Expertiza_Wiki - User contributions [en]

E1867 allow reviewer to say review can be shown to class as an example

2018-12-07T23:28:49Z

Ckaidab: /* Test Plan */

== Problem Statement ==
The objective of this project is to:
# Add a feature for students to make their reviews 'public', that is, allow other students to view them.
# Add a feature for TA to select a subset of 'public' reviews, and make those reviews visible as sample reviews of the particular assignment.
# Add a feature for Instructor to select a subset of 'public' reviews and make those reviews visible as sample reviews of any of his/her assignments in the course.
# Create a view where the student can see a list of sample reviews of the assignment and have a detailed view of each.
# Allow the student to toggle the visibility of a review he/she has submitted.

== Approach & Design ==

# Consent to make the review public - add a checkbox and an oncheck event handlers (JS) that sets a new field 'visibility' to public of Response object.
# Change the schema of Responses table (add the new column) and write db migrations.
# Create new table, model, view, controller for "similar_assignments" and validate CRUD operations that access the table.
# Add HTML (checkbox) to uncheck the consent such that the reviews becomes private again.
# On the "popup/team_users_popup" page (where instructor/TA can view all reviews), we give a checkbox against every review with public visibility to allow instructors/TAs to select one or more reviews as sample reviews to be available for students.
# Once the instructor selects and submits some reviews as sample reviews, we give a popup containing a list of assignments with a checkbox against each of them and a submit button at the end to allow instructors to make sample reviews available for multiple assignments in one go. We perform validation checks also.
# On submit of the popup, we update the similar_assignments table.
# At the top of student_reviews/list page, we give an option for the student to preview all the available sample reviews.
# Create the MVC setup for this new page to list all the sample reviews. Students will be able to click on one particular review and preview it.

'''DB Design'''

Currently, the Expertiza database design does not maintain any link between different assignments. An assignment of the current semester is completely independent of any other assignment of any other course having similar or exact objectives. For example, in a course C, the assignment named A1 in a semester Sx has no association to the same assignment given in an earlier semester Sy.

Since our task involves using reviews from the past as samples for the present, we should create this association as a new table. Further, reviews may not be the only intention to associate assignments with each other, as future requirements might require associating them on other criteria too. Thus, we find it appropriate to name the table as "similar_assignments".

The table structure is defined [http://wiki.expertiza.ncsu.edu/index.php/Similar_assignments here].

This table can be visualized as a directed graph where vertices represent assignments. An edge (u,v) with a label L means u is similar to v for the intent of association, L.

Consider a row (id = x, assignment_id = Ak, is_similar_for = An, association_intent = "review"). This means, given the intent of association as "review", assignment Ak was chosen as a similar assignment for assignment An. That is, while marking some review for An as a sample, the instructor opted to have reviews of Ak as samples for An as well.

== Implementation Details ==

==== UML - Use Case Diagram ====

[[Image:UseCase.png]]

'''Power Users:''' Instructors, TAs, Admins and Super Admins

'''More details about each point mentioned in the approach section will be updated after the implementation.'''

== Implementation ==

We have added a new column in the ‘responses’ table (in the database), namely, ‘visibility’.
Visibility can have 4 values as listed below:

{| class="wikitable"
|+ Table showing list of visibility values and the properties
! Visibility
! Properties
|-
| 0 || Response is private. This is the default value.
|-
| 1 || The response which was in the review has been approved as an example (that is, it has been marked as a sample)
|-
| 2 || The response which was in the review has been approved as an example (that is, it has been marked as a sample)
|-
| 3 || The response which was either in the review or approved earlier, has now been rejected as an example (it has been unmarked as a sample)
|-
|}

We have maintained these constants in a new file at helpers/response_constants.rb.

<pre>
module ResponseConstants
def _private
0
end

def in_review
1
end

def approved_as_sample
2
end

def rejected_as_sample
3
end
end
</pre>

In the existing implementation of reviews, when a student starts a review (but hasn’t filled any text or ratings yet), a response gets created in the database. This response has a default visibility of 0.

We have provided a checkbox (an HTML input node with attribute ‘type’ as ‘checkbox’) for the student to consent for his / her review to be used as an example, with values 0 and 1 for unchecked and checked respectively. This value is used to update the response object as part of the form submission.

However, a student might want to remove their consent or give their consent, for a review that is already submitted. So, in the page where student views his / her own response, we have added the same HTML checkbox. On checking or unchecking the checkbox, the visibility field in the corresponding response object in the database gets updated.Consider this as case 1.

Now when a power user looks at a review (at url , which is an HTML rendering of a ResponseMap containing Responses), he/she must be able to approve and reject responses which students have consented (offered) to be made visible to all. This is done by providing a button “Mark as Sample” or “Remove as Sample”. Responses without consent will not have any button.

These HTML changes appear in views/popup/team_users_popup.html.haml
<pre>
if instance_variable_get('@sample_button_'+round.to_s)
%div{:class=>'col-md-12 mark-delete-sample '+'round'+round.to_s}
%h3{:class=>'col-md-10'} "Reviewed by #{User.find(@reviewer_id).fullname} (Round #{round})"
%div{:class=>'col-md-2'}

%button{:class=>'col-md-12 mark-unmark-sample-button '+instance_variable_get('@mark_as_sample_'+round.to_s),
:data=>{'visibility':2, 'response_id':instance_variable_get('@response_id_round_' + round.to_s),'round':round} } Mark as Sample
%button{:class=>'col-md-12 mark-unmark-sample-button '+instance_variable_get('@remove_as_sample_'+round.to_s),
:data=>{'visibility':3, 'response_id':instance_variable_get('@response_id_round_' + round.to_s),'round':round} } Remove as Sample

%span{:class=>"hide col-md-12 mark-unmark-sample-result", :id=>"mark_unmark_fail_"+round.to_s}
%span{:class=>"hide col-md-12 mark-unmark-sample-result success", :id=>"mark_unmark_success_"+round.to_s}
</pre>

Clicking on “Mark as Sample” or “Unmark as Sample” changes the visibility of the response to 2 or 3 respectively. Like case 1 mentioned above, this is another situation where the visibility needs to be updated when there is a page event.

Both these cases are event-based and require to make an HTTP request from the browser and handle the response while staying on the same page. Therefore, according to standard practice, an AJAX request must be initiated on click of the button or checkbox. The request needs two parameters - response id, and the updated value of visibility. User-identifying data is sent by default in HTTP header cookies (as in any usual HTTP request).

To handle these requests, we have created a sample_reviews controller with a method update_visibility. Within the method, we first check whether the request parameters are valid, and then proceed to check whether the current user (identified by session id) should be allowed to edit the response object to the visibility value passed in the request.

We have validated requests in this manner since HTTP is stateless and requests can easily be cloned (a browser need not be the only client making requests). For example, one could simply copy the request as a cURL, change the session id in the HTTP header to a student’s session, and pass alternative values of visibility (say 2, meaning, approved as a sample) in the request. Such requests should be identified as unauthorized requests, while requests which want to update visibility to a value that’s not allowed need to be rejected as bad requests.

<pre>
def update_visibility
begin
visibility = params[:visibility] #response object consists of visibility in string format
if(visibility.nil?)
raise StandardError.new("Missing parameter 'visibility'")
end
visibility = visibility.to_i

if not (_private..rejected_as_sample).include? visibility
raise StandardError.new("Invalid value for parameter 'visibility'")
end
@@response_id = params[:id]
response_map_id = Response.find(@@response_id).map_id
response_map = ResponseMap.find(response_map_id)
assignment_id = response_map.reviewed_object_id
is_admin = [Role.administrator.id,Role.superadministrator.id].include? current_user.role.id
if is_admin
Response.update(@@response_id.to_i, :visibility => visibility)
update_similar_assignment(assignment_id, visibility)
render json:{"success" => true}
return
end
course_id = Assignment.find(assignment_id).course_id
instructor_id = Course.find(course_id).instructor_id
ta_ids = []
if current_user.role.id == Role.ta.id
ta_ids = TaMapping.where(course_id).ids # do this query only if current user is ta
elsif current_user.role.id == Role.student.id
# find if this student id is the same as the response reviewer id
# and that visiblity is 0 or 1 and nothing else.
# if anything fails, return failure
if visibility > in_review
render json:{"success" => false, "error"=>"Not allowed"}
return
end
reviewer_user_id = AssignmentParticipant.find(response_map.reviewer_id).user_id
if reviewer_user_id != current_user.id
render json:{"success" => false,"error" => "Unathorized"}
return
end

elsif not ([instructor_id] + ta_ids).include? current_user.id
render json:{"success" => false,"error" => "Unathorized"}
return
end
Response.update(@@response_id.to_i, :visibility => visibility)
update_similar_assignment(assignment_id, visibility)
rescue StandardError => e
render json:{"success" => false,"error" => e.message}
else
render json:{"success" => true}
end
end

</pre>

We have provided a success or error message text below the button to indicate to the user that the request is completed.

[[file: Mark unmark picssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss]]

We have used the same request mark_unmark/:id with POST data as {“visibility”:x}, in the student view as well.

This project also required that assignments be linked to each other, as explained in the sections above. To this end, we have created a controller, model, and a migration (to create the database table) for similar assignments.

By default, every assignment is similar to itself (assume it’s id is X). So, after updating a response’s visibility, we add a new entry in the similar_assignments table: (assignment_id = X, similar_for = X, association_intent = “Review”). This addition is done only after confirming for non-existence, as one can infer from the following code snippet:

<pre>
private
def update_similar_assignment(assignment_id, visibility)
if visibility == approved_as_sample
ids = SimilarAssignment.where(:is_similar_for => assignment_id, :association_intent => intent_review,
:assignment_id => assignment_id).ids
if ids.empty?
SimilarAssignment.create({:is_similar_for => assignment_id, :association_intent => intent_review,
:assignment_id => assignment_id})
end
end
if visibility == rejected_as_sample or visibility == _private
response_map_ids = ResponseMap.where(:reviewed_object_id => assignment_id).ids
response_ids = Response.where(:map_id => response_map_ids, :visibility => approved_as_sample)
if response_ids.empty?
SimilarAssignment.where(:assignment_id => assignment_id).destroy_all
end
end
end
</pre>

The power user visits a review response page expecting to mark some reviews as samples and then link or unlink the assignment associated with the review to his / her other assignments. To provide the linking functionality, we have provided a clickable text “ Use as Samples for More Assignments” at the top right corner of the page as shown below.

[[for use as sample for more assignment]]

The appearance or non-appearance of this text is conditional. It only appears when there is at least one sample review for the current assignment. So, to decide this, we have queried for those assignments for which this assignment is a similar one, and checked on the size of the query result. The size is then checked in popup_controller to set an instance variable popup_show to a boolean value. The view uses this to render or not render the clickable “Use as Samples for More Assignments” text.

Code snippet of get_similar_assignment_ids
<pre>
def get_similar_assignment_ids(assignment_id)
SimilarAssignment.where(:assignment_id => assignment_id).pluck(:is_similar_for)
end
</pre>

Code snippet of popup_controller line 84
<pre>
@page_size = popup_page_size
</pre>

On click of this text, we open a popup that lists out (with a checkbox alongside each list entry) the candidate assignments that this assignment can be similar for (these are unchecked), and assignments that it is already similar for (these are checked). For example, assume that the power user is viewing the response page of assignment X. Assume we have entries (X,Y,”review”) and (X,Z,”review”) in similar_assignments table. Then, the popup list will have the assignments Y and Z with a checkbox against each of them ticked, and all the other assignments that the current user has access to, with a checkbox against each of them unticked.

The popup and the data that go with it are fetched on demand. So, the assignment list need not be a part of the first render of the page itself, as the inherent querying would slow down page load time. Therefore, on click, we fetch the list by an AJAX request (we have given appropriate error messages below the clickable text for the rare eventuality of any server-side error or empty response).

This request GET “/similar_assignments/:id” is again authenticated in similar_assignments_controller, get method. Same validation ideas as explained earlier are used. Only the assignment’s course instructor and TAs, admin, and super-admin should be able to fetch this data, while others need not have access to it.

Code snippet of get method
<pre>
# GET /similar_assignments/:id
def get
@assignment_id = params[:id]
ids = Response.joins("INNER JOIN response_maps ON response_maps.id = responses.map_id
WHERE visibility=2 AND reviewed_object_id ="+@assignment_id.to_s).ids
if ids.empty?
render json: {"success"=>false, "error"=>"Please mark atleast one review as sample"}
return
end
begin
if current_user.role.id == Role.student.id
throw Exception.new
end
@similar_assignments = SimilarAssignment.where(:assignment_id => @assignment_id).
where.not(:is_similar_for=>@assignment_id).order("created_at DESC").pluck(:is_similar_for)
rescue ActiveRecord::RecordNotFound => e
render json: {"success" => false, "error" => "Resource not found"}
rescue Exception
render json: {"success" => false, "error" => "Unauthorized"}
else
@res = get_asssignments_set(@similar_assignments)
render json: {"success" => true, "values" => @res}
end
end
</pre>

The get method fetches similar assignment ids and passes them on to get_asssignments_set of similar_assignments_helper. This method queries for all assignments (except the ones passed in its parameter list) that the current user is allowed to access and returns a list of hash objects which are used by the caller (the on-success function of the AJAX request). Each hash object contains assignment name, id, it’s course name, and whether it’s a similar assignment or not. Following code snippets demonstrates this:

Code snippet of get_asssignments_set method
<pre>
def get_asssignments_set(selected)
all_assignments = get_assignments_based_on_role
assignment_array = []
courses = get_courses_based_on_role
all_assignments.each {
|assignment|
course_id = assignment.course_id
if(course_id.nil?)
next
end
if (selected.include? assignment.id)
hash1 = {:title => assignment.name, :course_name => courses[course_id], :checked => true, :id => assignment.id}
assignment_array.push(hash1)
else
hash2 = {:title => assignment.name, :course_name => courses[course_id], :checked => false, :id => assignment.id}
assignment_array.push(hash2)
end
}
return assignment_array
end
</pre>

Code snippet of get_assignments_based_on_role method

<pre>
def get_assignments_based_on_role()
role = current_user.role.id
page = params[:page]
assignment_id = params[:id].to_i
if page.nil?
page = 0
end
_offset = page.to_i * popup_page_size
case role
when Role.ta.id
course_ids = TaMapping.where(:ta_id => current_user.id).pluck(:course_id)
@all_assignments = Assignment.where(:course_id => course_ids).
where.not(:id=>assignment_id).limit(popup_page_size).offset(_offset).order("created_at DESC")
when Role.instructor.id
course_ids = Course.where(:instructor_id => current_user.id).pluck(:id)
@all_assignments = Assignment.where(:course_id => course_ids).
where.not(:id=>assignment_id).limit(popup_page_size).offset(_offset).order("created_at DESC")
else
@all_assignments = []
end
@all_assignments
end
</pre>

The query result can be prohibitively large. This calls for pagination.

Pagination at the server side is about performing the same query as a non-pagination implementation, with an addition: limit and offset. Limit denotes the size of a page, and offset denotes a start index, and is calculated as page size * page number. Page size is a constant defined in similar_assignments_constants.

We had two options for response and rendering:
Construct the popup list HTML from the query results and respond with this HTML.
Respond with JSON, and build the HTML client side.

Responding with HTML from server-side is expensive, as the byte size of the HTTP response would be significantly larger than JSON. Thus, we chose the second option.

Since HTTP is stateless, the server has no way to maintain a running counter of page number. Therefore, keeping track of page number must be the responsibility of the client (browser JavaScript) who must pass it as a request parameter while the server simply reads it and assumes its lack of existence as page number 0. The following snippet demonstrates this:

Snippet of response.js line 103-130
<pre>
fetchAssignments:function(){
var self = this;
var ajaxUrl = "/similar_assignments/"+assignmentId;
if(this.currentPageNumber > 0){
ajaxUrl += "?page="+this.currentPageNumber;
}
jQuery.ajax({
"url":ajaxUrl,
"type":"GET",
"dataType":"json",
"responseType":"json",
"beforeSend":function(){
self.hideSuccess();
self.hideError();
},
"success":function(result){
if(result.success && result.values.length){
self.onFetchSuccess(result.values);
}else if(result.success && self.currentPageNumber == 0){
self.onFetchFail("Cannot link this to any assignment!");
}else if(result.success){
self.onFetchSuccess(result.values);
}
else{
self.onFetchFail(result.error);
}
},
"failure": self.onFetchFail,
"error":self.onFetchFail
</pre>

We have avoided maintaining the constant value of page size once on server side (in similar_assignments_constants) and once on the client side (JS variable). The initial render of the page creates a hidden HTML element that contains the page size, and once the document is ready, response.js selects that element, reads its value into a variable, and deletes that HTML element. This prevents having a page size in the HTML page-source, and more importantly, complies with the DRY principle. Page size should be changed in one function only - and that is in similar_assignments_constants as explained earlier.

From the response JSON containing an array of objects (that are going to be rendered as list items), we have constructed the HTML list. Each list item maintains its assignment id in its HTML data attribute. The following snippet shows this.

Response.js lines 67-78
<pre>
addToList:function(assignment){
var assignmentId = assignment.id;
var title = assignment.title;
var course = assignment.course_name;
var displayText = "<strong>"+course+": </strong>" +title;
var checked = assignment.checked;
var newRow = this.template.clone();
newRow.removeClass("hide").find("input").attr("data-id",assignmentId).attr("checked",checked);
newRow.find("span").html(displayText).on("click",function(){
newRow.find("input").click();
});
this.list.append(newRow.removeAttr("id"));
},
</pre>

_________________________________________A snapshot of the popup is shown below.

The “More” button (shown in the snapshot above) is used to fetch the next set of results.

After a finite number of requests, the client receives a lesser number of results than expected. This is when pagination must stop (since there are no more results). This is achieved by the object AssignmentsPopup (in our response.js file) - it maintains the page size and current page number. The more button is now replaced by a text “No more results” and it’s on-click functionality is turned off.

______________________________________________Screenshot of popup with “No more results”

Further, we have implemented this as a plug-and-play service. By reusing the same popup HTML and the AssignmentsPopup variable, the entire popup can be made a part of any Expertiza page.

The page makes no requests on closing the popup, or on clicking Submit without checking any unchecked list item or unchecking any checked list item. It submits only if there is an overall difference in what items are checked and what are not.

Click of “Submit” makes another AJAX POST request to “/similar_assignments/create/:id” with two params in the post JSON data:
“checked” - an array of assignment ids that were checked in the list but unchecked while opening the popup
“unchecked” - an array of assignment ids that were unchecked in the list but checked while opening the popup

Either of these params may be empty, depending on the user’s actions, but not both (if both were empty, we simply close the popup without submitting). However, this optimization is only client side. Server side logic must still check for duplicates - that is, an assignment id under “checked” is already a part of similar_assignments.

Let current assignment id be X. For each of the checked assignment ids Ci in {C1,C2,...,Cn}, we have checked if there are entries (X,Ci) in similar_assignments table, and if not, then created that entry. Similarly, for each of the unchecked assignment ids Ui in {U1,U2,...,Um}, we have deleted the entry (X,Ui) from similar_assignments.

On a successful update, the client closes the popup and prints a success message.

_________________________________________________________________________________________Snapshot with success message

So far, power users have marked reviews as samples and linked assignments. Now, students need to view these samples. A student would view these sample reviews before writing their review on somebody else’s work. Therefore, we have added a link “View Sample Reviews” to view the list of sample reviews.

________________________________________________________________UI screenshot here.<pending>

Similarly, power users might also want to view samples. We have provided the same link on the following page too.

________________________________________________________________UI screenshot here

This page is rendered by the index method in sample_reviews_controller. It is a list of links to sample reviews. The layout of this page is common for users, as long as they are logged in. Non-logged-in or anonymous visitors are redirected to the Expertiza home page. ‘index’ calls a method redirect_anonymous_user in sample_reviews_helper to achieve this.

Snippet of sample_reviews_helper
<pre>
def redirect_anonymous_user
current_user = session[:user]
if current_user.nil?
redirect_to "/"
end
end
</pre>

The list of available samples has no upper bound on its size. Yet again, pagination solves this problem. But unlike the case of the popup discussed earlier, the response type differs. A request without a ‘page’ parameter in its URL is a request for the web-page and should, therefore, render HTML, while the same request URL with the ‘page’ parameter is a request for more content, and should, therefore, render JSON. The following snippet from the index method demonstrates this.

