmentid/groups', groupRouter); diff --git a/backend/src/services/groups.ts b/backend/src/services/groups.ts index 3c6f2919..b94d435c 100644 --- a/backend/src/services/groups.ts +++ b/backend/src/services/groups.ts @@ -22,6 +22,15 @@ export async function fetchGroup(classId: string, assignmentNumber: number, grou return group; } +export async function fetchAllGroups(classId: string, assignmentNumber: number): Promise { + const assignment = await fetchAssignment(classId, assignmentNumber); + + const groupRepository = getGroupRepository(); + const groups = await groupRepository.findAllGroupsForAssignment(assignment); + + return groups; +} + export async function getGroup(classId: string, assignmentNumber: number, groupNumber: number): Promise { const group = await fetchGroup(classId, assignmentNumber, groupNumber); return mapToGroupDTO(group); From 7c41c8e615cabe62d3530bd06661fe7ae54bf17e Mon Sep 17 00:00:00 2001 From: Adriaan Jacquet Date: Tue, 22 Apr 2025 15:37:22 +0200 Subject: [PATCH 024/128] feat: class permissies geupdate --- backend/src/routes/classes.ts | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/backend/src/routes/classes.ts b/backend/src/routes/classes.ts index 640d8513..9cf20ec0 100644 --- a/backend/src/routes/classes.ts +++ b/backend/src/routes/classes.ts @@ -19,31 +19,30 @@ import {onlyAllowIfInClass} from "../middleware/auth/checks/class-auth-checks"; const router = express.Router(); -// Root endpoint used to search objects router.get('/', adminOnly, getAllClassesHandler); router.post('/', teachersOnly, createClassHandler); -// Information about an class with id 'id' router.get('/:id', onlyAllowIfInClass, getClassHandler); -router.put('/:id', putClassHandler); +router.put('/:id', teachersOnly, onlyAllowIfInClass, putClassHandler); -router.delete('/:id', deleteClassHandler); +router.delete('/:id', teachersOnly, onlyAllowIfInClass, deleteClassHandler); router.get('/:id/teacher-invitations', teachersOnly, onlyAllowIfInClass, getTeacherInvitationsHandler); router.get('/:id/students', onlyAllowIfInClass, getClassStudentsHandler); -router.post('/:id/students', addClassStudentHandler); +router.post('/:id/students', teachersOnly, onlyAllowIfInClass, addClassStudentHandler); -router.delete('/:id/students/:username', deleteClassStudentHandler); +router.delete('/:id/students/:username', teachersOnly, onlyAllowIfInClass, deleteClassStudentHandler); -router.get('/:id/teachers', getClassTeachersHandler); +router.get('/:id/teachers', onlyAllowIfInClass, getClassTeachersHandler); -router.post('/:id/teachers', addClassTeacherHandler); +// De combinatie van deze POST en DELETE endpoints kan lethal zijn +router.post('/:id/teachers', teachersOnly, onlyAllowIfInClass, addClassTeacherHandler); -router.delete('/:id/teachers/:username', deleteClassTeacherHandler); +router.delete('/:id/teachers/:username', teachersOnly, onlyAllowIfInClass, deleteClassTeacherHandler); router.use('/:classid/assignments', assignmentRouter); From a4ccae6c0d7a32d3b259b4245d1fa852bd19b745 Mon Sep 17 00:00:00 2001 From: Adriaan Jacquet Date: Tue, 22 Apr 2025 16:47:31 +0200 Subject: [PATCH 025/128] feat: authenticatie voor submissions en groups toegevoegd --- .../auth/checks/group-auth-checker.ts | 4 +-- .../middleware/auth/checks/question-checks.ts | 8 ++--- .../auth/checks/submission-checks.ts | 29 +++++++++++++++++++ backend/src/routes/groups.ts | 8 ++--- backend/src/routes/submissions.ts | 13 +++++---- 5 files changed, 45 insertions(+), 17 deletions(-) create mode 100644 backend/src/middleware/auth/checks/submission-checks.ts diff --git a/backend/src/middleware/auth/checks/group-auth-checker.ts b/backend/src/middleware/auth/checks/group-auth-checker.ts index 0f42741e..73df4fb5 100644 --- a/backend/src/middleware/auth/checks/group-auth-checker.ts +++ b/backend/src/middleware/auth/checks/group-auth-checker.ts @@ -18,8 +18,8 @@ export const onlyAllowIfHasAccessToGroup = authorize( const clazz = await fetchClass(classId); return clazz.teachers.map(mapToUsername).includes(auth.username); } else { // user is student - const group = await fetchGroup(classId, assignmentId, groupId, false); - return clazz.students.map(mapToUsername).includes(auth.username); + const group = await fetchGroup(classId, assignmentId, groupId); + return group.members.map(mapToUsername).includes(auth.username); } } ); diff --git a/backend/src/middleware/auth/checks/question-checks.ts b/backend/src/middleware/auth/checks/question-checks.ts index bfe76061..c83e1de2 100644 --- a/backend/src/middleware/auth/checks/question-checks.ts +++ b/backend/src/middleware/auth/checks/question-checks.ts @@ -9,11 +9,11 @@ import {fetchAnswer} from "../../../services/answers"; import {mapToUsername} from "../../../interfaces/user"; export const onlyAllowAuthor = authorize( - (auth: AuthenticationInfo, req: AuthenticatedRequest) => req.body.author === auth.username + (auth: AuthenticationInfo, req: AuthenticatedRequest) => (req.body as { author: string }).author === auth.username ); export const onlyAllowAuthorRequest = authorize( - (auth: AuthenticationInfo, req: AuthenticatedRequest) => { + async (auth: AuthenticationInfo, req: AuthenticatedRequest) => { const hruid = req.params.hruid; const version = req.params.version; const language = req.query.lang as string; @@ -30,7 +30,7 @@ export const onlyAllowAuthorRequest = authorize( ); export const onlyAllowAuthorRequestAnswer = authorize( - (auth: AuthenticationInfo, req: AuthenticatedRequest) => { + async (auth: AuthenticationInfo, req: AuthenticatedRequest) => { const hruid = req.params.hruid; const version = req.params.version; const language = req.query.lang as string; @@ -49,7 +49,7 @@ export const onlyAllowAuthorRequestAnswer = authorize( ); export const onlyAllowIfHasAccessToQuestion = authorize( - async (auth, req) => { + async (auth: AuthenticationInfo, req: AuthenticatedRequest) => { const hruid = req.params.hruid; const version = req.params.version; const language = req.query.lang as string; diff --git a/backend/src/middleware/auth/checks/submission-checks.ts b/backend/src/middleware/auth/checks/submission-checks.ts new file mode 100644 index 00000000..78087fa9 --- /dev/null +++ b/backend/src/middleware/auth/checks/submission-checks.ts @@ -0,0 +1,29 @@ +import { languageMap } from "dwengo-1-common/util/language"; +import { LearningObjectIdentifier } from "../../../entities/content/learning-object-identifier"; +import { fetchSubmission } from "../../../services/submissions"; +import { AuthenticatedRequest } from "../authenticated-request"; +import { AuthenticationInfo } from "../authentication-info"; +import { authorize } from "./auth-checks"; +import { FALLBACK_LANG } from "../../../config"; +import { mapToUsername } from "../../../interfaces/user"; + +export const onlyAllowSubmitter = authorize( + (auth: AuthenticationInfo, req: AuthenticatedRequest) => (req.body as { submitter: string }).submitter === auth.username +); + +export const onlyAllowIfHasAccessToSubmission = authorize( + async (auth: AuthenticationInfo, req: AuthenticatedRequest) => { + const { hruid: lohruid, id: submissionNumber } = req.params; + const { language: lang, version: version } = req.query; + + const loId = new LearningObjectIdentifier(lohruid, languageMap[lang as string] ?? FALLBACK_LANG, Number(version)) + const submission = await fetchSubmission(loId, Number(submissionNumber)); + + if (auth.accountType === "teacher") { + // Dit kan niet werken om dat al deze objecten niet gepopulate zijn. + return submission.onBehalfOf.assignment.within.teachers.map(mapToUsername).includes(auth.username); + } + + return submission.onBehalfOf.members.map(mapToUsername).includes(auth.username); + } +) \ No newline at end of file diff --git a/backend/src/routes/groups.ts b/backend/src/routes/groups.ts index 8264e584..5d3d8ed0 100644 --- a/backend/src/routes/groups.ts +++ b/backend/src/routes/groups.ts @@ -13,17 +13,15 @@ import {onlyAllowIfHasAccessToAssignment} from "../middleware/auth/checks/assign const router = express.Router({ mergeParams: true }); -// Root endpoint used to search objects router.get('/', onlyAllowIfHasAccessToAssignment, getAllGroupsHandler); router.post('/', teachersOnly, onlyAllowIfHasAccessToAssignment, createGroupHandler); -// Information about a group (members, ... [TODO DOC]) -router.get('/:groupid', onlyAllowIfHasAccessToGroup, getGroupHandler); +router.get('/:groupid', onlyAllowIfHasAccessToAssignment, getGroupHandler); -router.put('/:groupid', putGroupHandler); +router.put('/:groupid', teachersOnly, onlyAllowIfHasAccessToAssignment, putGroupHandler); -router.delete('/:groupid', deleteGroupHandler); +router.delete('/:groupid', teachersOnly, onlyAllowIfHasAccessToAssignment, deleteGroupHandler); router.get('/:groupid/submissions', onlyAllowIfHasAccessToGroup, getGroupSubmissionsHandler); diff --git a/backend/src/routes/submissions.ts b/backend/src/routes/submissions.ts index 492b6439..8030f9f8 100644 --- a/backend/src/routes/submissions.ts +++ b/backend/src/routes/submissions.ts @@ -1,15 +1,16 @@ import express from 'express'; import { createSubmissionHandler, deleteSubmissionHandler, getSubmissionHandler, getSubmissionsHandler } from '../controllers/submissions.js'; +import { onlyAllowAuthor } from '../middleware/auth/checks/question-checks.js'; +import { onlyAllowIfHasAccessToSubmission, onlyAllowSubmitter } from '../middleware/auth/checks/submission-checks.js'; +import { adminOnly, studentsOnly } from '../middleware/auth/checks/auth-checks.js'; const router = express.Router({ mergeParams: true }); -// Root endpoint used to search objects -router.get('/', getSubmissionsHandler); +router.get('/', adminOnly, getSubmissionsHandler); -router.post('/:id', createSubmissionHandler); +router.post('/:id', studentsOnly, onlyAllowSubmitter, createSubmissionHandler); -// Information about an submission with id 'id' -router.get('/:id', getSubmissionHandler); +router.get('/:id', onlyAllowIfHasAccessToSubmission, getSubmissionHandler); -router.delete('/:id', deleteSubmissionHandler); +router.delete('/:id', onlyAllowIfHasAccessToSubmission, deleteSubmissionHandler); export default router; From b4b9abcc487716be1e9f97c56e8b4beb5c361992 Mon Sep 17 00:00:00 2001 From: Adriaan Jacquet Date: Tue, 22 Apr 2025 16:56:03 +0200 Subject: [PATCH 026/128] fix: fixed syntax & typescript errors --- .../auth/checks/learning-content-auth-checks.ts | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/backend/src/middleware/auth/checks/learning-content-auth-checks.ts b/backend/src/middleware/auth/checks/learning-content-auth-checks.ts index 57a3021d..64d78c73 100644 --- a/backend/src/middleware/auth/checks/learning-content-auth-checks.ts +++ b/backend/src/middleware/auth/checks/learning-content-auth-checks.ts @@ -1,7 +1,7 @@ import {authorize} from "./auth-checks"; import {AuthenticationInfo} from "../authentication-info"; import {AuthenticatedRequest} from "../authenticated-request"; -import {getGroup} from "../../../services/groups"; +import {fetchGroup, getGroup} from "../../../services/groups"; /** * Only allows requests whose learning path personalization query parameters ('forGroup' / 'assignmentNo' / 'classId') @@ -13,9 +13,10 @@ import {getGroup} from "../../../services/groups"; export const onlyAllowPersonalizationForOwnGroup = authorize( async (auth: AuthenticationInfo, req: AuthenticatedRequest) => { const {forGroup, assignmentNo, classId} = req.params; - if (forGroup && assignmentNo && classId) { - const group = getGroup(forGroup, parseInt(assignmentNo), classId, false); - + if (auth.accountType === "student" && forGroup && assignmentNo && classId) { + // TODO: groupNumber? + // const group = await fetchGroup(Number(classId), Number(assignmentNo), ) + return false; } else { return true; } From 356d4aafaddf3d4ffddfb32d2c7102ec64100295 Mon Sep 17 00:00:00 2001 From: Adriaan Jacquet Date: Tue, 22 Apr 2025 17:33:22 +0200 Subject: [PATCH 027/128] feat: assignment's question endpoint authenticatie --- backend/src/routes/assignments.ts | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/backend/src/routes/assignments.ts b/backend/src/routes/assignments.ts index 