E2565 : Integration of JoinTeamRequests #241

smitraval24 · 2025-12-03T00:59:23Z

No description provided.

…orrect data to frontend

added create student team method inside student_teams controller modified logic of participant accepting invitation modified serializer

added from_participant reference inside invitations schema modified retract invitations functionality team serializer now takes participant serializer added more validations inside invitation validator

…student_teams controller and added corresponding routes added advertisement related fields inside signedup teams table

…e properly integrated with the frontend.

…itations

efg · 2025-12-03T17:28:15Z

app/controllers/api/v1/join_team_requests_controller.rb

-    join_team_request.team_id = params[:team_id]
-    participant = Participant.where(user_id: @current_user.id, assignment_id: params[:assignment_id]).first
-    team = Team.find(params[:team_id])
+    # Find participant based on assignment_id


Find participant object for the user who is requesting to join the team

efg · 2025-12-03T17:32:36Z

app/controllers/api/v1/join_team_requests_controller.rb

+    )
+
+    if existing_request
+      return render json: { error: 'You already have a pending request for this team' }, status: :unprocessable_entity


a pending request to join this team

Copilot

Pull request overview

This pull request adds an "Advertisements" feature that enables teams to advertise for partners and allows students to request to join advertising teams. However, the PR contains several critical security issues that must be addressed before merging.

Key Changes:

Added comprehensive test coverage for advertisements, join team requests, and invitation acceptance workflows
Modified invitation status constants from REJECT_STATUS to DECLINED_STATUS
Added test coverage for email notifications on join request and invitation acceptance

Reviewed changes

Copilot reviewed 99 out of 104 changed files in this pull request and generated 31 comments.

Show a summary per file

File	Description
users.ibd	CRITICAL: Binary database file that should not be committed to version control
swagger/v1/swagger.yaml	CRITICAL: Hardcoded IP address in API configuration - should use localhost or environment variables
spec/swagger_helper.rb	CRITICAL: Hardcoded IP address in test configuration
spec/spec_helper.rb	Modified SimpleCov startup logic and commented out Coveralls configuration
spec/requests/api/v1/join_team_requests_controller_spec.rb	New comprehensive test suite for join team request authorization and functionality
spec/requests/api/v1/invitation_controller_spec.rb	Updated invitation tests with new participant setup and renamed constants
spec/requests/api/v1/advertisements_spec.rb	New comprehensive test suite covering advertisement display, creation, and join request workflows
spec/requests/api/v1/acceptance_email_integration_spec.rb	New integration tests for email notifications on acceptance
spec/rails_helper.rb	Commented out fixture path configuration
spec/models/invitation_spec.rb	Added email notification tests and updated constant names
get_token.sh	CRITICAL: New shell script with hardcoded IP address and credentials for JWT token retrieval

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-05T04:13:27Z

spec/requests/api/v1/invitation_controller_spec.rb

+
+      response(200, 'Update successful') do
+        let(:id) { invitation.id }
+        let(:invitation_status) { { reply_status: InvitationValidator::DECLINED_STATUS } }


The constant has been changed from REJECT_STATUS to DECLINED_STATUS. Ensure this constant name change is consistent throughout the codebase and that InvitationValidator::DECLINED_STATUS is properly defined. This appears to be a breaking API change if the constant was used elsewhere.

Copilot · 2025-12-05T04:13:28Z

spec/models/invitation_spec.rb

    invitation = Invitation.create(to_id: user1.id, from_id: user2.id, assignment_id: assignment.id)
    invitation.decline_invitation(nil)
-    expect(invitation.reply_status).to eq(InvitationValidator::REJECT_STATUS)
+    expect(invitation.reply_status).to eq(InvitationValidator::DECLINED_STATUS)


The constant has been changed from REJECT_STATUS to DECLINED_STATUS. Ensure this constant name change is consistent throughout the codebase and that InvitationValidator::DECLINED_STATUS is properly defined. This appears to be a breaking API change if the constant was used elsewhere.

Copilot · 2025-12-05T04:13:28Z

spec/spec_helper.rb

+if !ENV['COVERAGE_STARTED']
+  SimpleCov.start 'rails'
+  ENV['COVERAGE_STARTED'] = 'true'
+end


Using an environment variable to control whether SimpleCov starts is unusual and may cause issues with coverage tracking. If multiple test files are loaded, only the first one will start SimpleCov, potentially leading to incomplete coverage data. Consider removing this check or documenting why this pattern is necessary. The standard approach is to let SimpleCov start once at the beginning of the test suite in spec_helper.rb.

Copilot · 2025-12-05T04:13:28Z

spec/requests/api/v1/acceptance_email_integration_spec.rb

+      expect {
+        patch "/api/v1/join_team_requests/#{request_id}/accept", headers: team_member_headers
+      }.to have_enqueued_job(ActionMailer::MailDeliveryJob)
+
+      expect(response).to have_http_status(:ok)


The test expects a job to be enqueued within the expect block but uses have_enqueued_job after the action has already occurred. This pattern can lead to flaky tests. Consider using enqueue_job matcher syntax or performing the action within the expect block:

expect { patch "/api/v1/join_team_requests/#{request_id}/accept", headers: team_member_headers }.to have_enqueued_job(ActionMailer::MailDeliveryJob)

The response status check should be done after this assertion.

