Transfer groundControl (and admin panel) from staff to admin route

lib/cadet/devices/devices.ex

@@ -208,7 +208,7 @@ defmodule Cadet.Devices do
               },
               300,
               [],
-              ''
+              ~c""
             )
 
           # ExAws includes the session token in the signed payload and doesn't allow

lib/cadet_web/admin_controllers/admin_assets_controller.ex

@@ -1,8 +1,6 @@
 defmodule CadetWeb.AdminAssetsController do
   use CadetWeb, :controller
-
   use PhoenixSwagger
-
   alias Cadet.Assets.Assets
   alias Cadet.Courses
 
@@ -22,7 +20,7 @@ defmodule CadetWeb.AdminAssetsController do
 
     case Assets.delete_object(Courses.assets_prefix(course_reg.course), foldername, filename) do
       {:error, {status, message}} -> conn |> put_status(status) |> text(message)
-      _ -> conn |> put_status(204) |> text('')
+      _ -> conn |> put_status(204) |> text(~c"")
     end
   end
 
@@ -96,7 +94,12 @@ defmodule CadetWeb.AdminAssetsController do
     parameters do
       folderName(:path, :string, "Folder name", required: true)
 
-      fileName(:path, :string, "File path in folder, which may contain subfolders", required: true)
+      fileName(
+        :path,
+        :string,
+        "File path in folder, which may contain subfolders",
+        required: true
+      )
     end
 
     security([%{JWT: []}])
@@ -115,7 +118,12 @@ defmodule CadetWeb.AdminAssetsController do
     parameters do
       folderName(:path, :string, "Folder name", required: true)
 
-      fileName(:path, :string, "File path in folder, which may contain subfolders", required: true)
+      fileName(
+        :path,
+        :string,
+        "File path in folder, which may contain subfolders",
+        required: true
+      )
     end
 
     security([%{JWT: []}])

lib/cadet_web/admin_controllers/admin_courses_controller.ex

@@ -143,7 +143,13 @@ defmodule CadetWeb.AdminCoursesController do
           title("AdminSublanguage")
 
           properties do
-            chapter(:integer, "Chapter number from 1 to 4", required: true, minimum: 1, maximum: 4)
+            chapter(
+              :integer,
+              "Chapter number from 1 to 4",
+              required: true,
+              minimum: 1,
+              maximum: 4
+            )
 
             variant(Schema.ref(:SourceVariant), "Variant name", required: true)
           end

lib/cadet_web/admin_controllers/admin_grading_controller.ex

@@ -367,7 +367,11 @@ defmodule CadetWeb.AdminGradingController do
               required: true
             )
 
-            student(Schema.ref(:StudentInfo), "Student who created the submission", required: true)
+            student(
+              Schema.ref(:StudentInfo),
+              "Student who created the submission",
+              required: true
+            )
 
             unsubmittedBy(Schema.ref(:GraderInfo))
             unsubmittedAt(:string, "Last unsubmitted at", format: "date-time", required: false)

lib/cadet_web/admin_controllers/admin_stories_controller.ex

@@ -12,7 +12,7 @@ defmodule CadetWeb.AdminStoriesController do
 
     case result do
       {:ok, _story} ->
-        conn |> put_status(200) |> text('')
+        conn |> put_status(200) |> text(~c"")
 
       {:error, {status, message}} ->
         conn
@@ -29,7 +29,7 @@ defmodule CadetWeb.AdminStoriesController do
 
     case result do
       {:ok, _story} ->
-        conn |> put_status(200) |> text('')
+        conn |> put_status(200) |> text(~c"")
 
       {:error, {status, message}} ->
         conn
@@ -43,7 +43,7 @@ defmodule CadetWeb.AdminStoriesController do
 
     case result do
       {:ok, _nil} ->
-        conn |> put_status(204) |> text('')
+        conn |> put_status(204) |> text(~c"")
 
       {:error, {status, message}} ->
         conn

lib/cadet_web/admin_views/admin_assessments_view.ex

@@ -64,7 +64,12 @@ defmodule CadetWeb.AdminAssessmentsView do
   end
 
   def render("leaderboard.json", %{leaderboard: leaderboard}) do
-    render_many(leaderboard, CadetWeb.AdminAssessmentsView, "contestEntry.json", as: :contestEntry)
+    render_many(
+      leaderboard,
+      CadetWeb.AdminAssessmentsView,
+      "contestEntry.json",
+      as: :contestEntry
+    )
   end
 
   def render("contestEntry.json", %{contestEntry: contestEntry}) do

lib/cadet_web/router.ex

@@ -28,6 +28,10 @@ defmodule CadetWeb.Router do
     plug(:ensure_role, [:staff, :admin])
   end
 
+  pipeline :ensure_admin do
+    plug(:ensure_role, [:admin])
+  end
+
   scope "/", CadetWeb do
     get("/.well-known/jwks.json", JWKSController, :index)
   end
@@ -119,11 +123,18 @@ defmodule CadetWeb.Router do
     get("/team/:assessmentid", TeamController, :index)
   end
 
-  # Admin pages
-  scope "/v2/courses/:course_id/admin", CadetWeb do
-    pipe_through([:api, :auth, :ensure_auth, :course, :ensure_staff])
+  # Admin pages (Access: Course administrators only - these routes can cause substantial damage)
+  @doc """
+    NOTE: This scope must come before the routes for all staff below.
 