8bf42022..7b2d66fa 100644 --- a/backend/src/routes/assignments.ts +++ b/backend/src/routes/assignments.ts @@ -8,8 +8,8 @@ import { putAssignmentHandler, } from '../controllers/assignments.js'; import groupRouter from './groups.js'; -import {adminOnly, teachersOnly} from "../middleware/auth/checks/auth-checks"; -import {onlyAllowIfInClass, onlyAllowOwnClassInBody} from "../middleware/auth/checks/class-auth-checks"; +import {teachersOnly} from "../middleware/auth/checks/auth-checks"; +import {onlyAllowIfInClass} from "../middleware/auth/checks/class-auth-checks"; import {onlyAllowIfHasAccessToAssignment} from "../middleware/auth/checks/assignment-auth-checks"; const router = express.Router({ mergeParams: true }); @@ -26,6 +26,12 @@ router.delete('/:id', teachersOnly, onlyAllowIfHasAccessToAssignment, deleteAssi router.get('/:id/submissions', teachersOnly, onlyAllowIfHasAccessToAssignment, getAssignmentsSubmissionsHandler); +router.get('/:id/questions', teachersOnly, onlyAllowIfHasAccessToAssignment, (_req, res) => { + res.json({ + questions: ['0'], + }); +}); + router.use('/:assignmentid/groups', groupRouter); export default router; From 7f670030a762ef2e83b8439ab63971082019bbfe Mon Sep 17 00:00:00 2001 From: Adriaan Jacquet Date: Tue, 22 Apr 2025 17:57:18 +0200 Subject: [PATCH 028/128] fix: fixed linter errors --- .../src/middleware/auth/checks/assignment-auth-checks.ts | 5 ++--- backend/src/middleware/auth/checks/class-auth-checks.ts | 2 +- backend/src/middleware/auth/checks/group-auth-checker.ts | 8 ++++---- .../auth/checks/learning-content-auth-checks.ts | 7 +++---- backend/src/middleware/auth/checks/question-checks.ts | 8 ++++---- .../middleware/auth/checks/teacher-invitation-checks.ts | 4 ++-- backend/src/routes/answers.ts | 2 +- backend/src/routes/questions.ts | 2 +- backend/src/services/questions.ts | 2 +- backend/src/services/students.ts | 3 ++- backend/src/services/teachers.ts | 3 ++- backend/tests/controllers/teachers.test.ts | 1 - frontend/src/services/auth/auth-service.ts | 4 ---- 13 files changed, 23 insertions(+), 28 deletions(-) diff --git a/backend/src/middleware/auth/checks/assignment-auth-checks.ts b/backend/src/middleware/auth/checks/assignment-auth-checks.ts index 11199bb1..070df4a0 100644 --- a/backend/src/middleware/auth/checks/assignment-auth-checks.ts +++ b/backend/src/middleware/auth/checks/assignment-auth-checks.ts @@ -1,5 +1,4 @@ import {authorize} from "./auth-checks"; -import {fetchAssignment} from "../../../services/assignments"; import {fetchClass} from "../../../services/classes"; import {fetchAllGroups} from "../../../services/groups"; import {mapToUsername} from "../../../interfaces/user"; @@ -16,9 +15,9 @@ export const onlyAllowIfHasAccessToAssignment = authorize( if (auth.accountType === "teacher") { const clazz = await fetchClass(classId); return clazz.teachers.map(mapToUsername).includes(auth.username); - } else { + } const groups = await fetchAllGroups(classId, assignmentId); return groups.some(group => group.members.map((member) => member.username).includes(auth.username) ); - } + } ); diff --git a/backend/src/middleware/auth/checks/class-auth-checks.ts b/backend/src/middleware/auth/checks/class-auth-checks.ts index 1f8e685b..603142be 100644 --- a/backend/src/middleware/auth/checks/class-auth-checks.ts +++ b/backend/src/middleware/auth/checks/class-auth-checks.ts @@ -1,7 +1,7 @@ import {authorize} from "./auth-checks"; import {AuthenticationInfo} from "../authentication-info"; import {AuthenticatedRequest} from "../authenticated-request"; -import {fetchClass, getClass} from "../../../services/classes"; +import {fetchClass} from "../../../services/classes"; import {mapToUsername} from "../../../interfaces/user"; async function teaches(teacherUsername: string, classId: string): Promise { diff --git a/backend/src/middleware/auth/checks/group-auth-checker.ts b/backend/src/middleware/auth/checks/group-auth-checker.ts index 73df4fb5..643a3713 100644 --- a/backend/src/middleware/auth/checks/group-auth-checker.ts +++ b/backend/src/middleware/auth/checks/group-auth-checker.ts @@ -1,6 +1,6 @@ import {authorize} from "./auth-checks"; -import {fetchClass, getClass} from "../../../services/classes"; -import {fetchGroup, getGroup} from "../../../services/groups"; +import {fetchClass} from "../../../services/classes"; +import {fetchGroup} from "../../../services/groups"; import {mapToUsername} from "../../../interfaces/user"; /** @@ -17,9 +17,9 @@ export const onlyAllowIfHasAccessToGroup = authorize( if (auth.accountType === "teacher") { const clazz = await fetchClass(classId); return clazz.teachers.map(mapToUsername).includes(auth.username); - } else { // user is student + } // User is student const group = await fetchGroup(classId, assignmentId, groupId); return group.members.map(mapToUsername).includes(auth.username); - } + } ); diff --git a/backend/src/middleware/auth/checks/learning-content-auth-checks.ts b/backend/src/middleware/auth/checks/learning-content-auth-checks.ts index 64d78c73..a13cd038 100644 --- a/backend/src/middleware/auth/checks/learning-content-auth-checks.ts +++ b/backend/src/middleware/auth/checks/learning-content-auth-checks.ts @@ -1,7 +1,6 @@ import {authorize} from "./auth-checks"; import {AuthenticationInfo} from "../authentication-info"; import {AuthenticatedRequest} from "../authenticated-request"; -import {fetchGroup, getGroup} from "../../../services/groups"; /** * Only allows requests whose learning path personalization query parameters ('forGroup' / 'assignmentNo' / 'classId') @@ -15,10 +14,10 @@ export const onlyAllowPersonalizationForOwnGroup = authorize( const {forGroup, assignmentNo, classId} = req.params; if (auth.accountType === "student" && forGroup && assignmentNo && classId) { // TODO: groupNumber? - // const group = await fetchGroup(Number(classId), Number(assignmentNo), ) + // Const group = await fetchGroup(Number(classId), Number(assignmentNo), ) return false; - } else { + } return true; - } + } ); diff --git a/backend/src/middleware/auth/checks/question-checks.ts b/backend/src/middleware/auth/checks/question-checks.ts index c83e1de2..38b1f0ef 100644 --- a/backend/src/middleware/auth/checks/question-checks.ts +++ b/backend/src/middleware/auth/checks/question-checks.ts @@ -25,7 +25,7 @@ export const onlyAllowAuthorRequest = authorize( const question = await fetchQuestion(questionId); - return question.author.username == auth.username; + return question.author.username === auth.username; } ); @@ -44,7 +44,7 @@ export const onlyAllowAuthorRequestAnswer = authorize( const sequenceNumber = Number(seqAnswer) || FALLBACK_SEQ_NUM; const answer = await fetchAnswer(questionId, sequenceNumber); - return answer.author.username == auth.username; + return answer.author.username === auth.username; } ); @@ -65,8 +65,8 @@ export const onlyAllowIfHasAccessToQuestion = authorize( if (auth.accountType === "teacher") { const cls = group.assignment.within; // TODO check if contains full objects return cls.teachers.map(mapToUsername).includes(auth.username); - } else { // user is student + } // User is student return group.members.map(mapToUsername).includes(auth.username); - } + } ); diff --git a/backend/src/middleware/auth/checks/teacher-invitation-checks.ts b/backend/src/middleware/auth/checks/teacher-invitation-checks.ts index 6ebc8512..27d0cab2 100644 --- a/backend/src/middleware/auth/checks/teacher-invitation-checks.ts +++ b/backend/src/middleware/auth/checks/teacher-invitation-checks.ts @@ -14,10 +14,10 @@ export const onlyAllowSender = authorize( export const onlyAllowSenderBody = authorize( (auth: AuthenticationInfo, req: AuthenticatedRequest) => - req.body.sender === auth.username + (req.body as { sender: string }).sender === auth.username ); export const onlyAllowReceiverBody = authorize( (auth: AuthenticationInfo, req: AuthenticatedRequest) => - req.body.receiver === auth.username + (req.body as { receiver: string }).receiver === auth.username ); diff --git a/backend/src/routes/answers.ts b/backend/src/routes/answers.ts index 2571c56d..a5ee6278 100644 --- a/backend/src/routes/answers.ts +++ b/backend/src/routes/answers.ts @@ -1,6 +1,6 @@ import express from 'express'; import { createAnswerHandler, deleteAnswerHandler, getAnswerHandler, getAllAnswersHandler, updateAnswerHandler } from '../controllers/answers.js'; -import {adminOnly, authenticatedOnly, teachersOnly} from "../middleware/auth/checks/auth-checks"; +import {adminOnly, teachersOnly} from "../middleware/auth/checks/auth-checks"; import { onlyAllowAuthor, onlyAllowAuthorRequestAnswer, diff --git a/backend/src/routes/questions.ts b/backend/src/routes/questions.ts index 1363ae1a..bffcbe9e 100644 --- a/backend/src/routes/questions.ts +++ b/backend/src/routes/questions.ts @@ -1,7 +1,7 @@ import express from 'express'; import { createQuestionHandler, deleteQuestionHandler, getAllQuestionsHandler, getQuestionHandler } from '../controllers/questions.js'; import answerRoutes from './answers.js'; -import {adminOnly, authenticatedOnly, studentsOnly} from "../middleware/auth/checks/auth-checks"; +import {adminOnly, studentsOnly} from "../middleware/auth/checks/auth-checks"; import {updateAnswerHandler} from "../controllers/answers"; import { onlyAllowAuthor, diff --git a/backend/src/services/questions.ts b/backend/src/services/questions.ts index 01e4cc5c..70400226 100644 --- a/backend/src/services/questions.ts +++ b/backend/src/services/questions.ts @@ -102,7 +102,7 @@ export async function createQuestion(loId: LearningObjectIdentifier, questionDat const question = await questionRepository.createQuestion({ loId, author, - inGroup: group!, + inGroup: group, content, }); diff --git a/backend/src/services/students.ts b/backend/src/services/students.ts index 95e836a0..09ba1643 100644 --- a/backend/src/services/students.ts +++ b/backend/src/services/students.ts @@ -59,7 +59,8 @@ export async function getStudent(username: string): Promise { return mapToStudentDTO(user); } -export async function createStudent(userData: StudentDTO, allowUpdate = false): Promise { +// TODO allowupdate parameter? +export async function createStudent(userData: StudentDTO, _allowUpdate = false): Promise { const studentRepository = getStudentRepository(); const newStudent = mapToStudent(userData); diff --git a/backend/src/services/teachers.ts b/backend/src/services/teachers.ts index 12148ebd..79072616 100644 --- a/backend/src/services/teachers.ts +++ b/backend/src/services/teachers.ts @@ -58,7 +58,8 @@ export async function getTeacher(username: string): Promise { return mapToTeacherDTO(user); } -export async function createTeacher(userData: TeacherDTO, update?: boolean): Promise { +// TODO update parameter +export async function createTeacher(userData: TeacherDTO, _update?: boolean): Promise { const teacherRepository: TeacherRepository = getTeacherRepository(); const newTeacher = mapToTeacher(userData); diff --git a/backend/tests/controllers/teachers.test.ts b/backend/tests/controllers/teachers.test.ts index 39e59d6f..26a2d56c 100644 --- a/backend/tests/controllers/teachers.test.ts +++ b/backend/tests/controllers/teachers.test.ts @@ -15,7 +15,6 @@ import { import { BadRequestException } from '../../src/exceptions/bad-request-exception.js'; import { EntityAlreadyExistsException } from '../../src/exceptions/entity-already-exists-exception.js'; import { getStudentRequestsHandler } from '../../src/controllers/students.js'; -import { TeacherDTO } from '@dwengo-1/common/interfaces/teacher'; import { getClassHandler } from '../../src/controllers/classes'; describe('Teacher controllers', () => { diff --git a/frontend/src/services/auth/auth-service.ts b/frontend/src/services/auth/auth-service.ts index 7b0ff5ee..a813cd6e 100644 --- a/frontend/src/services/auth/auth-service.ts +++ b/frontend/src/services/auth/auth-service.ts @@ -29,10 +29,6 @@ const authState = reactive({ activeRole: authStorage.getActiveRole() ?? null, }); -async function sendHello(): Promise { - return apiClient.post("/auth/hello"); -} - /** * Load the information about who is currently logged in from the IDP. */ From 0c47546814ad856a534611c76d2ea33836e466dc Mon Sep 17 00:00:00 2001 From: Lint