Sample_reviews_controller - index method - add the if-else just before return statement
<pre>
def index
redirect_anonymous_user
@assignment_id = params[:id].to_i
page_number = params[:page].to_i
if page_number.nil?
page_number = 0
end
@page_size = 8
similar_assignment_ids = get_similar_assignment_ids(@assignment_id)
@response_ids = []
similar_assignment_ids.each do |id|
_offset = page_number * @page_size
ids = Response.joins("INNER JOIN response_maps ON response_maps.id = responses.map_id
WHERE visibility=2 AND reviewed_object_id = "+id.to_s+
" ORDER BY responses.created_at LIMIT "+@page_size.to_s+" OFFSET "+_offset.to_s ).ids
@response_ids += ids
end
@links = generate_links(@response_ids)
if page_number == 0
@course_assignment_name = get_course_assignment_name(@assignment_id)
else
render json: {"success" => true, "sampleReviews" => @links}
end
end
</pre>

During this first render itself, we have also identified whether more results can exist. The “More” button only appears if the number of sample review links being rendered is equal to the page size, as shown in a snippet of views/sample_reviews/index.html.erb below.

Code snip of Lines 12-15
<pre>
<% if @links.size == @page_size %>
<h5 style="cursor:pointer;text-align: center;" id="more_button">More +</h5>
<% end %>
</pre>

Clicking the “More” button now makes the same request as the page’s URL, but with the parameter ‘page’. In that case, the response is JSON, which is used by the caller (JavaScript Ajax) to add more rows to the page. If the number of rows is lesser than expected, the More text is changed, its click listener is turned off, and no more requests are made, demonstrated by the snippet of sample_review.js below.

Code snip of Line 25-35
<pre>
for(var i in result.sampleReviews)
{
currentNumberOfRows++;
var review = result.sampleReviews[i];
var newRow = listTemplate.clone();
newRow.removeClass("hide").removeAttr("id").find("a").
html("Sample Review "+currentNumberOfRows).attr("href",review);
ulList.append(newRow);
}

if(responseSize < pageSize){
self.html("No more results!").off().css({"cursor":"default"});
}
else
{
pageNumber++;
}
</pre>

Each of the list items on the page is a link, which takes the user to /sample_reviews/:id. On this page, we fetch the question-answer pairs corresponding to the object having the id given in the URL and print it out in the form of a table.

== Test Plan ==
'''As a Power User (TA/Instructor/Admin/Super Admin)'''
# Log in
# Click on Manage->Assignments
# Displays list of Assignments
# Click View Report/Review for a particular assignment.
# Displays a list of reviews submitted by students.
# Click on any review in "team reviewed" column for a particular student.
# Displays the summary of reviews submitted by that student, with a "Make as sample" button on the right of every review.
# Click on "Make as sample" for the intended reviews, which opens a popup that displays a list of all assignments that are a part of the instructor's courses.
# From this list select all assignments for which the review has to be shown as a sample.
# Click on 'Submit' after selection (this closes the popup).
# Navigate to view reviews of that particular assignment and click on "Sample Reviews".
# A new page is opened that lists out all the sample reviews of the assignment.

'''As a Student'''
# Log in.
# Click on Assignments
# List of assignments is displayed.
# Click on any assignment for which the review has to be submitted.
# Assignment task page is displayed.
# Click on "Other's work" to open the reviews summary page (at /student_review).
# Below the heading "Reviews for ...", click on the "Show sample reviews" link.
# This opens a page where the student can view all sample reviews for that assignment.
# Use the browser's back button to go back to Assignment review page.
# Chose to review any of the teams' assignments that are displayed.
# Select a team for review and fill in the review.
# Before submitting the review, select the checkbox that says "I agree to share this review anonymously as an example to the entire class".
# After clicking on the submit button, the review submitted has been made public.

'''RSpec Tests'''

Below are the Rpsec tests that have been added to test the edge cases when a user tries to get access to the data using cloned requests:
# If an anonymous user tries to view the sample reviews page he/she will be redirected to home page.
# If an anonymous user tries to view the details of a particular sample review, he/she will be redirected to home page.
# If a user tries to view the sample review of a particular assignment for which there are no sample reviews, he/she will be redirected to home page.

=='''Additional Links and References'''==

#[https://github.com/expertiza/expertiza/pull/1291 Link to the Git Pull Request]
#[https://github.com/expertiza/expertiza Expertiza on GitHub]
#[https://github.com/chinmaiks/expertiza GitHub Project Repository Fork]
#[http://expertiza.ncsu.edu/ The Live Expertiza Website]

==Team==
[mailto:aagniho@ncsu.edu Amogh Agnihotri Subbanna]<br>
[mailto:ckaidab@ncsu.edu Chinmai Kaidabettu Srinivas]<br>
[mailto:smadhur@ncsu.edu Siddu Madhure Jayanna]<br>
[mailto:snaramb@ncsu.edu Suhas Naramballi Gururaja]

E1867 allow reviewer to say review can be shown to class as an example

2018-12-07T23:28:17Z

Ckaidab: /* Test Plan */

== Problem Statement ==
The objective of this project is to:
# Add a feature for students to make their reviews 'public', that is, allow other students to view them.
# Add a feature for TA to select a subset of 'public' reviews, and make those reviews visible as sample reviews of the particular assignment.
# Add a feature for Instructor to select a subset of 'public' reviews and make those reviews visible as sample reviews of any of his/her assignments in the course.
# Create a view where the student can see a list of sample reviews of the assignment and have a detailed view of each.
# Allow the student to toggle the visibility of a review he/she has submitted.

== Approach & Design ==

# Consent to make the review public - add a checkbox and an oncheck event handlers (JS) that sets a new field 'visibility' to public of Response object.
# Change the schema of Responses table (add the new column) and write db migrations.
# Create new table, model, view, controller for "similar_assignments" and validate CRUD operations that access the table.
# Add HTML (checkbox) to uncheck the consent such that the reviews becomes private again.
# On the "popup/team_users_popup" page (where instructor/TA can view all reviews), we give a checkbox against every review with public visibility to allow instructors/TAs to select one or more reviews as sample reviews to be available for students.
# Once the instructor selects and submits some reviews as sample reviews, we give a popup containing a list of assignments with a checkbox against each of them and a submit button at the end to allow instructors to make sample reviews available for multiple assignments in one go. We perform validation checks also.
# On submit of the popup, we update the similar_assignments table.
# At the top of student_reviews/list page, we give an option for the student to preview all the available sample reviews.
# Create the MVC setup for this new page to list all the sample reviews. Students will be able to click on one particular review and preview it.

'''DB Design'''

Currently, the Expertiza database design does not maintain any link between different assignments. An assignment of the current semester is completely independent of any other assignment of any other course having similar or exact objectives. For example, in a course C, the assignment named A1 in a semester Sx has no association to the same assignment given in an earlier semester Sy.

Since our task involves using reviews from the past as samples for the present, we should create this association as a new table. Further, reviews may not be the only intention to associate assignments with each other, as future requirements might require associating them on other criteria too. Thus, we find it appropriate to name the table as "similar_assignments".

The table structure is defined [http://wiki.expertiza.ncsu.edu/index.php/Similar_assignments here].

This table can be visualized as a directed graph where vertices represent assignments. An edge (u,v) with a label L means u is similar to v for the intent of association, L.

Consider a row (id = x, assignment_id = Ak, is_similar_for = An, association_intent = "review"). This means, given the intent of association as "review", assignment Ak was chosen as a similar assignment for assignment An. That is, while marking some review for An as a sample, the instructor opted to have reviews of Ak as samples for An as well.

== Implementation Details ==

==== UML - Use Case Diagram ====

[[Image:UseCase.png]]

'''Power Users:''' Instructors, TAs, Admins and Super Admins

'''More details about each point mentioned in the approach section will be updated after the implementation.'''

== Implementation ==

We have added a new column in the ‘responses’ table (in the database), namely, ‘visibility’.
Visibility can have 4 values as listed below:

{| class="wikitable"
|+ Table showing list of visibility values and the properties
! Visibility
! Properties
|-
| 0 || Response is private. This is the default value.
|-
| 1 || The response which was in the review has been approved as an example (that is, it has been marked as a sample)
|-
| 2 || The response which was in the review has been approved as an example (that is, it has been marked as a sample)
|-
| 3 || The response which was either in the review or approved earlier, has now been rejected as an example (it has been unmarked as a sample)
|-
|}

We have maintained these constants in a new file at helpers/response_constants.rb.

<pre>
module ResponseConstants
def _private
0
end

def in_review
1
end

def approved_as_sample
2
end

def rejected_as_sample
3
end
end
</pre>

In the existing implementation of reviews, when a student starts a review (but hasn’t filled any text or ratings yet), a response gets created in the database. This response has a default visibility of 0.

We have provided a checkbox (an HTML input node with attribute ‘type’ as ‘checkbox’) for the student to consent for his / her review to be used as an example, with values 0 and 1 for unchecked and checked respectively. This value is used to update the response object as part of the form submission.

However, a student might want to remove their consent or give their consent, for a review that is already submitted. So, in the page where student views his / her own response, we have added the same HTML checkbox. On checking or unchecking the checkbox, the visibility field in the corresponding response object in the database gets updated.Consider this as case 1.

Now when a power user looks at a review (at url , which is an HTML rendering of a ResponseMap containing Responses), he/she must be able to approve and reject responses which students have consented (offered) to be made visible to all. This is done by providing a button “Mark as Sample” or “Remove as Sample”. Responses without consent will not have any button.

These HTML changes appear in views/popup/team_users_popup.html.haml
<pre>
if instance_variable_get('@sample_button_'+round.to_s)
%div{:class=>'col-md-12 mark-delete-sample '+'round'+round.to_s}
%h3{:class=>'col-md-10'} "Reviewed by #{User.find(@reviewer_id).fullname} (Round #{round})"
%div{:class=>'col-md-2'}

%button{:class=>'col-md-12 mark-unmark-sample-button '+instance_variable_get('@mark_as_sample_'+round.to_s),
:data=>{'visibility':2, 'response_id':instance_variable_get('@response_id_round_' + round.to_s),'round':round} } Mark as Sample
%button{:class=>'col-md-12 mark-unmark-sample-button '+instance_variable_get('@remove_as_sample_'+round.to_s),
:data=>{'visibility':3, 'response_id':instance_variable_get('@response_id_round_' + round.to_s),'round':round} } Remove as Sample

%span{:class=>"hide col-md-12 mark-unmark-sample-result", :id=>"mark_unmark_fail_"+round.to_s}
%span{:class=>"hide col-md-12 mark-unmark-sample-result success", :id=>"mark_unmark_success_"+round.to_s}
</pre>

Clicking on “Mark as Sample” or “Unmark as Sample” changes the visibility of the response to 2 or 3 respectively. Like case 1 mentioned above, this is another situation where the visibility needs to be updated when there is a page event.

Both these cases are event-based and require to make an HTTP request from the browser and handle the response while staying on the same page. Therefore, according to standard practice, an AJAX request must be initiated on click of the button or checkbox. The request needs two parameters - response id, and the updated value of visibility. User-identifying data is sent by default in HTTP header cookies (as in any usual HTTP request).

To handle these requests, we have created a sample_reviews controller with a method update_visibility. Within the method, we first check whether the request parameters are valid, and then proceed to check whether the current user (identified by session id) should be allowed to edit the response object to the visibility value passed in the request.

We have validated requests in this manner since HTTP is stateless and requests can easily be cloned (a browser need not be the only client making requests). For example, one could simply copy the request as a cURL, change the session id in the HTTP header to a student’s session, and pass alternative values of visibility (say 2, meaning, approved as a sample) in the request. Such requests should be identified as unauthorized requests, while requests which want to update visibility to a value that’s not allowed need to be rejected as bad requests.

<pre>
def update_visibility
begin
visibility = params[:visibility] #response object consists of visibility in string format
if(visibility.nil?)
raise StandardError.new("Missing parameter 'visibility'")
end
visibility = visibility.to_i

if not (_private..rejected_as_sample).include? visibility
raise StandardError.new("Invalid value for parameter 'visibility'")
end
@@response_id = params[:id]
response_map_id = Response.find(@@response_id).map_id
response_map = ResponseMap.find(response_map_id)
assignment_id = response_map.reviewed_object_id
is_admin = [Role.administrator.id,Role.superadministrator.id].include? current_user.role.id
if is_admin
Response.update(@@response_id.to_i, :visibility => visibility)
update_similar_assignment(assignment_id, visibility)
render json:{"success" => true}
return
end
course_id = Assignment.find(assignment_id).course_id
instructor_id = Course.find(course_id).instructor_id
ta_ids = []
if current_user.role.id == Role.ta.id
ta_ids = TaMapping.where(course_id).ids # do this query only if current user is ta
elsif current_user.role.id == Role.student.id
# find if this student id is the same as the response reviewer id
# and that visiblity is 0 or 1 and nothing else.
# if anything fails, return failure
if visibility > in_review
render json:{"success" => false, "error"=>"Not allowed"}
return
end
reviewer_user_id = AssignmentParticipant.find(response_map.reviewer_id).user_id
if reviewer_user_id != current_user.id
render json:{"success" => false,"error" => "Unathorized"}
return
end

elsif not ([instructor_id] + ta_ids).include? current_user.id
render json:{"success" => false,"error" => "Unathorized"}
return
end
Response.update(@@response_id.to_i, :visibility => visibility)
update_similar_assignment(assignment_id, visibility)
rescue StandardError => e
render json:{"success" => false,"error" => e.message}
else
render json:{"success" => true}
end
end

</pre>

We have provided a success or error message text below the button to indicate to the user that the request is completed.

[[file: Mark unmark picssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss]]

We have used the same request mark_unmark/:id with POST data as {“visibility”:x}, in the student view as well.

This project also required that assignments be linked to each other, as explained in the sections above. To this end, we have created a controller, model, and a migration (to create the database table) for similar assignments.

By default, every assignment is similar to itself (assume it’s id is X). So, after updating a response’s visibility, we add a new entry in the similar_assignments table: (assignment_id = X, similar_for = X, association_intent = “Review”). This addition is done only after confirming for non-existence, as one can infer from the following code snippet:

<pre>
private
def update_similar_assignment(assignment_id, visibility)
if visibility == approved_as_sample
ids = SimilarAssignment.where(:is_similar_for => assignment_id, :association_intent => intent_review,
:assignment_id => assignment_id).ids
if ids.empty?
SimilarAssignment.create({:is_similar_for => assignment_id, :association_intent => intent_review,
:assignment_id => assignment_id})
end
end
if visibility == rejected_as_sample or visibility == _private
response_map_ids = ResponseMap.where(:reviewed_object_id => assignment_id).ids
response_ids = Response.where(:map_id => response_map_ids, :visibility => approved_as_sample)
if response_ids.empty?
SimilarAssignment.where(:assignment_id => assignment_id).destroy_all
end
end
end
</pre>

The power user visits a review response page expecting to mark some reviews as samples and then link or unlink the assignment associated with the review to his / her other assignments. To provide the linking functionality, we have provided a clickable text “ Use as Samples for More Assignments” at the top right corner of the page as shown below.

[[for use as sample for more assignment]]

The appearance or non-appearance of this text is conditional. It only appears when there is at least one sample review for the current assignment. So, to decide this, we have queried for those assignments for which this assignment is a similar one, and checked on the size of the query result. The size is then checked in popup_controller to set an instance variable popup_show to a boolean value. The view uses this to render or not render the clickable “Use as Samples for More Assignments” text.

Code snippet of get_similar_assignment_ids
<pre>
def get_similar_assignment_ids(assignment_id)
SimilarAssignment.where(:assignment_id => assignment_id).pluck(:is_similar_for)
end
</pre>

Code snippet of popup_controller line 84
<pre>
@page_size = popup_page_size
</pre>

On click of this text, we open a popup that lists out (with a checkbox alongside each list entry) the candidate assignments that this assignment can be similar for (these are unchecked), and assignments that it is already similar for (these are checked). For example, assume that the power user is viewing the response page of assignment X. Assume we have entries (X,Y,”review”) and (X,Z,”review”) in similar_assignments table. Then, the popup list will have the assignments Y and Z with a checkbox against each of them ticked, and all the other assignments that the current user has access to, with a checkbox against each of them unticked.

The popup and the data that go with it are fetched on demand. So, the assignment list need not be a part of the first render of the page itself, as the inherent querying would slow down page load time. Therefore, on click, we fetch the list by an AJAX request (we have given appropriate error messages below the clickable text for the rare eventuality of any server-side error or empty response).

This request GET “/similar_assignments/:id” is again authenticated in similar_assignments_controller, get method. Same validation ideas as explained earlier are used. Only the assignment’s course instructor and TAs, admin, and super-admin should be able to fetch this data, while others need not have access to it.

Code snippet of get method
<pre>
# GET /similar_assignments/:id
def get
@assignment_id = params[:id]
ids = Response.joins("INNER JOIN response_maps ON response_maps.id = responses.map_id
WHERE visibility=2 AND reviewed_object_id ="+@assignment_id.to_s).ids
if ids.empty?
render json: {"success"=>false, "error"=>"Please mark atleast one review as sample"}
return
end
begin
if current_user.role.id == Role.student.id
throw Exception.new
end
@similar_assignments = SimilarAssignment.where(:assignment_id => @assignment_id).
where.not(:is_similar_for=>@assignment_id).order("created_at DESC").pluck(:is_similar_for)
rescue ActiveRecord::RecordNotFound => e
render json: {"success" => false, "error" => "Resource not found"}
rescue Exception
render json: {"success" => false, "error" => "Unauthorized"}
else
@res = get_asssignments_set(@similar_assignments)
render json: {"success" => true, "values" => @res}
end
end
</pre>

The get method fetches similar assignment ids and passes them on to get_asssignments_set of similar_assignments_helper. This method queries for all assignments (except the ones passed in its parameter list) that the current user is allowed to access and returns a list of hash objects which are used by the caller (the on-success function of the AJAX request). Each hash object contains assignment name, id, it’s course name, and whether it’s a similar assignment or not. Following code snippets demonstrates this:

Code snippet of get_asssignments_set method
<pre>
def get_asssignments_set(selected)
all_assignments = get_assignments_based_on_role
assignment_array = []
courses = get_courses_based_on_role
all_assignments.each {
|assignment|
course_id = assignment.course_id
if(course_id.nil?)
next
end
if (selected.include? assignment.id)
hash1 = {:title => assignment.name, :course_name => courses[course_id], :checked => true, :id => assignment.id}
assignment_array.push(hash1)
else
hash2 = {:title => assignment.name, :course_name => courses[course_id], :checked => false, :id => assignment.id}
assignment_array.push(hash2)
end
}
return assignment_array
end
</pre>

Code snippet of get_assignments_based_on_role method

<pre>
def get_assignments_based_on_role()
role = current_user.role.id
page = params[:page]
assignment_id = params[:id].to_i
if page.nil?
page = 0
end
_offset = page.to_i * popup_page_size
case role
when Role.ta.id
course_ids = TaMapping.where(:ta_id => current_user.id).pluck(:course_id)
@all_assignments = Assignment.where(:course_id => course_ids).
where.not(:id=>assignment_id).limit(popup_page_size).offset(_offset).order("created_at DESC")
when Role.instructor.id
course_ids = Course.where(:instructor_id => current_user.id).pluck(:id)
@all_assignments = Assignment.where(:course_id => course_ids).
where.not(:id=>assignment_id).limit(popup_page_size).offset(_offset).order("created_at DESC")
else
@all_assignments = []
end
@all_assignments
end
</pre>

The query result can be prohibitively large. This calls for pagination.

Pagination at the server side is about performing the same query as a non-pagination implementation, with an addition: limit and offset. Limit denotes the size of a page, and offset denotes a start index, and is calculated as page size * page number. Page size is a constant defined in similar_assignments_constants.

We had two options for response and rendering:
Construct the popup list HTML from the query results and respond with this HTML.
Respond with JSON, and build the HTML client side.

Responding with HTML from server-side is expensive, as the byte size of the HTTP response would be significantly larger than JSON. Thus, we chose the second option.

