Fix some router security and code style issues

lib/cadet/notifications.ex

@@ -4,6 +4,7 @@
   """
 
   import Ecto.Query, warn: false
+  require Logger
   alias Cadet.Repo
 
   alias Cadet.Notifications.{
@@ -49,20 +50,94 @@
 
   def get_notification_config!(notification_type_id, course_id, assconfig_id) do
     query =
-      from(n in Cadet.Notifications.NotificationConfig,
-        join: ntype in Cadet.Notifications.NotificationType,
-        on: n.notification_type_id == ntype.id,
-        where: n.notification_type_id == ^notification_type_id and n.course_id == ^course_id
+      Cadet.Notifications.NotificationConfig
+      |> join(:inner, [n], ntype in Cadet.Notifications.NotificationType,
+        on: n.notification_type_id == ntype.id
       )
+      |> where([n], n.notification_type_id == ^notification_type_id and n.course_id == ^course_id)
+      |> filter_assconfig_id(assconfig_id)
+      |> Repo.one()
 
+    case query do
+      nil ->
+        Logger.error(
+          "No NotificationConfig found for Course #{course_id} and NotificationType #{notification_type_id}"
+        )
+
+        nil
+
+      config ->
+        config
+    end
+  end
+
+  defp filter_assconfig_id(query, nil) do
+    query |> where([c], is_nil(c.assessment_config_id))
+  end
+
+  defp filter_assconfig_id(query, assconfig_id) do
+    query |> where([c], c.assessment_config_id == ^assconfig_id)
+  end
+
+  def get_notification_config!(id), do: Repo.get!(NotificationConfig, id)
+
+  @doc """
+  Gets all notification configs that belong to a course
+  """
+  def get_notification_configs(course_id) do
     query =
-      if is_nil(assconfig_id) do
-        where(query, [c], is_nil(c.assessment_config_id))
-      else
-        where(query, [c], c.assessment_config_id == ^assconfig_id)
-      end
+      Cadet.Notifications.NotificationConfig
+      |> where([n], n.course_id == ^course_id)
+      |> Repo.all()
 
-    Repo.one(query)
+    query
+    |> Repo.preload([:notification_type, :course, :assessment_config, :time_options])
+  end
+
+  @doc """
+  Gets all notification configs with preferences that
+  1. belongs to the course of the course reg,
+  2. only notifications that it can configure based on course reg's role
+  """
+  def get_configurable_notification_configs(cr_id) do
+    cr = Repo.get(Cadet.Accounts.CourseRegistration, cr_id)
+
+    case cr do
+      nil ->
+        nil
+
+      _ ->
+        is_staff = cr.role == :staff
+
+        query =
+          Cadet.Notifications.NotificationConfig
+          |> join(:inner, [n], ntype in Cadet.Notifications.NotificationType,
+            on: n.notification_type_id == ntype.id
+          )
+          |> join(:inner, [n], c in Cadet.Courses.Course, on: n.course_id == c.id)
+          |> join(:left, [n], ac in Cadet.Courses.AssessmentConfig,
+            on: n.assessment_config_id == ac.id
+          )
+          |> join(:left, [n], p in Cadet.Notifications.NotificationPreference,
+            on: p.notification_config_id == n.id
+          )
+          |> where(
+            [n, ntype, c, ac, p],
+            ntype.for_staff == ^is_staff and
+              n.course_id == ^cr.course_id and
+              (p.course_reg_id == ^cr.id or is_nil(p.course_reg_id))
+          )
+          |> Repo.all()
+
+        query
+        |> Repo.preload([
+          :notification_type,
+          :course,
+          :assessment_config,
+          :time_options,
+          :notification_preferences
+        ])
+    end
   end
 
   @doc """
@@ -83,6 +158,17 @@
     |> Repo.update()
   end
 
+  def update_many_noti_configs(noti_configs) when is_list(noti_configs) do
+    Repo.transaction(fn ->
+      for noti_config <- noti_configs do
+        case Repo.update(noti_config) do
+          {:ok, res} -> res
+          {:error, error} -> Repo.rollback(error)
+        end
+      end
+    end)
+  end
+
   @doc """
   Returns an `%Ecto.Changeset{}` for tracking notification_config changes.
 
@@ -112,6 +198,24 @@
   """
   def get_time_option!(id), do: Repo.get!(TimeOption, id)
 
+  @doc """
+  Gets all time options for a notification config
+  """
+  def get_time_options_for_config(notification_config_id) do
+    query =
+      Cadet.Notifications.TimeOption
+      |> join(:inner, [to], nc in Cadet.Notifications.NotificationConfig,
+        on: to.notification_config_id == nc.id
+      )
+      |> where([to, nc], nc.id == ^notification_config_id)
+      |> Repo.all()
+
+    query
+  end
+
+  @doc """
+  Gets all time options for an assessment config and notification type
+  """
   def get_time_options_for_assessment(assessment_config_id, notification_type_id) do
     query =
       from(ac in Cadet.Courses.AssessmentConfig,
@@ -126,6 +230,9 @@
     Repo.all(query)
   end
 
+  @doc """
+  Gets the default time options for an assessment config and notification type
+  """
   def get_default_time_option_for_assessment!(assessment_config_id, notification_type_id) do
     query =
       from(ac in Cadet.Courses.AssessmentConfig,
@@ -160,6 +267,34 @@
     |> Repo.insert()
   end
 
+  def upsert_many_time_options(time_options) when is_list(time_options) do
+    Repo.transaction(fn ->
+      for to <- time_options do
+        case Repo.insert(to,
+               on_conflict: {:replace, [:is_default]},
+               conflict_target: [:minutes, :notification_config_id]
+             ) do
+          {:ok, time_option} -> time_option
+          {:error, error} -> Repo.rollback(error)
+        end
+      end
+    end)
+  end
+
+  def upsert_many_noti_preferences(noti_prefs) when is_list(noti_prefs) do
+    Repo.transaction(fn ->
+      for np <- noti_prefs do
+        case Repo.insert(np,
+               on_conflict: {:replace, [:is_enabled, :time_option_id]},
+               conflict_target: [:course_reg_id, :notification_config_id]
+             ) do
+          {:ok, noti_pref} -> noti_pref
+          {:error, error} -> Repo.rollback(error)
+        end
+      end
+    end)
+  end
+
   @doc """
   Deletes a time_option.
 
@@ -176,6 +311,42 @@
     Repo.delete(time_option)
   end
 
+  def delete_many_time_options(to_ids) when is_list(to_ids) do
+    Repo.transaction(fn ->
+      for to_id <- to_ids do
+        time_option = Repo.get(TimeOption, to_id)
+
+        case time_option do
+          nil ->
+            Repo.rollback("Time option does not exist")
+
+          _ ->
+            case Repo.delete(time_option) do
+              {:ok, deleted_time_option} -> deleted_time_option
+              {:delete_error, error} -> Repo.rollback(error)
+            end
+        end
+      end
+    end)
+  end
+
+  @doc """
+  Gets the notification preference based from its id
+  """
+  def get_notification_preference!(notification_preference_id) do
+    query =
+      NotificationPreference
+      |> join(:left, [np], to in TimeOption, on: to.id == np.time_option_id)
+      |> where([np, to], np.id == ^notification_preference_id)
+      |> preload(:time_option)
+      |> Repo.one!()
+
+    query
+  end
+
+  @doc """
+  Gets the notification preference based from notification type and course reg
+  """
   def get_notification_preference(notification_type_id, course_reg_id) do
     query =
       from(np in NotificationPreference,
@@ -276,7 +447,7 @@
     |> Repo.insert()
   end
 
   @doc """
   Returns the list of sent_notifications.
 
   ## Examples

lib/cadet/notifications/notification_config.ex

@@ -5,7 +5,7 @@ defmodule Cadet.Notifications.NotificationConfig do
   use Ecto.Schema
   import Ecto.Changeset
   alias Cadet.Courses.{Course, AssessmentConfig}
-  alias Cadet.Notifications.NotificationType
+  alias Cadet.Notifications.{NotificationType, TimeOption, NotificationPreference}
 
   schema "notification_configs" do
     field(:is_enabled, :boolean, default: false)
@@ -14,6 +14,9 @@ defmodule Cadet.Notifications.NotificationConfig do
     belongs_to(:course, Course)
     belongs_to(:assessment_config, AssessmentConfig)
 
+    has_many(:time_options, TimeOption)
+    has_many(:notification_preferences, NotificationPreference)
+
     timestamps()
   end
 

lib/cadet/notifications/notification_preference.ex

@@ -20,8 +20,9 @@ defmodule Cadet.Notifications.NotificationPreference do
   @doc false
   def changeset(notification_preference, attrs) do
     notification_preference
-    |> cast(attrs, [:is_enabled, :notification_config_id, :course_reg_id])
+    |> cast(attrs, [:is_enabled, :notification_config_id, :course_reg_id, :time_option_id])
     |> validate_required([:notification_config_id, :course_reg_id])
+    |> unique_constraint(:unique_course_reg_and_config, name: :single_preference_per_config)
     |> prevent_nil_is_enabled()
   end
 