Action Date: Tue, 22 Apr 2025 16:04:52 +0000 Subject: [PATCH 029/128] style: fix linting issues met Prettier --- backend/src/controllers/auth.ts | 40 ++++--- .../src/controllers/teacher-invitations.ts | 6 +- backend/src/interfaces/user.ts | 2 +- backend/src/middleware/auth/auth.ts | 10 +- .../auth/authenticated-request.d.ts | 4 +- .../auth/checks/assignment-auth-checks.ts | 27 ++--- .../src/middleware/auth/checks/auth-checks.ts | 26 +++-- .../auth/checks/class-auth-checks.ts | 62 +++++------ .../auth/checks/group-auth-checker.ts | 34 +++--- .../checks/learning-content-auth-checks.ts | 25 ++--- .../middleware/auth/checks/question-checks.ts | 105 ++++++++---------- .../auth/checks/submission-checks.ts | 40 ++++--- .../auth/checks/teacher-invitation-checks.ts | 20 ++-- .../auth/checks/user-auth-checks.ts | 10 +- backend/src/routes/answers.ts | 9 +- backend/src/routes/assignments.ts | 6 +- backend/src/routes/classes.ts | 4 +- backend/src/routes/groups.ts | 6 +- backend/src/routes/learning-objects.ts | 2 +- backend/src/routes/learning-paths.ts | 2 +- backend/src/routes/questions.ts | 12 +- backend/src/routes/student-join-requests.ts | 4 +- backend/src/routes/students.ts | 4 +- backend/src/routes/teacher-invitations.ts | 11 +- backend/src/routes/teachers.ts | 6 +- backend/src/routes/themes.ts | 2 +- backend/src/services/questions.ts | 10 +- backend/src/services/students.ts | 2 +- backend/src/services/teacher-invitations.ts | 2 +- backend/src/services/teachers.ts | 2 +- 30 files changed, 233 insertions(+), 262 deletions(-) diff --git a/backend/src/controllers/auth.ts b/backend/src/controllers/auth.ts index 14b05dc8..6395715d 100644 --- a/backend/src/controllers/auth.ts +++ b/backend/src/controllers/auth.ts @@ -2,10 +2,10 @@ import { UnauthorizedException } from '../exceptions/unauthorized-exception.js'; import { getLogger } from '../logging/initalize.js'; import { AuthenticatedRequest } from '../middleware/auth/authenticated-request.js'; import { envVars, getEnvVar } from '../util/envVars.js'; -import {createOrUpdateStudent, createStudent} from "../services/students"; -import {AuthenticationInfo} from "../middleware/auth/authentication-info"; -import {Request, Response} from "express"; -import {createOrUpdateTeacher, createTeacher} from "../services/teachers"; +import { createOrUpdateStudent, createStudent } from '../services/students'; +import { AuthenticationInfo } from '../middleware/auth/authentication-info'; +import { Request, Response } from 'express'; +import { createOrUpdateTeacher, createTeacher } from '../services/teachers'; interface FrontendIdpConfig { authority: string; @@ -47,20 +47,26 @@ export function handleGetFrontendAuthConfig(_req: Request, res: Response): void export async function handleHello(req: AuthenticatedRequest): Promise { const auth: AuthenticationInfo = req.auth!; - if (auth.accountType === "teacher") { - await createTeacher({ - id: auth.username, - username: auth.username, - firstName: auth.firstName ?? "", - lastName: auth.lastName ?? "", - }, true); + if (auth.accountType === 'teacher') { + await createTeacher( + { + id: auth.username, + username: auth.username, + firstName: auth.firstName ?? '', + lastName: auth.lastName ?? '', + }, + true + ); } else { - await createStudent({ - id: auth.username, - username: auth.username, - firstName: auth.firstName ?? "", - lastName: auth.lastName ?? "", - }, true); + await createStudent( + { + id: auth.username, + username: auth.username, + firstName: auth.firstName ?? '', + lastName: auth.lastName ?? '', + }, + true + ); } } diff --git a/backend/src/controllers/teacher-invitations.ts b/backend/src/controllers/teacher-invitations.ts index 0a8b89c0..f1350660 100644 --- a/backend/src/controllers/teacher-invitations.ts +++ b/backend/src/controllers/teacher-invitations.ts @@ -2,7 +2,7 @@ import { Request, Response } from 'express'; import { requireFields } from './error-helper.js'; import { createInvitation, deleteInvitation, getAllInvitations, getInvitation, updateInvitation } from '../services/teacher-invitations.js'; import { TeacherInvitationData } from '@dwengo-1/common/interfaces/teacher-invitation'; -import {ConflictException} from "../exceptions/conflict-exception"; +import { ConflictException } from '../exceptions/conflict-exception'; export async function getAllInvitationsHandler(req: Request, res: Response): Promise { const username = req.params.username; @@ -31,8 +31,8 @@ export async function createInvitationHandler(req: Request, res: Response): Prom const classId = req.body.class; requireFields({ sender, receiver, classId }); - if (sender === receiver){ - throw new ConflictException("Cannot send an invitation to yourself"); + if (sender === receiver) { + throw new ConflictException('Cannot send an invitation to yourself'); } const data = req.body as TeacherInvitationData; diff --git a/backend/src/interfaces/user.ts b/backend/src/interfaces/user.ts index 88252a1e..3084c494 100644 --- a/backend/src/interfaces/user.ts +++ b/backend/src/interfaces/user.ts @@ -10,7 +10,7 @@ export function mapToUserDTO(user: User): UserDTO { }; } -export function mapToUsername(user: {username: string}): string { +export function mapToUsername(user: { username: string }): string { return user.username; } diff --git a/backend/src/middleware/auth/auth.ts b/backend/src/middleware/auth/auth.ts index 158e2c28..24be4825 100644 --- a/backend/src/middleware/auth/auth.ts +++ b/backend/src/middleware/auth/auth.ts @@ -1,11 +1,11 @@ -import {envVars, getEnvVar} from '../../util/envVars.js'; -import {expressjwt} from 'express-jwt'; +import { envVars, getEnvVar } from '../../util/envVars.js'; +import { expressjwt } from 'express-jwt'; import * as jwt from 'jsonwebtoken'; -import {JwtPayload} from 'jsonwebtoken'; +import { JwtPayload } from 'jsonwebtoken'; import jwksClient from 'jwks-rsa'; import * as express from 'express'; -import {AuthenticatedRequest} from './authenticated-request.js'; -import {AuthenticationInfo} from './authentication-info.js'; +import { AuthenticatedRequest } from './authenticated-request.js'; +import { AuthenticationInfo } from './authentication-info.js'; import { UnauthorizedException } from '../../exceptions/unauthorized-exception.js'; const JWKS_CACHE = true; diff --git a/backend/src/middleware/auth/authenticated-request.d.ts b/backend/src/middleware/auth/authenticated-request.d.ts index c0049dc7..af7630af 100644 --- a/backend/src/middleware/auth/authenticated-request.d.ts +++ b/backend/src/middleware/auth/authenticated-request.d.ts @@ -1,7 +1,7 @@ import { Request } from 'express'; import { JwtPayload } from 'jsonwebtoken'; import { AuthenticationInfo } from './authentication-info.js'; -import * as core from "express-serve-static-core"; +import * as core from 'express-serve-static-core'; export interface AuthenticatedRequest< P = core.ParamsDictionary, @@ -9,7 +9,7 @@ export interface AuthenticatedRequest< ReqBody = unknown, ReqQuery = core.Query, Locals extends Record = Record, -> extends Request { +> extends Request { // Properties are optional since the user is not necessarily authenticated. jwtPayload?: JwtPayload; auth?: AuthenticationInfo; diff --git a/backend/src/middleware/auth/checks/assignment-auth-checks.ts b/backend/src/middleware/auth/checks/assignment-auth-checks.ts index 070df4a0..8328dec0 100644 --- a/backend/src/middleware/auth/checks/assignment-auth-checks.ts +++ b/backend/src/middleware/auth/checks/assignment-auth-checks.ts @@ -1,7 +1,7 @@ -import {authorize} from "./auth-checks"; -import {fetchClass} from "../../../services/classes"; -import {fetchAllGroups} from "../../../services/groups"; -import {mapToUsername} from "../../../interfaces/user"; +import { authorize } from './auth-checks'; +import { fetchClass } from '../../../services/classes'; +import { fetchAllGroups } from '../../../services/groups'; +import { mapToUsername } from '../../../interfaces/user'; /** * Expects the path to contain the path parameters 'classId' and 'id' (meaning the ID of the assignment). @@ -9,15 +9,12 @@ import {mapToUsername} from "../../../interfaces/user"; * - either teachers of the class the assignment was posted in, * - or students in a group of the assignment. */ -export const onlyAllowIfHasAccessToAssignment = authorize( - async (auth, req) => { - const { classid: classId, id: assignmentId } = req.params as { classid: string, id: number }; - if (auth.accountType === "teacher") { - const clazz = await fetchClass(classId); - return clazz.teachers.map(mapToUsername).includes(auth.username); - } - const groups = await fetchAllGroups(classId, assignmentId); - return groups.some(group => group.members.map((member) => member.username).includes(auth.username) ); - +export const onlyAllowIfHasAccessToAssignment = authorize(async (auth, req) => { + const { classid: classId, id: assignmentId } = req.params as { classid: string; id: number }; + if (auth.accountType === 'teacher') { + const clazz = await fetchClass(classId); + return clazz.teachers.map(mapToUsername).includes(auth.username); } -); + const groups = await fetchAllGroups(classId, assignmentId); + return groups.some((group) => group.members.map((member) => member.username).includes(auth.username)); +}); diff --git a/backend/src/middleware/auth/checks/auth-checks.ts b/backend/src/middleware/auth/checks/auth-checks.ts index d14e8dee..a4a75db5 100644 --- a/backend/src/middleware/auth/checks/auth-checks.ts +++ b/backend/src/middleware/auth/checks/auth-checks.ts @@ -1,9 +1,9 @@ -import {AuthenticationInfo} from "../authentication-info"; -import {AuthenticatedRequest} from "../authenticated-request"; -import * as express from "express"; -import {UnauthorizedException} from "../../../exceptions/unauthorized-exception"; -import {ForbiddenException} from "../../../exceptions/forbidden-exception"; -import {RequestHandler} from "express"; +import { AuthenticationInfo } from '../authentication-info'; +import { AuthenticatedRequest } from '../authenticated-request'; +import * as express from 'express'; +import { UnauthorizedException } from '../../../exceptions/unauthorized-exception'; +import { ForbiddenException } from '../../../exceptions/forbidden-exception'; +import { RequestHandler } from 'express'; /** * Middleware which rejects unauthenticated users (with HTTP 401) and authenticated users which do not fulfill @@ -11,13 +11,17 @@ import {RequestHandler} from "express"; * @param accessCondition Predicate over the current AuthenticationInfo. Access is only granted when this evaluates * to true. */ -export function authorize>( - accessCondition: (auth: AuthenticationInfo, req: AuthenticatedRequest) => boolean | Promise -): RequestHandler { - return async (req: AuthenticatedRequest, _res: express.Response, next: express.NextFunction): Promise => { +export function authorize>( + accessCondition: (auth: AuthenticationInfo, req: AuthenticatedRequest) => boolean | Promise +): RequestHandler { + return async ( + req: AuthenticatedRequest, + _res: express.Response, + next: express.NextFunction + ): Promise => { if (!req.auth) { throw new UnauthorizedException(); - } else if (!await accessCondition(req.auth, req)) { + } else if (!