Skip to content

Exam mode: Skip access forbidden alert for instructors #10538

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Apr 18, 2025

Conversation

coolchock
Copy link
Contributor

@coolchock coolchock commented Mar 20, 2025

Checklist

General

Server

  • Important: I implemented the changes with a very good performance and prevented too many (unnecessary) and too complex database calls.
  • I strictly followed the server coding and design guidelines.
  • I added multiple integration tests (Spring) related to the features (with a high test coverage).

Motivation and Context

In the 8.0.0 testing session, an issue was discovered where instructors see an "Access Forbidden" alert when opening a normal exam. This shouldn't happen, as instructors already receive a message stating they cannot participate in a normal exam, but can proceed to the exam management page.

This PR resolves #10509.

Description

I added a check in getOrCreateStudentExamElseThrow to verify if the user is at least an instructor in the course. If they are, an AccessForbiddenAlertException is thrown, preventing the getOrCreateNormalExam method from being called, since instructors and admins cannot participate in normal exams. The alert is suppressed on the client side.

Steps for Testing

Prerequisites:

  • 1 Instructor
  • 1 normal exam
  1. Log in to Artemis as an Instructor.
  2. Navigate to a course where you are an instructor and select Exams
  3. Open any normal exam and verify that no alert is shown. Instead, the exam page should display the message:
    "Since you are not a student, you cannot participate in this exam."

Testserver States

You can manage test servers using Helios. Check environment statuses in the environment list. To deploy to a test server, go to the CI/CD page, find your PR or branch, and trigger the deployment.

Review Progress

Code Review

  • Code Review 1
  • Code Review 2

Manual Tests

  • Test 1
  • Test 2

Summary by CodeRabbit

  • Bug Fixes
    • Updated exam access controls to prevent instructors and administrators from participating in student exams.
  • Tests
    • Added a new test scenario to ensure that restricted users receive appropriate feedback when attempting to access student exams.

@github-project-automation github-project-automation bot moved this to Work In Progress in Artemis Development Mar 20, 2025
@github-actions github-actions bot added tests server Pull requests that update Java code. (Added Automatically!) exam Pull requests that affect the corresponding module labels Mar 20, 2025
@coolchock coolchock marked this pull request as ready for review March 20, 2025 16:25
@coolchock coolchock requested a review from a team as a code owner March 20, 2025 16:25
@helios-aet helios-aet bot temporarily deployed to artemis-test1.artemis.cit.tum.de March 20, 2025 16:26 Inactive
Copy link
Contributor

coderabbitai bot commented Mar 20, 2025

Walkthrough

This pull request adds a new conditional branch in the getOrCreateStudentExamElseThrow method within the exam access service to check if the current user is at least an instructor. If so, it immediately throws an AccessForbiddenAlertException to prevent instructors from accessing student exams. Additionally, the PR includes a new test method to verify that this exception is raised correctly when an instructor attempts to access a student exam. No changes were made to the exported or public entities.

Changes

File Change Summary
src/main/java/de/tum/.../ExamAccessService.java Added an else if condition in getOrCreateStudentExamElseThrow to throw AccessForbiddenAlertException for instructors; added necessary imports.
src/test/java/de/tum/.../ExamAccessServiceTest.java Introduced testCheckAndGetCourseAndExamAccessForConduction_instructor to ensure an instructor's access attempt correctly triggers the exception.

Sequence Diagram(s)

sequenceDiagram
    participant Client
    participant ExamAccessService

    Client->>ExamAccessService: getOrCreateStudentExamElseThrow()
    ExamAccessService->>ExamAccessService: Check user role
    alt User is Instructor
        ExamAccessService-->>Client: throw AccessForbiddenAlertException
    else User is not Instructor
        ExamAccessService-->>Client: Proceed with exam retrieval/creation
    end
Loading

Assessment against linked issues

Objective Addressed Explanation
Prevent multiple unauthorized pop-ups for instructors (#10509)

Possibly related PRs

Suggested labels

bugfix, ready to merge

Suggested reviewers

  • JohannesStoehr
  • krusche
  • Hialus
  • edkaya

📜 Recent review details

Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 29118dc and e46929c.

📒 Files selected for processing (2)
  • src/main/java/de/tum/cit/aet/artemis/exam/service/ExamAccessService.java (2 hunks)
  • src/test/java/de/tum/cit/aet/artemis/exam/service/ExamAccessServiceTest.java (2 hunks)
🧰 Additional context used
📓 Path-based instructions (2)
`src/main/java/**/*.java`: naming:CamelCase; principles:{single_responsibility,small_methods,no_duplication}; db:{perf_queries,datetime_not_timestamp}; rest:{stateless,singleton,de...

src/main/java/**/*.java: naming:CamelCase; principles:{single_responsibility,small_methods,no_duplication}; db:{perf_queries,datetime_not_timestamp}; rest:{stateless,singleton,delegate_logic,http_only,minimal_dtos}; dtos:{java_records,no_entities,min_data,single_resp}; di:constructor_injection; kiss:simple_code; file_handling:os_indep_paths; practices:{least_access,avoid_transactions,code_reuse,static_member_ref,prefer_primitives}; sql:{param_annotation,uppercase,avoid_subqueries};java:avoid_star_imports

  • src/main/java/de/tum/cit/aet/artemis/exam/service/ExamAccessService.java
`src/test/java/**/*.java`: test_naming: descriptive; test_size: small_specific; fixed_data: true; junit5_features: true; assert_use: assertThat; assert_specificity: true; archunit_...