lib/cadet/notifications/notification_type.ex

@@ -12,15 +12,16 @@ defmodule Cadet.Notifications.NotificationType do
     field(:is_enabled, :boolean, default: false)
     field(:name, :string)
     field(:template_file_name, :string)
+    field(:for_staff, :boolean)
 
     timestamps()
   end
 
   @doc false
   def changeset(notification_type, attrs) do
     notification_type
-    |> cast(attrs, [:name, :template_file_name, :is_enabled, :is_autopopulated])
-    |> validate_required([:name, :template_file_name, :is_autopopulated])
+    |> cast(attrs, [:name, :template_file_name, :is_enabled, :is_autopopulated, :for_staff])
+    |> validate_required([:name, :template_file_name, :is_autopopulated, :for_staff])
     |> unique_constraint(:name)
     |> prevent_nil_is_enabled()
   end

lib/cadet/workers/NotificationWorker.ex

@@ -3,6 +3,7 @@ defmodule Cadet.Workers.NotificationWorker do
   Contain oban workers for sending notifications
   """
   use Oban.Worker, queue: :notifications, max_attempts: 1
+  require Logger
   alias Cadet.{Email, Notifications, Mailer}
   alias Cadet.Repo
 
@@ -73,39 +74,43 @@ defmodule Cadet.Workers.NotificationWorker do
           for avenger_cr <- avengers_crs do
             avenger = Cadet.Accounts.get_user(avenger_cr.user_id)
 
-            ungraded_submissions =
-              Jason.decode!(
-                elem(
-                  Cadet.Assessments.all_submissions_by_grader_for_index(avenger_cr, true, true),
-                  1
+            if is_user_enabled(notification_type_id, avenger_cr.id) do
+              ungraded_submissions =
+                Jason.decode!(
+                  elem(
+                    Cadet.Assessments.all_submissions_by_grader_for_index(avenger_cr, true, true),
+                    1
+                  )
                 )
-              )
 
-            if length(ungraded_submissions) < ungraded_threshold do
-              IO.puts("[AVENGER_BACKLOG] below threshold!")
-            else
-              IO.puts("[AVENGER_BACKLOG] SENDING_OUT")
+              if length(ungraded_submissions) < ungraded_threshold do
+                Logger.info("[AVENGER_BACKLOG] below threshold!")
+              else
+                Logger.info("[AVENGER_BACKLOG] SENDING_OUT")
 
-              email =
-                Email.avenger_backlog_email(
-                  ntype.template_file_name,
-                  avenger,
-                  ungraded_submissions
-                )
+                email =
+                  Email.avenger_backlog_email(
+                    ntype.template_file_name,
+                    avenger,
+                    ungraded_submissions
+                  )
 
-              {status, email} = Mailer.deliver_now(email)
+                {status, email} = Mailer.deliver_now(email)
 
-              if status == :ok do
-                Notifications.create_sent_notification(avenger_cr.id, email.html_body)
+                if status == :ok do
+                  Notifications.create_sent_notification(avenger_cr.id, email.html_body)
+                end
               end
+            else
+              Logger.info("[ASSESSMENT_SUBMISSION] user-level disabled")
             end
           end
         else
-          IO.puts("[AVENGER_BACKLOG] course-level disabled")
+          Logger.info("[AVENGER_BACKLOG] course-level disabled")
         end
       end
     else
-      IO.puts("[AVENGER_BACKLOG] system-level disabled!")
+      Logger.info("[AVENGER_BACKLOG] system-level disabled!")
     end
 
     :ok
@@ -132,13 +137,13 @@ defmodule Cadet.Workers.NotificationWorker do
 
       cond do
         !is_course_enabled(notification_type.id, course_id, assessment_config_id) ->
-          IO.puts("[ASSESSMENT_SUBMISSION] course-level disabled")
+          Logger.info("[ASSESSMENT_SUBMISSION] course-level disabled")
 
         !is_user_enabled(notification_type.id, avenger_cr.id) ->
-          IO.puts("[ASSESSMENT_SUBMISSION] user-level disabled")
+          Logger.info("[ASSESSMENT_SUBMISSION] user-level disabled")
 
         true ->
-          IO.puts("[ASSESSMENT_SUBMISSION] SENDING_OUT")
+          Logger.info("[ASSESSMENT_SUBMISSION] SENDING_OUT")
 
           email =
             Email.assessment_submission_email(
@@ -155,7 +160,7 @@ defmodule Cadet.Workers.NotificationWorker do
           end
       end
     else
-      IO.puts("[ASSESSMENT_SUBMISSION] system-level disabled!")
+      Logger.info("[ASSESSMENT_SUBMISSION] system-level disabled!")
     end
   end
 end