Since HTTP is stateless, the server has no way to maintain a running counter of page number. Therefore, keeping track of page number must be the responsibility of the client (browser JavaScript) who must pass it as a request parameter while the server simply reads it and assumes its lack of existence as page number 0. The following snippet demonstrates this:

Snippet of response.js line 103-130
<pre>
fetchAssignments:function(){
var self = this;
var ajaxUrl = "/similar_assignments/"+assignmentId;
if(this.currentPageNumber > 0){
ajaxUrl += "?page="+this.currentPageNumber;
}
jQuery.ajax({
"url":ajaxUrl,
"type":"GET",
"dataType":"json",
"responseType":"json",
"beforeSend":function(){
self.hideSuccess();
self.hideError();
},
"success":function(result){
if(result.success && result.values.length){
self.onFetchSuccess(result.values);
}else if(result.success && self.currentPageNumber == 0){
self.onFetchFail("Cannot link this to any assignment!");
}else if(result.success){
self.onFetchSuccess(result.values);
}
else{
self.onFetchFail(result.error);
}
},
"failure": self.onFetchFail,
"error":self.onFetchFail
</pre>

We have avoided maintaining the constant value of page size once on server side (in similar_assignments_constants) and once on the client side (JS variable). The initial render of the page creates a hidden HTML element that contains the page size, and once the document is ready, response.js selects that element, reads its value into a variable, and deletes that HTML element. This prevents having a page size in the HTML page-source, and more importantly, complies with the DRY principle. Page size should be changed in one function only - and that is in similar_assignments_constants as explained earlier.

From the response JSON containing an array of objects (that are going to be rendered as list items), we have constructed the HTML list. Each list item maintains its assignment id in its HTML data attribute. The following snippet shows this.

Response.js lines 67-78
<pre>
addToList:function(assignment){
var assignmentId = assignment.id;
var title = assignment.title;
var course = assignment.course_name;
var displayText = "<strong>"+course+": </strong>" +title;
var checked = assignment.checked;
var newRow = this.template.clone();
newRow.removeClass("hide").find("input").attr("data-id",assignmentId).attr("checked",checked);
newRow.find("span").html(displayText).on("click",function(){
newRow.find("input").click();
});
this.list.append(newRow.removeAttr("id"));
},
</pre>

_________________________________________A snapshot of the popup is shown below.

The “More” button (shown in the snapshot above) is used to fetch the next set of results.

After a finite number of requests, the client receives a lesser number of results than expected. This is when pagination must stop (since there are no more results). This is achieved by the object AssignmentsPopup (in our response.js file) - it maintains the page size and current page number. The more button is now replaced by a text “No more results” and it’s on-click functionality is turned off.

______________________________________________Screenshot of popup with “No more results”

Further, we have implemented this as a plug-and-play service. By reusing the same popup HTML and the AssignmentsPopup variable, the entire popup can be made a part of any Expertiza page.

The page makes no requests on closing the popup, or on clicking Submit without checking any unchecked list item or unchecking any checked list item. It submits only if there is an overall difference in what items are checked and what are not.

Click of “Submit” makes another AJAX POST request to “/similar_assignments/create/:id” with two params in the post JSON data:
“checked” - an array of assignment ids that were checked in the list but unchecked while opening the popup
“unchecked” - an array of assignment ids that were unchecked in the list but checked while opening the popup

Either of these params may be empty, depending on the user’s actions, but not both (if both were empty, we simply close the popup without submitting). However, this optimization is only client side. Server side logic must still check for duplicates - that is, an assignment id under “checked” is already a part of similar_assignments.

Let current assignment id be X. For each of the checked assignment ids Ci in {C1,C2,...,Cn}, we have checked if there are entries (X,Ci) in similar_assignments table, and if not, then created that entry. Similarly, for each of the unchecked assignment ids Ui in {U1,U2,...,Um}, we have deleted the entry (X,Ui) from similar_assignments.

On a successful update, the client closes the popup and prints a success message.

_________________________________________________________________________________________Snapshot with success message

So far, power users have marked reviews as samples and linked assignments. Now, students need to view these samples. A student would view these sample reviews before writing their review on somebody else’s work. Therefore, we have added a link “View Sample Reviews” to view the list of sample reviews.

________________________________________________________________UI screenshot here.<pending>

Similarly, power users might also want to view samples. We have provided the same link on the following page too.

________________________________________________________________UI screenshot here

This page is rendered by the index method in sample_reviews_controller. It is a list of links to sample reviews. The layout of this page is common for users, as long as they are logged in. Non-logged-in or anonymous visitors are redirected to the Expertiza home page. ‘index’ calls a method redirect_anonymous_user in sample_reviews_helper to achieve this.

Snippet of sample_reviews_helper
<pre>
def redirect_anonymous_user
current_user = session[:user]
if current_user.nil?
redirect_to "/"
end
end
</pre>

The list of available samples has no upper bound on its size. Yet again, pagination solves this problem. But unlike the case of the popup discussed earlier, the response type differs. A request without a ‘page’ parameter in its URL is a request for the web-page and should, therefore, render HTML, while the same request URL with the ‘page’ parameter is a request for more content, and should, therefore, render JSON. The following snippet from the index method demonstrates this.

Sample_reviews_controller - index method - add the if-else just before return statement
<pre>
def index
redirect_anonymous_user
@assignment_id = params[:id].to_i
page_number = params[:page].to_i
if page_number.nil?
page_number = 0
end
@page_size = 8
similar_assignment_ids = get_similar_assignment_ids(@assignment_id)
@response_ids = []
similar_assignment_ids.each do |id|
_offset = page_number * @page_size
ids = Response.joins("INNER JOIN response_maps ON response_maps.id = responses.map_id
WHERE visibility=2 AND reviewed_object_id = "+id.to_s+
" ORDER BY responses.created_at LIMIT "+@page_size.to_s+" OFFSET "+_offset.to_s ).ids
@response_ids += ids
end
@links = generate_links(@response_ids)
if page_number == 0
@course_assignment_name = get_course_assignment_name(@assignment_id)
else
render json: {"success" => true, "sampleReviews" => @links}
end
end
</pre>

During this first render itself, we have also identified whether more results can exist. The “More” button only appears if the number of sample review links being rendered is equal to the page size, as shown in a snippet of views/sample_reviews/index.html.erb below.

Code snip of Lines 12-15
<pre>
<% if @links.size == @page_size %>
<h5 style="cursor:pointer;text-align: center;" id="more_button">More +</h5>
<% end %>
</pre>

Clicking the “More” button now makes the same request as the page’s URL, but with the parameter ‘page’. In that case, the response is JSON, which is used by the caller (JavaScript Ajax) to add more rows to the page. If the number of rows is lesser than expected, the More text is changed, its click listener is turned off, and no more requests are made, demonstrated by the snippet of sample_review.js below.

Code snip of Line 25-35
<pre>
for(var i in result.sampleReviews)
{
currentNumberOfRows++;
var review = result.sampleReviews[i];
var newRow = listTemplate.clone();
newRow.removeClass("hide").removeAttr("id").find("a").
html("Sample Review "+currentNumberOfRows).attr("href",review);
ulList.append(newRow);
}

if(responseSize < pageSize){
self.html("No more results!").off().css({"cursor":"default"});
}
else
{
pageNumber++;
}
</pre>

Each of the list items on the page is a link, which takes the user to /sample_reviews/:id. On this page, we fetch the question-answer pairs corresponding to the object having the id given in the URL and print it out in the form of a table.

== Test Plan ==
'''As a Power User (TA/Instructor/Admin/Super Admin)'''
# Log in
# Click on Manage->Assignments
# Displays list of Assignments
# Click View Report/Review for a particular assignment.
# Displays a list of reviews submitted by students.
# Click on any review in "team reviewed" column for a particular student.
# Displays the summary of reviews submitted by that student, with a "Make as sample" button on the right of every review.
# Click on "Make as sample" for the intended reviews, which opens a popup that displays a list of all assignments that are a part of the instructor's courses.
# From this list select all assignments for which the review has to be shown as a sample.
# Click on 'Submit' after selection (this closes the popup).
# Navigate to view reviews of that particular assignment and click on "Sample Reviews".
# A new page is opened that lists out all the sample reviews of the assignment.

'''As a Student'''
# Log in.
# Click on Assignments
# List of assignments is displayed.
# Click on any assignment for which the review has to be submitted.
# Assignment task page is displayed.
# Click on "Other's work" to open the reviews summary page (at /student_review).
# Below the heading "Reviews for ...", click on the "Show sample reviews" link.
# This opens a page where the student can view all sample reviews for that assignment.
# Use the browser's back button to go back to Assignment review page.
# Chose to review any of the teams' assignments that are displayed.
# Select a team for review and fill in the review.
# Before submitting the review, select the checkbox that says "I agree to share this review anonymously as an example to the entire class".
# After clicking on the submit button, the review submitted has been made public.

'''RSpec Tests'''
''Below are the Rpsec tests that have been added to test the edge cases when a user tries to get access to the data using cloned requests:''
# If an anonymous user tries to view the sample reviews page he/she will be redirected to home page.
# If an anonymous user tries to view the details of a particular sample review, he/she will be redirected to home page.
# If a user tries to view the sample review of a particular assignment for which there are no sample reviews, he/she will be redirected to home page.

=='''Additional Links and References'''==

#[https://github.com/expertiza/expertiza/pull/1291 Link to the Git Pull Request]
#[https://github.com/expertiza/expertiza Expertiza on GitHub]
#[https://github.com/chinmaiks/expertiza GitHub Project Repository Fork]
#[http://expertiza.ncsu.edu/ The Live Expertiza Website]

==Team==
[mailto:aagniho@ncsu.edu Amogh Agnihotri Subbanna]<br>
[mailto:ckaidab@ncsu.edu Chinmai Kaidabettu Srinivas]<br>
[mailto:smadhur@ncsu.edu Siddu Madhure Jayanna]<br>
[mailto:snaramb@ncsu.edu Suhas Naramballi Gururaja]

E1867 allow reviewer to say review can be shown to class as an example

2018-12-07T23:27:31Z

Ckaidab: /* Test Plan */

== Problem Statement ==
The objective of this project is to:
# Add a feature for students to make their reviews 'public', that is, allow other students to view them.
# Add a feature for TA to select a subset of 'public' reviews, and make those reviews visible as sample reviews of the particular assignment.
# Add a feature for Instructor to select a subset of 'public' reviews and make those reviews visible as sample reviews of any of his/her assignments in the course.
# Create a view where the student can see a list of sample reviews of the assignment and have a detailed view of each.
# Allow the student to toggle the visibility of a review he/she has submitted.

== Approach & Design ==

# Consent to make the review public - add a checkbox and an oncheck event handlers (JS) that sets a new field 'visibility' to public of Response object.
# Change the schema of Responses table (add the new column) and write db migrations.
# Create new table, model, view, controller for "similar_assignments" and validate CRUD operations that access the table.
# Add HTML (checkbox) to uncheck the consent such that the reviews becomes private again.
# On the "popup/team_users_popup" page (where instructor/TA can view all reviews), we give a checkbox against every review with public visibility to allow instructors/TAs to select one or more reviews as sample reviews to be available for students.
# Once the instructor selects and submits some reviews as sample reviews, we give a popup containing a list of assignments with a checkbox against each of them and a submit button at the end to allow instructors to make sample reviews available for multiple assignments in one go. We perform validation checks also.
# On submit of the popup, we update the similar_assignments table.
# At the top of student_reviews/list page, we give an option for the student to preview all the available sample reviews.
# Create the MVC setup for this new page to list all the sample reviews. Students will be able to click on one particular review and preview it.

'''DB Design'''

Currently, the Expertiza database design does not maintain any link between different assignments. An assignment of the current semester is completely independent of any other assignment of any other course having similar or exact objectives. For example, in a course C, the assignment named A1 in a semester Sx has no association to the same assignment given in an earlier semester Sy.

Since our task involves using reviews from the past as samples for the present, we should create this association as a new table. Further, reviews may not be the only intention to associate assignments with each other, as future requirements might require associating them on other criteria too. Thus, we find it appropriate to name the table as "similar_assignments".

The table structure is defined [http://wiki.expertiza.ncsu.edu/index.php/Similar_assignments here].

This table can be visualized as a directed graph where vertices represent assignments. An edge (u,v) with a label L means u is similar to v for the intent of association, L.

Consider a row (id = x, assignment_id = Ak, is_similar_for = An, association_intent = "review"). This means, given the intent of association as "review", assignment Ak was chosen as a similar assignment for assignment An. That is, while marking some review for An as a sample, the instructor opted to have reviews of Ak as samples for An as well.

== Implementation Details ==

==== UML - Use Case Diagram ====

[[Image:UseCase.png]]

'''Power Users:''' Instructors, TAs, Admins and Super Admins

'''More details about each point mentioned in the approach section will be updated after the implementation.'''

== Implementation ==

We have added a new column in the ‘responses’ table (in the database), namely, ‘visibility’.
Visibility can have 4 values as listed below:

{| class="wikitable"
|+ Table showing list of visibility values and the properties
! Visibility
! Properties
|-
| 0 || Response is private. This is the default value.
|-
| 1 || The response which was in the review has been approved as an example (that is, it has been marked as a sample)
|-
| 2 || The response which was in the review has been approved as an example (that is, it has been marked as a sample)
|-
| 3 || The response which was either in the review or approved earlier, has now been rejected as an example (it has been unmarked as a sample)
|-
|}

We have maintained these constants in a new file at helpers/response_constants.rb.

<pre>
module ResponseConstants
def _private
0
end

def in_review
1
end

def approved_as_sample
2
end

def rejected_as_sample
3
end
end
</pre>

In the existing implementation of reviews, when a student starts a review (but hasn’t filled any text or ratings yet), a response gets created in the database. This response has a default visibility of 0.

We have provided a checkbox (an HTML input node with attribute ‘type’ as ‘checkbox’) for the student to consent for his / her review to be used as an example, with values 0 and 1 for unchecked and checked respectively. This value is used to update the response object as part of the form submission.

However, a student might want to remove their consent or give their consent, for a review that is already submitted. So, in the page where student views his / her own response, we have added the same HTML checkbox. On checking or unchecking the checkbox, the visibility field in the corresponding response object in the database gets updated.Consider this as case 1.

Now when a power user looks at a review (at url , which is an HTML rendering of a ResponseMap containing Responses), he/she must be able to approve and reject responses which students have consented (offered) to be made visible to all. This is done by providing a button “Mark as Sample” or “Remove as Sample”. Responses without consent will not have any button.

These HTML changes appear in views/popup/team_users_popup.html.haml
<pre>
if instance_variable_get('@sample_button_'+round.to_s)
%div{:class=>'col-md-12 mark-delete-sample '+'round'+round.to_s}
%h3{:class=>'col-md-10'} "Reviewed by #{User.find(@reviewer_id).fullname} (Round #{round})"
%div{:class=>'col-md-2'}

%button{:class=>'col-md-12 mark-unmark-sample-button '+instance_variable_get('@mark_as_sample_'+round.to_s),
:data=>{'visibility':2, 'response_id':instance_variable_get('@response_id_round_' + round.to_s),'round':round} } Mark as Sample
%button{:class=>'col-md-12 mark-unmark-sample-button '+instance_variable_get('@remove_as_sample_'+round.to_s),
:data=>{'visibility':3, 'response_id':instance_variable_get('@response_id_round_' + round.to_s),'round':round} } Remove as Sample

%span{:class=>"hide col-md-12 mark-unmark-sample-result", :id=>"mark_unmark_fail_"+round.to_s}
%span{:class=>"hide col-md-12 mark-unmark-sample-result success", :id=>"mark_unmark_success_"+round.to_s}
</pre>

Clicking on “Mark as Sample” or “Unmark as Sample” changes the visibility of the response to 2 or 3 respectively. Like case 1 mentioned above, this is another situation where the visibility needs to be updated when there is a page event.

Both these cases are event-based and require to make an HTTP request from the browser and handle the response while staying on the same page. Therefore, according to standard practice, an AJAX request must be initiated on click of the button or checkbox. The request needs two parameters - response id, and the updated value of visibility. User-identifying data is sent by default in HTTP header cookies (as in any usual HTTP request).

To handle these requests, we have created a sample_reviews controller with a method update_visibility. Within the method, we first check whether the request parameters are valid, and then proceed to check whether the current user (identified by session id) should be allowed to edit the response object to the visibility value passed in the request.

We have validated requests in this manner since HTTP is stateless and requests can easily be cloned (a browser need not be the only client making requests). For example, one could simply copy the request as a cURL, change the session id in the HTTP header to a student’s session, and pass alternative values of visibility (say 2, meaning, approved as a sample) in the request. Such requests should be identified as unauthorized requests, while requests which want to update visibility to a value that’s not allowed need to be rejected as bad requests.

<pre>
def update_visibility
begin
visibility = params[:visibility] #response object consists of visibility in string format
if(visibility.nil?)
raise StandardError.new("Missing parameter 'visibility'")
end
visibility = visibility.to_i

if not (_private..rejected_as_sample).include? visibility
raise StandardError.new("Invalid value for parameter 'visibility'")
end
@@response_id = params[:id]
response_map_id = Response.find(@@response_id).map_id
response_map = ResponseMap.find(response_map_id)
assignment_id = response_map.reviewed_object_id
is_admin = [Role.administrator.id,Role.superadministrator.id].include? current_user.role.id
if is_admin
Response.update(@@response_id.to_i, :visibility => visibility)
update_similar_assignment(assignment_id, visibility)
render json:{"success" => true}
return
end
course_id = Assignment.find(assignment_id).course_id
instructor_id = Course.find(course_id).instructor_id
ta_ids = []
if current_user.role.id == Role.ta.id
ta_ids = TaMapping.where(course_id).ids # do this query only if current user is ta
elsif current_user.role.id == Role.student.id
# find if this student id is the same as the response reviewer id
# and that visiblity is 0 or 1 and nothing else.
# if anything fails, return failure
if visibility > in_review
render json:{"success" => false, "error"=>"Not allowed"}
return
end
reviewer_user_id = AssignmentParticipant.find(response_map.reviewer_id).user_id
if reviewer_user_id != current_user.id
render json:{"success" => false,"error" => "Unathorized"}
return
end

elsif not ([instructor_id] + ta_ids).include? current_user.id
render json:{"success" => false,"error" => "Unathorized"}
return
end
Response.update(@@response_id.to_i, :visibility => visibility)
update_similar_assignment(assignment_id, visibility)
rescue StandardError => e
render json:{"success" => false,"error" => e.message}
else
render json:{"success" => true}
end
end

</pre>

We have provided a success or error message text below the button to indicate to the user that the request is completed.

[[file: Mark unmark picssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss]]

We have used the same request mark_unmark/:id with POST data as {“visibility”:x}, in the student view as well.

This project also required that assignments be linked to each other, as explained in the sections above. To this end, we have created a controller, model, and a migration (to create the database table) for similar assignments.

By default, every assignment is similar to itself (assume it’s id is X). So, after updating a response’s visibility, we add a new entry in the similar_assignments table: (assignment_id = X, similar_for = X, association_intent = “Review”). This addition is done only after confirming for non-existence, as one can infer from the following code snippet:

<pre>
private
def update_similar_assignment(assignment_id, visibility)
if visibility == approved_as_sample
ids = SimilarAssignment.where(:is_similar_for => assignment_id, :association_intent => intent_review,
:assignment_id => assignment_id).ids
if ids.empty?
SimilarAssignment.create({:is_similar_for => assignment_id, :association_intent => intent_review,
:assignment_id => assignment_id})
end
end
if visibility == rejected_as_sample or visibility == _private
response_map_ids = ResponseMap.where(:reviewed_object_id => assignment_id).ids
response_ids = Response.where(:map_id => response_map_ids, :visibility => approved_as_sample)
if response_ids.empty?
SimilarAssignment.where(:assignment_id => assignment_id).destroy_all
end
end
end
</pre>

The power user visits a review response page expecting to mark some reviews as samples and then link or unlink the assignment associated with the review to his / her other assignments. To provide the linking functionality, we have provided a clickable text “ Use as Samples for More Assignments” at the top right corner of the page as shown below.

[[for use as sample for more assignment]]

The appearance or non-appearance of this text is conditional. It only appears when there is at least one sample review for the current assignment. So, to decide this, we have queried for those assignments for which this assignment is a similar one, and checked on the size of the query result. The size is then checked in popup_controller to set an instance variable popup_show to a boolean value. The view uses this to render or not render the clickable “Use as Samples for More Assignments” text.

