Skip to content

Commit 5c1a4f7

Browse files
anheftianhefti
committed
SEBSP-176
1 parent fcaef1e commit 5c1a4f7

File tree

3 files changed

+50
-19
lines changed

3 files changed

+50
-19
lines changed

‎src/main/java/ch/ethz/seb/sps/server/datalayer/dao/ExamDAO.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,11 @@ public interface ExamDAO extends ActivatableEntityDAO<Exam, Exam> {
1010

1111
boolean existsByUUID(String examUUID);
1212

13-
Result<Collection<Exam>> pksByExamName(final FilterMap filterMap);
13+
Result<Collection<Exam>> pksByExamName(FilterMap filterMap);
1414

1515
boolean isExamRunning(Long examId);
1616

17-
Result<Collection<Exam>> getExamsStarted(final FilterMap filterMap);
17+
Result<Collection<Exam>> getExamsWithin(FilterMap filterMap, Collection<Long> prePredicated);
1818

1919
Result<Collection<Long>> getAllForDeletion();
2020

‎src/main/java/ch/ethz/seb/sps/server/datalayer/dao/impl/ExamDAOBatis.java‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -178,12 +178,15 @@ public Result<Collection<Exam>> allMatching(
178178

179179
@Override
180180
@Transactional(readOnly = true)
181-
public Result<Collection<Exam>> getExamsStarted(final FilterMap filterMap) {
181+
public Result<Collection<Exam>> getExamsWithin(final FilterMap filterMap, Collection<Long> prePredicated) {
182182

183183
return Result.tryCatch(() -> {
184184

185185
final Long fromTime = filterMap.getLong(API.PARAM_FROM_TIME);
186186
final Long toTime = filterMap.getLong(API.PARAM_TO_TIME);
187+
final Collection<Long> pre = prePredicated != null && !prePredicated.isEmpty()
188+
? prePredicated
189+
: null;
187190

188191
return this.examRecordMapper
189192
.selectByExample()
@@ -193,6 +196,8 @@ public Result<Collection<Exam>> getExamsStarted(final FilterMap filterMap) {
193196
.and(
194197
ExamRecordDynamicSqlSupport.startTime,
195198
SqlBuilder.isLessThanOrEqualToWhenPresent(toTime))
199+
.and( ExamRecordDynamicSqlSupport.id,
200+
SqlBuilder.isInWhenPresent(pre))
196201
.build()
197202
.execute()
198203
.stream()

‎src/main/java/ch/ethz/seb/sps/server/weblayer/AdminProctorController.java‎

Lines changed: 42 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,11 @@
1414
import java.util.concurrent.Executor;
1515
import java.util.stream.Collectors;
1616

17+
import ch.ethz.seb.sps.domain.model.EntityType;
1718
import ch.ethz.seb.sps.domain.model.service.DistinctMetadataWindowForExam;
1819
import ch.ethz.seb.sps.domain.model.service.UserListForApplicationSearch;
1920
import ch.ethz.seb.sps.server.datalayer.dao.ExamDAO;
21+
import ch.ethz.seb.sps.server.servicelayer.*;
2022
import jakarta.servlet.http.HttpServletRequest;
2123
import jakarta.servlet.http.HttpServletResponse;
2224

@@ -46,10 +48,6 @@
4648
import ch.ethz.seb.sps.server.datalayer.batis.mapper.SessionRecordDynamicSqlSupport;
4749
import ch.ethz.seb.sps.server.datalayer.dao.GroupDAO;
4850
import ch.ethz.seb.sps.server.datalayer.dao.NoResourceFoundException;
49-
import ch.ethz.seb.sps.server.servicelayer.GroupService;
50-
import ch.ethz.seb.sps.server.servicelayer.GroupingService;
51-
import ch.ethz.seb.sps.server.servicelayer.PaginationService;
52-
import ch.ethz.seb.sps.server.servicelayer.ProctoringService;
5351
import ch.ethz.seb.sps.utils.Constants;
5452
import ch.ethz.seb.sps.utils.Result;
5553
import io.swagger.v3.oas.annotations.Operation;
@@ -75,6 +73,7 @@ public class AdminProctorController {
7573
private final ProctoringService proctoringService;
7674
private final PaginationService paginationService;
7775
private final GroupingService groupingService;
76+
private final UserService userService;
7877

7978
public AdminProctorController(
8079
final GroupDAO groupDAO,
@@ -84,6 +83,7 @@ public AdminProctorController(
8483
final ProctoringService proctoringService,
8584
final PaginationService paginationService,
8685
final GroupingService groupingService,
86+
final UserService userService,
8787
@Qualifier(value = ServiceConfig.SCREENSHOT_DOWNLOAD_API_EXECUTOR) final Executor downloadExecutor) {
8888

8989
this.downloadExecutor = downloadExecutor;
@@ -94,6 +94,7 @@ public AdminProctorController(
9494
this.paginationService = paginationService;
9595
this.proctoringService = proctoringService;
9696
this.groupingService = groupingService;
97+
this.userService = userService;
9798
}
9899

99100
@RequestMapping(
@@ -838,8 +839,8 @@ public List<Long> getScreenshotTimestamps(
838839