-    resources("/sourcecast", AdminSourcecastController, only: [:create, :delete])
+    This is due to the all-staff route "/grading/:submissionid/:questionid", which would pattern match
+    and overshadow "/grading/:assessmentid/publish_all_grades".
+
+    If an admin route will overshadow an all-staff route as well, a suggested better solution would be a
+    per-route permission level check.
+  """
+  scope "/v2/courses/:course_id/admin", CadetWeb do
+    pipe_through([:api, :auth, :ensure_auth, :course, :ensure_admin])
 
     get("/assets/:foldername", AdminAssetsController, :index)
     post("/assets/:foldername/*filename", AdminAssetsController, :upload)
@@ -133,6 +144,39 @@ defmodule CadetWeb.Router do
     post("/assessments/:assessmentid", AdminAssessmentsController, :update)
     delete("/assessments/:assessmentid", AdminAssessmentsController, :delete)
 
+    post(
+      "/grading/:assessmentid/publish_all_grades",
+      AdminGradingController,
+      :publish_all_grades
+    )
+
+    post(
+      "/grading/:assessmentid/unpublish_all_grades",
+      AdminGradingController,
+      :unpublish_all_grades
+    )
+
+    put("/users/:course_reg_id/role", AdminUserController, :update_role)
+    delete("/users/:course_reg_id", AdminUserController, :delete_user)
+
+    put("/config", AdminCoursesController, :update_course_config)
+    # TODO: Missing corresponding Swagger path entry
+    get("/config/assessment_configs", AdminCoursesController, :get_assessment_configs)
+    put("/config/assessment_configs", AdminCoursesController, :update_assessment_configs)
+    # TODO: Missing corresponding Swagger path entry
+    delete(
+      "/config/assessment_config/:assessment_config_id",
+      AdminCoursesController,
+      :delete_assessment_config
+    )
+  end
+
+  # Admin pages (Access: All staff)
+  scope "/v2/courses/:course_id/admin", CadetWeb do
+    pipe_through([:api, :auth, :ensure_auth, :course, :ensure_staff])
+
+    resources("/sourcecast", AdminSourcecastController, only: [:create, :delete])
+
     get(
       "/assessments/:assessmentid/popularVoteLeaderboard",
       AdminAssessmentsController,
@@ -148,14 +192,6 @@ defmodule CadetWeb.Router do
     get("/grading", AdminGradingController, :index)
     get("/grading/summary", AdminGradingController, :grading_summary)
 
-    post("/grading/:assessmentid/publish_all_grades", AdminGradingController, :publish_all_grades)
-
-    post(
-      "/grading/:assessmentid/unpublish_all_grades",
-      AdminGradingController,
-      :unpublish_all_grades
-    )
-
     get("/grading/:submissionid", AdminGradingController, :show)
     post("/grading/:submissionid/unsubmit", AdminGradingController, :unsubmit)
     post("/grading/:submissionid/unpublish_grades", AdminGradingController, :unpublish_grades)
@@ -184,8 +220,6 @@ defmodule CadetWeb.Router do
 
     # The admin route for getting total xp of a specific user
     get("/users/:course_reg_id/total_xp", AdminUserController, :combined_total_xp)
-    put("/users/:course_reg_id/role", AdminUserController, :update_role)
-    delete("/users/:course_reg_id", AdminUserController, :delete_user)
     get("/users/:course_reg_id/goals", AdminGoalsController, :index_goals_with_progress)
     post("/users/:course_reg_id/goals/:uuid/progress", AdminGoalsController, :update_progress)
 
@@ -202,17 +236,6 @@ defmodule CadetWeb.Router do
     delete("/stories/:storyid", AdminStoriesController, :delete)
     post("/stories/:storyid", AdminStoriesController, :update)
 
-    put("/config", AdminCoursesController, :update_course_config)
-    # TODO: Missing corresponding Swagger path entry
-    get("/config/assessment_configs", AdminCoursesController, :get_assessment_configs)
-    put("/config/assessment_configs", AdminCoursesController, :update_assessment_configs)
-    # TODO: Missing corresponding Swagger path entry
-    delete(
-      "/config/assessment_config/:assessment_config_id",
-      AdminCoursesController,
-      :delete_assessment_config
-    )
-
     get("/teams", AdminTeamsController, :index)
     post("/teams", AdminTeamsController, :create)
     delete("/teams/:teamid", AdminTeamsController, :delete)

lib/cadet_web/views/assessments_view.ex

@@ -67,7 +67,12 @@ defmodule CadetWeb.AssessmentsView do
   end
 
   def render("leaderboard.json", %{leaderboard: leaderboard}) do
-    render_many(leaderboard, CadetWeb.AdminAssessmentsView, "contestEntry.json", as: :contestEntry)
+    render_many(
+      leaderboard,
+      CadetWeb.AdminAssessmentsView,
+      "contestEntry.json",
+      as: :contestEntry
+    )
   end
 
   def render("contestEntry.json", %{contestEntry: contestEntry}) do