(await accessCondition(req.auth, req))) { throw new ForbiddenException(); } else { next(); diff --git a/backend/src/middleware/auth/checks/class-auth-checks.ts b/backend/src/middleware/auth/checks/class-auth-checks.ts index 603142be..6aae97b3 100644 --- a/backend/src/middleware/auth/checks/class-auth-checks.ts +++ b/backend/src/middleware/auth/checks/class-auth-checks.ts @@ -1,8 +1,8 @@ -import {authorize} from "./auth-checks"; -import {AuthenticationInfo} from "../authentication-info"; -import {AuthenticatedRequest} from "../authenticated-request"; -import {fetchClass} from "../../../services/classes"; -import {mapToUsername} from "../../../interfaces/user"; +import { authorize } from './auth-checks'; +import { AuthenticationInfo } from '../authentication-info'; +import { AuthenticatedRequest } from '../authenticated-request'; +import { fetchClass } from '../../../services/classes'; +import { mapToUsername } from '../../../interfaces/user'; async function teaches(teacherUsername: string, classId: string): Promise { const clazz = await fetchClass(classId); @@ -14,53 +14,45 @@ async function teaches(teacherUsername: string, classId: string): Promise { - if (req.params.username === auth.username) { - return true; - } else if (auth.accountType === "teacher") { - return teaches(auth.username, req.params.classId); - } - return false; - +export const onlyAllowStudentHimselfAndTeachersOfClass = authorize(async (auth: AuthenticationInfo, req: AuthenticatedRequest) => { + if (req.params.username === auth.username) { + return true; + } else if (auth.accountType === 'teacher') { + return teaches(auth.username, req.params.classId); } -); + return false; +}); /** * Only let the request pass through if its path parameter "username" is the username of the currently logged-in * teacher and the path parameter "classId" refers to a class the teacher teaches. */ export const onlyAllowTeacherOfClass = authorize( - async (auth: AuthenticationInfo, req: AuthenticatedRequest) => - req.params.username === auth.username && teaches(auth.username, req.params.classId), + async (auth: AuthenticationInfo, req: AuthenticatedRequest) => req.params.username === auth.username && teaches(auth.username, req.params.classId) ); /** * Only let the request pass through if the class id in it refers to a class the current user is in (as a student * or teacher) */ -export const onlyAllowIfInClass = authorize( - async (auth: AuthenticationInfo, req: AuthenticatedRequest) => { - const classId = req.params.classId ?? req.params.classid ?? req.params.id; - const clazz = await fetchClass(classId); - if (auth.accountType === "teacher") { - return clazz.teachers.map(mapToUsername).includes(auth.username); - } - return clazz.students.map(mapToUsername).includes(auth.username); +export const onlyAllowIfInClass = authorize(async (auth: AuthenticationInfo, req: AuthenticatedRequest) => { + const classId = req.params.classId ?? req.params.classid ?? req.params.id; + const clazz = await fetchClass(classId); + if (auth.accountType === 'teacher') { + return clazz.teachers.map(mapToUsername).includes(auth.username); } -); + return clazz.students.map(mapToUsername).includes(auth.username); +}); /** * Only allows the request to pass if the 'class' property in its body is a class the current user is a member of. */ -export const onlyAllowOwnClassInBody = authorize( - async (auth, req) => { - const classId = (req.body as {class: string})?.class; - const clazz = await fetchClass(classId); +export const onlyAllowOwnClassInBody = authorize(async (auth, req) => { + const classId = (req.body as { class: string })?.class; + const clazz = await fetchClass(classId); - if (auth.accountType === "teacher") { - return clazz.teachers.map(mapToUsername).includes(auth.username); - } - return clazz.students.map(mapToUsername).includes(auth.username); + if (auth.accountType === 'teacher') { + return clazz.teachers.map(mapToUsername).includes(auth.username); } -); + return clazz.students.map(mapToUsername).includes(auth.username); +}); diff --git a/backend/src/middleware/auth/checks/group-auth-checker.ts b/backend/src/middleware/auth/checks/group-auth-checker.ts index 643a3713..bebda954 100644 --- a/backend/src/middleware/auth/checks/group-auth-checker.ts +++ b/backend/src/middleware/auth/checks/group-auth-checker.ts @@ -1,7 +1,7 @@ -import {authorize} from "./auth-checks"; -import {fetchClass} from "../../../services/classes"; -import {fetchGroup} from "../../../services/groups"; -import {mapToUsername} from "../../../interfaces/user"; +import { authorize } from './auth-checks'; +import { fetchClass } from '../../../services/classes'; +import { fetchGroup } from '../../../services/groups'; +import { mapToUsername } from '../../../interfaces/user'; /** * Expects the path to contain the path parameters 'classid', 'assignmentid' and 'groupid'. @@ -9,17 +9,17 @@ import {mapToUsername} from "../../../interfaces/user"; * - either teachers of the class the assignment for the group was posted in, * - or students in the group */ -export const onlyAllowIfHasAccessToGroup = authorize( - async (auth, req) => { - const { classid: classId, assignmentid: assignmentId, groupid: groupId } = - req.params as { classid: string, assignmentid: number, groupid: number }; +export const onlyAllowIfHasAccessToGroup = authorize(async (auth, req) => { + const { + classid: classId, + assignmentid: assignmentId, + groupid: groupId, + } = req.params as { classid: string; assignmentid: number; groupid: number }; - if (auth.accountType === "teacher") { - const clazz = await fetchClass(classId); - return clazz.teachers.map(mapToUsername).includes(auth.username); - } // User is student - const group = await fetchGroup(classId, assignmentId, groupId); - return group.members.map(mapToUsername).includes(auth.username); - - } -); + if (auth.accountType === 'teacher') { + const clazz = await fetchClass(classId); + return clazz.teachers.map(mapToUsername).includes(auth.username); + } // User is student + const group = await fetchGroup(classId, assignmentId, groupId); + return group.members.map(mapToUsername).includes(auth.username); +}); diff --git a/backend/src/middleware/auth/checks/learning-content-auth-checks.ts b/backend/src/middleware/auth/checks/learning-content-auth-checks.ts index a13cd038..c0b34c52 100644 --- a/backend/src/middleware/auth/checks/learning-content-auth-checks.ts +++ b/backend/src/middleware/auth/checks/learning-content-auth-checks.ts @@ -1,6 +1,6 @@ -import {authorize} from "./auth-checks"; -import {AuthenticationInfo} from "../authentication-info"; -import {AuthenticatedRequest} from "../authenticated-request"; +import { authorize } from './auth-checks'; +import { AuthenticationInfo } from '../authentication-info'; +import { AuthenticatedRequest } from '../authenticated-request'; /** * Only allows requests whose learning path personalization query parameters ('forGroup' / 'assignmentNo' / 'classId') @@ -9,15 +9,12 @@ import {AuthenticatedRequest} from "../authenticated-request"; * - or set to a group the user is in, * - or set to anything if the user is a teacher. */ -export const onlyAllowPersonalizationForOwnGroup = authorize( - async (auth: AuthenticationInfo, req: AuthenticatedRequest) => { - const {forGroup, assignmentNo, classId} = req.params; - if (auth.accountType === "student" && forGroup && assignmentNo && classId) { - // TODO: groupNumber? - // Const group = await fetchGroup(Number(classId), Number(assignmentNo), ) - return false; - } - return true; - +export const onlyAllowPersonalizationForOwnGroup = authorize(async (auth: AuthenticationInfo, req: AuthenticatedRequest) => { + const { forGroup, assignmentNo, classId } = req.params; + if (auth.accountType === 'student' && forGroup && assignmentNo && classId) { + // TODO: groupNumber? + // Const group = await fetchGroup(Number(classId), Number(assignmentNo), ) + return false; } -); + return true; +}); diff --git a/backend/src/middleware/auth/checks/question-checks.ts b/backend/src/middleware/auth/checks/question-checks.ts index 38b1f0ef..c0a4329f 100644 --- a/backend/src/middleware/auth/checks/question-checks.ts +++ b/backend/src/middleware/auth/checks/question-checks.ts @@ -1,72 +1,65 @@ -import {authorize} from "./auth-checks"; -import {AuthenticationInfo} from "../authentication-info"; -import {AuthenticatedRequest} from "../authenticated-request"; -import {requireFields} from "../../../controllers/error-helper"; -import {getLearningObjectId, getQuestionId} from "../../../controllers/questions"; -import {fetchQuestion} from "../../../services/questions"; -import {FALLBACK_SEQ_NUM} from "../../../config"; -import {fetchAnswer} from "../../../services/answers"; -import {mapToUsername} from "../../../interfaces/user"; +import { authorize } from './auth-checks'; +import { AuthenticationInfo } from '../authentication-info'; +import { AuthenticatedRequest } from '../authenticated-request'; +import { requireFields } from '../../../controllers/error-helper'; +import { getLearningObjectId, getQuestionId } from '../../../controllers/questions'; +import { fetchQuestion } from '../../../services/questions'; +import { FALLBACK_SEQ_NUM } from '../../../config'; +import { fetchAnswer } from '../../../services/answers'; +import { mapToUsername } from '../../../interfaces/user'; export const onlyAllowAuthor = authorize( (auth: AuthenticationInfo, req: AuthenticatedRequest) => (req.body as { author: string }).author === auth.username ); -export const onlyAllowAuthorRequest = authorize( - async (auth: AuthenticationInfo, req: AuthenticatedRequest) => { - const hruid = req.params.hruid; - const version = req.params.version; - const language = req.query.lang as string; - const seq = req.params.seq; - requireFields({ hruid }); +export const onlyAllowAuthorRequest = authorize(async (auth: AuthenticationInfo, req: AuthenticatedRequest) => { + const hruid = req.params.hruid; + const version = req.params.version; + const language = req.query.lang as string; + const seq = req.params.seq; + requireFields({ hruid }); - const learningObjectId = getLearningObjectId(hruid, version, language); - const questionId = getQuestionId(learningObjectId, seq); + const learningObjectId = getLearningObjectId(hruid, version, language); + const questionId = getQuestionId(learningObjectId, seq); - const question = await fetchQuestion(questionId); + const question = await fetchQuestion(questionId); - return question.author.username === auth.username; - } -); + return question.author.username === auth.username; +}); -export const onlyAllowAuthorRequestAnswer = authorize( - async (auth: AuthenticationInfo, req: AuthenticatedRequest) => { - const hruid = req.params.hruid; - const version = req.params.version; - const language = req.query.lang as string; - const seq = req.params.seq; - const seqAnswer = req.params.seqAnswer; - requireFields({ hruid }); +export const onlyAllowAuthorRequestAnswer = authorize(async (auth: AuthenticationInfo, req: AuthenticatedRequest) => { + const hruid = req.params.hruid; + const version = req.params.version; + const language = req.query.lang as string; + const seq = req.params.seq; + const seqAnswer = req.params.seqAnswer; + requireFields({ hruid }); - const learningObjectId = getLearningObjectId(hruid, version, language); - const questionId = getQuestionId(learningObjectId, seq); + const learningObjectId = getLearningObjectId(hruid, version, language); + const questionId = getQuestionId(learningObjectId, seq); - const sequenceNumber = Number(seqAnswer) || FALLBACK_SEQ_NUM; - const answer = await fetchAnswer(questionId, sequenceNumber); + const sequenceNumber = Number(seqAnswer) || FALLBACK_SEQ_NUM; + const answer = await fetchAnswer(questionId, sequenceNumber); - return answer.author.username === auth.username; - } -); + return answer.author.username === auth.username; +}); -export const onlyAllowIfHasAccessToQuestion = authorize( - async (auth: AuthenticationInfo, req: AuthenticatedRequest) => { - const hruid = req.params.hruid; - const version = req.params.version; - const language = req.query.lang as string; - const seq = req.params.seq; - requireFields({ hruid }); +export const onlyAllowIfHasAccessToQuestion = authorize(async (auth: AuthenticationInfo, req: AuthenticatedRequest) => { + const hruid = req.params.hruid; + const version = req.params.version; + const language = req.query.lang as string; + const seq = req.params.seq; + requireFields({ hruid }); - const learningObjectId = getLearningObjectId(hruid, version, language); - const questionId = getQuestionId(learningObjectId, seq); + const learningObjectId = getLearningObjectId(hruid, version, language); + const questionId = getQuestionId(learningObjectId, seq); - const question = await fetchQuestion(questionId); - const group = question.inGroup; + const question = await fetchQuestion(questionId); + const group = question.inGroup; - if (auth.accountType === "teacher") { - const cls = group.assignment.within; // TODO check if contains full objects - return cls.teachers.map(mapToUsername).includes(auth.username); - } // User is student - return group.members.map(mapToUsername).includes(auth.username); - - } -); + if (auth.accountType === 'teacher') { + const cls = group.assignment.within; // TODO check if contains full objects + return cls.teachers.map(mapToUsername).includes(auth.username); + } // User is student + return group.members.map(mapToUsername).includes(auth.username); +}); diff --git a/backend/src/middleware/auth/checks/submission-checks.ts b/backend/src/middleware/auth/checks/submission-checks.ts index 78087fa9..87171584 100644 --- a/backend/src/middleware/auth/checks/submission-checks.ts +++ b/backend/src/middleware/auth/checks/submission-checks.ts @@ -1,29 +1,27 @@ -import { languageMap } from "dwengo-1-common/util/language"; -import { LearningObjectIdentifier } from "../../../entities/content/learning-object-identifier"; -import { fetchSubmission } from "../../../services/submissions"; -import { AuthenticatedRequest } from "../authenticated-request"; -import { AuthenticationInfo } from "../authentication-info"; -import { authorize } from "./auth-checks"; -import { FALLBACK_LANG } from "../../../config"; -import { mapToUsername } from "../../../interfaces/user"; +import { languageMap } from 'dwengo-1-common/util/language'; +import { LearningObjectIdentifier } from '../../../entities/content/learning-object-identifier'; +import { fetchSubmission } from '../../../services/submissions'; +import { AuthenticatedRequest } from '../authenticated-request'; +import { AuthenticationInfo } from '../authentication-info'; +import { authorize } from './auth-checks'; +import { FALLBACK_LANG } from '../../../config'; +import { mapToUsername } from '../../../interfaces/user'; export const onlyAllowSubmitter = authorize( (auth: AuthenticationInfo, req: AuthenticatedRequest) => (req.body as { submitter: string }).submitter === auth.username ); -export const onlyAllowIfHasAccessToSubmission = authorize( - async (auth: AuthenticationInfo, req: AuthenticatedRequest) => { - const { hruid: lohruid, id: submissionNumber } = req.params; - const { language: lang, version: version } = req.query; +export const onlyAllowIfHasAccessToSubmission = authorize(async (auth: AuthenticationInfo, req: AuthenticatedRequest) => { + const { hruid: lohruid, id: submissionNumber } = req.params; + const { language: lang, version: version } = req.query; - const loId = new LearningObjectIdentifier(lohruid, languageMap[lang as string] ?? FALLBACK_LANG, Number(version)) - const submission = await fetchSubmission(loId, Number(submissionNumber)); + const loId = new LearningObjectIdentifier(lohruid, languageMap[lang as string] ?? FALLBACK_LANG, Number(version)); + const submission = await fetchSubmission(loId, Number(submissionNumber)); - if (auth.accountType === "teacher") { - // Dit kan niet werken om dat al deze objecten niet gepopulate zijn. - return submission.onBehalfOf.assignment.within.teachers.map(mapToUsername).includes(auth.username); - } - - return submission.onBehalfOf.members.map(mapToUsername).includes(auth.username); + if (auth.accountType === 'teacher') { + // Dit kan niet werken om dat al deze objecten niet gepopulate zijn. + return submission.onBehalfOf.assignment.within.teachers.map(mapToUsername).includes(auth.username); } -) \ No newline at end of file + + return submission.onBehalfOf.members.map(mapToUsername).includes(auth.username); +}); diff --git a/backend/src/middleware/auth/checks/teacher-invitation-checks.ts b/backend/src/middleware/auth/checks/teacher-invitation-checks.ts index 27d0cab2..5f38eaf1 100644 --- a/backend/src/middleware/auth/checks/teacher-invitation-checks.ts +++ b/backend/src/middleware/auth/checks/teacher-invitation-checks.ts @@ -1,23 +1,17 @@ -import {authorize} from "./auth-checks"; -import {AuthenticationInfo} from "../authentication-info"; -import {AuthenticatedRequest} from "../authenticated-request"; +import { authorize } from './auth-checks'; +import { AuthenticationInfo } from '../authentication-info'; +import { AuthenticatedRequest } from '../authenticated-request'; export const onlyAllowSenderOrReceiver = authorize( - (auth: AuthenticationInfo, req: AuthenticatedRequest) => - req.params.sender === auth.username || req.params.receiver === auth.username + (auth: AuthenticationInfo, req: AuthenticatedRequest) => req.params.sender === auth.username || req.params.receiver === auth.username ); -export const onlyAllowSender = authorize( - (auth: AuthenticationInfo, req: AuthenticatedRequest) => - req.params.sender === auth.username -); +export const onlyAllowSender = authorize((auth: AuthenticationInfo, req: AuthenticatedRequest) => req.params.sender === auth.username); export const onlyAllowSenderBody = authorize( - (auth: AuthenticationInfo, req: AuthenticatedRequest) => - (req.body as { sender: string }).sender === auth.username + (auth: AuthenticationInfo, req: AuthenticatedRequest) => (req.body as { sender: string }).sender === auth.username ); export const onlyAllowReceiverBody = authorize( - (auth: AuthenticationInfo, req: AuthenticatedRequest) => - (req.body as { receiver: string }).receiver === auth.username + (auth: AuthenticationInfo, req: AuthenticatedRequest) => (req.body as { receiver: string }).receiver === auth.username ); diff --git a/backend/src/middleware/auth/checks/user-auth-checks.ts b/backend/src/middleware/auth/checks/user-auth-checks.ts index 10814eb8..bbe4c7f2 100644 --- a/backend/src/middleware/auth/checks/user-auth-checks.ts +++ b/backend/src/middleware/auth/checks/user-auth-checks.ts @@ -1,10 +1,8 @@ -import {authorize} from "./auth-checks"; -import {AuthenticationInfo} from "../authentication-info"; -import {AuthenticatedRequest} from "../authenticated-request"; +import { authorize } from './auth-checks'; +import { AuthenticationInfo } from '../authentication-info'; +import { AuthenticatedRequest } from '../authenticated-request'; /** * Only allow the user whose username is in the path parameter "username" to access the endpoint. */ -export const onlyAllowUserHimself = authorize( - (auth: AuthenticationInfo, req: AuthenticatedRequest) => req.params.username === auth.username -); +export const onlyAllowUserHimself = authorize((auth: AuthenticationInfo, req: AuthenticatedRequest) => req.params.username === auth.username); diff --git a/backend/src/routes/answers.ts b/backend/src/routes/answers.ts index a5ee6278..6e76a543 100644 --- a/backend/src/routes/answers.ts +++ b/backend/src/routes/answers.ts @@ -1,12 +1,7 @@ import express from 'express'; import { createAnswerHandler, deleteAnswerHandler, getAnswerHandler, getAllAnswersHandler, updateAnswerHandler } from '../controllers/answers.js'; -import {adminOnly, teachersOnly} from "../middleware/auth/checks/auth-checks"; -import { - onlyAllowAuthor, - onlyAllowAuthorRequestAnswer, - onlyAllowIfHasAccessToQuestion -} from "../middleware/auth/checks/question-checks"; - +import { adminOnly, teachersOnly } from '../middleware/auth/checks/auth-checks'; +import { onlyAllowAuthor, onlyAllowAuthorRequestAnswer, onlyAllowIfHasAccessToQuestion } from '../middleware/auth/checks/question-checks'; const router = express.Router({ mergeParams: true }); diff --git a/backend/src/routes/assignments.ts b/backend/src/routes/assignments.ts index 7b2d66fa..2a38748b 100644 --- a/backend/src/routes/assignments.ts +++ b/backend/src/routes/assignments.ts @@ -8,9 +8,9 @@ import { putAssignmentHandler, } from '../controllers/assignments.js'; import groupRouter from './groups.js'; -import {teachersOnly} from "../middleware/auth/checks/auth-checks"; -import {onlyAllowIfInClass} from "../middleware/auth/checks/class-auth-checks"; -import {onlyAllowIfHasAccessToAssignment} from "../middleware/auth/checks/assignment-auth-checks"; +import { teachersOnly } from '../middleware/auth/checks/auth-checks'; +import { onlyAllowIfInClass } from '../middleware/auth/checks/class-auth-checks'; +import { onlyAllowIfHasAccessToAssignment } from '../middleware/auth/checks/assignment-auth-checks'; const router = express.Router({ mergeParams: true }); diff --git a/backend/src/routes/classes.ts b/backend/src/routes/classes.ts index 9cf20ec0..9889151d 100644 --- a/backend/src/routes/classes.ts +++ b/backend/src/routes/classes.ts @@ -14,8 +14,8 @@ import { putClassHandler, } from '../controllers/classes.js'; import assignmentRouter from './assignments.js'; -import {adminOnly, teachersOnly} from "../middleware/auth/checks/auth-checks"; -import {onlyAllowIfInClass} from "../middleware/auth/checks/class-auth-checks"; +import { adminOnly, teachersOnly } from '../middleware/auth/checks/auth-checks'; +import { onlyAllowIfInClass } from '../middleware/auth/checks/class-auth-checks'; const router = express.Router(); diff --git a/backend/src/routes/groups.ts b/backend/src/routes/groups.ts index 5d3d8ed0..cb92e7c2 100644 --- a/backend/src/routes/groups.ts +++ b/backend/src/routes/groups.ts @@ -7,9 +7,9 @@ import { getGroupSubmissionsHandler, putGroupHandler, } from '../controllers/groups.js'; -import {onlyAllowIfHasAccessToGroup} from "../middleware/auth/checks/group-auth-checker"; -import {teachersOnly} from "../middleware/auth/checks/auth-checks"; -import {onlyAllowIfHasAccessToAssignment} from "../middleware/auth/checks/assignment-auth-checks"; +import { onlyAllowIfHasAccessToGroup } from '../middleware/auth/checks/group-auth-checker'; +import { teachersOnly } from '../middleware/auth/checks/auth-checks'; +import { onlyAllowIfHasAccessToAssignment } from '../middleware/auth/checks/assignment-auth-checks'; const router = express.Router({ mergeParams: true }); diff --git a/backend/src/routes/learning-objects.ts b/backend/src/routes/learning-objects.ts index fb65d9cd..fa438a57 100644 --- a/backend/src/routes/learning-objects.ts +++ b/backend/src/routes/learning-objects.ts @@ -3,7 +3,7 @@ import { getAllLearningObjects, getAttachment, getLearningObject, getLearningObj import submissionRoutes from './submissions.js'; import questionRoutes from './questions.js'; -import {authenticatedOnly} from "../middleware/auth/checks/auth-checks"; +import { authenticatedOnly } from '../middleware/auth/checks/auth-checks'; const router = express.Router(); diff --git a/backend/src/routes/learning-paths.ts b/backend/src/routes/learning-paths.ts index ad079551..ee3c4955 100644 --- a/backend/src/routes/learning-paths.ts +++ b/backend/src/routes/learning-paths.ts @@ -1,6 +1,6 @@ import express from 'express'; import { getLearningPaths } from '../controllers/learning-paths.js'; -import {authenticatedOnly} from "../middleware/auth/checks/auth-checks"; +import { authenticatedOnly } from '../middleware/auth/checks/auth-checks'; const router = express.Router(); diff --git a/backend/src/routes/questions.ts b/backend/src/routes/questions.ts index bffcbe9e..a15c1d0a 100644 --- a/backend/src/routes/questions.ts +++ b/backend/src/routes/questions.ts @@ -1,13 +1,9 @@ import express from 'express'; import { createQuestionHandler, deleteQuestionHandler, getAllQuestionsHandler, getQuestionHandler } from '../controllers/questions.js'; import answerRoutes from './answers.js'; -import {adminOnly, studentsOnly} from "../middleware/auth/checks/auth-checks"; -import {updateAnswerHandler} from "../controllers/answers"; -import { - onlyAllowAuthor, - onlyAllowAuthorRequest, - onlyAllowIfHasAccessToQuestion -} from "../middleware/auth/checks/question-checks"; +import { adminOnly, studentsOnly } from '../middleware/auth/checks/auth-checks'; +import { updateAnswerHandler } from '../controllers/answers'; +import { onlyAllowAuthor, onlyAllowAuthorRequest, onlyAllowIfHasAccessToQuestion } from '../middleware/auth/checks/question-checks'; const router = express.Router({ mergeParams: true }); @@ -23,7 +19,7 @@ router.get('/:seq', onlyAllowIfHasAccessToQuestion, getQuestionHandler); router.delete('/:seq', studentsOnly, onlyAllowAuthorRequest, deleteQuestionHandler); -router.put("/:seq", studentsOnly, onlyAllowAuthorRequest, updateAnswerHandler); +router.put('/:seq', studentsOnly, onlyAllowAuthorRequest, updateAnswerHandler); router.use('/:seq/answers', answerRoutes); diff --git a/backend/src/routes/student-join-requests.ts b/backend/src/routes/student-join-requests.ts index 66a6c75e..f467f346 100644 --- a/backend/src/routes/student-join-requests.ts +++ b/backend/src/routes/student-join-requests.ts @@ -5,8 +5,8 @@ import { getStudentRequestHandler, getStudentRequestsHandler, } from '../controllers/students.js'; -import {onlyAllowUserHimself} from "../middleware/auth/checks/user-auth-checks"; -import {onlyAllowStudentHimselfAndTeachersOfClass} from "../middleware/auth/checks/class-auth-checks"; +import { onlyAllowUserHimself } from '../middleware/auth/checks/user-auth-checks'; +import { onlyAllowStudentHimselfAndTeachersOfClass } from '../middleware/auth/checks/class-auth-checks'; // Under /:username/joinRequests/ diff --git a/backend/src/routes/students.ts b/backend/src/routes/students.ts index 04d260b4..e0634219 100644 --- a/backend/src/routes/students.ts +++ b/backend/src/routes/students.ts @@ -11,8 +11,8 @@ import { getStudentSubmissionsHandler, } from '../controllers/students.js'; import joinRequestRouter from './student-join-requests.js'; -import {onlyAllowUserHimself} from "../middleware/auth/checks/user-auth-checks"; -import {adminOnly} from "../middleware/auth/checks/auth-checks"; +import { onlyAllowUserHimself } from '../middleware/auth/checks/user-auth-checks'; +import { adminOnly } from '../middleware/auth/checks/auth-checks'; const router = express.Router(); diff --git a/backend/src/routes/teacher-invitations.ts b/backend/src/routes/teacher-invitations.ts index fe0b924f..d9c98e5f 100644 --- a/backend/src/routes/teacher-invitations.ts +++ b/backend/src/routes/teacher-invitations.ts @@ -6,18 +6,19 @@ import { getInvitationHandler, updateInvitationHandler, } from '../controllers/teacher-invitations'; -import {onlyAllowUserHimself} from "../middleware/auth/checks/user-auth-checks"; +import { onlyAllowUserHimself } from '../middleware/auth/checks/user-auth-checks'; import { - onlyAllowReceiverBody, onlyAllowSender, + onlyAllowReceiverBody, + onlyAllowSender, onlyAllowSenderBody, - onlyAllowSenderOrReceiver -} from "../middleware/auth/checks/teacher-invitation-checks"; + onlyAllowSenderOrReceiver, +} from '../middleware/auth/checks/teacher-invitation-checks'; const router = express.Router({ mergeParams: true }); router.get('/:username', onlyAllowUserHimself, getAllInvitationsHandler); -router.get('/:sender/:receiver/:classId', onlyAllowSenderOrReceiver ,getInvitationHandler); +router.get('/:sender/:receiver/:classId', onlyAllowSenderOrReceiver, getInvitationHandler); router.post('/', onlyAllowSenderBody, createInvitationHandler); diff --git a/backend/src/routes/teachers.ts b/backend/src/routes/teachers.ts index 776b9951..edd06118 100644 --- a/backend/src/routes/teachers.ts +++ b/backend/src/routes/teachers.ts @@ -12,9 +12,9 @@ import { } from '../controllers/teachers.js'; import invitationRouter from './teacher-invitations.js'; -import {adminOnly} from "../middleware/auth/checks/auth-checks"; -import {onlyAllowUserHimself} from "../middleware/auth/checks/user-auth-checks"; -import {onlyAllowTeacherOfClass} from "../middleware/auth/checks/class-auth-checks"; +import { adminOnly } from '../middleware/auth/checks/auth-checks'; +import { onlyAllowUserHimself } from '../middleware/auth/checks/user-auth-checks'; +import { onlyAllowTeacherOfClass } from '../middleware/auth/checks/class-auth-checks'; const router = express.Router(); // Root endpoint used to search objects diff --git a/backend/src/routes/themes.ts b/backend/src/routes/themes.ts index 089c5d46..c5882a2a 100644 --- a/backend/src/routes/themes.ts +++ b/backend/src/routes/themes.ts @@ -1,6 +1,6 @@ import express from 'express'; import { getThemesHandler, getHruidsByThemeHandler } from '../controllers/themes.js'; -import {authenticatedOnly} from "../middleware/auth/checks/auth-checks"; +import { authenticatedOnly } from '../middleware/auth/checks/auth-checks'; const router = express.Router(); diff --git a/backend/src/services/questions.ts b/backend/src/services/questions.ts index 70400226..5894ad6f 100644 --- a/backend/src/services/questions.ts +++ b/backend/src/services/questions.ts @@ -12,7 +12,7 @@ import { AssignmentDTO } from '@dwengo-1/common/interfaces/assignment'; import { fetchStudent } from './students.js'; import { NotFoundException } from '../exceptions/not-found-exception.js'; import { FALLBACK_VERSION_NUM } from '../config.js'; -import {ConflictException} from "../exceptions/conflict-exception"; +import { ConflictException } from '../exceptions/conflict-exception'; export async function getQuestionsAboutLearningObjectInAssignment( loId: LearningObjectIdentifier, @@ -91,12 +91,12 @@ export async function createQuestion(loId: LearningObjectIdentifier, questionDat const assignment = mapToAssignment(questionData.inGroup.assignment as AssignmentDTO, clazz!); const group = await getGroupRepository().findByAssignmentAndGroupNumber(assignment, questionData.inGroup.groupNumber); - if (!group){ - throw new NotFoundException("Group with id and assignment not found"); + if (!group) { + throw new NotFoundException('Group with id and assignment not found'); } - if (! group.members.contains(author)) { - throw new ConflictException("Author is not part of this group"); + if (!group.members.contains(author)) { + throw new ConflictException('Author is not part of this group'); } const question = await questionRepository.createQuestion({ diff --git a/backend/src/services/students.ts b/backend/src/services/students.ts index 09ba1643..de6a9254 100644 --- a/backend/src/services/students.ts +++ b/backend/src/services/students.ts @@ -25,7 +25,7 @@ import { QuestionDTO, QuestionId } from '@dwengo-1/common/interfaces/question'; import { ClassJoinRequestDTO } from '@dwengo-1/common/interfaces/class-join-request'; import { ConflictException } from '../exceptions/conflict-exception.js'; import { Submission } from '../entities/assignments/submission.entity'; -import {mapToUsername} from "../interfaces/user"; +import { mapToUsername } from '../interfaces/user'; export async function getAllStudents(full: boolean): Promise { const studentRepository = getStudentRepository(); diff --git a/backend/src/services/teacher-invitations.ts b/backend/src/services/teacher-invitations.ts index 6aec819b..0457496f 100644 --- a/backend/src/services/teacher-invitations.ts +++ b/backend/src/services/teacher-invitations.ts @@ -32,7 +32,7 @@ export async function createInvitation(data: TeacherInvitationData): Promise { const teacherRepository: TeacherRepository = getTeacherRepository(); From 6c1aeb2331a2e746e4116214384cfa4e2051dd06 Mon Sep 17 00:00:00 2001 From: Gabriellvl Date: Thu, 24 Apr 2025 10:44:54 +0200 Subject: [PATCH 030/128] fix: error import --- backend/src/middleware/auth/checks/submission-checks.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/src/middleware/auth/checks/submission-checks.ts b/backend/src/middleware/auth/checks/submission-checks.ts index 87171584..b4e7b1a5 100644 --- a/backend/src/middleware/auth/checks/submission-checks.ts +++ b/backend/src/middleware/auth/checks/submission-checks.ts @@ -1,4 +1,3 @@ -import { languageMap } from 'dwengo-1-common/util/language'; import { LearningObjectIdentifier } from '../../../entities/content/learning-object-identifier'; import { fetchSubmission } from '../../../services/submissions'; import { AuthenticatedRequest } from '../authenticated-request'; @@ -6,6 +5,7 @@ import { AuthenticationInfo } from '../authentication-info'; import { authorize } from './auth-checks'; import { FALLBACK_LANG } from '../../../config'; import { mapToUsername } from '../../../interfaces/user'; +import { languageMap } from "@dwengo-1/common/util/language"; export const onlyAllowSubmitter = authorize( (auth: AuthenticationInfo, req: AuthenticatedRequest) => (req.body as { submitter: string }).submitter === auth.username From 68479616889cfa28a456cd32c332fb9f36025d66 Mon Sep 17 00:00:00 2001 From: Lint Action Date: Thu, 24 Apr 2025 08:47:39 +0000 Subject: [PATCH 031/128] style: fix linting issues met Prettier --- backend/src/middleware/auth/checks/submission-checks.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/src/middleware/auth/checks/submission-checks.ts b/backend/src/middleware/auth/checks/submission-checks.ts index b4e7b1a5..f7a33a3d 100644 --- a/backend/src/middleware/auth/checks/submission-checks.ts +++ b/backend/src/middleware/auth/checks/submission-checks.ts @@ -5,7 +5,7 @@ import { AuthenticationInfo } from '../authentication-info'; import { authorize } from './auth-checks'; import { FALLBACK_LANG } from '../../../config'; import { mapToUsername } from '../../../interfaces/user'; -import { languageMap } from "@dwengo-1/common/util/language"; +import { languageMap } from '@dwengo-1/common/util/language'; export const onlyAllowSubmitter = authorize( (auth: AuthenticationInfo, req: AuthenticatedRequest) => (req.body as { submitter: string }).submitter === auth.username From 04fd54e3d623642b880a5ab0b9017f1a7825cf40 Mon Sep 17 00:00:00 2001 From: Tibo De Peuter Date: Thu, 24 Apr 2025 10:53:08 +0200 Subject: [PATCH 032/128] fix: .js toevoegen aan imports --- backend/src/controllers/auth.ts | 6 +++--- backend/src/controllers/teacher-invitations.ts | 2 +- .../auth/checks/assignment-auth-checks.ts | 8 ++++---- .../src/middleware/auth/checks/auth-checks.ts | 8 ++++---- .../auth/checks/class-auth-checks.ts | 10 +++++----- .../auth/checks/group-auth-checker.ts | 8 ++++---- .../middleware/auth/checks/question-checks.ts | 18 +++++++++--------- .../auth/checks/submission-checks.ts | 14 +++++++------- .../auth/checks/teacher-invitation-checks.ts | 6 +++--- .../middleware/auth/checks/user-auth-checks.ts | 6 +++--- backend/src/routes/answers.ts | 4 ++-- backend/src/routes/assignments.ts | 6 +++--- backend/src/routes/classes.ts | 4 ++-- backend/src/routes/groups.ts | 6 +++--- backend/src/routes/learning-objects.ts | 3 +-- backend/src/routes/learning-paths.ts | 2 +- backend/src/routes/questions.ts | 6 +++--- backend/src/routes/student-join-requests.ts | 4 ++-- backend/src/routes/students.ts | 4 ++-- backend/src/routes/teacher-invitations.ts | 6 +++--- backend/src/routes/teachers.ts | 7 +++---- backend/src/routes/themes.ts | 2 +- backend/src/services/questions.ts | 2 +- backend/src/services/students.ts | 4 ++-- backend/src/services/teachers.ts | 2 +- 25 files changed, 73 insertions(+), 75 deletions(-) diff --git a/backend/src/controllers/auth.ts b/backend/src/controllers/auth.ts index 6395715d..d8eaade5 100644 --- a/backend/src/controllers/auth.ts +++ b/backend/src/controllers/auth.ts @@ -2,10 +2,10 @@ import { UnauthorizedException } from '../exceptions/unauthorized-exception.js'; import { getLogger } from '../logging/initalize.js'; import { AuthenticatedRequest } from '../middleware/auth/authenticated-request.js'; import { envVars, getEnvVar } from '../util/envVars.js'; -import { createOrUpdateStudent, createStudent } from '../services/students'; -import { AuthenticationInfo } from '../middleware/auth/authentication-info'; +import { createOrUpdateStudent, createStudent } from '../services/students.js'; +import { AuthenticationInfo } from '../middleware/auth/authentication-info.js'; import { Request, Response } from 'express'; -import { createOrUpdateTeacher, createTeacher } from '../services/teachers'; +import { createOrUpdateTeacher, createTeacher } from '../services/teachers.js'; interface FrontendIdpConfig { authority: string; diff --git a/backend/src/controllers/teacher-invitations.ts b/backend/src/controllers/teacher-invitations.ts index f1350660..9e8eee6e 100644 --- a/backend/src/controllers/teacher-invitations.ts +++ b/backend/src/controllers/teacher-invitations.ts @@ -2,7 +2,7 @@ import { Request, Response } from 'express'; import { requireFields } from './error-helper.js'; import { createInvitation, deleteInvitation, getAllInvitations, getInvitation, updateInvitation } from '../services/teacher-invitations.js'; import { TeacherInvitationData } from '@dwengo-1/common/interfaces/teacher-invitation'; -import { ConflictException } from '../exceptions/conflict-exception'; +import { ConflictException } from '../exceptions/conflict-exception.js'; export async function getAllInvitationsHandler(req: Request, res: Response): Promise { const username = req.params.username; diff --git