Copilot · 2025-12-05T04:13:28Z

swagger/v1/swagger.yaml

  variables:
    defaultHost:
-      default: localhost:3002
+      default: 152.7.176.23:3002


Hardcoded IP address 152.7.176.23:3002 should not be committed to the repository. This appears to be a specific server IP address that:

May expose internal infrastructure details

Will not work for other developers or environments

Should be configured through environment variables or configuration files

Please revert this to localhost:3002 or use an environment variable like ENV['API_HOST'] with appropriate defaults for different environments.

Copilot · 2025-12-05T04:13:35Z

app/models/response.rb

+    # answer for scorable questions, and they will not be counted towards the total score)
+    total_weight = 0
+    scores.each do |s|
+      item = Item.find(s.item_id)


This call to a database query operation happens inside this loop, and could be hoisted to a single call outside the loop.

Copilot · 2025-12-05T04:13:35Z

app/models/response_map.rb

+      maps.each do |map|
+        next if map.response.empty?
+
+        all_resp = Response.where(map_id: map.map_id).last


This call to a database query operation happens inside this loop, and could be hoisted to a single call outside the loop.

Copilot · 2025-12-05T04:13:35Z

db/seeds.rb

+
+    ((num_students / 2)..num_students-1).each do |i|
+      user_id = student_user_ids[i]
+      handle = User.find(user_id).handle


This call to a database query operation happens inside this loop, and could be hoisted to a single call outside the loop.

Copilot · 2025-12-05T04:13:36Z

app/models/ta.rb

+
+  def courses_assisted_with
+    courses = TaMapping.where(ta_id: id)
+    courses.map { |c| Course.find(c.course_id) }


This call to a database query operation happens inside this loop, and could be hoisted to a single call outside the loop.

Copilot · 2025-12-05T04:13:36Z

get_token.sh

+echo ""
+
+# Make login request
+response=$(curl -s -X POST http://152.7.176.23:3002/login \


This script sends login credentials and JWT tokens to http://152.7.176.23:3002 over plain HTTP (see this line and similar uses on lines 25 and 52), which exposes passwords and bearer tokens to interception or tampering by any attacker on the network path. An attacker sniffing traffic on the same network could steal the credentials or token and impersonate the user or replay API calls. Switch these calls to an HTTPS endpoint (or gate HTTP strictly to local-only development), and ensure the base URL is configurable so that sensitive environments always use TLS.

vihar2712 and others added 24 commits June 24, 2025 13:28

Pending changes exported from your codespace

fbbe467

grades controller finished

755012e

Merged main branch into join-team-requests-and-invitations

a1878ad

team hierarchy still unresolved. authorization module included.

cd798c6

/api/v1 removed

65bf36b

modified invitation model

61e8698

modified student_teams controller - made use of serializer, sending c…

8985131

…orrect data to frontend

methods inside student_teams added

04e31e6

retract, accept, reject invitation working

9f8d758

added authorization inside invitations controller

f0ebf63

added create student team method inside student_teams controller modified logic of participant accepting invitation modified serializer

modified invitations controller

4c80523

added from_participant reference inside invitations schema modified retract invitations functionality team serializer now takes participant serializer added more validations inside invitation validator

added invitations sent by participant route and method

61a437b

added methods for performing crud operations on advertisement inside …

ec90caa

…student_teams controller and added corresponding routes added advertisement related fields inside signedup teams table

single action_allowed? method implemented

2952a55

Review and validate the existing controller methods, ensuring they ar…

ffd3251

…e properly integrated with the frontend.

common database

36ea31b

signup data

2cfda59

joining team requests implemented

dd2ace3

adding data for the requests and joins

c129b97

Implement email notifications for accepted join team requests and inv…

e08e826

…itations

adding test cases

ee37683

test case integrated

44730b9

axios

cdba488

fix change teams

99b1aa2

efg reviewed Dec 3, 2025

View reviewed changes

Model tests

053260c

Copilot AI review requested due to automatic review settings December 5, 2025 04:05

Copilot started reviewing on behalf of devyash2930 December 5, 2025 04:05 View session

Copilot finished reviewing on behalf of devyash2930 December 5, 2025 04:07

Copilot AI reviewed Dec 5, 2025

View reviewed changes

vihar2712 changed the title ~~Advertisements~~ E2565 : Integration of JoinTeamRequests Dec 15, 2025

E2565 : Integration of JoinTeamRequests #241

Are you sure you want to change the base?

E2565 : Integration of JoinTeamRequests #241

Uh oh!

Conversation

smitraval24 commented Dec 3, 2025

Uh oh!

efg Dec 3, 2025

Choose a reason for hiding this comment

Find participant object for the user who is requesting to join the team

Uh oh!

efg Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Key Changes:

Reviewed changes

Uh oh!

Copilot AI Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants