headless_lms_server/controllers/course_material/

exercises.rs

//! Controllers for requests starting with `/api/v0/course-material/exercises`.

use crate::{
    domain::{
        authorization::skip_authorize,
        exercises::process_submission,
        models_requests::{self, GivePeerReviewClaim, JwtKey},
    },
    prelude::*,
};
use headless_lms_models::{
    ModelError, ModelErrorType, flagged_answers::FlaggedAnswer, peer_or_self_review_configs,
};
use models::{
    exercise_task_submissions::PeerOrSelfReviewsReceived,
    exercises::CourseMaterialExercise,
    flagged_answers::NewFlaggedAnswerWithToken,
    library::{
        grading::{StudentExerciseSlideSubmission, StudentExerciseSlideSubmissionResult},
        peer_or_self_reviewing::{
            CourseMaterialPeerOrSelfReviewData, CourseMaterialPeerOrSelfReviewSubmission,
        },
    },
    user_chapter_locking_statuses, user_exercise_states,
};
use utoipa::OpenApi;

#[derive(OpenApi)]
#[openapi(paths(
    get_exercise,
    get_peer_review_for_exercise,
    get_peer_reviews_received,
    post_submission,
    start_peer_or_self_review,
    submit_peer_or_self_review,
    post_flag_answer_in_peer_review
))]
pub(crate) struct CourseMaterialExercisesApiDoc;

#[derive(Debug, Serialize, Deserialize, PartialEq, Clone, utoipa::ToSchema)]

pub struct CourseMaterialPeerOrSelfReviewDataWithToken {
    pub course_material_peer_or_self_review_data: CourseMaterialPeerOrSelfReviewData,
    pub token: Option<String>,
}

/**
GET `/api/v0/course-material/exercises/:exercise_id` - Get exercise by id. Includes
relevant context so that doing the exercise is possible based on the response.

This endpoint does not expose exercise's private spec because it would
expose the correct answers to the user.
*/
#[utoipa::path(
    get,
    path = "/{exercise_id}",
    operation_id = "getCourseMaterialExercise",
    tag = "course-material-exercises",
    params(
        ("exercise_id" = Uuid, Path, description = "Exercise id")
    ),
    responses(
        (status = 200, description = "Course material exercise", body = CourseMaterialExercise)
    )
)]
#[instrument(skip(pool, file_store, app_conf))]
async fn get_exercise(
    pool: web::Data<PgPool>,
    exercise_id: web::Path<Uuid>,
    user: Option<AuthUser>,
    file_store: web::Data<dyn FileStore>,
    app_conf: web::Data<ApplicationConfiguration>,
) -> ControllerResult<web::Json<CourseMaterialExercise>> {
    let mut conn = pool.acquire().await?;
    let user_id = user.map(|u| u.id);
    let mut course_material_exercise = models::exercises::get_course_material_exercise(
        &mut conn,
        user_id,
        *exercise_id,
        models_requests::fetch_service_info,
        file_store.as_ref(),
        app_conf.as_ref(),
    )
    .await?;

    let mut should_clear_grading_information = true;
    // Check if teacher is testing an exam and wants to see the exercise answers
    if let Some(exam_id) = course_material_exercise.exercise.exam_id {
        let user_id_for_exam = user_id.ok_or_else(|| {
            ControllerError::new(
                ControllerErrorType::UnauthorizedWithReason(
                    crate::domain::error::UnauthorizedReason::AuthenticationRequiredForExamExercise,
                ),
                "User must be authenticated to view exam exercises".to_string(),
                None,
            )
        })?;
        let user_enrollment =
            models::exams::get_enrollment(&mut conn, exam_id, user_id_for_exam).await?;

        if let Some(enrollment) = user_enrollment
            && let Some(show_answers) = enrollment.show_exercise_answers
            && enrollment.is_teacher_testing
            && show_answers
        {
            should_clear_grading_information = false;
        }
    }

    if course_material_exercise.can_post_submission
        && course_material_exercise.exercise.exam_id.is_some()
        && should_clear_grading_information
    {
        // Explicitely clear grading information from ongoing exam submissions.
        course_material_exercise.clear_grading_information();
    }

    let score_given: f32 = if let Some(status) = &course_material_exercise.exercise_status {
        status.score_given.unwrap_or(0.0)
    } else {
        0.0
    };

    let submission_count = course_material_exercise
        .exercise_slide_submission_counts
        .get(&course_material_exercise.current_exercise_slide.id)
        .unwrap_or(&0);

    let out_of_tries = course_material_exercise.exercise.limit_number_of_tries
        && *submission_count as i32
            >= course_material_exercise
                .exercise
                .max_tries_per_slide
                .unwrap_or(i32::MAX);

    // Model solution spec should only be shown when this is the last try for the current slide or they have gotten full points from the current slide.
    // TODO: this uses points for the whole exercise, change this to slide points when slide grading finalized
    let has_received_full_points = score_given
        >= course_material_exercise.exercise.score_maximum as f32
        || (score_given - course_material_exercise.exercise.score_maximum as f32).abs() < 0.0001;
    if !has_received_full_points && !out_of_tries {
        course_material_exercise.clear_model_solution_specs();
    }
    let token = skip_authorize();
    token.authorized_ok(web::Json(course_material_exercise))
}

/**
GET `/api/v0/course-material/exercises/:exercise_id/peer-review` - Get peer review for an exercise. This includes the submission to peer review and the questions the user is supposed to answer.ALTER

This request will fail if the user is not in the peer review stage yet because the information included in the peer review often exposes the correct solution to the exercise.
*/
#[utoipa::path(
    get,
    path = "/{exercise_id}/peer-review",
    operation_id = "fetchPeerOrSelfReviewDataByExerciseId",
    tag = "course-material-exercises",
    params(
        ("exercise_id" = Uuid, Path, description = "Exercise id")
    ),
    responses(
        (
            status = 200,
            description = "Peer or self review data",
            body = CourseMaterialPeerOrSelfReviewDataWithToken
        )
    )
)]
#[instrument(skip(pool, file_store, app_conf))]
async fn get_peer_review_for_exercise(
    pool: web::Data<PgPool>,
    exercise_id: web::Path<Uuid>,
    user: AuthUser,
    jwt_key: web::Data<JwtKey>,
    file_store: web::Data<dyn FileStore>,
    app_conf: web::Data<ApplicationConfiguration>,
) -> ControllerResult<web::Json<CourseMaterialPeerOrSelfReviewDataWithToken>> {
    let mut conn = pool.acquire().await?;
    let course_material_peer_or_self_review_data =
        models::peer_or_self_review_configs::get_course_material_peer_or_self_review_data(
            &mut conn,
            user.id,
            *exercise_id,
            models_requests::fetch_service_info,
            file_store.as_ref(),
            app_conf.as_ref(),
        )
        .await?;
    let token = authorize(
        &mut conn,
        Act::View,
        Some(user.id),
        Res::Exercise(*exercise_id),
    )
    .await?;
    let give_peer_review_claim =
        if let Some(to_review) = &course_material_peer_or_self_review_data.answer_to_review {
            Some(
                GivePeerReviewClaim::expiring_in_1_day(
                    to_review.exercise_slide_submission_id,
                    course_material_peer_or_self_review_data
                        .peer_or_self_review_config
                        .id,
                )
                .sign(&jwt_key)?,
            )
        } else {
            None
        };

    let res = CourseMaterialPeerOrSelfReviewDataWithToken {
        course_material_peer_or_self_review_data,
        token: give_peer_review_claim,
    };
    token.authorized_ok(web::Json(res))
}

/**
GET `/api/v0/course-material/exercises/:exercise_id/peer-review-received` - Get peer review recieved from other student for an exercise. This includes peer review submitted and the question asociated with it.
*/
#[utoipa::path(
    get,
    path = "/{exercise_id}/exercise-slide-submission/{exercise_slide_submission_id}/peer-or-self-reviews-received",
    operation_id = "fetchPeerReviewDataReceivedByExerciseId",
    tag = "course-material-exercises",
    params(
        ("exercise_id" = Uuid, Path, description = "Exercise id"),
        ("exercise_slide_submission_id" = Uuid, Path, description = "Exercise slide submission id")
    ),
    responses(
        (status = 200, description = "Peer reviews received", body = PeerOrSelfReviewsReceived)
    )
)]
#[instrument(skip(pool))]
async fn get_peer_reviews_received(
    pool: web::Data<PgPool>,
    params: web::Path<(Uuid, Uuid)>,
    user: AuthUser,
) -> ControllerResult<web::Json<PeerOrSelfReviewsReceived>> {
    let mut conn = pool.acquire().await?;
    let (exercise_id, exercise_slide_submission_id) = params.into_inner();
    let peer_review_data = models::exercise_task_submissions::get_peer_reviews_received(
        &mut conn,
        exercise_id,
        exercise_slide_submission_id,
        user.id,
    )
    .await?;
    let token = skip_authorize();
    token.authorized_ok(web::Json(peer_review_data))
}

/**
POST `/api/v0/course-material/exercises/:exercise_id/submissions` - Post new submission for an
exercise.

# Example
```http
POST /api/v0/course-material/exercises/:exercise_id/submissions HTTP/1.1
Content-Type: application/json

{
  "exercise_slide_id": "0125c21b-6afa-4652-89f7-56c48bd8ffe4",
  "exercise_task_answers": [
    {
      "exercise_task_id": "0125c21b-6afa-4652-89f7-56c48bd8ffe4",
      "answer": {
        "kind": "json",
        "data": { "selectedOptionId": "8f09e9a0-ac20-486a-ba29-704e7eeaf6af" }
      }
    }
  ]
}
```
*/
#[utoipa::path(
    post,
    path = "/{exercise_id}/submissions",
    operation_id = "postSubmission",
    tag = "course-material-exercises",
    params(
        ("exercise_id" = Uuid, Path, description = "Exercise id")
    ),
    request_body = StudentExerciseSlideSubmission,
    responses(
        (
            status = 200,
            description = "Submission result",
            body = StudentExerciseSlideSubmissionResult
        )
    )
)]
#[instrument(skip(pool, file_store, jwt_key, app_conf))]
async fn post_submission(
    pool: web::Data<PgPool>,
    file_store: web::Data<dyn FileStore>,
    jwt_key: web::Data<JwtKey>,
    exercise_id: web::Path<Uuid>,
    payload: web::Json<StudentExerciseSlideSubmission>,
    user: AuthUser,
    app_conf: web::Data<ApplicationConfiguration>,
) -> ControllerResult<web::Json<StudentExerciseSlideSubmissionResult>> {
    let submission = payload.0;
    let mut conn = pool.acquire().await?;
    let exercise = models::exercises::get_by_id(&mut conn, *exercise_id).await?;

    if let Some(chapter_id) = exercise.chapter_id {
        let course_id = models::chapters::get_course_id(&mut conn, chapter_id).await?;
        let is_accessible = user_chapter_locking_statuses::is_chapter_accessible(
            &mut conn, user.id, chapter_id, course_id,
        )
        .await?;
        if !is_accessible {
            return Err(ControllerError::new(
                ControllerErrorType::Forbidden,
                "Complete and lock the previous chapter to unlock exercises in this chapter."
                    .to_string(),
                None,
            ));
        }
        let exercises_locked = user_chapter_locking_statuses::is_chapter_exercises_locked(
            &mut conn, user.id, chapter_id, course_id,
        )
        .await?;
        if exercises_locked {
            return Err(ControllerError::new(
                ControllerErrorType::Forbidden,
                "The current chapter is locked, and you can no longer submit exercises."
                    .to_string(),
                None,
            ));
        }
    }

    let token = authorize(
        &mut conn,
        Act::View,
        Some(user.id),
        Res::Exercise(exercise.id),
    )
    .await?;
    let result = process_submission(
        &mut conn,
        user.id,
        exercise,
        &submission,
        jwt_key.into_inner(),
        file_store.as_ref(),
        app_conf.as_ref(),
    )
    .await?;
    token.authorized_ok(web::Json(result))
}

/**
 * POST `/api/v0/course-material/exercises/:exercise_id/peer-or-self-reviews/start` - Post a signal indicating that
 * the user will start the peer or self reviewing process.
 *
 * This operation is only valid for exercises marked for peer reviews. No further submissions will be
 * accepted after posting to this endpoint.
 */
#[utoipa::path(
    post,
    path = "/{exercise_id}/peer-or-self-reviews/start",
    operation_id = "postStartPeerOrSelfReview",
    tag = "course-material-exercises",
    params(
        ("exercise_id" = Uuid, Path, description = "Exercise id")
    ),
    responses(
        (status = 200, description = "Peer or self review started", body = bool)
    )
)]
#[instrument(skip(pool))]
async fn start_peer_or_self_review(
    pool: web::Data<PgPool>,
    exercise_id: web::Path<Uuid>,
    user: AuthUser,
) -> ControllerResult<web::Json<bool>> {
    let mut conn = pool.acquire().await?;

    let exercise = models::exercises::get_by_id(&mut conn, *exercise_id).await?;

    if let Some(chapter_id) = exercise.chapter_id {
        let course_id = models::chapters::get_course_id(&mut conn, chapter_id).await?;
        let is_accessible = user_chapter_locking_statuses::is_chapter_accessible(
            &mut conn, user.id, chapter_id, course_id,
        )
        .await?;
        if !is_accessible {
            return Err(ControllerError::new(
                ControllerErrorType::Forbidden,
                "Complete and lock the previous chapter to unlock exercises in this chapter."
                    .to_string(),
                None,
            ));
        }
        let exercises_locked = user_chapter_locking_statuses::is_chapter_exercises_locked(
            &mut conn, user.id, chapter_id, course_id,
        )
        .await?;
        if exercises_locked {
            return Err(ControllerError::new(
                ControllerErrorType::Forbidden,
                "The current chapter is locked, and you can no longer submit exercises."
                    .to_string(),
                None,
            ));
        }
    }

    let user_exercise_state =
        user_exercise_states::get_users_current_by_exercise(&mut conn, user.id, &exercise).await?;
    let token = authorize(
        &mut conn,
        Act::View,
        Some(user.id),
        Res::Exercise(*exercise_id),
    )
    .await?;
    models::library::peer_or_self_reviewing::start_peer_or_self_review_for_user(
        &mut conn,
        user_exercise_state,
        &exercise,
    )
    .await?;

    token.authorized_ok(web::Json(true))
}

/**
 * POST `/api/v0/course-material/exercises/:exercise_id/peer-or-self-reviews - Post a peer review or a self review for an
 * exercise submission.
 */
#[utoipa::path(
    post,
    path = "/{exercise_id}/peer-or-self-reviews",
    operation_id = "postPeerOrSelfReviewSubmission",
    tag = "course-material-exercises",
    params(
        ("exercise_id" = Uuid, Path, description = "Exercise id")
    ),
    request_body = CourseMaterialPeerOrSelfReviewSubmission,
    responses(
        (status = 200, description = "Peer or self review submitted", body = bool)
    )
)]
#[instrument(skip(pool))]
async fn submit_peer_or_self_review(
    pool: web::Data<PgPool>,
    exercise_id: web::Path<Uuid>,
    payload: web::Json<CourseMaterialPeerOrSelfReviewSubmission>,
    user: AuthUser,
    jwt_key: web::Data<JwtKey>,
) -> ControllerResult<web::Json<bool>> {
    let mut conn = pool.acquire().await?;
    let payload = payload.into_inner();
    let exercise = models::exercises::get_non_deleted_by_id(&mut conn, *exercise_id).await?;

    if let Some(chapter_id) = exercise.chapter_id {
        let course_id = models::chapters::get_course_id(&mut conn, chapter_id).await?;
        let is_accessible = user_chapter_locking_statuses::is_chapter_accessible(
            &mut conn, user.id, chapter_id, course_id,
        )
        .await?;
        if !is_accessible {
            return Err(ControllerError::new(
                ControllerErrorType::Forbidden,
                "Complete and lock the previous chapter to unlock exercises in this chapter."
                    .to_string(),
                None,
            ));
        }
        let exercises_locked = user_chapter_locking_statuses::is_chapter_exercises_locked(
            &mut conn, user.id, chapter_id, course_id,
        )
        .await?;
        if exercises_locked {
            return Err(ControllerError::new(
                ControllerErrorType::Forbidden,
                "The current chapter is locked, and you can no longer submit exercises."
                    .to_string(),
                None,
            ));
        }
    }

    // If the claim in the token validates, we can be sure that the user submitting this peer review got the peer review candidate from the backend.
    // The validation prevents users from chaging which answer they peer review.
    let claim = GivePeerReviewClaim::validate(&payload.token, &jwt_key)?;
    if claim.exercise_slide_submission_id != payload.exercise_slide_submission_id
        || claim.peer_or_self_review_config_id != payload.peer_or_self_review_config_id
    {
        return Err(ControllerError::new(
            ControllerErrorType::BadRequest,
            "You are not allowed to review this answer.".to_string(),
            None,
        ));
    }

    let giver_user_exercise_state =
        user_exercise_states::get_users_current_by_exercise(&mut conn, user.id, &exercise).await?;
    let exercise_slide_submission: models::exercise_slide_submissions::ExerciseSlideSubmission =
        models::exercise_slide_submissions::get_by_id(
            &mut conn,
            payload.exercise_slide_submission_id,
        )
        .await?;
    if exercise_slide_submission.exercise_id != exercise.id
        || exercise_slide_submission.course_id != exercise.course_id
    {
        return Err(controller_err!(
            Forbidden,
            "Reviewed submission does not belong to the requested exercise".to_string()
        ));
    }

    let peer_or_self_review_config = peer_or_self_review_configs::get_by_exercise_or_course_id(
        &mut conn,
        &exercise,
        exercise.get_course_id()?,
    )
    .await?;
    if peer_or_self_review_config.id != payload.peer_or_self_review_config_id {
        return Err(controller_err!(
            Forbidden,
            "Peer review configuration does not belong to the requested exercise".to_string()
        ));
    }

    if let Some(receiver_course_id) = exercise_slide_submission.course_id {
        let receiver_user_exercise_state = user_exercise_states::get_user_exercise_state_if_exists(
            &mut conn,
            exercise_slide_submission.user_id,
            exercise.id,
            CourseOrExamId::Course(receiver_course_id),
        )
        .await?;
        if let Some(receiver_user_exercise_state) = receiver_user_exercise_state {
            let mut tx = conn.begin().await?;

            models::library::peer_or_self_reviewing::create_peer_or_self_review_submission_for_user(
                &mut tx,
                &exercise,
                giver_user_exercise_state,
                receiver_user_exercise_state,
                payload,
            )
            .await?;