a/backend/src/middleware/auth/checks/assignment-auth-checks.ts b/backend/src/middleware/auth/checks/assignment-auth-checks.ts index 8328dec0..f8e1e3d7 100644 --- a/backend/src/middleware/auth/checks/assignment-auth-checks.ts +++ b/backend/src/middleware/auth/checks/assignment-auth-checks.ts @@ -1,7 +1,7 @@ -import { authorize } from './auth-checks'; -import { fetchClass } from '../../../services/classes'; -import { fetchAllGroups } from '../../../services/groups'; -import { mapToUsername } from '../../../interfaces/user'; +import { authorize } from './auth-checks.js'; +import { fetchClass } from '../../../services/classes.js'; +import { fetchAllGroups } from '../../../services/groups.js'; +import { mapToUsername } from '../../../interfaces/user.js'; /** * Expects the path to contain the path parameters 'classId' and 'id' (meaning the ID of the assignment). diff --git a/backend/src/middleware/auth/checks/auth-checks.ts b/backend/src/middleware/auth/checks/auth-checks.ts index a4a75db5..6afe92e7 100644 --- a/backend/src/middleware/auth/checks/auth-checks.ts +++ b/backend/src/middleware/auth/checks/auth-checks.ts @@ -1,9 +1,9 @@ -import { AuthenticationInfo } from '../authentication-info'; -import { AuthenticatedRequest } from '../authenticated-request'; +import { AuthenticationInfo } from '../authentication-info.js'; +import { AuthenticatedRequest } from '../authenticated-request.js'; import * as express from 'express'; -import { UnauthorizedException } from '../../../exceptions/unauthorized-exception'; -import { ForbiddenException } from '../../../exceptions/forbidden-exception'; import { RequestHandler } from 'express'; +import { UnauthorizedException } from '../../../exceptions/unauthorized-exception.js'; +import { ForbiddenException } from '../../../exceptions/forbidden-exception.js'; /** * Middleware which rejects unauthenticated users (with HTTP 401) and authenticated users which do not fulfill diff --git a/backend/src/middleware/auth/checks/class-auth-checks.ts b/backend/src/middleware/auth/checks/class-auth-checks.ts index 6aae97b3..7093b0d1 100644 --- a/backend/src/middleware/auth/checks/class-auth-checks.ts +++ b/backend/src/middleware/auth/checks/class-auth-checks.ts @@ -1,8 +1,8 @@ -import { authorize } from './auth-checks'; -import { AuthenticationInfo } from '../authentication-info'; -import { AuthenticatedRequest } from '../authenticated-request'; -import { fetchClass } from '../../../services/classes'; -import { mapToUsername } from '../../../interfaces/user'; +import { authorize } from './auth-checks.js'; +import { AuthenticationInfo } from '../authentication-info.js'; +import { AuthenticatedRequest } from '../authenticated-request.js'; +import { fetchClass } from '../../../services/classes.js'; +import { mapToUsername } from '../../../interfaces/user.js'; async function teaches(teacherUsername: string, classId: string): Promise { const clazz = await fetchClass(classId); diff --git a/backend/src/middleware/auth/checks/group-auth-checker.ts b/backend/src/middleware/auth/checks/group-auth-checker.ts index bebda954..02230b13 100644 --- a/backend/src/middleware/auth/checks/group-auth-checker.ts +++ b/backend/src/middleware/auth/checks/group-auth-checker.ts @@ -1,7 +1,7 @@ -import { authorize } from './auth-checks'; -import { fetchClass } from '../../../services/classes'; -import { fetchGroup } from '../../../services/groups'; -import { mapToUsername } from '../../../interfaces/user'; +import { authorize } from './auth-checks.js'; +import { fetchClass } from '../../../services/classes.js'; +import { fetchGroup } from '../../../services/groups.js'; +import { mapToUsername } from '../../../interfaces/user.js'; /** * Expects the path to contain the path parameters 'classid', 'assignmentid' and 'groupid'. diff --git a/backend/src/middleware/auth/checks/question-checks.ts b/backend/src/middleware/auth/checks/question-checks.ts index c0a4329f..374a2aa0 100644 --- a/backend/src/middleware/auth/checks/question-checks.ts +++ b/backend/src/middleware/auth/checks/question-checks.ts @@ -1,12 +1,12 @@ -import { authorize } from './auth-checks'; -import { AuthenticationInfo } from '../authentication-info'; -import { AuthenticatedRequest } from '../authenticated-request'; -import { requireFields } from '../../../controllers/error-helper'; -import { getLearningObjectId, getQuestionId } from '../../../controllers/questions'; -import { fetchQuestion } from '../../../services/questions'; -import { FALLBACK_SEQ_NUM } from '../../../config'; -import { fetchAnswer } from '../../../services/answers'; -import { mapToUsername } from '../../../interfaces/user'; +import { authorize } from './auth-checks.js'; +import { AuthenticationInfo } from '../authentication-info.js'; +import { AuthenticatedRequest } from '../authenticated-request.js'; +import { requireFields } from '../../../controllers/error-helper.js'; +import { getLearningObjectId, getQuestionId } from '../../../controllers/questions.js'; +import { fetchQuestion } from '../../../services/questions.js'; +import { FALLBACK_SEQ_NUM } from '../../../config.js'; +import { fetchAnswer } from '../../../services/answers.js'; +import { mapToUsername } from '../../../interfaces/user.js'; export const onlyAllowAuthor = authorize( (auth: AuthenticationInfo, req: AuthenticatedRequest) => (req.body as { author: string }).author === auth.username diff --git a/backend/src/middleware/auth/checks/submission-checks.ts b/backend/src/middleware/auth/checks/submission-checks.ts index f7a33a3d..cb84f438 100644 --- a/backend/src/middleware/auth/checks/submission-checks.ts +++ b/backend/src/middleware/auth/checks/submission-checks.ts @@ -1,11 +1,11 @@ -import { LearningObjectIdentifier } from '../../../entities/content/learning-object-identifier'; -import { fetchSubmission } from '../../../services/submissions'; -import { AuthenticatedRequest } from '../authenticated-request'; -import { AuthenticationInfo } from '../authentication-info'; -import { authorize } from './auth-checks'; -import { FALLBACK_LANG } from '../../../config'; -import { mapToUsername } from '../../../interfaces/user'; import { languageMap } from '@dwengo-1/common/util/language'; +import { LearningObjectIdentifier } from '../../../entities/content/learning-object-identifier.js'; +import { fetchSubmission } from '../../../services/submissions.js'; +import { AuthenticatedRequest } from '../authenticated-request.js'; +import { AuthenticationInfo } from '../authentication-info.js'; +import { authorize } from './auth-checks.js'; +import { FALLBACK_LANG } from '../../../config.js'; +import { mapToUsername } from '../../../interfaces/user.js'; export const onlyAllowSubmitter = authorize( (auth: AuthenticationInfo, req: AuthenticatedRequest) => (req.body as { submitter: string }).submitter === auth.username diff --git a/backend/src/middleware/auth/checks/teacher-invitation-checks.ts b/backend/src/middleware/auth/checks/teacher-invitation-checks.ts index 5f38eaf1..0c6a790f 100644 --- a/backend/src/middleware/auth/checks/teacher-invitation-checks.ts +++ b/backend/src/middleware/auth/checks/teacher-invitation-checks.ts @@ -1,6 +1,6 @@ -import { authorize } from './auth-checks'; -import { AuthenticationInfo } from '../authentication-info'; -import { AuthenticatedRequest } from '../authenticated-request'; +import { authorize } from './auth-checks.js'; +import { AuthenticationInfo } from '../authentication-info.js'; +import { AuthenticatedRequest } from '../authenticated-request.js'; export const onlyAllowSenderOrReceiver = authorize( (auth: AuthenticationInfo, req: AuthenticatedRequest) => req.params.sender === auth.username || req.params.receiver === auth.username diff --git a/backend/src/middleware/auth/checks/user-auth-checks.ts b/backend/src/middleware/auth/checks/user-auth-checks.ts index bbe4c7f2..f66f6682 100644 --- a/backend/src/middleware/auth/checks/user-auth-checks.ts +++ b/backend/src/middleware/auth/checks/user-auth-checks.ts @@ -1,6 +1,6 @@ -import { authorize } from './auth-checks'; -import { AuthenticationInfo } from '../authentication-info'; -import { AuthenticatedRequest } from '../authenticated-request'; +import { authorize } from './auth-checks.js'; +import { AuthenticationInfo } from '../authentication-info.js'; +import { AuthenticatedRequest } from '../authenticated-request.js'; /** * Only allow the user whose username is in the path parameter "username" to access the endpoint. diff --git a/backend/src/routes/answers.ts b/backend/src/routes/answers.ts index 6e76a543..e0cf5b17 100644 --- a/backend/src/routes/answers.ts +++ b/backend/src/routes/answers.ts @@ -1,7 +1,7 @@ import express from 'express'; import { createAnswerHandler, deleteAnswerHandler, getAnswerHandler, getAllAnswersHandler, updateAnswerHandler } from '../controllers/answers.js'; -import { adminOnly, teachersOnly } from '../middleware/auth/checks/auth-checks'; -import { onlyAllowAuthor, onlyAllowAuthorRequestAnswer, onlyAllowIfHasAccessToQuestion } from '../middleware/auth/checks/question-checks'; +import { adminOnly, teachersOnly } from '../middleware/auth/checks/auth-checks.js'; +import { onlyAllowAuthor, onlyAllowAuthorRequestAnswer, onlyAllowIfHasAccessToQuestion } from '../middleware/auth/checks/question-checks.js'; const router = express.Router({ mergeParams: true }); diff --git a/backend/src/routes/assignments.ts b/backend/src/routes/assignments.ts index cb2ff268..f0250550 100644 --- a/backend/src/routes/assignments.ts +++ b/backend/src/routes/assignments.ts @@ -9,9 +9,9 @@ import { putAssignmentHandler, } from '../controllers/assignments.js'; import groupRouter from './groups.js'; -import { teachersOnly } from '../middleware/auth/checks/auth-checks'; -import { onlyAllowIfInClass } from '../middleware/auth/checks/class-auth-checks'; -import { onlyAllowIfHasAccessToAssignment } from '../middleware/auth/checks/assignment-auth-checks'; +import { teachersOnly } from '../middleware/auth/checks/auth-checks.js'; +import { onlyAllowIfInClass } from '../middleware/auth/checks/class-auth-checks.js'; +import { onlyAllowIfHasAccessToAssignment } from '../middleware/auth/checks/assignment-auth-checks.js'; const router = express.Router({ mergeParams: true }); diff --git a/backend/src/routes/classes.ts b/backend/src/routes/classes.ts index 9889151d..4b272971 100644 --- a/backend/src/routes/classes.ts +++ b/backend/src/routes/classes.ts @@ -14,8 +14,8 @@ import { putClassHandler, } from '../controllers/classes.js'; import assignmentRouter from './assignments.js'; -import { adminOnly, teachersOnly } from '../middleware/auth/checks/auth-checks'; -import { onlyAllowIfInClass } from '../middleware/auth/checks/class-auth-checks'; +import { adminOnly, teachersOnly } from '../middleware/auth/checks/auth-checks.js'; +import { onlyAllowIfInClass } from '../middleware/auth/checks/class-auth-checks.js'; const router = express.Router(); diff --git a/backend/src/routes/groups.ts b/backend/src/routes/groups.ts index bcde8f45..086c5eff 100644 --- a/backend/src/routes/groups.ts +++ b/backend/src/routes/groups.ts @@ -8,9 +8,9 @@ import { getGroupSubmissionsHandler, putGroupHandler, } from '../controllers/groups.js'; -import { onlyAllowIfHasAccessToGroup } from '../middleware/auth/checks/group-auth-checker'; -import { teachersOnly } from '../middleware/auth/checks/auth-checks'; -import { onlyAllowIfHasAccessToAssignment } from '../middleware/auth/checks/assignment-auth-checks'; +import { onlyAllowIfHasAccessToGroup } from '../middleware/auth/checks/group-auth-checker.js'; +import { teachersOnly } from '../middleware/auth/checks/auth-checks.js'; +import { onlyAllowIfHasAccessToAssignment } from '../middleware/auth/checks/assignment-auth-checks.js'; const router = express.Router({ mergeParams: true }); diff --git a/backend/src/routes/learning-objects.ts b/backend/src/routes/learning-objects.ts index fa438a57..f53f208a 100644 --- a/backend/src/routes/learning-objects.ts +++ b/backend/src/routes/learning-objects.ts @@ -1,9 +1,8 @@ import express from 'express'; import { getAllLearningObjects, getAttachment, getLearningObject, getLearningObjectHTML } from '../controllers/learning-objects.js'; - import