Code snippet of get_similar_assignment_ids
<pre>
def get_similar_assignment_ids(assignment_id)
SimilarAssignment.where(:assignment_id => assignment_id).pluck(:is_similar_for)
end
</pre>

Code snippet of popup_controller line 84
<pre>
@page_size = popup_page_size
</pre>

On click of this text, we open a popup that lists out (with a checkbox alongside each list entry) the candidate assignments that this assignment can be similar for (these are unchecked), and assignments that it is already similar for (these are checked). For example, assume that the power user is viewing the response page of assignment X. Assume we have entries (X,Y,”review”) and (X,Z,”review”) in similar_assignments table. Then, the popup list will have the assignments Y and Z with a checkbox against each of them ticked, and all the other assignments that the current user has access to, with a checkbox against each of them unticked.

The popup and the data that go with it are fetched on demand. So, the assignment list need not be a part of the first render of the page itself, as the inherent querying would slow down page load time. Therefore, on click, we fetch the list by an AJAX request (we have given appropriate error messages below the clickable text for the rare eventuality of any server-side error or empty response).

This request GET “/similar_assignments/:id” is again authenticated in similar_assignments_controller, get method. Same validation ideas as explained earlier are used. Only the assignment’s course instructor and TAs, admin, and super-admin should be able to fetch this data, while others need not have access to it.

Code snippet of get method
<pre>
# GET /similar_assignments/:id
def get
@assignment_id = params[:id]
ids = Response.joins("INNER JOIN response_maps ON response_maps.id = responses.map_id
WHERE visibility=2 AND reviewed_object_id ="+@assignment_id.to_s).ids
if ids.empty?
render json: {"success"=>false, "error"=>"Please mark atleast one review as sample"}
return
end
begin
if current_user.role.id == Role.student.id
throw Exception.new
end
@similar_assignments = SimilarAssignment.where(:assignment_id => @assignment_id).
where.not(:is_similar_for=>@assignment_id).order("created_at DESC").pluck(:is_similar_for)
rescue ActiveRecord::RecordNotFound => e
render json: {"success" => false, "error" => "Resource not found"}
rescue Exception
render json: {"success" => false, "error" => "Unauthorized"}
else
@res = get_asssignments_set(@similar_assignments)
render json: {"success" => true, "values" => @res}
end
end
</pre>

The get method fetches similar assignment ids and passes them on to get_asssignments_set of similar_assignments_helper. This method queries for all assignments (except the ones passed in its parameter list) that the current user is allowed to access and returns a list of hash objects which are used by the caller (the on-success function of the AJAX request). Each hash object contains assignment name, id, it’s course name, and whether it’s a similar assignment or not. Following code snippets demonstrates this:

Code snippet of get_asssignments_set method
<pre>
def get_asssignments_set(selected)
all_assignments = get_assignments_based_on_role
assignment_array = []
courses = get_courses_based_on_role
all_assignments.each {
|assignment|
course_id = assignment.course_id
if(course_id.nil?)
next
end
if (selected.include? assignment.id)
hash1 = {:title => assignment.name, :course_name => courses[course_id], :checked => true, :id => assignment.id}
assignment_array.push(hash1)
else
hash2 = {:title => assignment.name, :course_name => courses[course_id], :checked => false, :id => assignment.id}
assignment_array.push(hash2)
end
}
return assignment_array
end
</pre>

Code snippet of get_assignments_based_on_role method

<pre>
def get_assignments_based_on_role()
role = current_user.role.id
page = params[:page]
assignment_id = params[:id].to_i
if page.nil?
page = 0
end
_offset = page.to_i * popup_page_size
case role
when Role.ta.id
course_ids = TaMapping.where(:ta_id => current_user.id).pluck(:course_id)
@all_assignments = Assignment.where(:course_id => course_ids).
where.not(:id=>assignment_id).limit(popup_page_size).offset(_offset).order("created_at DESC")
when Role.instructor.id
course_ids = Course.where(:instructor_id => current_user.id).pluck(:id)
@all_assignments = Assignment.where(:course_id => course_ids).
where.not(:id=>assignment_id).limit(popup_page_size).offset(_offset).order("created_at DESC")
else
@all_assignments = []
end
@all_assignments
end
</pre>

The query result can be prohibitively large. This calls for pagination.

Pagination at the server side is about performing the same query as a non-pagination implementation, with an addition: limit and offset. Limit denotes the size of a page, and offset denotes a start index, and is calculated as page size * page number. Page size is a constant defined in similar_assignments_constants.

We had two options for response and rendering:
Construct the popup list HTML from the query results and respond with this HTML.
Respond with JSON, and build the HTML client side.

Responding with HTML from server-side is expensive, as the byte size of the HTTP response would be significantly larger than JSON. Thus, we chose the second option.

Since HTTP is stateless, the server has no way to maintain a running counter of page number. Therefore, keeping track of page number must be the responsibility of the client (browser JavaScript) who must pass it as a request parameter while the server simply reads it and assumes its lack of existence as page number 0. The following snippet demonstrates this:

Snippet of response.js line 103-130
<pre>
fetchAssignments:function(){
var self = this;
var ajaxUrl = "/similar_assignments/"+assignmentId;
if(this.currentPageNumber > 0){
ajaxUrl += "?page="+this.currentPageNumber;
}
jQuery.ajax({
"url":ajaxUrl,
"type":"GET",
"dataType":"json",
"responseType":"json",
"beforeSend":function(){
self.hideSuccess();
self.hideError();
},
"success":function(result){
if(result.success && result.values.length){
self.onFetchSuccess(result.values);
}else if(result.success && self.currentPageNumber == 0){
self.onFetchFail("Cannot link this to any assignment!");
}else if(result.success){
self.onFetchSuccess(result.values);
}
else{
self.onFetchFail(result.error);
}
},
"failure": self.onFetchFail,
"error":self.onFetchFail
</pre>

We have avoided maintaining the constant value of page size once on server side (in similar_assignments_constants) and once on the client side (JS variable). The initial render of the page creates a hidden HTML element that contains the page size, and once the document is ready, response.js selects that element, reads its value into a variable, and deletes that HTML element. This prevents having a page size in the HTML page-source, and more importantly, complies with the DRY principle. Page size should be changed in one function only - and that is in similar_assignments_constants as explained earlier.

From the response JSON containing an array of objects (that are going to be rendered as list items), we have constructed the HTML list. Each list item maintains its assignment id in its HTML data attribute. The following snippet shows this.

Response.js lines 67-78
<pre>
addToList:function(assignment){
var assignmentId = assignment.id;
var title = assignment.title;
var course = assignment.course_name;
var displayText = "<strong>"+course+": </strong>" +title;
var checked = assignment.checked;
var newRow = this.template.clone();
newRow.removeClass("hide").find("input").attr("data-id",assignmentId).attr("checked",checked);
newRow.find("span").html(displayText).on("click",function(){
newRow.find("input").click();
});
this.list.append(newRow.removeAttr("id"));
},
</pre>

_________________________________________A snapshot of the popup is shown below.

The “More” button (shown in the snapshot above) is used to fetch the next set of results.

After a finite number of requests, the client receives a lesser number of results than expected. This is when pagination must stop (since there are no more results). This is achieved by the object AssignmentsPopup (in our response.js file) - it maintains the page size and current page number. The more button is now replaced by a text “No more results” and it’s on-click functionality is turned off.

______________________________________________Screenshot of popup with “No more results”

Further, we have implemented this as a plug-and-play service. By reusing the same popup HTML and the AssignmentsPopup variable, the entire popup can be made a part of any Expertiza page.

The page makes no requests on closing the popup, or on clicking Submit without checking any unchecked list item or unchecking any checked list item. It submits only if there is an overall difference in what items are checked and what are not.

Click of “Submit” makes another AJAX POST request to “/similar_assignments/create/:id” with two params in the post JSON data:
“checked” - an array of assignment ids that were checked in the list but unchecked while opening the popup
“unchecked” - an array of assignment ids that were unchecked in the list but checked while opening the popup

Either of these params may be empty, depending on the user’s actions, but not both (if both were empty, we simply close the popup without submitting). However, this optimization is only client side. Server side logic must still check for duplicates - that is, an assignment id under “checked” is already a part of similar_assignments.

Let current assignment id be X. For each of the checked assignment ids Ci in {C1,C2,...,Cn}, we have checked if there are entries (X,Ci) in similar_assignments table, and if not, then created that entry. Similarly, for each of the unchecked assignment ids Ui in {U1,U2,...,Um}, we have deleted the entry (X,Ui) from similar_assignments.

On a successful update, the client closes the popup and prints a success message.

_________________________________________________________________________________________Snapshot with success message

So far, power users have marked reviews as samples and linked assignments. Now, students need to view these samples. A student would view these sample reviews before writing their review on somebody else’s work. Therefore, we have added a link “View Sample Reviews” to view the list of sample reviews.

________________________________________________________________UI screenshot here.<pending>

Similarly, power users might also want to view samples. We have provided the same link on the following page too.

________________________________________________________________UI screenshot here

This page is rendered by the index method in sample_reviews_controller. It is a list of links to sample reviews. The layout of this page is common for users, as long as they are logged in. Non-logged-in or anonymous visitors are redirected to the Expertiza home page. ‘index’ calls a method redirect_anonymous_user in sample_reviews_helper to achieve this.

Snippet of sample_reviews_helper
<pre>
def redirect_anonymous_user
current_user = session[:user]
if current_user.nil?
redirect_to "/"
end
end
</pre>

The list of available samples has no upper bound on its size. Yet again, pagination solves this problem. But unlike the case of the popup discussed earlier, the response type differs. A request without a ‘page’ parameter in its URL is a request for the web-page and should, therefore, render HTML, while the same request URL with the ‘page’ parameter is a request for more content, and should, therefore, render JSON. The following snippet from the index method demonstrates this.

Sample_reviews_controller - index method - add the if-else just before return statement
<pre>
def index
redirect_anonymous_user
@assignment_id = params[:id].to_i
page_number = params[:page].to_i
if page_number.nil?
page_number = 0
end
@page_size = 8
similar_assignment_ids = get_similar_assignment_ids(@assignment_id)
@response_ids = []
similar_assignment_ids.each do |id|
_offset = page_number * @page_size
ids = Response.joins("INNER JOIN response_maps ON response_maps.id = responses.map_id
WHERE visibility=2 AND reviewed_object_id = "+id.to_s+
" ORDER BY responses.created_at LIMIT "+@page_size.to_s+" OFFSET "+_offset.to_s ).ids
@response_ids += ids
end
@links = generate_links(@response_ids)
if page_number == 0
@course_assignment_name = get_course_assignment_name(@assignment_id)
else
render json: {"success" => true, "sampleReviews" => @links}
end
end
</pre>

During this first render itself, we have also identified whether more results can exist. The “More” button only appears if the number of sample review links being rendered is equal to the page size, as shown in a snippet of views/sample_reviews/index.html.erb below.

Code snip of Lines 12-15
<pre>
<% if @links.size == @page_size %>
<h5 style="cursor:pointer;text-align: center;" id="more_button">More +</h5>
<% end %>
</pre>

Clicking the “More” button now makes the same request as the page’s URL, but with the parameter ‘page’. In that case, the response is JSON, which is used by the caller (JavaScript Ajax) to add more rows to the page. If the number of rows is lesser than expected, the More text is changed, its click listener is turned off, and no more requests are made, demonstrated by the snippet of sample_review.js below.

Code snip of Line 25-35
<pre>
for(var i in result.sampleReviews)
{
currentNumberOfRows++;
var review = result.sampleReviews[i];
var newRow = listTemplate.clone();
newRow.removeClass("hide").removeAttr("id").find("a").
html("Sample Review "+currentNumberOfRows).attr("href",review);
ulList.append(newRow);
}

if(responseSize < pageSize){
self.html("No more results!").off().css({"cursor":"default"});
}
else
{
pageNumber++;
}
</pre>

Each of the list items on the page is a link, which takes the user to /sample_reviews/:id. On this page, we fetch the question-answer pairs corresponding to the object having the id given in the URL and print it out in the form of a table.

== Test Plan ==
'''As a Power User (TA/Instructor/Admin/Super Admin)'''
# Log in
# Click on Manage->Assignments
# Displays list of Assignments
# Click View Report/Review for a particular assignment.
# Displays a list of reviews submitted by students.
# Click on any review in "team reviewed" column for a particular student.
# Displays the summary of reviews submitted by that student, with a "Make as sample" button on the right of every review.
# Click on "Make as sample" for the intended reviews, which opens a popup that displays a list of all assignments that are a part of the instructor's courses.
# From this list select all assignments for which the review has to be shown as a sample.
# Click on 'Submit' after selection (this closes the popup).
# Navigate to view reviews of that particular assignment and click on "Sample Reviews".
# A new page is opened that lists out all the sample reviews of the assignment.

'''As a Student'''
# Log in.
# Click on Assignments
# List of assignments is displayed.
# Click on any assignment for which the review has to be submitted.
# Assignment task page is displayed.
# Click on "Other's work" to open the reviews summary page (at /student_review).
# Below the heading "Reviews for ...", click on the "Show sample reviews" link.
# This opens a page where the student can view all sample reviews for that assignment.
# Use the browser's back button to go back to Assignment review page.
# Chose to review any of the teams' assignments that are displayed.
# Select a team for review and fill in the review.
# Before submitting the review, select the checkbox that says "I agree to share this review anonymously as an example to the entire class".
# After clicking on the submit button, the review submitted has been made public.

'''RSpec Tests'''
Below are the Rpsec tests that have been added to test the edge cases when a user tries to get access to the data using cloned requests:
# If an anonymous user tries to view the sample reviews page he/she will be redirected to home page.
# If an anonymous user tries to view the details of a particular sample review, he/she will be redirected to home page.
# If a user tries to view the sample review of a particular assignment for which there are no sample reviews, he/she will be redirected to home page.

=='''Additional Links and References'''==

#[https://github.com/expertiza/expertiza/pull/1291 Link to the Git Pull Request]
#[https://github.com/expertiza/expertiza Expertiza on GitHub]
#[https://github.com/chinmaiks/expertiza GitHub Project Repository Fork]
#[http://expertiza.ncsu.edu/ The Live Expertiza Website]

==Team==
[mailto:aagniho@ncsu.edu Amogh Agnihotri Subbanna]<br>
[mailto:ckaidab@ncsu.edu Chinmai Kaidabettu Srinivas]<br>
[mailto:smadhur@ncsu.edu Siddu Madhure Jayanna]<br>
[mailto:snaramb@ncsu.edu Suhas Naramballi Gururaja]

E1867 allow reviewer to say review can be shown to class as an example

2018-12-07T23:25:41Z

Ckaidab: /* Test Plan */

== Problem Statement ==
The objective of this project is to:
# Add a feature for students to make their reviews 'public', that is, allow other students to view them.
# Add a feature for TA to select a subset of 'public' reviews, and make those reviews visible as sample reviews of the particular assignment.
# Add a feature for Instructor to select a subset of 'public' reviews and make those reviews visible as sample reviews of any of his/her assignments in the course.
# Create a view where the student can see a list of sample reviews of the assignment and have a detailed view of each.
# Allow the student to toggle the visibility of a review he/she has submitted.

== Approach & Design ==

# Consent to make the review public - add a checkbox and an oncheck event handlers (JS) that sets a new field 'visibility' to public of Response object.
# Change the schema of Responses table (add the new column) and write db migrations.
# Create new table, model, view, controller for "similar_assignments" and validate CRUD operations that access the table.
# Add HTML (checkbox) to uncheck the consent such that the reviews becomes private again.
# On the "popup/team_users_popup" page (where instructor/TA can view all reviews), we give a checkbox against every review with public visibility to allow instructors/TAs to select one or more reviews as sample reviews to be available for students.
# Once the instructor selects and submits some reviews as sample reviews, we give a popup containing a list of assignments with a checkbox against each of them and a submit button at the end to allow instructors to make sample reviews available for multiple assignments in one go. We perform validation checks also.
# On submit of the popup, we update the similar_assignments table.
# At the top of student_reviews/list page, we give an option for the student to preview all the available sample reviews.
# Create the MVC setup for this new page to list all the sample reviews. Students will be able to click on one particular review and preview it.

'''DB Design'''

Currently, the Expertiza database design does not maintain any link between different assignments. An assignment of the current semester is completely independent of any other assignment of any other course having similar or exact objectives. For example, in a course C, the assignment named A1 in a semester Sx has no association to the same assignment given in an earlier semester Sy.

Since our task involves using reviews from the past as samples for the present, we should create this association as a new table. Further, reviews may not be the only intention to associate assignments with each other, as future requirements might require associating them on other criteria too. Thus, we find it appropriate to name the table as "similar_assignments".

The table structure is defined [http://wiki.expertiza.ncsu.edu/index.php/Similar_assignments here].

This table can be visualized as a directed graph where vertices represent assignments. An edge (u,v) with a label L means u is similar to v for the intent of association, L.

Consider a row (id = x, assignment_id = Ak, is_similar_for = An, association_intent = "review"). This means, given the intent of association as "review", assignment Ak was chosen as a similar assignment for assignment An. That is, while marking some review for An as a sample, the instructor opted to have reviews of Ak as samples for An as well.

== Implementation Details ==

==== UML - Use Case Diagram ====

[[Image:UseCase.png]]

'''Power Users:''' Instructors, TAs, Admins and Super Admins

'''More details about each point mentioned in the approach section will be updated after the implementation.'''

== Implementation ==

We have added a new column in the ‘responses’ table (in the database), namely, ‘visibility’.
Visibility can have 4 values as listed below:

{| class="wikitable"
|+ Table showing list of visibility values and the properties
! Visibility
! Properties
|-
| 0 || Response is private. This is the default value.
|-
| 1 || The response which was in the review has been approved as an example (that is, it has been marked as a sample)
|-
| 2 || The response which was in the review has been approved as an example (that is, it has been marked as a sample)
|-
| 3 || The response which was either in the review or approved earlier, has now been rejected as an example (it has been unmarked as a sample)
|-
|}

We have maintained these constants in a new file at helpers/response_constants.rb.

<pre>
module ResponseConstants
def _private
0
end

def in_review
1
end

def approved_as_sample
2
end

def rejected_as_sample
3
end
end
</pre>

In the existing implementation of reviews, when a student starts a review (but hasn’t filled any text or ratings yet), a response gets created in the database. This response has a default visibility of 0.

We have provided a checkbox (an HTML input node with attribute ‘type’ as ‘checkbox’) for the student to consent for his / her review to be used as an example, with values 0 and 1 for unchecked and checked respectively. This value is used to update the response object as part of the form submission.

However, a student might want to remove their consent or give their consent, for a review that is already submitted. So, in the page where student views his / her own response, we have added the same HTML checkbox. On checking or unchecking the checkbox, the visibility field in the corresponding response object in the database gets updated.Consider this as case 1.

Now when a power user looks at a review (at url , which is an HTML rendering of a ResponseMap containing Responses), he/she must be able to approve and reject responses which students have consented (offered) to be made visible to all. This is done by providing a button “Mark as Sample” or “Remove as Sample”. Responses without consent will not have any button.

These HTML changes appear in views/popup/team_users_popup.html.haml
<pre>
if instance_variable_get('@sample_button_'+round.to_s)
%div{:class=>'col-md-12 mark-delete-sample '+'round'+round.to_s}
%h3{:class=>'col-md-10'} "Reviewed by #{User.find(@reviewer_id).fullname} (Round #{round})"
%div{:class=>'col-md-2'}

%button{:class=>'col-md-12 mark-unmark-sample-button '+instance_variable_get('@mark_as_sample_'+round.to_s),
:data=>{'visibility':2, 'response_id':instance_variable_get('@response_id_round_' + round.to_s),'round':round} } Mark as Sample
%button{:class=>'col-md-12 mark-unmark-sample-button '+instance_variable_get('@remove_as_sample_'+round.to_s),
:data=>{'visibility':3, 'response_id':instance_variable_get('@response_id_round_' + round.to_s),'round':round} } Remove as Sample

%span{:class=>"hide col-md-12 mark-unmark-sample-result", :id=>"mark_unmark_fail_"+round.to_s}
%span{:class=>"hide col-md-12 mark-unmark-sample-result success", :id=>"mark_unmark_success_"+round.to_s}
</pre>

Clicking on “Mark as Sample” or “Unmark as Sample” changes the visibility of the response to 2 or 3 respectively. Like case 1 mentioned above, this is another situation where the visibility needs to be updated when there is a page event.