839840

840841
@Operation(
841-
summary = "Get a list of all running exams in the given time frame",
842-
description = "Get a list of all exams which don't have a termination time and their start time is in the given time frame",
842+
summary = "Get a list of all exams in the given time frame",
843+
description = "Get a list of all exams which start time is in the given time frame",
843844
requestBody = @io.swagger.v3.oas.annotations.parameters.RequestBody(
844845
content = { @Content(mediaType = MediaType.APPLICATION_FORM_URLENCODED_VALUE) }),
845846
parameters = {
@@ -863,10 +864,13 @@ public List<Exam> getExamsStarted(
863864
@RequestParam(name = API.PARAM_FROM_TIME, required = false) final Long fromTime,
864865
@RequestParam(name = API.PARAM_TO_TIME, required = false) final Long toTime,
865866
final HttpServletRequest request){
866-
867+
867868
final FilterMap filterMap = new FilterMap(request);
868-
869-
return this.examDAO.getExamsStarted(filterMap)
869+
final Set<Long> granted = this.userService
870+
.getIdsWithReadEntityPrivilege(EntityType.EXAM)
871+
.getOrThrow();
872+
return this.examDAO
873+
.getExamsWithin(filterMap, granted)
870874
.getOrThrow()
871875
.stream()
872876
.toList();
@@ -890,8 +894,17 @@ public List<Exam> getExamsStarted(
890894
produces = MediaType.APPLICATION_JSON_VALUE)
891895
public List<Long> getGroupIdsForExam(
892896
@PathVariable(name = API.PARAM_EXAM_ID) final Long examId){
893-
894-
return this.groupDAO.getGroupIdsForExam(examId)
897+
898+
Exam exam = examDAO
899+
.byPK(examId)
900+
.getOrThrow();
901+
902+
if (!userService.hasGrant(API.PrivilegeType.READ, exam)) {
903+
return Collections.emptyList();
904+
}
905+
906+
return this.groupDAO
907+
.getGroupIdsForExam(examId)
895908
.getOrThrow()
896909
.stream()
897910
.toList();
@@ -915,14 +928,14 @@ public List<Long> getGroupIdsForExam(
915928
produces = MediaType.APPLICATION_JSON_VALUE)
916929
public List<String> getDistinctMetadataAppForExam(
917930
@RequestParam(name = API.PARAM_GROUP_IDS, required = false) final String groupIds){
918-
919-
return this.screenshotDataDAO.getDistinctMetadataAppForExam(getIdListFromParameter(groupIds))
931+
932+
return this.screenshotDataDAO
933+
.getDistinctMetadataAppForExam(getIdListFromParameter(groupIds))
920934
.getOrThrow()
921935
.stream()
922936
.toList();
923937
}
924-
925-
938+
926939
@Operation(
927940
summary = "Get a list of metadata window titles for a given exam",
928941
description = "Returns a list of distinct window titles for a given exam (via groupIds) & metadata application",
@@ -945,6 +958,7 @@ public DistinctMetadataWindowForExam getDistinctMetadataWindowForExam(
945958
@RequestParam(name = API.SCREENSHOT_META_DATA_APPLICATION, required = true) final String metadataApplication,
946959
@RequestParam(name = API.PARAM_GROUP_IDS, required = true) final String groupIds){
947960

961+
// TODO Apply user rights
948962
return this.proctoringService.getDistinctMetadataWindowForExam(metadataApplication, getIdListFromParameter(groupIds));
949963
}
950964

@@ -974,6 +988,7 @@ public List<UserListForApplicationSearch> getUserListForApplicationSearch(
974988
@RequestParam(name = API.SCREENSHOT_META_DATA_ACTIVE_WINDOW_TITLE, required = true) final String metadataWindowTitle,
975989
@RequestParam(name = API.PARAM_GROUP_IDS, required = true) final String groupIds){
976990

991+
// TODO Apply user rights?
977992
return this.screenshotDataDAO
978993
.getUserListForApplicationSearch(metadataApplication, metadataWindowTitle, getIdListFromParameter(groupIds))
979994
.getOrThrow();
@@ -1005,6 +1020,7 @@ public List<Long> getTimestampListForApplicationSearch(
10051020
@RequestParam(name = API.SCREENSHOT_META_DATA_APPLICATION, required = true) final String metadataApplication,
10061021
@RequestParam(name = API.SCREENSHOT_META_DATA_ACTIVE_WINDOW_TITLE, required = true) final String metadataWindowTitle){
10071022

1023+
// TODO Apply user rights?
10081024
return this.screenshotDataDAO
10091025
.getTimestampListForApplicationSearch(sessionUuid, metadataApplication, metadataWindowTitle)
10101026
.getOrThrow();
@@ -1054,11 +1070,21 @@ private Result<List<Date>> queryMatchingDaysForSessionSearch(final FilterMap fil
10541070
}
10551071

10561072
private List<Long> getIdListFromParameter(final String ids){
1073+
// check if user at least has read right for a group
1074+
final Collection<Long> readPrivilegedPredication = this.groupService.getReadPrivilegedPredication();
1075+
10571076
String[] idsString = StringUtils.split(ids, Constants.LIST_SEPARATOR_CHAR);
10581077
List<Long> idsList = new ArrayList<>();
10591078

10601079
for (String s : idsString) {
1061-
idsList.add(Long.parseLong(s));
1080+
try {
1081+
Long id = Long.parseLong(s);
1082+
if (readPrivilegedPredication.contains(id)) {
1083+
idsList.add(id);
1084+
}
1085+
} catch (Exception e) {
1086+
log.error("Failed to parse group id (pk): {} error: {}",s, e.getMessage());
1087+
}
10621088
}
10631089

10641090
return idsList;

0 commit comments

Comments
 (0)