submissionRoutes from './submissions.js'; import questionRoutes from './questions.js'; -import { authenticatedOnly } from '../middleware/auth/checks/auth-checks'; +import { authenticatedOnly } from '../middleware/auth/checks/auth-checks.js'; const router = express.Router(); diff --git a/backend/src/routes/learning-paths.ts b/backend/src/routes/learning-paths.ts index ee3c4955..59b85e62 100644 --- a/backend/src/routes/learning-paths.ts +++ b/backend/src/routes/learning-paths.ts @@ -1,6 +1,6 @@ import express from 'express'; import { getLearningPaths } from '../controllers/learning-paths.js'; -import { authenticatedOnly } from '../middleware/auth/checks/auth-checks'; +import { authenticatedOnly } from '../middleware/auth/checks/auth-checks.js'; const router = express.Router(); diff --git a/backend/src/routes/questions.ts b/backend/src/routes/questions.ts index a15c1d0a..76ec4eaa 100644 --- a/backend/src/routes/questions.ts +++ b/backend/src/routes/questions.ts @@ -1,9 +1,9 @@ import express from 'express'; import { createQuestionHandler, deleteQuestionHandler, getAllQuestionsHandler, getQuestionHandler } from '../controllers/questions.js'; import answerRoutes from './answers.js'; -import { adminOnly, studentsOnly } from '../middleware/auth/checks/auth-checks'; -import { updateAnswerHandler } from '../controllers/answers'; -import { onlyAllowAuthor, onlyAllowAuthorRequest, onlyAllowIfHasAccessToQuestion } from '../middleware/auth/checks/question-checks'; +import { adminOnly, studentsOnly } from '../middleware/auth/checks/auth-checks.js'; +import { updateAnswerHandler } from '../controllers/answers.js'; +import { onlyAllowAuthor, onlyAllowAuthorRequest, onlyAllowIfHasAccessToQuestion } from '../middleware/auth/checks/question-checks.js'; const router = express.Router({ mergeParams: true }); diff --git a/backend/src/routes/student-join-requests.ts b/backend/src/routes/student-join-requests.ts index f467f346..35198d0c 100644 --- a/backend/src/routes/student-join-requests.ts +++ b/backend/src/routes/student-join-requests.ts @@ -5,8 +5,8 @@ import { getStudentRequestHandler, getStudentRequestsHandler, } from '../controllers/students.js'; -import { onlyAllowUserHimself } from '../middleware/auth/checks/user-auth-checks'; -import { onlyAllowStudentHimselfAndTeachersOfClass } from '../middleware/auth/checks/class-auth-checks'; +import { onlyAllowUserHimself } from '../middleware/auth/checks/user-auth-checks.js'; +import { onlyAllowStudentHimselfAndTeachersOfClass } from '../middleware/auth/checks/class-auth-checks.js'; // Under /:username/joinRequests/ diff --git a/backend/src/routes/students.ts b/backend/src/routes/students.ts index e0634219..f40ce939 100644 --- a/backend/src/routes/students.ts +++ b/backend/src/routes/students.ts @@ -11,8 +11,8 @@ import { getStudentSubmissionsHandler, } from '../controllers/students.js'; import joinRequestRouter from './student-join-requests.js'; -import { onlyAllowUserHimself } from '../middleware/auth/checks/user-auth-checks'; -import { adminOnly } from '../middleware/auth/checks/auth-checks'; +import { onlyAllowUserHimself } from '../middleware/auth/checks/user-auth-checks.js'; +import { adminOnly } from '../middleware/auth/checks/auth-checks.js'; const router = express.Router(); diff --git a/backend/src/routes/teacher-invitations.ts b/backend/src/routes/teacher-invitations.ts index d9c98e5f..0855c6a6 100644 --- a/backend/src/routes/teacher-invitations.ts +++ b/backend/src/routes/teacher-invitations.ts @@ -5,14 +5,14 @@ import { getAllInvitationsHandler, getInvitationHandler, updateInvitationHandler, -} from '../controllers/teacher-invitations'; -import { onlyAllowUserHimself } from '../middleware/auth/checks/user-auth-checks'; +} from '../controllers/teacher-invitations.js'; +import { onlyAllowUserHimself } from '../middleware/auth/checks/user-auth-checks.js'; import { onlyAllowReceiverBody, onlyAllowSender, onlyAllowSenderBody, onlyAllowSenderOrReceiver, -} from '../middleware/auth/checks/teacher-invitation-checks'; +} from '../middleware/auth/checks/teacher-invitation-checks.js'; const router = express.Router({ mergeParams: true }); diff --git a/backend/src/routes/teachers.ts b/backend/src/routes/teachers.ts index edd06118..26ec77be 100644 --- a/backend/src/routes/teachers.ts +++ b/backend/src/routes/teachers.ts @@ -11,10 +11,9 @@ import { updateStudentJoinRequestHandler, } from '../controllers/teachers.js'; import invitationRouter from './teacher-invitations.js'; - -import { adminOnly } from '../middleware/auth/checks/auth-checks'; -import { onlyAllowUserHimself } from '../middleware/auth/checks/user-auth-checks'; -import { onlyAllowTeacherOfClass } from '../middleware/auth/checks/class-auth-checks'; +import { adminOnly } from '../middleware/auth/checks/auth-checks.js'; +import { onlyAllowUserHimself } from '../middleware/auth/checks/user-auth-checks.js'; +import { onlyAllowTeacherOfClass } from '../middleware/auth/checks/class-auth-checks.js'; const router = express.Router(); // Root endpoint used to search objects diff --git a/backend/src/routes/themes.ts b/backend/src/routes/themes.ts index c5882a2a..6310c2ab 100644 --- a/backend/src/routes/themes.ts +++ b/backend/src/routes/themes.ts @@ -1,6 +1,6 @@ import express from 'express'; import { getThemesHandler, getHruidsByThemeHandler } from '../controllers/themes.js'; -import { authenticatedOnly } from '../middleware/auth/checks/auth-checks'; +import { authenticatedOnly } from '../middleware/auth/checks/auth-checks.js'; const router = express.Router(); diff --git a/backend/src/services/questions.ts b/backend/src/services/questions.ts index 5894ad6f..8e2d245d 100644 --- a/backend/src/services/questions.ts +++ b/backend/src/services/questions.ts @@ -12,7 +12,7 @@ import { AssignmentDTO } from '@dwengo-1/common/interfaces/assignment'; import { fetchStudent } from './students.js'; import { NotFoundException } from '../exceptions/not-found-exception.js'; import { FALLBACK_VERSION_NUM } from '../config.js'; -import { ConflictException } from '../exceptions/conflict-exception'; +import { ConflictException } from '../exceptions/conflict-exception.js'; export async function getQuestionsAboutLearningObjectInAssignment( loId: LearningObjectIdentifier, diff --git a/backend/src/services/students.ts b/backend/src/services/students.ts index de6a9254..2a003d3a 100644 --- a/backend/src/services/students.ts +++ b/backend/src/services/students.ts @@ -24,8 +24,8 @@ import { SubmissionDTO, SubmissionDTOId } from '@dwengo-1/common/interfaces/subm import { QuestionDTO, QuestionId } from '@dwengo-1/common/interfaces/question'; import { ClassJoinRequestDTO } from '@dwengo-1/common/interfaces/class-join-request'; import { ConflictException } from '../exceptions/conflict-exception.js'; -import { Submission } from '../entities/assignments/submission.entity'; -import { mapToUsername } from '../interfaces/user'; +import { Submission } from '../entities/assignments/submission.entity.js'; +import { mapToUsername } from '../interfaces/user.js'; export async function getAllStudents(full: boolean): Promise { const studentRepository = getStudentRepository(); diff --git a/backend/src/services/teachers.ts b/backend/src/services/teachers.ts index 46336bd7..aa67f211 100644 --- a/backend/src/services/teachers.ts +++ b/backend/src/services/teachers.ts @@ -30,7 +30,7 @@ import { QuestionDTO, QuestionId } from '@dwengo-1/common/interfaces/question'; import { ClassJoinRequestDTO } from '@dwengo-1/common/interfaces/class-join-request'; import { ClassStatus } from '@dwengo-1/common/util/class-join-request'; import { ConflictException } from '../exceptions/conflict-exception.js'; -import { mapToUsername } from '../interfaces/user'; +import { mapToUsername } from '../interfaces/user.js'; export async function getAllTeachers(full: boolean): Promise { const teacherRepository: TeacherRepository = getTeacherRepository(); From 0b9f7653660529c32b00227301c5931613531ed6 Mon Sep 17 00:00:00 2001 From: Gerald Schmittinger Date: Tue, 29 Apr 2025 23:06:58 +0200 Subject: [PATCH 033/128] fix(backend): 409 Conflict bij het oproepen van /hello met een reeds geregistreerd account. --- backend/src/controllers/auth.ts | 30 ++---------------------------- backend/src/routes/auth.ts | 10 ++++------ 2 files changed, 6 insertions(+), 34 deletions(-) diff --git a/backend/src/controllers/auth.ts b/backend/src/controllers/auth.ts index d8eaade5..ca79da59 100644 --- a/backend/src/controllers/auth.ts +++ b/backend/src/controllers/auth.ts @@ -2,10 +2,9 @@ import { UnauthorizedException } from '../exceptions/unauthorized-exception.js'; import { getLogger } from '../logging/initalize.js'; import { AuthenticatedRequest } from '../middleware/auth/authenticated-request.js'; import { envVars, getEnvVar } from '../util/envVars.js'; -import { createOrUpdateStudent, createStudent } from '../services/students.js'; -import { AuthenticationInfo } from '../middleware/auth/authentication-info.js'; +import { createOrUpdateStudent } from '../services/students.js'; import { Request, Response } from 'express'; -import { createOrUpdateTeacher, createTeacher } from '../services/teachers.js'; +import { createOrUpdateTeacher } from '../services/teachers.js'; interface FrontendIdpConfig { authority: string; @@ -45,31 +44,6 @@ export function handleGetFrontendAuthConfig(_req: Request, res: Response): void res.json(getFrontendAuthConfig()); } -export async function handleHello(req: AuthenticatedRequest): Promise { - const auth: AuthenticationInfo = req.auth!; - if (auth.accountType === 'teacher') { - await createTeacher( - { - id: auth.username, - username: auth.username, - firstName: auth.firstName ?? '', - lastName: auth.lastName ?? '', - }, - true - ); - } else { - await createStudent( - { - id: auth.username, - username: auth.username, - firstName: auth.firstName ?? '', - lastName: auth.lastName ?? '', - }, - true - ); - } -} - export async function postHelloHandler(req: AuthenticatedRequest, res: Response): Promise { const auth = req.auth; if (!auth) { diff --git a/backend/src/routes/auth.ts b/backend/src/routes/auth.ts index a7bd5497..b71b418d 100644 --- a/backend/src/routes/auth.ts +++ b/backend/src/routes/auth.ts @@ -1,15 +1,11 @@ import express from 'express'; -import { handleGetFrontendAuthConfig, handleHello, postHelloHandler } from '../controllers/auth.js'; +import { handleGetFrontendAuthConfig, postHelloHandler } from '../controllers/auth.js'; import { authenticatedOnly, studentsOnly, teachersOnly } from '../middleware/auth/checks/auth-checks.js'; const router = express.Router(); // Returns auth configuration for frontend -router.get('/config', handleGetFrontendAuthConfig); - -// This endpoint is called by the client when the user has just logged in. -// It creates or updates the user entity based on the authentication data the endpoint was called with. -router.post('/hello', authenticatedOnly, handleHello); +router.get('/config', handleGetFrontendAuthConfig) router.get('/testAuthenticatedOnly', authenticatedOnly, (_req, res) => { /* #swagger.security = [{ "student": [ ] }, { "teacher": [ ] }] */ @@ -26,6 +22,8 @@ router.get('/testTeachersOnly', teachersOnly, (_req, res) => { res.json({ message: 'If you see this, you should be a teacher!' }); }); +// This endpoint is called by the client when the user has just logged in. +// It creates or updates the user entity based on the authentication data the endpoint was called with. router.post('/hello', authenticatedOnly, postHelloHandler); export default router; From 7c3528d07f2a798bb48ae38c06cd7e61be140305 Mon Sep 17 00:00:00 2001 From: laurejablonski Date: Thu, 1 May 2025 08:58:41 +0200 Subject: [PATCH 034/128] fix: translate knop werkt en is zichtbaar op mobile --- frontend/src/components/MenuBar.vue | 54 ++++++++++++++++------------- 1 file changed, 30 insertions(+), 24 deletions(-) diff --git a/frontend/src/components/MenuBar.vue b/frontend/src/components/MenuBar.vue index e3734976..c4b4825b 100644 --- a/frontend/src/components/MenuBar.vue +++ b/frontend/src/components/MenuBar.vue @@ -90,31 +90,31 @@ - - - - - {{ language.name }} - - - + + + + + {{ language.name }} + + + - - +