Both these cases are event-based and require to make an HTTP request from the browser and handle the response while staying on the same page. Therefore, according to standard practice, an AJAX request must be initiated on click of the button or checkbox. The request needs two parameters - response id, and the updated value of visibility. User-identifying data is sent by default in HTTP header cookies (as in any usual HTTP request).

To handle these requests, we have created a sample_reviews controller with a method update_visibility. Within the method, we first check whether the request parameters are valid, and then proceed to check whether the current user (identified by session id) should be allowed to edit the response object to the visibility value passed in the request.

We have validated requests in this manner since HTTP is stateless and requests can easily be cloned (a browser need not be the only client making requests). For example, one could simply copy the request as a cURL, change the session id in the HTTP header to a student’s session, and pass alternative values of visibility (say 2, meaning, approved as a sample) in the request. Such requests should be identified as unauthorized requests, while requests which want to update visibility to a value that’s not allowed need to be rejected as bad requests.

<pre>
def update_visibility
begin
visibility = params[:visibility] #response object consists of visibility in string format
if(visibility.nil?)
raise StandardError.new("Missing parameter 'visibility'")
end
visibility = visibility.to_i

if not (_private..rejected_as_sample).include? visibility
raise StandardError.new("Invalid value for parameter 'visibility'")
end
@@response_id = params[:id]
response_map_id = Response.find(@@response_id).map_id
response_map = ResponseMap.find(response_map_id)
assignment_id = response_map.reviewed_object_id
is_admin = [Role.administrator.id,Role.superadministrator.id].include? current_user.role.id
if is_admin
Response.update(@@response_id.to_i, :visibility => visibility)
update_similar_assignment(assignment_id, visibility)
render json:{"success" => true}
return
end
course_id = Assignment.find(assignment_id).course_id
instructor_id = Course.find(course_id).instructor_id
ta_ids = []
if current_user.role.id == Role.ta.id
ta_ids = TaMapping.where(course_id).ids # do this query only if current user is ta
elsif current_user.role.id == Role.student.id
# find if this student id is the same as the response reviewer id
# and that visiblity is 0 or 1 and nothing else.
# if anything fails, return failure
if visibility > in_review
render json:{"success" => false, "error"=>"Not allowed"}
return
end
reviewer_user_id = AssignmentParticipant.find(response_map.reviewer_id).user_id
if reviewer_user_id != current_user.id
render json:{"success" => false,"error" => "Unathorized"}
return
end

elsif not ([instructor_id] + ta_ids).include? current_user.id
render json:{"success" => false,"error" => "Unathorized"}
return
end
Response.update(@@response_id.to_i, :visibility => visibility)
update_similar_assignment(assignment_id, visibility)
rescue StandardError => e
render json:{"success" => false,"error" => e.message}
else
render json:{"success" => true}
end
end

</pre>

We have provided a success or error message text below the button to indicate to the user that the request is completed.

[[file: Mark unmark picssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss]]

We have used the same request mark_unmark/:id with POST data as {“visibility”:x}, in the student view as well.

This project also required that assignments be linked to each other, as explained in the sections above. To this end, we have created a controller, model, and a migration (to create the database table) for similar assignments.

By default, every assignment is similar to itself (assume it’s id is X). So, after updating a response’s visibility, we add a new entry in the similar_assignments table: (assignment_id = X, similar_for = X, association_intent = “Review”). This addition is done only after confirming for non-existence, as one can infer from the following code snippet:

<pre>
private
def update_similar_assignment(assignment_id, visibility)
if visibility == approved_as_sample
ids = SimilarAssignment.where(:is_similar_for => assignment_id, :association_intent => intent_review,
:assignment_id => assignment_id).ids
if ids.empty?
SimilarAssignment.create({:is_similar_for => assignment_id, :association_intent => intent_review,
:assignment_id => assignment_id})
end
end
if visibility == rejected_as_sample or visibility == _private
response_map_ids = ResponseMap.where(:reviewed_object_id => assignment_id).ids
response_ids = Response.where(:map_id => response_map_ids, :visibility => approved_as_sample)
if response_ids.empty?
SimilarAssignment.where(:assignment_id => assignment_id).destroy_all
end
end
end
</pre>

The power user visits a review response page expecting to mark some reviews as samples and then link or unlink the assignment associated with the review to his / her other assignments. To provide the linking functionality, we have provided a clickable text “ Use as Samples for More Assignments” at the top right corner of the page as shown below.

[[for use as sample for more assignment]]

The appearance or non-appearance of this text is conditional. It only appears when there is at least one sample review for the current assignment. So, to decide this, we have queried for those assignments for which this assignment is a similar one, and checked on the size of the query result. The size is then checked in popup_controller to set an instance variable popup_show to a boolean value. The view uses this to render or not render the clickable “Use as Samples for More Assignments” text.

Code snippet of get_similar_assignment_ids
<pre>
def get_similar_assignment_ids(assignment_id)
SimilarAssignment.where(:assignment_id => assignment_id).pluck(:is_similar_for)
end
</pre>

Code snippet of popup_controller line 84
<pre>
@page_size = popup_page_size
</pre>

On click of this text, we open a popup that lists out (with a checkbox alongside each list entry) the candidate assignments that this assignment can be similar for (these are unchecked), and assignments that it is already similar for (these are checked). For example, assume that the power user is viewing the response page of assignment X. Assume we have entries (X,Y,”review”) and (X,Z,”review”) in similar_assignments table. Then, the popup list will have the assignments Y and Z with a checkbox against each of them ticked, and all the other assignments that the current user has access to, with a checkbox against each of them unticked.

The popup and the data that go with it are fetched on demand. So, the assignment list need not be a part of the first render of the page itself, as the inherent querying would slow down page load time. Therefore, on click, we fetch the list by an AJAX request (we have given appropriate error messages below the clickable text for the rare eventuality of any server-side error or empty response).

This request GET “/similar_assignments/:id” is again authenticated in similar_assignments_controller, get method. Same validation ideas as explained earlier are used. Only the assignment’s course instructor and TAs, admin, and super-admin should be able to fetch this data, while others need not have access to it.

Code snippet of get method
<pre>
# GET /similar_assignments/:id
def get
@assignment_id = params[:id]
ids = Response.joins("INNER JOIN response_maps ON response_maps.id = responses.map_id
WHERE visibility=2 AND reviewed_object_id ="+@assignment_id.to_s).ids
if ids.empty?
render json: {"success"=>false, "error"=>"Please mark atleast one review as sample"}
return
end
begin
if current_user.role.id == Role.student.id
throw Exception.new
end
@similar_assignments = SimilarAssignment.where(:assignment_id => @assignment_id).
where.not(:is_similar_for=>@assignment_id).order("created_at DESC").pluck(:is_similar_for)
rescue ActiveRecord::RecordNotFound => e
render json: {"success" => false, "error" => "Resource not found"}
rescue Exception
render json: {"success" => false, "error" => "Unauthorized"}
else
@res = get_asssignments_set(@similar_assignments)
render json: {"success" => true, "values" => @res}
end
end
</pre>

The get method fetches similar assignment ids and passes them on to get_asssignments_set of similar_assignments_helper. This method queries for all assignments (except the ones passed in its parameter list) that the current user is allowed to access and returns a list of hash objects which are used by the caller (the on-success function of the AJAX request). Each hash object contains assignment name, id, it’s course name, and whether it’s a similar assignment or not. Following code snippets demonstrates this:

Code snippet of get_asssignments_set method
<pre>
def get_asssignments_set(selected)
all_assignments = get_assignments_based_on_role
assignment_array = []
courses = get_courses_based_on_role
all_assignments.each {
|assignment|
course_id = assignment.course_id
if(course_id.nil?)
next
end
if (selected.include? assignment.id)
hash1 = {:title => assignment.name, :course_name => courses[course_id], :checked => true, :id => assignment.id}
assignment_array.push(hash1)
else
hash2 = {:title => assignment.name, :course_name => courses[course_id], :checked => false, :id => assignment.id}
assignment_array.push(hash2)
end
}
return assignment_array
end
</pre>

Code snippet of get_assignments_based_on_role method

<pre>
def get_assignments_based_on_role()
role = current_user.role.id
page = params[:page]
assignment_id = params[:id].to_i
if page.nil?
page = 0
end
_offset = page.to_i * popup_page_size
case role
when Role.ta.id
course_ids = TaMapping.where(:ta_id => current_user.id).pluck(:course_id)
@all_assignments = Assignment.where(:course_id => course_ids).
where.not(:id=>assignment_id).limit(popup_page_size).offset(_offset).order("created_at DESC")
when Role.instructor.id
course_ids = Course.where(:instructor_id => current_user.id).pluck(:id)
@all_assignments = Assignment.where(:course_id => course_ids).
where.not(:id=>assignment_id).limit(popup_page_size).offset(_offset).order("created_at DESC")
else
@all_assignments = []
end
@all_assignments
end
</pre>

The query result can be prohibitively large. This calls for pagination.

Pagination at the server side is about performing the same query as a non-pagination implementation, with an addition: limit and offset. Limit denotes the size of a page, and offset denotes a start index, and is calculated as page size * page number. Page size is a constant defined in similar_assignments_constants.

We had two options for response and rendering:
Construct the popup list HTML from the query results and respond with this HTML.
Respond with JSON, and build the HTML client side.

Responding with HTML from server-side is expensive, as the byte size of the HTTP response would be significantly larger than JSON. Thus, we chose the second option.

Since HTTP is stateless, the server has no way to maintain a running counter of page number. Therefore, keeping track of page number must be the responsibility of the client (browser JavaScript) who must pass it as a request parameter while the server simply reads it and assumes its lack of existence as page number 0. The following snippet demonstrates this:

Snippet of response.js line 103-130
<pre>
fetchAssignments:function(){
var self = this;
var ajaxUrl = "/similar_assignments/"+assignmentId;
if(this.currentPageNumber > 0){
ajaxUrl += "?page="+this.currentPageNumber;
}
jQuery.ajax({
"url":ajaxUrl,
"type":"GET",
"dataType":"json",
"responseType":"json",
"beforeSend":function(){
self.hideSuccess();
self.hideError();
},
"success":function(result){
if(result.success && result.values.length){
self.onFetchSuccess(result.values);
}else if(result.success && self.currentPageNumber == 0){
self.onFetchFail("Cannot link this to any assignment!");
}else if(result.success){
self.onFetchSuccess(result.values);
}
else{
self.onFetchFail(result.error);
}
},
"failure": self.onFetchFail,
"error":self.onFetchFail
</pre>

We have avoided maintaining the constant value of page size once on server side (in similar_assignments_constants) and once on the client side (JS variable). The initial render of the page creates a hidden HTML element that contains the page size, and once the document is ready, response.js selects that element, reads its value into a variable, and deletes that HTML element. This prevents having a page size in the HTML page-source, and more importantly, complies with the DRY principle. Page size should be changed in one function only - and that is in similar_assignments_constants as explained earlier.

From the response JSON containing an array of objects (that are going to be rendered as list items), we have constructed the HTML list. Each list item maintains its assignment id in its HTML data attribute. The following snippet shows this.

Response.js lines 67-78
<pre>
addToList:function(assignment){
var assignmentId = assignment.id;
var title = assignment.title;
var course = assignment.course_name;
var displayText = "<strong>"+course+": </strong>" +title;
var checked = assignment.checked;
var newRow = this.template.clone();
newRow.removeClass("hide").find("input").attr("data-id",assignmentId).attr("checked",checked);
newRow.find("span").html(displayText).on("click",function(){
newRow.find("input").click();
});
this.list.append(newRow.removeAttr("id"));
},
</pre>

_________________________________________A snapshot of the popup is shown below.

The “More” button (shown in the snapshot above) is used to fetch the next set of results.

After a finite number of requests, the client receives a lesser number of results than expected. This is when pagination must stop (since there are no more results). This is achieved by the object AssignmentsPopup (in our response.js file) - it maintains the page size and current page number. The more button is now replaced by a text “No more results” and it’s on-click functionality is turned off.

______________________________________________Screenshot of popup with “No more results”

Further, we have implemented this as a plug-and-play service. By reusing the same popup HTML and the AssignmentsPopup variable, the entire popup can be made a part of any Expertiza page.

The page makes no requests on closing the popup, or on clicking Submit without checking any unchecked list item or unchecking any checked list item. It submits only if there is an overall difference in what items are checked and what are not.

Click of “Submit” makes another AJAX POST request to “/similar_assignments/create/:id” with two params in the post JSON data:
“checked” - an array of assignment ids that were checked in the list but unchecked while opening the popup
“unchecked” - an array of assignment ids that were unchecked in the list but checked while opening the popup

Either of these params may be empty, depending on the user’s actions, but not both (if both were empty, we simply close the popup without submitting). However, this optimization is only client side. Server side logic must still check for duplicates - that is, an assignment id under “checked” is already a part of similar_assignments.

Let current assignment id be X. For each of the checked assignment ids Ci in {C1,C2,...,Cn}, we have checked if there are entries (X,Ci) in similar_assignments table, and if not, then created that entry. Similarly, for each of the unchecked assignment ids Ui in {U1,U2,...,Um}, we have deleted the entry (X,Ui) from similar_assignments.

On a successful update, the client closes the popup and prints a success message.

_________________________________________________________________________________________Snapshot with success message

So far, power users have marked reviews as samples and linked assignments. Now, students need to view these samples. A student would view these sample reviews before writing their review on somebody else’s work. Therefore, we have added a link “View Sample Reviews” to view the list of sample reviews.

________________________________________________________________UI screenshot here.<pending>

Similarly, power users might also want to view samples. We have provided the same link on the following page too.

________________________________________________________________UI screenshot here

This page is rendered by the index method in sample_reviews_controller. It is a list of links to sample reviews. The layout of this page is common for users, as long as they are logged in. Non-logged-in or anonymous visitors are redirected to the Expertiza home page. ‘index’ calls a method redirect_anonymous_user in sample_reviews_helper to achieve this.

Snippet of sample_reviews_helper
<pre>
def redirect_anonymous_user
current_user = session[:user]
if current_user.nil?
redirect_to "/"
end
end
</pre>

The list of available samples has no upper bound on its size. Yet again, pagination solves this problem. But unlike the case of the popup discussed earlier, the response type differs. A request without a ‘page’ parameter in its URL is a request for the web-page and should, therefore, render HTML, while the same request URL with the ‘page’ parameter is a request for more content, and should, therefore, render JSON. The following snippet from the index method demonstrates this.

Sample_reviews_controller - index method - add the if-else just before return statement
<pre>
def index
redirect_anonymous_user
@assignment_id = params[:id].to_i
page_number = params[:page].to_i
if page_number.nil?
page_number = 0
end
@page_size = 8
similar_assignment_ids = get_similar_assignment_ids(@assignment_id)
@response_ids = []
similar_assignment_ids.each do |id|
_offset = page_number * @page_size
ids = Response.joins("INNER JOIN response_maps ON response_maps.id = responses.map_id
WHERE visibility=2 AND reviewed_object_id = "+id.to_s+
" ORDER BY responses.created_at LIMIT "+@page_size.to_s+" OFFSET "+_offset.to_s ).ids
@response_ids += ids
end
@links = generate_links(@response_ids)
if page_number == 0
@course_assignment_name = get_course_assignment_name(@assignment_id)
else
render json: {"success" => true, "sampleReviews" => @links}
end
end
</pre>

During this first render itself, we have also identified whether more results can exist. The “More” button only appears if the number of sample review links being rendered is equal to the page size, as shown in a snippet of views/sample_reviews/index.html.erb below.

Code snip of Lines 12-15
<pre>
<% if @links.size == @page_size %>
<h5 style="cursor:pointer;text-align: center;" id="more_button">More +</h5>
<% end %>
</pre>

Clicking the “More” button now makes the same request as the page’s URL, but with the parameter ‘page’. In that case, the response is JSON, which is used by the caller (JavaScript Ajax) to add more rows to the page. If the number of rows is lesser than expected, the More text is changed, its click listener is turned off, and no more requests are made, demonstrated by the snippet of sample_review.js below.

Code snip of Line 25-35
<pre>
for(var i in result.sampleReviews)
{
currentNumberOfRows++;
var review = result.sampleReviews[i];
var newRow = listTemplate.clone();
newRow.removeClass("hide").removeAttr("id").find("a").
html("Sample Review "+currentNumberOfRows).attr("href",review);
ulList.append(newRow);
}

if(responseSize < pageSize){
self.html("No more results!").off().css({"cursor":"default"});
}
else
{
pageNumber++;
}
</pre>

Each of the list items on the page is a link, which takes the user to /sample_reviews/:id. On this page, we fetch the question-answer pairs corresponding to the object having the id given in the URL and print it out in the form of a table.

== Test Plan ==
'''As a Power User (TA/Instructor/Admin/Super Admin)'''
# Log in
# Click on Manage->Assignments
# Displays list of Assignments
# Click View Report/Review for a particular assignment.
# Displays a list of reviews submitted by students.
# Click on any review in "team reviewed" column for a particular student.
# Displays the summary of reviews submitted by that student, with a "Make as sample" button on the right of every review.
# Click on "Make as sample" for the intended reviews, which opens a popup that displays a list of all assignments that are a part of the instructor's courses.
# From this list select all assignments for which the review has to be shown as a sample.
# Click on 'Submit' after selection (this closes the popup).
# Navigate to view reviews of that particular assignment and click on "Sample Reviews".
# A new page is opened that lists out all the sample reviews of the assignment.

'''As a Student'''
# Log in.
# Click on Assignments
# List of assignments is displayed.
# Click on any assignment for which the review has to be submitted.
# Assignment task page is displayed.
# Click on "Other's work" to open the reviews summary page (at /student_review).
# Below the heading "Reviews for ...", click on the "Show sample reviews" link.
# This opens a page where the student can view all sample reviews for that assignment.
# Use the browser's back button to go back to Assignment review page.
# Chose to review any of the teams' assignments that are displayed.
# Select a team for review and fill in the review.
# Before submitting the review, select the checkbox that says "I agree to share this review anonymously as an example to the entire class".
# After clicking on the submit button, the review submitted has been made public.

'''RSpec Tests'''
'''Below are the Rpsec tests that have been added to test the edge cases when a user tries to get access to the data using cloned requests:'''
# If an anonymous user tries to view the sample reviews page he/she will be redirected to home page.
# If an anonymous user tries to view the details of a particular sample review, he/she will be redirected to home page.
# If a user tries to view the sample review of a particular assignment for which there are no sample reviews, he/she will be redirected to home page.

=='''Additional Links and References'''==

#[https://github.com/expertiza/expertiza/pull/1291 Link to the Git Pull Request]
#[https://github.com/expertiza/expertiza Expertiza on GitHub]
#[https://github.com/chinmaiks/expertiza GitHub Project Repository Fork]
#[http://expertiza.ncsu.edu/ The Live Expertiza Website]

==Team==
[mailto:aagniho@ncsu.edu Amogh Agnihotri Subbanna]<br>
[mailto:ckaidab@ncsu.edu Chinmai Kaidabettu Srinivas]<br>
[mailto:smadhur@ncsu.edu Siddu Madhure Jayanna]<br>
[mailto:snaramb@ncsu.edu Suhas Naramballi Gururaja]

E1867 allow reviewer to say review can be shown to class as an example

2018-12-07T23:25:06Z

Ckaidab: /* Test Plan */

== Problem Statement ==
The objective of this project is to:
# Add a feature for students to make their reviews 'public', that is, allow other students to view them.
# Add a feature for TA to select a subset of 'public' reviews, and make those reviews visible as sample reviews of the particular assignment.
# Add a feature for Instructor to select a subset of 'public' reviews and make those reviews visible as sample reviews of any of his/her assignments in the course.
# Create a view where the student can see a list of sample reviews of the assignment and have a detailed view of each.
# Allow the student to toggle the visibility of a review he/she has submitted.

== Approach & Design ==

# Consent to make the review public - add a checkbox and an oncheck event handlers (JS) that sets a new field 'visibility' to public of Response object.
# Change the schema of Responses table (add the new column) and write db migrations.
# Create new table, model, view, controller for "similar_assignments" and validate CRUD operations that access the table.
# Add HTML (checkbox) to uncheck the consent such that the reviews becomes private again.
# On the "popup/team_users_popup" page (where instructor/TA can view all reviews), we give a checkbox against every review with public visibility to allow instructors/TAs to select one or more reviews as sample reviews to be available for students.
# Once the instructor selects and submits some reviews as sample reviews, we give a popup containing a list of assignments with a checkbox against each of them and a submit button at the end to allow instructors to make sample reviews available for multiple assignments in one go. We perform validation checks also.
# On submit of the popup, we update the similar_assignments table.
# At the top of student_reviews/list page, we give an option for the student to preview all the available sample reviews.
# Create the MVC setup for this new page to list all the sample reviews. Students will be able to click on one particular review and preview it.