            // Get updater receiver state after possible update above
            let updated_receiver_state = user_exercise_states::get_user_exercise_state_if_exists(
                &mut tx,
                exercise_slide_submission.user_id,
                exercise.id,
                CourseOrExamId::Course(receiver_course_id),
            )
            .await?
            .ok_or_else(|| {
                ModelError::new(
                    ModelErrorType::Generic,
                    "Receiver exercise state not found".to_string(),
                    None,
                )
            })?;

            let _ = models::library::peer_or_self_reviewing::reset_exercise_if_needed_if_zero_points_from_review(
                &mut tx,
                &peer_or_self_review_config,
                &updated_receiver_state,
            ).await?;

            tx.commit().await?;
        } else {
            warn!(
                "No user exercise state found for receiver's exercise slide submission id: {}",
                exercise_slide_submission.id
            );
            return Err(ControllerError::new(
                ControllerErrorType::BadRequest,
                "No user exercise state found for receiver's exercise slide submission."
                    .to_string(),
                None,
            ));
        }
    } else {
        warn!(
            "No course instance id found for receiver's exercise slide submission id: {}",
            exercise_slide_submission.id
        );
        return Err(ControllerError::new(
            ControllerErrorType::BadRequest,
            "No course instance id found for receiver's exercise slide submission.".to_string(),
            None,
        ));
    }
    let token = skip_authorize();
    token.authorized_ok(web::Json(true))
}

/**
 * POST `/api/v0/course-material/exercises/:exercise_id/flag-peer-review-answer - Post a report of an answer in peer review made by a student
 */
#[utoipa::path(
    post,
    path = "/{exercise_id}/flag-peer-review-answer",
    operation_id = "postFlagAnswerInPeerReview",
    tag = "course-material-exercises",
    params(
        ("exercise_id" = Uuid, Path, description = "Exercise id")
    ),
    request_body = NewFlaggedAnswerWithToken,
    responses(
        (status = 200, description = "Created flagged answer", body = FlaggedAnswer)
    )
)]
#[instrument(skip(pool))]
async fn post_flag_answer_in_peer_review(
    pool: web::Data<PgPool>,
    payload: web::Json<NewFlaggedAnswerWithToken>,
    user: AuthUser,
    jwt_key: web::Data<JwtKey>,
) -> ControllerResult<web::Json<FlaggedAnswer>> {
    let mut conn = pool.acquire().await?;

    let claim = GivePeerReviewClaim::validate(&payload.token, &jwt_key)?;
    if claim.exercise_slide_submission_id != payload.submission_id
        || claim.peer_or_self_review_config_id != payload.peer_or_self_review_config_id
    {
        return Err(ControllerError::new(
            ControllerErrorType::BadRequest,
            "You are not allowed to report this answer.".to_string(),
            None,
        ));
    }

    let insert_result =
        models::flagged_answers::insert_flagged_answer_and_move_to_manual_review_if_needed(
            &mut conn,
            payload.into_inner(),
            user.id,
        )
        .await?;

    let token = skip_authorize();
    token.authorized_ok(web::Json(insert_result))
}

/**
Add a route for each controller in this module.

The name starts with an underline in order to appear before other functions in the module documentation.

We add the routes by calling the route method instead of using the route annotations because this method preserves the function signatures for documentation.
*/
pub fn _add_routes(cfg: &mut ServiceConfig) {
    cfg.route("/{exercise_id}", web::get().to(get_exercise))
        .route(
            "/{exercise_id}/peer-or-self-reviews",
            web::post().to(submit_peer_or_self_review),
        )
        .route(
            "/{exercise_id}/peer-or-self-reviews/start",
            web::post().to(start_peer_or_self_review),
        )
        .route(
            "/{exercise_id}/peer-review",
            web::get().to(get_peer_review_for_exercise),
        )
        .route(
            "/{exercise_id}/exercise-slide-submission/{exercise_slide_submission_id}/peer-or-self-reviews-received",
            web::get().to(get_peer_reviews_received),
        )
        .route(
            "/{exercise_id}/submissions",
            web::post().to(post_submission),
        ).route(
            "/{exercise_id}/flag-peer-review-answer",
            web::post().to(post_flag_answer_in_peer_review),
        );
}