src/test/java/**/*.java: test_naming: descriptive; test_size: small_specific; fixed_data: true; junit5_features: true; assert_use: assertThat; assert_specificity: true; archunit_use: enforce_package_rules; db_query_count_tests: track_performance; util_service_factory_pattern: true; avoid_db_access: true; mock_strategy: static_mocks; context_restart_minimize: true

  • src/test/java/de/tum/cit/aet/artemis/exam/service/ExamAccessServiceTest.java
🧠 Learnings (1)
src/main/java/de/tum/cit/aet/artemis/exam/service/ExamAccessService.java (1)
Learnt from: SamuelRoettgermann
PR: ls1intum/Artemis#9303
File: src/main/java/de/tum/in/www1/artemis/service/exam/StudentExamService.java:266-267
Timestamp: 2025-03-20T14:13:13.272Z
Learning: When reviewing code in this project, avoid suggesting code changes that are outside the scope of the PR.
⏰ Context from checks skipped due to timeout of 90000ms (4)
  • GitHub Check: Deploy to Test-Server
  • GitHub Check: Codacy Static Code Analysis
  • GitHub Check: Analyse
  • GitHub Check: client-tests
🔇 Additional comments (4)
src/main/java/de/tum/cit/aet/artemis/exam/service/ExamAccessService.java (2)

14-14: Added imports for the new exception handling.

The new imports for AccessForbiddenAlertException and ErrorConstants are correctly added to support the exception throwing in the new condition block.

Also applies to: 19-19


97-100: Well-implemented check to prevent instructor access alert.

This new condition addresses the PR objective by checking if the current user is at least an instructor in the course and throwing an AccessForbiddenAlertException with the alert flag set to true. This prevents instructors from receiving unnecessary alerts when accessing normal exams.

The implementation:

  1. Properly uses the authorizationCheckService
  2. Throws the appropriate exception type
  3. Includes a clear error message
  4. Sets the alert flag to true to handle display behavior correctly on the client side

This change effectively prevents the execution of getOrCreateNormalExam method for instructors, which is the intended behavior.

src/test/java/de/tum/cit/aet/artemis/exam/service/ExamAccessServiceTest.java (2)

21-21: Added import for exception type used in the new test.

The import for AccessForbiddenAlertException is correctly added to support the new test assertion.


356-360: Good test coverage for the new instructor access check.

This test properly verifies that an instructor receives an AccessForbiddenAlertException when attempting to access a student exam. The test follows the project's testing style with:

  1. Proper @Test annotation
  2. Appropriate @WithMockUser to simulate an instructor user
  3. Clear assertion that verifies the expected exception is thrown
  4. Naming convention that aligns with other similar tests in the file

This ensures that the new condition added to getOrCreateStudentExamElseThrow is properly tested, enhancing the reliability of the change.

✨ Finishing Touches
  • 📝 Generate Docstrings

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share
🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Generate unit testing code for this file.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai generate unit testing code for this file.
    • @coderabbitai modularize this function.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read src/utils.ts and generate unit testing code.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
    • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai generate docstrings to generate docstrings for this PR.
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai or @coderabbitai title anywhere in the PR title to generate the title automatically.

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

Copy link
Contributor

@tobias-lippert tobias-lippert left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

code

@helios-aet helios-aet bot temporarily deployed to artemis-test7.artemis.cit.tum.de March 21, 2025 10:08 Inactive
Copy link

End-to-End (E2E) Test Results Summary

TestsPassed ☑️Skipped ⚠️Failed ❌️Time ⏱
End-to-End (E2E) Test Report202 ran195 passed3 skipped4 failed58m 43s 132ms
TestResultTime ⏱
End-to-End (E2E) Test Report
e2e/exam/ExamParticipation.spec.ts
ts.Exam participation › Programming exam with Git submissions › Participates in exam by Git submission using ssh❌ failure5m 9s 972ms
e2e/exercise/programming/ProgrammingExerciseParticipation.spec.ts
ts.Programming exercise participation › Programming exercise participation using secure git › Programming exercise participation using SSH › Makes a git submission using SSH with RSA key❌ failure4m 43s 367ms
ts.Programming exercise participation › Programming exercise participation using secure git › Programming exercise participation using SSH › Makes a git submission using SSH with ED25519 key❌ failure4m 45s 164ms
e2e/exercise/programming/ProgrammingExerciseStaticCodeAnalysis.spec.ts
ts.Static code analysis tests › Configures SCA grading and makes a successful submission with SCA errors❌ failure1m 45s 826ms

Copy link

github-actions bot commented Apr 4, 2025

There hasn't been any activity on this pull request recently. Therefore, this pull request has been automatically marked as stale and will be closed if no further activity occurs within seven days. Thank you for your contributions.

@krusche krusche added this to the 8.0.0 milestone Apr 18, 2025
@krusche krusche merged commit d5f16d9 into develop Apr 18, 2025
17 of 21 checks passed
@krusche krusche deleted the chore/exam-mode/skip-access-alert-for-instructors branch April 18, 2025 07:33
@github-project-automation github-project-automation bot moved this from Work In Progress to Merged in Artemis Development Apr 18, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
exam Pull requests that affect the corresponding module server Pull requests that update Java code. (Added Automatically!) small stale tests
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

Exam: Unauthorize pop up appear multiple times
3 participants