'''DB Design'''

Currently, the Expertiza database design does not maintain any link between different assignments. An assignment of the current semester is completely independent of any other assignment of any other course having similar or exact objectives. For example, in a course C, the assignment named A1 in a semester Sx has no association to the same assignment given in an earlier semester Sy.

Since our task involves using reviews from the past as samples for the present, we should create this association as a new table. Further, reviews may not be the only intention to associate assignments with each other, as future requirements might require associating them on other criteria too. Thus, we find it appropriate to name the table as "similar_assignments".

The table structure is defined [http://wiki.expertiza.ncsu.edu/index.php/Similar_assignments here].

This table can be visualized as a directed graph where vertices represent assignments. An edge (u,v) with a label L means u is similar to v for the intent of association, L.

Consider a row (id = x, assignment_id = Ak, is_similar_for = An, association_intent = "review"). This means, given the intent of association as "review", assignment Ak was chosen as a similar assignment for assignment An. That is, while marking some review for An as a sample, the instructor opted to have reviews of Ak as samples for An as well.

== Implementation Details ==

==== UML - Use Case Diagram ====

[[Image:UseCase.png]]

'''Power Users:''' Instructors, TAs, Admins and Super Admins

'''More details about each point mentioned in the approach section will be updated after the implementation.'''

== Implementation ==

We have added a new column in the ‘responses’ table (in the database), namely, ‘visibility’.
Visibility can have 4 values as listed below:

{| class="wikitable"
|+ Table showing list of visibility values and the properties
! Visibility
! Properties
|-
| 0 || Response is private. This is the default value.
|-
| 1 || The response which was in the review has been approved as an example (that is, it has been marked as a sample)
|-
| 2 || The response which was in the review has been approved as an example (that is, it has been marked as a sample)
|-
| 3 || The response which was either in the review or approved earlier, has now been rejected as an example (it has been unmarked as a sample)
|-
|}

We have maintained these constants in a new file at helpers/response_constants.rb.

<pre>
module ResponseConstants
def _private
0
end

def in_review
1
end

def approved_as_sample
2
end

def rejected_as_sample
3
end
end
</pre>

In the existing implementation of reviews, when a student starts a review (but hasn’t filled any text or ratings yet), a response gets created in the database. This response has a default visibility of 0.

We have provided a checkbox (an HTML input node with attribute ‘type’ as ‘checkbox’) for the student to consent for his / her review to be used as an example, with values 0 and 1 for unchecked and checked respectively. This value is used to update the response object as part of the form submission.

However, a student might want to remove their consent or give their consent, for a review that is already submitted. So, in the page where student views his / her own response, we have added the same HTML checkbox. On checking or unchecking the checkbox, the visibility field in the corresponding response object in the database gets updated.Consider this as case 1.

Now when a power user looks at a review (at url , which is an HTML rendering of a ResponseMap containing Responses), he/she must be able to approve and reject responses which students have consented (offered) to be made visible to all. This is done by providing a button “Mark as Sample” or “Remove as Sample”. Responses without consent will not have any button.

These HTML changes appear in views/popup/team_users_popup.html.haml
<pre>
if instance_variable_get('@sample_button_'+round.to_s)
%div{:class=>'col-md-12 mark-delete-sample '+'round'+round.to_s}
%h3{:class=>'col-md-10'} "Reviewed by #{User.find(@reviewer_id).fullname} (Round #{round})"
%div{:class=>'col-md-2'}

%button{:class=>'col-md-12 mark-unmark-sample-button '+instance_variable_get('@mark_as_sample_'+round.to_s),
:data=>{'visibility':2, 'response_id':instance_variable_get('@response_id_round_' + round.to_s),'round':round} } Mark as Sample
%button{:class=>'col-md-12 mark-unmark-sample-button '+instance_variable_get('@remove_as_sample_'+round.to_s),
:data=>{'visibility':3, 'response_id':instance_variable_get('@response_id_round_' + round.to_s),'round':round} } Remove as Sample

%span{:class=>"hide col-md-12 mark-unmark-sample-result", :id=>"mark_unmark_fail_"+round.to_s}
%span{:class=>"hide col-md-12 mark-unmark-sample-result success", :id=>"mark_unmark_success_"+round.to_s}
</pre>

Clicking on “Mark as Sample” or “Unmark as Sample” changes the visibility of the response to 2 or 3 respectively. Like case 1 mentioned above, this is another situation where the visibility needs to be updated when there is a page event.

Both these cases are event-based and require to make an HTTP request from the browser and handle the response while staying on the same page. Therefore, according to standard practice, an AJAX request must be initiated on click of the button or checkbox. The request needs two parameters - response id, and the updated value of visibility. User-identifying data is sent by default in HTTP header cookies (as in any usual HTTP request).

To handle these requests, we have created a sample_reviews controller with a method update_visibility. Within the method, we first check whether the request parameters are valid, and then proceed to check whether the current user (identified by session id) should be allowed to edit the response object to the visibility value passed in the request.

We have validated requests in this manner since HTTP is stateless and requests can easily be cloned (a browser need not be the only client making requests). For example, one could simply copy the request as a cURL, change the session id in the HTTP header to a student’s session, and pass alternative values of visibility (say 2, meaning, approved as a sample) in the request. Such requests should be identified as unauthorized requests, while requests which want to update visibility to a value that’s not allowed need to be rejected as bad requests.

<pre>
def update_visibility
begin
visibility = params[:visibility] #response object consists of visibility in string format
if(visibility.nil?)
raise StandardError.new("Missing parameter 'visibility'")
end
visibility = visibility.to_i

if not (_private..rejected_as_sample).include? visibility
raise StandardError.new("Invalid value for parameter 'visibility'")
end
@@response_id = params[:id]
response_map_id = Response.find(@@response_id).map_id
response_map = ResponseMap.find(response_map_id)
assignment_id = response_map.reviewed_object_id
is_admin = [Role.administrator.id,Role.superadministrator.id].include? current_user.role.id
if is_admin
Response.update(@@response_id.to_i, :visibility => visibility)
update_similar_assignment(assignment_id, visibility)
render json:{"success" => true}
return
end
course_id = Assignment.find(assignment_id).course_id
instructor_id = Course.find(course_id).instructor_id
ta_ids = []
if current_user.role.id == Role.ta.id
ta_ids = TaMapping.where(course_id).ids # do this query only if current user is ta
elsif current_user.role.id == Role.student.id
# find if this student id is the same as the response reviewer id
# and that visiblity is 0 or 1 and nothing else.
# if anything fails, return failure
if visibility > in_review
render json:{"success" => false, "error"=>"Not allowed"}
return
end
reviewer_user_id = AssignmentParticipant.find(response_map.reviewer_id).user_id
if reviewer_user_id != current_user.id
render json:{"success" => false,"error" => "Unathorized"}
return
end

elsif not ([instructor_id] + ta_ids).include? current_user.id
render json:{"success" => false,"error" => "Unathorized"}
return
end
Response.update(@@response_id.to_i, :visibility => visibility)
update_similar_assignment(assignment_id, visibility)
rescue StandardError => e
render json:{"success" => false,"error" => e.message}
else
render json:{"success" => true}
end
end

</pre>

We have provided a success or error message text below the button to indicate to the user that the request is completed.

[[file: Mark unmark picssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss]]

We have used the same request mark_unmark/:id with POST data as {“visibility”:x}, in the student view as well.

This project also required that assignments be linked to each other, as explained in the sections above. To this end, we have created a controller, model, and a migration (to create the database table) for similar assignments.

By default, every assignment is similar to itself (assume it’s id is X). So, after updating a response’s visibility, we add a new entry in the similar_assignments table: (assignment_id = X, similar_for = X, association_intent = “Review”). This addition is done only after confirming for non-existence, as one can infer from the following code snippet:

<pre>
private
def update_similar_assignment(assignment_id, visibility)
if visibility == approved_as_sample
ids = SimilarAssignment.where(:is_similar_for => assignment_id, :association_intent => intent_review,
:assignment_id => assignment_id).ids
if ids.empty?
SimilarAssignment.create({:is_similar_for => assignment_id, :association_intent => intent_review,
:assignment_id => assignment_id})
end
end
if visibility == rejected_as_sample or visibility == _private
response_map_ids = ResponseMap.where(:reviewed_object_id => assignment_id).ids
response_ids = Response.where(:map_id => response_map_ids, :visibility => approved_as_sample)
if response_ids.empty?
SimilarAssignment.where(:assignment_id => assignment_id).destroy_all
end
end
end
</pre>

The power user visits a review response page expecting to mark some reviews as samples and then link or unlink the assignment associated with the review to his / her other assignments. To provide the linking functionality, we have provided a clickable text “ Use as Samples for More Assignments” at the top right corner of the page as shown below.

[[for use as sample for more assignment]]

The appearance or non-appearance of this text is conditional. It only appears when there is at least one sample review for the current assignment. So, to decide this, we have queried for those assignments for which this assignment is a similar one, and checked on the size of the query result. The size is then checked in popup_controller to set an instance variable popup_show to a boolean value. The view uses this to render or not render the clickable “Use as Samples for More Assignments” text.

Code snippet of get_similar_assignment_ids
<pre>
def get_similar_assignment_ids(assignment_id)
SimilarAssignment.where(:assignment_id => assignment_id).pluck(:is_similar_for)
end
</pre>

Code snippet of popup_controller line 84
<pre>
@page_size = popup_page_size
</pre>

On click of this text, we open a popup that lists out (with a checkbox alongside each list entry) the candidate assignments that this assignment can be similar for (these are unchecked), and assignments that it is already similar for (these are checked). For example, assume that the power user is viewing the response page of assignment X. Assume we have entries (X,Y,”review”) and (X,Z,”review”) in similar_assignments table. Then, the popup list will have the assignments Y and Z with a checkbox against each of them ticked, and all the other assignments that the current user has access to, with a checkbox against each of them unticked.

The popup and the data that go with it are fetched on demand. So, the assignment list need not be a part of the first render of the page itself, as the inherent querying would slow down page load time. Therefore, on click, we fetch the list by an AJAX request (we have given appropriate error messages below the clickable text for the rare eventuality of any server-side error or empty response).

This request GET “/similar_assignments/:id” is again authenticated in similar_assignments_controller, get method. Same validation ideas as explained earlier are used. Only the assignment’s course instructor and TAs, admin, and super-admin should be able to fetch this data, while others need not have access to it.

Code snippet of get method
<pre>
# GET /similar_assignments/:id
def get
@assignment_id = params[:id]
ids = Response.joins("INNER JOIN response_maps ON response_maps.id = responses.map_id
WHERE visibility=2 AND reviewed_object_id ="+@assignment_id.to_s).ids
if ids.empty?
render json: {"success"=>false, "error"=>"Please mark atleast one review as sample"}
return
end
begin
if current_user.role.id == Role.student.id
throw Exception.new
end
@similar_assignments = SimilarAssignment.where(:assignment_id => @assignment_id).
where.not(:is_similar_for=>@assignment_id).order("created_at DESC").pluck(:is_similar_for)
rescue ActiveRecord::RecordNotFound => e
render json: {"success" => false, "error" => "Resource not found"}
rescue Exception
render json: {"success" => false, "error" => "Unauthorized"}
else
@res = get_asssignments_set(@similar_assignments)
render json: {"success" => true, "values" => @res}
end
end
</pre>

The get method fetches similar assignment ids and passes them on to get_asssignments_set of similar_assignments_helper. This method queries for all assignments (except the ones passed in its parameter list) that the current user is allowed to access and returns a list of hash objects which are used by the caller (the on-success function of the AJAX request). Each hash object contains assignment name, id, it’s course name, and whether it’s a similar assignment or not. Following code snippets demonstrates this:

Code snippet of get_asssignments_set method
<pre>
def get_asssignments_set(selected)
all_assignments = get_assignments_based_on_role
assignment_array = []
courses = get_courses_based_on_role
all_assignments.each {
|assignment|
course_id = assignment.course_id
if(course_id.nil?)
next
end
if (selected.include? assignment.id)
hash1 = {:title => assignment.name, :course_name => courses[course_id], :checked => true, :id => assignment.id}
assignment_array.push(hash1)
else
hash2 = {:title => assignment.name, :course_name => courses[course_id], :checked => false, :id => assignment.id}
assignment_array.push(hash2)
end
}
return assignment_array
end
</pre>

Code snippet of get_assignments_based_on_role method

<pre>
def get_assignments_based_on_role()
role = current_user.role.id
page = params[:page]
assignment_id = params[:id].to_i
if page.nil?
page = 0
end
_offset = page.to_i * popup_page_size
case role
when Role.ta.id
course_ids = TaMapping.where(:ta_id => current_user.id).pluck(:course_id)
@all_assignments = Assignment.where(:course_id => course_ids).
where.not(:id=>assignment_id).limit(popup_page_size).offset(_offset).order("created_at DESC")
when Role.instructor.id
course_ids = Course.where(:instructor_id => current_user.id).pluck(:id)
@all_assignments = Assignment.where(:course_id => course_ids).
where.not(:id=>assignment_id).limit(popup_page_size).offset(_offset).order("created_at DESC")
else
@all_assignments = []
end
@all_assignments
end
</pre>

The query result can be prohibitively large. This calls for pagination.

Pagination at the server side is about performing the same query as a non-pagination implementation, with an addition: limit and offset. Limit denotes the size of a page, and offset denotes a start index, and is calculated as page size * page number. Page size is a constant defined in similar_assignments_constants.

We had two options for response and rendering:
Construct the popup list HTML from the query results and respond with this HTML.
Respond with JSON, and build the HTML client side.

Responding with HTML from server-side is expensive, as the byte size of the HTTP response would be significantly larger than JSON. Thus, we chose the second option.

Since HTTP is stateless, the server has no way to maintain a running counter of page number. Therefore, keeping track of page number must be the responsibility of the client (browser JavaScript) who must pass it as a request parameter while the server simply reads it and assumes its lack of existence as page number 0. The following snippet demonstrates this:

Snippet of response.js line 103-130
<pre>
fetchAssignments:function(){
var self = this;
var ajaxUrl = "/similar_assignments/"+assignmentId;
if(this.currentPageNumber > 0){
ajaxUrl += "?page="+this.currentPageNumber;
}
jQuery.ajax({
"url":ajaxUrl,
"type":"GET",
"dataType":"json",
"responseType":"json",
"beforeSend":function(){
self.hideSuccess();
self.hideError();
},
"success":function(result){
if(result.success && result.values.length){
self.onFetchSuccess(result.values);
}else if(result.success && self.currentPageNumber == 0){
self.onFetchFail("Cannot link this to any assignment!");
}else if(result.success){
self.onFetchSuccess(result.values);
}
else{
self.onFetchFail(result.error);
}
},
"failure": self.onFetchFail,
"error":self.onFetchFail
</pre>

We have avoided maintaining the constant value of page size once on server side (in similar_assignments_constants) and once on the client side (JS variable). The initial render of the page creates a hidden HTML element that contains the page size, and once the document is ready, response.js selects that element, reads its value into a variable, and deletes that HTML element. This prevents having a page size in the HTML page-source, and more importantly, complies with the DRY principle. Page size should be changed in one function only - and that is in similar_assignments_constants as explained earlier.

From the response JSON containing an array of objects (that are going to be rendered as list items), we have constructed the HTML list. Each list item maintains its assignment id in its HTML data attribute. The following snippet shows this.

Response.js lines 67-78
<pre>
addToList:function(assignment){
var assignmentId = assignment.id;
var title = assignment.title;
var course = assignment.course_name;
var displayText = "<strong>"+course+": </strong>" +title;
var checked = assignment.checked;
var newRow = this.template.clone();
newRow.removeClass("hide").find("input").attr("data-id",assignmentId).attr("checked",checked);
newRow.find("span").html(displayText).on("click",function(){
newRow.find("input").click();
});
this.list.append(newRow.removeAttr("id"));
},
</pre>

_________________________________________A snapshot of the popup is shown below.

The “More” button (shown in the snapshot above) is used to fetch the next set of results.

After a finite number of requests, the client receives a lesser number of results than expected. This is when pagination must stop (since there are no more results). This is achieved by the object AssignmentsPopup (in our response.js file) - it maintains the page size and current page number. The more button is now replaced by a text “No more results” and it’s on-click functionality is turned off.

______________________________________________Screenshot of popup with “No more results”

Further, we have implemented this as a plug-and-play service. By reusing the same popup HTML and the AssignmentsPopup variable, the entire popup can be made a part of any Expertiza page.

The page makes no requests on closing the popup, or on clicking Submit without checking any unchecked list item or unchecking any checked list item. It submits only if there is an overall difference in what items are checked and what are not.

Click of “Submit” makes another AJAX POST request to “/similar_assignments/create/:id” with two params in the post JSON data:
“checked” - an array of assignment ids that were checked in the list but unchecked while opening the popup
“unchecked” - an array of assignment ids that were unchecked in the list but checked while opening the popup

Either of these params may be empty, depending on the user’s actions, but not both (if both were empty, we simply close the popup without submitting). However, this optimization is only client side. Server side logic must still check for duplicates - that is, an assignment id under “checked” is already a part of similar_assignments.

Let current assignment id be X. For each of the checked assignment ids Ci in {C1,C2,...,Cn}, we have checked if there are entries (X,Ci) in similar_assignments table, and if not, then created that entry. Similarly, for each of the unchecked assignment ids Ui in {U1,U2,...,Um}, we have deleted the entry (X,Ui) from similar_assignments.

On a successful update, the client closes the popup and prints a success message.

_________________________________________________________________________________________Snapshot with success message

So far, power users have marked reviews as samples and linked assignments. Now, students need to view these samples. A student would view these sample reviews before writing their review on somebody else’s work. Therefore, we have added a link “View Sample Reviews” to view the list of sample reviews.

________________________________________________________________UI screenshot here.<pending>

Similarly, power users might also want to view samples. We have provided the same link on the following page too.

________________________________________________________________UI screenshot here

This page is rendered by the index method in sample_reviews_controller. It is a list of links to sample reviews. The layout of this page is common for users, as long as they are logged in. Non-logged-in or anonymous visitors are redirected to the Expertiza home page. ‘index’ calls a method redirect_anonymous_user in sample_reviews_helper to achieve this.

Snippet of sample_reviews_helper
<pre>
def redirect_anonymous_user
current_user = session[:user]
if current_user.nil?
redirect_to "/"
end
end
</pre>

The list of available samples has no upper bound on its size. Yet again, pagination solves this problem. But unlike the case of the popup discussed earlier, the response type differs. A request without a ‘page’ parameter in its URL is a request for the web-page and should, therefore, render HTML, while the same request URL with the ‘page’ parameter is a request for more content, and should, therefore, render JSON. The following snippet from the index method demonstrates this.

Sample_reviews_controller - index method - add the if-else just before return statement
<pre>
def index
redirect_anonymous_user
@assignment_id = params[:id].to_i
page_number = params[:page].to_i
if page_number.nil?
page_number = 0
end
@page_size = 8
similar_assignment_ids = get_similar_assignment_ids(@assignment_id)
@response_ids = []
similar_assignment_ids.each do |id|
_offset = page_number * @page_size
ids = Response.joins("INNER JOIN response_maps ON response_maps.id = responses.map_id
WHERE visibility=2 AND reviewed_object_id = "+id.to_s+
" ORDER BY responses.created_at LIMIT "+@page_size.to_s+" OFFSET "+_offset.to_s ).ids
@response_ids += ids
end
@links = generate_links(@response_ids)
if page_number == 0
@course_assignment_name = get_course_assignment_name(@assignment_id)
else
render json: {"success" => true, "sampleReviews" => @links}
end
end
</pre>

During this first render itself, we have also identified whether more results can exist. The “More” button only appears if the number of sample review links being rendered is equal to the page size, as shown in a snippet of views/sample_reviews/index.html.erb below.

Code snip of Lines 12-15
<pre>
<% if @links.size == @page_size %>
<h5 style="cursor:pointer;text-align: center;" id="more_button">More +</h5>
<% end %>
</pre>

Clicking the “More” button now makes the same request as the page’s URL, but with the parameter ‘page’. In that case, the response is JSON, which is used by the caller (JavaScript Ajax) to add more rows to the page. If the number of rows is lesser than expected, the More text is changed, its click listener is turned off, and no more requests are made, demonstrated by the snippet of sample_review.js below.

Code snip of Line 25-35
<pre>
for(var i in result.sampleReviews)
{
currentNumberOfRows++;
var review = result.sampleReviews[i];
var newRow = listTemplate.clone();
newRow.removeClass("hide").removeAttr("id").find("a").
html("Sample Review "+currentNumberOfRows).attr("href",review);
ulList.append(newRow);
}

if(responseSize < pageSize){
self.html("No more results!").off().css({"cursor":"default"});
}
else
{
pageNumber++;
}
</pre>

Each of the list items on the page is a link, which takes the user to /sample_reviews/:id. On this page, we fetch the question-answer pairs corresponding to the object having the id given in the URL and print it out in the form of a table.

== Test Plan ==
'''As a Power User (TA/Instructor/Admin/Super Admin)'''
# Log in
# Click on Manage->Assignments
# Displays list of Assignments
# Click View Report/Review for a particular assignment.
# Displays a list of reviews submitted by students.
# Click on any review in "team reviewed" column for a particular student.
# Displays the summary of reviews submitted by that student, with a "Make as sample" button on the right of every review.
# Click on "Make as sample" for the intended reviews, which opens a popup that displays a list of all assignments that are a part of the instructor's courses.
# From this list select all assignments for which the review has to be shown as a sample.
# Click on 'Submit' after selection (this closes the popup).
# Navigate to view reviews of that particular assignment and click on "Sample Reviews".
# A new page is opened that lists out all the sample reviews of the assignment.

'''As a Student'''
# Log in.
# Click on Assignments
# List of assignments is displayed.
# Click on any assignment for which the review has to be submitted.
# Assignment task page is displayed.
# Click on "Other's work" to open the reviews summary page (at /student_review).
# Below the heading "Reviews for ...", click on the "Show sample reviews" link.
# This opens a page where the student can view all sample reviews for that assignment.
# Use the browser's back button to go back to Assignment review page.
# Chose to review any of the teams' assignments that are displayed.
# Select a team for review and fill in the review.
# Before submitting the review, select the checkbox that says "I agree to share this review anonymously as an example to the entire class".
# After clicking on the submit button, the review submitted has been made public.

'''RSpec Tests'''
Below are the Rpsec tests that have been added to test the edge cases when a user tries to get access to the data using cloned requests:
# If an anonymous user tries to view the sample reviews page he/she will be redirected to home page.
# If an anonymous user tries to view the details of a particular sample review, he/she will be redirected to home page.
# If a user tries to view the sample review of a particular assignment for which there are no sample reviews, he/she will be redirected to home page.

=='''Additional Links and References'''==

#[https://github.com/expertiza/expertiza/pull/1291 Link to the Git Pull Request]
#[https://github.com/expertiza/expertiza Expertiza on GitHub]
#[https://github.com/chinmaiks/expertiza GitHub Project Repository Fork]
#[http://expertiza.ncsu.edu/ The Live Expertiza Website]

==Team==
[mailto:aagniho@ncsu.edu Amogh Agnihotri Subbanna]<br>
[mailto:ckaidab@ncsu.edu Chinmai Kaidabettu Srinivas]<br>
[mailto:smadhur@ncsu.edu Siddu Madhure Jayanna]<br>
[mailto:snaramb@ncsu.edu Suhas Naramballi Gururaja]

E1867 allow reviewer to say review can be shown to class as an example

2018-12-07T23:23:01Z

Ckaidab: /* Test Plan */

== Problem Statement ==
The objective of this project is to:
# Add a feature for students to make their reviews 'public', that is, allow other students to view them.
# Add a feature for TA to select a subset of 'public' reviews, and make those reviews visible as sample reviews of the particular assignment.
# Add a feature for Instructor to select a subset of 'public' reviews and make those reviews visible as sample reviews of any of his/her assignments in the course.
# Create a view where the student can see a list of sample reviews of the assignment and have a detailed view of each.
# Allow the student to toggle the visibility of a review he/she has submitted.

== Approach & Design ==

# Consent to make the review public - add a checkbox and an oncheck event handlers (JS) that sets a new field 'visibility' to public of Response object.
# Change the schema of Responses table (add the new column) and write db migrations.
# Create new table, model, view, controller for "similar_assignments" and validate CRUD operations that access the table.
# Add HTML (checkbox) to uncheck the consent such that the reviews becomes private again.
# On the "popup/team_users_popup" page (where instructor/TA can view all reviews), we give a checkbox against every review with public visibility to allow instructors/TAs to select one or more reviews as sample reviews to be available for students.
# Once the instructor selects and submits some reviews as sample reviews, we give a popup containing a list of assignments with a checkbox against each of them and a submit button at the end to allow instructors to make sample reviews available for multiple assignments in one go. We perform validation checks also.
# On submit of the popup, we update the similar_assignments table.
# At the top of student_reviews/list page, we give an option for the student to preview all the available sample reviews.
# Create the MVC setup for this new page to list all the sample reviews. Students will be able to click on one particular review and preview it.

'''DB Design'''

Currently, the Expertiza database design does not maintain any link between different assignments. An assignment of the current semester is completely independent of any other assignment of any other course having similar or exact objectives. For example, in a course C, the assignment named A1 in a semester Sx has no association to the same assignment given in an earlier semester Sy.

Since our task involves using reviews from the past as samples for the present, we should create this association as a new table. Further, reviews may not be the only intention to associate assignments with each other, as future requirements might require associating them on other criteria too. Thus, we find it appropriate to name the table as "similar_assignments".

The table structure is defined [http://wiki.expertiza.ncsu.edu/index.php/Similar_assignments here].

This table can be visualized as a directed graph where vertices represent assignments. An edge (u,v) with a label L means u is similar to v for the intent of association, L.

Consider a row (id = x, assignment_id = Ak, is_similar_for = An, association_intent = "review"). This means, given the intent of association as "review", assignment Ak was chosen as a similar assignment for assignment An. That is, while marking some review for An as a sample, the instructor opted to have reviews of Ak as samples for An as well.

== Implementation Details ==

==== UML - Use Case Diagram ====

[[Image:UseCase.png]]

'''Power Users:''' Instructors, TAs, Admins and Super Admins

'''More details about each point mentioned in the approach section will be updated after the implementation.'''

== Implementation ==

We have added a new column in the ‘responses’ table (in the database), namely, ‘visibility’.
Visibility can have 4 values as listed below:

{| class="wikitable"
|+ Table showing list of visibility values and the properties
! Visibility
! Properties
|-
| 0 || Response is private. This is the default value.
|-
| 1 || The response which was in the review has been approved as an example (that is, it has been marked as a sample)
|-
| 2 || The response which was in the review has been approved as an example (that is, it has been marked as a sample)
|-
| 3 || The response which was either in the review or approved earlier, has now been rejected as an example (it has been unmarked as a sample)
|-
|}

We have maintained these constants in a new file at helpers/response_constants.rb.

<pre>
module ResponseConstants
def _private
0
end

def in_review
1
end

def approved_as_sample
2
end

def rejected_as_sample
3
end
end
</pre>

In the existing implementation of reviews, when a student starts a review (but hasn’t filled any text or ratings yet), a response gets created in the database. This response has a default visibility of 0.

We have provided a checkbox (an HTML input node with attribute ‘type’ as ‘checkbox’) for the student to consent for his / her review to be used as an example, with values 0 and 1 for unchecked and checked respectively. This value is used to update the response object as part of the form submission.

However, a student might want to remove their consent or give their consent, for a review that is already submitted. So, in the page where student views his / her own response, we have added the same HTML checkbox. On checking or unchecking the checkbox, the visibility field in the corresponding response object in the database gets updated.Consider this as case 1.

Now when a power user looks at a review (at url , which is an HTML rendering of a ResponseMap containing Responses), he/she must be able to approve and reject responses which students have consented (offered) to be made visible to all. This is done by providing a button “Mark as Sample” or “Remove as Sample”. Responses without consent will not have any button.

These HTML changes appear in views/popup/team_users_popup.html.haml
<pre>
if instance_variable_get('@sample_button_'+round.to_s)
%div{:class=>'col-md-12 mark-delete-sample '+'round'+round.to_s}
%h3{:class=>'col-md-10'} "Reviewed by #{User.find(@reviewer_id).fullname} (Round #{round})"
%div{:class=>'col-md-2'}

%button{:class=>'col-md-12 mark-unmark-sample-button '+instance_variable_get('@mark_as_sample_'+round.to_s),
:data=>{'visibility':2, 'response_id':instance_variable_get('@response_id_round_' + round.to_s),'round':round} } Mark as Sample
%button{:class=>'col-md-12 mark-unmark-sample-button '+instance_variable_get('@remove_as_sample_'+round.to_s),
:data=>{'visibility':3, 'response_id':instance_variable_get('@response_id_round_' + round.to_s),'round':round} } Remove as Sample

%span{:class=>"hide col-md-12 mark-unmark-sample-result", :id=>"mark_unmark_fail_"+round.to_s}
%span{:class=>"hide col-md-12 mark-unmark-sample-result success", :id=>"mark_unmark_success_"+round.to_s}
</pre>

Clicking on “Mark as Sample” or “Unmark as Sample” changes the visibility of the response to 2 or 3 respectively. Like case 1 mentioned above, this is another situation where the visibility needs to be updated when there is a page event.

Both these cases are event-based and require to make an HTTP request from the browser and handle the response while staying on the same page. Therefore, according to standard practice, an AJAX request must be initiated on click of the button or checkbox. The request needs two parameters - response id, and the updated value of visibility. User-identifying data is sent by default in HTTP header cookies (as in any usual HTTP request).

To handle these requests, we have created a sample_reviews controller with a method update_visibility. Within the method, we first check whether the request parameters are valid, and then proceed to check whether the current user (identified by session id) should be allowed to edit the response object to the visibility value passed in the request.

We have validated requests in this manner since HTTP is stateless and requests can easily be cloned (a browser need not be the only client making requests). For example, one could simply copy the request as a cURL, change the session id in the HTTP header to a student’s session, and pass alternative values of visibility (say 2, meaning, approved as a sample) in the request. Such requests should be identified as unauthorized requests, while requests which want to update visibility to a value that’s not allowed need to be rejected as bad requests.

<pre>
def update_visibility
begin
visibility = params[:visibility] #response object consists of visibility in string format
if(visibility.nil?)
raise StandardError.new("Missing parameter 'visibility'")
end
visibility = visibility.to_i

if not (_private..rejected_as_sample).include? visibility
raise StandardError.new("Invalid value for parameter 'visibility'")
end
@@response_id = params[:id]
response_map_id = Response.find(@@response_id).map_id
response_map = ResponseMap.find(response_map_id)
assignment_id = response_map.reviewed_object_id
is_admin = [Role.administrator.id,Role.superadministrator.id].include? current_user.role.id
if is_admin
Response.update(@@response_id.to_i, :visibility => visibility)
update_similar_assignment(assignment_id, visibility)
render json:{"success" => true}
return
end
course_id = Assignment.find(assignment_id).course_id
instructor_id = Course.find(course_id).instructor_id
ta_ids = []
if current_user.role.id == Role.ta.id
ta_ids = TaMapping.where(course_id).ids # do this query only if current user is ta
elsif current_user.role.id == Role.student.id
# find if this student id is the same as the response reviewer id
# and that visiblity is 0 or 1 and nothing else.
# if anything fails, return failure
if visibility > in_review
render json:{"success" => false, "error"=>"Not allowed"}
return
end
reviewer_user_id = AssignmentParticipant.find(response_map.reviewer_id).user_id
if reviewer_user_id != current_user.id
render json:{"success" => false,"error" => "Unathorized"}
return
end

elsif not ([instructor_id] + ta_ids).include? current_user.id
render json:{"success" => false,"error" => "Unathorized"}
return
end
Response.update(@@response_id.to_i, :visibility => visibility)
update_similar_assignment(assignment_id, visibility)
rescue StandardError => e
render json:{"success" => false,"error" => e.message}
else
render json:{"success" => true}
end
end

</pre>

We have provided a success or error message text below the button to indicate to the user that the request is completed.

[[file: Mark unmark picssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss]]

We have used the same request mark_unmark/:id with POST data as {“visibility”:x}, in the student view as well.

This project also required that assignments be linked to each other, as explained in the sections above. To this end, we have created a controller, model, and a migration (to create the database table) for similar assignments.

By default, every assignment is similar to itself (assume it’s id is X). So, after updating a response’s visibility, we add a new entry in the similar_assignments table: (assignment_id = X, similar_for = X, association_intent = “Review”). This addition is done only after confirming for non-existence, as one can infer from the following code snippet:

<pre>
private
def update_similar_assignment(assignment_id, visibility)
if visibility == approved_as_sample
ids = SimilarAssignment.where(:is_similar_for => assignment_id, :association_intent => intent_review,
:assignment_id => assignment_id).ids
if ids.empty?
SimilarAssignment.create({:is_similar_for => assignment_id, :association_intent => intent_review,
:assignment_id => assignment_id})
end
end
if visibility == rejected_as_sample or visibility == _private
response_map_ids = ResponseMap.where(:reviewed_object_id => assignment_id).ids
response_ids = Response.where(:map_id => response_map_ids, :visibility => approved_as_sample)
if response_ids.empty?
SimilarAssignment.where(:assignment_id => assignment_id).destroy_all
end
end
end
</pre>

The power user visits a review response page expecting to mark some reviews as samples and then link or unlink the assignment associated with the review to his / her other assignments. To provide the linking functionality, we have provided a clickable text “ Use as Samples for More Assignments” at the top right corner of the page as shown below.

[[for use as sample for more assignment]]

The appearance or non-appearance of this text is conditional. It only appears when there is at least one sample review for the current assignment. So, to decide this, we have queried for those assignments for which this assignment is a similar one, and checked on the size of the query result. The size is then checked in popup_controller to set an instance variable popup_show to a boolean value. The view uses this to render or not render the clickable “Use as Samples for More Assignments” text.

Code snippet of get_similar_assignment_ids
<pre>
def get_similar_assignment_ids(assignment_id)
SimilarAssignment.where(:assignment_id => assignment_id).pluck(:is_similar_for)
end
</pre>

Code snippet of popup_controller line 84
<pre>
@page_size = popup_page_size
</pre>

On click of this text, we open a popup that lists out (with a checkbox alongside each list entry) the candidate assignments that this assignment can be similar for (these are unchecked), and assignments that it is already similar for (these are checked). For example, assume that the power user is viewing the response page of assignment X. Assume we have entries (X,Y,”review”) and (X,Z,”review”) in similar_assignments table. Then, the popup list will have the assignments Y and Z with a checkbox against each of them ticked, and all the other assignments that the current user has access to, with a checkbox against each of them unticked.

The popup and the data that go with it are fetched on demand. So, the assignment list need not be a part of the first render of the page itself, as the inherent querying would slow down page load time. Therefore, on click, we fetch the list by an AJAX request (we have given appropriate error messages below the clickable text for the rare eventuality of any server-side error or empty response).

This request GET “/similar_assignments/:id” is again authenticated in similar_assignments_controller, get method. Same validation ideas as explained earlier are used. Only the assignment’s course instructor and TAs, admin, and super-admin should be able to fetch this data, while others need not have access to it.

Code snippet of get method
<pre>
# GET /similar_assignments/:id
def get
@assignment_id = params[:id]
ids = Response.joins("INNER JOIN response_maps ON response_maps.id = responses.map_id
WHERE visibility=2 AND reviewed_object_id ="+@assignment_id.to_s).ids
if ids.empty?
render json: {"success"=>false, "error"=>"Please mark atleast one review as sample"}
return
end
begin
if current_user.role.id == Role.student.id
throw Exception.new
end
@similar_assignments = SimilarAssignment.where(:assignment_id => @assignment_id).
where.not(:is_similar_for=>@assignment_id).order("created_at DESC").pluck(:is_similar_for)
rescue ActiveRecord::RecordNotFound => e
render json: {"success" => false, "error" => "Resource not found"}
rescue Exception
render json: {"success" => false, "error" => "Unauthorized"}
else
@res = get_asssignments_set(@similar_assignments)
render json: {"success" => true, "values" => @res}
end
end
</pre>

The get method fetches similar assignment ids and passes them on to get_asssignments_set of similar_assignments_helper. This method queries for all assignments (except the ones passed in its parameter list) that the current user is allowed to access and returns a list of hash objects which are used by the caller (the on-success function of the AJAX request). Each hash object contains assignment name, id, it’s course name, and whether it’s a similar assignment or not. Following code snippets demonstrates this:

Code snippet of get_asssignments_set method
<pre>
def get_asssignments_set(selected)
all_assignments = get_assignments_based_on_role
assignment_array = []
courses = get_courses_based_on_role
all_assignments.each {
|assignment|
course_id = assignment.course_id
if(course_id.nil?)
next
end
if (selected.include? assignment.id)
hash1 = {:title => assignment.name, :course_name => courses[course_id], :checked => true, :id => assignment.id}
assignment_array.push(hash1)
else
hash2 = {:title => assignment.name, :course_name => courses[course_id], :checked => false, :id => assignment.id}
assignment_array.push(hash2)
end
}
return assignment_array
end
</pre>

Code snippet of get_assignments_based_on_role method

<pre>
def get_assignments_based_on_role()
role = current_user.role.id
page = params[:page]
assignment_id = params[:id].to_i
if page.nil?
page = 0
end
_offset = page.to_i * popup_page_size
case role
when Role.ta.id
course_ids = TaMapping.where(:ta_id => current_user.id).pluck(:course_id)
@all_assignments = Assignment.where(:course_id => course_ids).
where.not(:id=>assignment_id).limit(popup_page_size).offset(_offset).order("created_at DESC")
when Role.instructor.id
course_ids = Course.where(:instructor_id => current_user.id).pluck(:id)
@all_assignments = Assignment.where(:course_id => course_ids).
where.not(:id=>assignment_id).limit(popup_page_size).offset(_offset).order("created_at DESC")
else
@all_assignments = []
end
@all_assignments
end
</pre>

The query result can be prohibitively large. This calls for pagination.

Pagination at the server side is about performing the same query as a non-pagination implementation, with an addition: limit and offset. Limit denotes the size of a page, and offset denotes a start index, and is calculated as page size * page number. Page size is a constant defined in similar_assignments_constants.

We had two options for response and rendering:
Construct the popup list HTML from the query results and respond with this HTML.
Respond with JSON, and build the HTML client side.

Responding with HTML from server-side is expensive, as the byte size of the HTTP response would be significantly larger than JSON. Thus, we chose the second option.

Since HTTP is stateless, the server has no way to maintain a running counter of page number. Therefore, keeping track of page number must be the responsibility of the client (browser JavaScript) who must pass it as a request parameter while the server simply reads it and assumes its lack of existence as page number 0. The following snippet demonstrates this:

Snippet of response.js line 103-130
<pre>
fetchAssignments:function(){
var self = this;
var ajaxUrl = "/similar_assignments/"+assignmentId;
if(this.currentPageNumber > 0){
ajaxUrl += "?page="+this.currentPageNumber;
}
jQuery.ajax({
"url":ajaxUrl,
"type":"GET",
"dataType":"json",
"responseType":"json",
"beforeSend":function(){
self.hideSuccess();
self.hideError();
},
"success":function(result){
if(result.success && result.values.length){
self.onFetchSuccess(result.values);
}else if(result.success && self.currentPageNumber == 0){
self.onFetchFail("Cannot link this to any assignment!");
}else if(result.success){
self.onFetchSuccess(result.values);
}
else{
self.onFetchFail(result.error);
}
},
"failure": self.onFetchFail,
"error":self.onFetchFail
</pre>

We have avoided maintaining the constant value of page size once on server side (in similar_assignments_constants) and once on the client side (JS variable). The initial render of the page creates a hidden HTML element that contains the page size, and once the document is ready, response.js selects that element, reads its value into a variable, and deletes that HTML element. This prevents having a page size in the HTML page-source, and more importantly, complies with the DRY principle. Page size should be changed in one function only - and that is in similar_assignments_constants as explained earlier.

From the response JSON containing an array of objects (that are going to be rendered as list items), we have constructed the HTML list. Each list item maintains its assignment id in its HTML data attribute. The following snippet shows this.

Response.js lines 67-78
<pre>
addToList:function(assignment){
var assignmentId = assignment.id;
var title = assignment.title;
var course = assignment.course_name;
var displayText = "<strong>"+course+": </strong>" +title;
var checked = assignment.checked;
var newRow = this.template.clone();
newRow.removeClass("hide").find("input").attr("data-id",assignmentId).attr("checked",checked);
newRow.find("span").html(displayText).on("click",function(){
newRow.find("input").click();
});
this.list.append(newRow.removeAttr("id"));
},
</pre>

_________________________________________A snapshot of the popup is shown below.

The “More” button (shown in the snapshot above) is used to fetch the next set of results.

After a finite number of requests, the client receives a lesser number of results than expected. This is when pagination must stop (since there are no more results). This is achieved by the object AssignmentsPopup (in our response.js file) - it maintains the page size and current page number. The more button is now replaced by a text “No more results” and it’s on-click functionality is turned off.

______________________________________________Screenshot of popup with “No more results”

Further, we have implemented this as a plug-and-play service. By reusing the same popup HTML and the AssignmentsPopup variable, the entire popup can be made a part of any Expertiza page.

The page makes no requests on closing the popup, or on clicking Submit without checking any unchecked list item or unchecking any checked list item. It submits only if there is an overall difference in what items are checked and what are not.

Click of “Submit” makes another AJAX POST request to “/similar_assignments/create/:id” with two params in the post JSON data:
“checked” - an array of assignment ids that were checked in the list but unchecked while opening the popup
“unchecked” - an array of assignment ids that were unchecked in the list but checked while opening the popup

Either of these params may be empty, depending on the user’s actions, but not both (if both were empty, we simply close the popup without submitting). However, this optimization is only client side. Server side logic must still check for duplicates - that is, an assignment id under “checked” is already a part of similar_assignments.

Let current assignment id be X. For each of the checked assignment ids Ci in {C1,C2,...,Cn}, we have checked if there are entries (X,Ci) in similar_assignments table, and if not, then created that entry. Similarly, for each of the unchecked assignment ids Ui in {U1,U2,...,Um}, we have deleted the entry (X,Ui) from similar_assignments.

On a successful update, the client closes the popup and prints a success message.

_________________________________________________________________________________________Snapshot with success message

So far, power users have marked reviews as samples and linked assignments. Now, students need to view these samples. A student would view these sample reviews before writing their review on somebody else’s work. Therefore, we have added a link “View Sample Reviews” to view the list of sample reviews.

________________________________________________________________UI screenshot here.<pending>

Similarly, power users might also want to view samples. We have provided the same link on the following page too.

________________________________________________________________UI screenshot here

This page is rendered by the index method in sample_reviews_controller. It is a list of links to sample reviews. The layout of this page is common for users, as long as they are logged in. Non-logged-in or anonymous visitors are redirected to the Expertiza home page. ‘index’ calls a method redirect_anonymous_user in sample_reviews_helper to achieve this.

Snippet of sample_reviews_helper
<pre>
def redirect_anonymous_user
current_user = session[:user]
if current_user.nil?
redirect_to "/"
end
end
</pre>

The list of available samples has no upper bound on its size. Yet again, pagination solves this problem. But unlike the case of the popup discussed earlier, the response type differs. A request without a ‘page’ parameter in its URL is a request for the web-page and should, therefore, render HTML, while the same request URL with the ‘page’ parameter is a request for more content, and should, therefore, render JSON. The following snippet from the index method demonstrates this.

Sample_reviews_controller - index method - add the if-else just before return statement
<pre>
def index
redirect_anonymous_user
@assignment_id = params[:id].to_i
page_number = params[:page].to_i
if page_number.nil?
page_number = 0
end
@page_size = 8
similar_assignment_ids = get_similar_assignment_ids(@assignment_id)
@response_ids = []
similar_assignment_ids.each do |id|
_offset = page_number * @page_size
ids = Response.joins("INNER JOIN response_maps ON response_maps.id = responses.map_id
WHERE visibility=2 AND reviewed_object_id = "+id.to_s+
" ORDER BY responses.created_at LIMIT "+@page_size.to_s+" OFFSET "+_offset.to_s ).ids
@response_ids += ids
end
@links = generate_links(@response_ids)
if page_number == 0
@course_assignment_name = get_course_assignment_name(@assignment_id)
else
render json: {"success" => true, "sampleReviews" => @links}
end
end
</pre>

During this first render itself, we have also identified whether more results can exist. The “More” button only appears if the number of sample review links being rendered is equal to the page size, as shown in a snippet of views/sample_reviews/index.html.erb below.

Code snip of Lines 12-15
<pre>
<% if @links.size == @page_size %>
<h5 style="cursor:pointer;text-align: center;" id="more_button">More +</h5>
<% end %>
</pre>

Clicking the “More” button now makes the same request as the page’s URL, but with the parameter ‘page’. In that case, the response is JSON, which is used by the caller (JavaScript Ajax) to add more rows to the page. If the number of rows is lesser than expected, the More text is changed, its click listener is turned off, and no more requests are made, demonstrated by the snippet of sample_review.js below.

Code snip of Line 25-35
<pre>
for(var i in result.sampleReviews)
{
currentNumberOfRows++;
var review = result.sampleReviews[i];
var newRow = listTemplate.clone();
newRow.removeClass("hide").removeAttr("id").find("a").
html("Sample Review "+currentNumberOfRows).attr("href",review);
ulList.append(newRow);
}

if(responseSize < pageSize){
self.html("No more results!").off().css({"cursor":"default"});
}
else
{
pageNumber++;
}
</pre>

Each of the list items on the page is a link, which takes the user to /sample_reviews/:id. On this page, we fetch the question-answer pairs corresponding to the object having the id given in the URL and print it out in the form of a table.

== Test Plan ==
'''As a Power User (TA/Instructor/Admin/Super Admin)'''
# Log in
# Click on Manage->Assignments
# Displays list of Assignments
# Click View Report/Review for a particular assignment.
# Displays a list of reviews submitted by students.
# Click on any review in "team reviewed" column for a particular student.
# Displays the summary of reviews submitted by that student, with a "Make as sample" button on the right of every review.
# Click on "Make as sample" for the intended reviews, which opens a popup that displays a list of all assignments that are a part of the instructor's courses.
# From this list select all assignments for which the review has to be shown as a sample.
# Click on 'Submit' after selection (this closes the popup).
# Navigate to view reviews of that particular assignment and click on "Sample Reviews".
# A new page is opened that lists out all the sample reviews of the assignment.

'''As a Student'''
# Log in.
# Click on Assignments
# List of assignments is displayed.
# Click on any assignment for which the review has to be submitted.
# Assignment task page is displayed.
# Click on "Other's work" to open the reviews summary page (at /student_review).
# Below the heading "Reviews for ...", click on the "Show sample reviews" link.
# This opens a page where the student can view all sample reviews for that assignment.
# Use the browser's back button to go back to Assignment review page.
# Chose to review any of the teams' assignments that are displayed.
# Select a team for review and fill in the review.
# Before submitting the review, select the checkbox that says "I agree to share this review anonymously as an example to the entire class".
# After clicking on the submit button, the review submitted has been made public.

'''RSpec Tests'''
Rpsec tests have been added to test the following edge cases where an user tries to get access to the data using cloned requests:
# If an anonymous user tries to view the sample reviews page he/she will be redirected to home page.
# If an anonymous user tries to view the details of a particular sample review, he/she will be redirected to home page.
# If a user tries to view the sample review of a particular assignment for which there are no sample reviews, he/she will be redirected to home page.

=='''Additional Links and References'''==

#[https://github.com/expertiza/expertiza/pull/1291 Link to the Git Pull Request]
#[https://github.com/expertiza/expertiza Expertiza on GitHub]
#[https://github.com/chinmaiks/expertiza GitHub Project Repository Fork]
#[http://expertiza.ncsu.edu/ The Live Expertiza Website]

==Team==
[mailto:aagniho@ncsu.edu Amogh Agnihotri Subbanna]<br>
[mailto:ckaidab@ncsu.edu Chinmai Kaidabettu Srinivas]<br>
[mailto:smadhur@ncsu.edu Siddu Madhure Jayanna]<br>
[mailto:snaramb@ncsu.edu Suhas Naramballi Gururaja]

E1867 allow reviewer to say review can be shown to class as an example

2018-11-20T18:06:51Z

Ckaidab: /* Below are the changes we intend to make: */

E1867 allow reviewer to say review can be shown to class as an example

2018-11-20T18:06:18Z

Ckaidab: /* Below are the changes we intend to make: */

E1867 allow reviewer to say review can be shown to class as an example

2018-11-20T18:05:57Z

Ckaidab: /* Below are the changes we intend to make: */

E1867 allow reviewer to say review can be shown to class as an example

2018-11-20T18:05:37Z

Ckaidab: /* Below are the changes we intend to make: */

E1867 allow reviewer to say review can be shown to class as an example

2018-11-20T18:03:50Z

Ckaidab: /* Below are the changes we intend to make: */

E1867 allow reviewer to say review can be shown to class as an example

2018-11-20T18:03:24Z

Ckaidab: /* Below are the changes we intend to make: */

E1867 allow reviewer to say review can be shown to class as an example

2018-11-20T18:02:54Z

Ckaidab: /* Test Plan */

E1867 allow reviewer to say review can be shown to class as an example

2018-11-20T16:57:14Z

Ckaidab: /* Implementation Details */

E1867 allow reviewer to say review can be shown to class as an example

2018-11-20T16:56:47Z

Ckaidab: /* Implementation Details */

E1867 allow reviewer to say review can be shown to class as an example

2018-11-20T16:53:54Z

Ckaidab: /* Test Plan */

E1867 allow reviewer to say review can be shown to class as an example

2018-11-20T16:53:37Z

Ckaidab: /* Expected Flow */

E1867 allow reviewer to say review can be shown to class as an example

2018-11-20T16:52:40Z

Ckaidab: /*Removing Introduction as it is nit required*/

E1867 allow reviewer to say review can be shown to class as an example

2018-11-16T04:30:37Z

Ckaidab: /* Project Tasks */

== Introduction ==
[http://expertiza.ncsu.edu/ Expertiza] is a web based open source peer reviewing tool developed and maintained by current and past students of [https://en.wikipedia.org/wiki/North_Carolina_State_University North Carolina State University]. Peer review is a great way for a student to learn how to approach a project and get ideas for their own projects. Currently, there is no way for a student to view another student's work, unless they are reviewing the other student's work.

== Problem Statement ==
The objective of this project is to:
# Add a feature for students to make their reviews 'public', that is, allow other students to view them.
# Add a feature for TA to select a subset of 'public' reviews, and make those reviews visible as sample reviews of the particular assignment.
# Add a feature for Instructor to select a subset of 'public' reviews and make those reviews visible as sample reviews of any of his/her assignments in the course.
# Create a view where the student can see a list of sample reviews of the assignment and have a detailed view of each.
# Allow the student to toggle the visibility of a review he/she has submitted.

== Expected Flow ==
'''As a TA / Instructor'''
# Log in
# Click on Manage->Assignments
# Displays list of Assignments
# Click View Report/Review for a particular assignment.
# Displays a list of reviews submitted by students.
# Click on any review in "team reviewed" column for a particular student.
# Displays the summary of reviews submitted by that student.
# Click on "Make as sample" for the intended reviews, which opens a popup that displays a list of all assignments that are a part of the instructor's courses.
# From this list select all assignments for which the review has to be shown as a sample.
# Click on 'Submit' after selection (this closes the popup).
# Navigate to view reviews of that particular assignment and click on "Sample Reviews".
# A new page is opened that lists out all the sample reviews of the assignment.

'''As a Student'''
# Log in.
# Click on Assignments
# List of assignments is displayed.
# Click on any assignment for which the review has to be submitted.
# Assignment description is displayed.
# Click on "Other's work" to submit review for other's work.
# At this point student can click on "Show sample reviews" to view all sample reviews for that assignment.
# On clicking this, it will display all the sample reviews.
# Student can click on back to go back to Assignment description page.
# Student can chose to review any of the team's assignment that is displayed.
# Student selects a team for review and fills in the review.
# Before submitting the review, student can select the check box that says "I agree to share this review anonymously as an example to the entire class".
# After clicking on the submit button, the review submitted by the student has been made public.

== Approach ==

# Consent to make the review public - add a checkbox and an oncheck event handlers (JS) that sets a new field 'visibility' to public of Response object.
# Change the schema of Responses table (add the new column) and write db migrations.
# Create new table, model, view, controller for similar_assignments and validate CRUD operations that access the table.
# Add HTML (checkbox) to uncheck the consent such that the reviews becomes private again.
# On the "popup/team_users_popup" page (where instructor/TA can view all reviews), give a checkbox against every review with public visibility to allow instructors/TAs to select one or more reviews as sample reviews to be available for students.
# Once the instructor selects and submits some reviews as sample reviews, give a popup with a list of assignments with a checkbox against each and a submit button to allow instructors to make sample reviews available for multiple assignments in one go. Add validation checks also.
# On submit of the popup, update the similar_assignments table.
# At the top of student_reviews/list page, give an option for the student to preview all the available sample reviews.
# Create the MVC setup for this new page to list all the sample reviews. Students should be able to click on one particular review to preview it.

== Implementation Details ==

'''UML - Use Case Diagram'''

[[Image:Use_Case_Dia.png]]

'''Other details will be updated after the implementation'''

== Test Plan ==

'''To be updated'''

=='''Additional Links and References'''==

#[https://github.com/expertiza/expertiza/pull/1291 Link to the Git Pull Request]
#[https://github.com/expertiza/expertiza Expertiza on GitHub]
#[https://github.com/chinmaiks/expertiza GitHub Project Repository Fork]
#[http://expertiza.ncsu.edu/ The Live Expertiza Website]

==Team==
[mailto:aagniho@ncsu.edu Amogh Agnihotri Subbanna]<br>
[mailto:ckaidab@ncsu.edu Chinmai Kaidabettu Srinivas]<br>
[mailto:smadhur@ncsu.edu Siddu Madhure Jayanna]<br>
[mailto:snaramb@ncsu.edu Suhas Naramballi Gururaja]

E1867 allow reviewer to say review can be shown to class as an example

2018-11-14T04:09:00Z

Ckaidab: /* Expected Flow */

== Introduction ==
[http://expertiza.ncsu.edu/ Expertiza] is a web based open source peer reviewing tool developed and maintained by current and past students of [https://en.wikipedia.org/wiki/North_Carolina_State_University North Carolina State University]. Peer review is a great way for a student to learn how to approach a project and get ideas for their own projects. Currently, there is no way for a student to view another student's work, unless they are reviewing the other student's work.

== Problem Statement ==
The objective of this project is to:
# Add a feature for students to make their reviews 'public', that is, allow other students to view them.
# Add a feature for TA to select a subset of 'public' reviews, and make those reviews visible as sample reviews of the particular assignment.
# Add a feature for Instructor to select a subset of 'public' reviews and make those reviews visible as sample reviews of any of his/her assignments in the course.
# Create a view where the student can see a list of sample reviews of the assignment and have a detailed view of each.
# Allow the student to toggle the visibility of a review he/she has submitted.

== Expected Flow ==
'''As a TA / Instructor'''
# Log in
# Click on Manage->Assignments
# Displays list of Assignments
# Click View Report/Review for a particular assignment.
# Displays a list of reviews submitted by students.
# Click on any review in "team reviewed" column for a particular student.
# Displays the summary of reviews submitted by that student.
# Click on "Make as sample" for the intended reviews, which opens a popup that displays a list of all assignments that are a part of the instructor's courses.
# From this list select all assignments for which the review has to be shown as a sample.
# Click on 'Submit' after selection (this closes the popup).
# Navigate to view reviews of that particular assignment and click on "Sample Reviews".
# A new page is opened that lists out all the sample reviews of the assignment.

'''As a Student'''
# Log in.
# Click on Assignments
# List of assignments is displayed.
# Click on any assignment for which the review has to be submitted.
# Assignment description is displayed.
# Click on "Other's work" to submit review for other's work.
# At this point student can click on "Show sample reviews" to view all sample reviews for that assignment.
# On clicking this, it will display all the sample reviews.
# Student can click on back to go back to Assignment description page.
# Student can chose to review any of the team's assignment that is displayed.
# Student selects a team for review and fills in the review.
# Before submitting the review, student can select the check box that says "I agree to share this review anonymously as an example to the entire class".
# After clicking on the submit button, the review submitted by the student has been made public.

== Project Tasks ==

# Consent to make the review public - add a checkbox and an oncheck event handlers (JS) that sets a new field 'visibility' to public of Response object

# Change the schema of Responses table (add the new column) and write db migrations.

# Create new table, model, view, controller for similar_assignments and validate CRUD operations that access the table.

# Add HTML (checkbox) to uncheck the consent such that the reviews becomes private.

# On the "popup/team_users_popup" page (where instructor/TA can view all reviews), for all reviews with public visibility set, add a button to mark a review as a sample.

# Write HTML for a popup that contains a list (of assignments) with checkboxes against each, and a submit button. Add validations for non-selection.

# Modify view for the instructor/TA to include this popup to make the review available as sample. On submit of popup, update the similar_assignments table.

# At the top of student_reviews/list page, add a link to a new page.

# Create new route, model, view, controller for this new page at 'student_reviews/samples?id=<assignment_id>'. Write HTML to display the list
of sample reviews.

== Implementation Details ==

'''To be updated'''

== Test Plan ==

'''To be updated'''

=='''Additional Links and References'''==

#[https://github.com/expertiza/expertiza/pull/1291 Link to the Git Pull Request]
#[https://github.com/expertiza/expertiza Expertiza on GitHub]
#[https://github.com/chinmaiks/expertiza GitHub Project Repository Fork]
#[http://expertiza.ncsu.edu/ The Live Expertiza Website]

==Team==
[mailto:aagniho@ncsu.edu Amogh Agnihotri Subbanna]<br>
[mailto:ckaidab@ncsu.edu Chinmai Kaidabettu Srinivas]<br>
[mailto:smadhur@ncsu.edu Siddu Madhure Jayanna]<br>
[mailto:snaramb@ncsu.edu Suhas Naramballi Gururaja]

E1867 allow reviewer to say review can be shown to class as an example

2018-11-14T04:07:20Z

Ckaidab: /* Expected Flow */

== Introduction ==
[http://expertiza.ncsu.edu/ Expertiza] is a web based open source peer reviewing tool developed and maintained by current and past students of [https://en.wikipedia.org/wiki/North_Carolina_State_University North Carolina State University]. Peer review is a great way for a student to learn how to approach a project and get ideas for their own projects. Currently, there is no way for a student to view another student's work, unless they are reviewing the other student's work.

== Problem Statement ==
The objective of this project is to:
# Add a feature for students to make their reviews 'public', that is, allow other students to view them.
# Add a feature for TA to select a subset of 'public' reviews, and make those reviews visible as sample reviews of the particular assignment.
# Add a feature for Instructor to select a subset of 'public' reviews and make those reviews visible as sample reviews of any of his/her assignments in the course.
# Create a view where the student can see a list of sample reviews of the assignment and have a detailed view of each.
# Allow the student to toggle the visibility of a review he/she has submitted.

== Expected Flow ==
'''As a TA / Instructor'''
# Log in
# Click on Manage->Assignments
# Displays list of Assignments
# Click View Report/Review for a particular assignment.
# Displays a list of reviews submitted by students.
# Click on any review in "team reviewed" column for a particular student.
# Displays the summary of reviews submitted by that student.
# Click on "Make as sample" for the intended reviews, which opens a popup that displays a list of all assignments that are a part of the instructor's courses.
# From this list select all assignments for which the review has to be shown as a sample.
# Click on 'Submit' after selection (this closes the popup).
# Navigate to view reviews of that particular assignment and click on "Sample Reviews".
# A new page is opened that lists out all the sample reviews of the assignment.

'''As a Student'''
# Log in.
# Click on Assignments
# List of assignments is displayed.
# Click on any assignment for which the review has to be submitted.
# Assignment description is displayed.
# Click on "Other's work" to submit review for other's work.
# At this point student can click on "Show sample reviews" to view all sample reviews for that assignment.
# On clicking this, it will display all the sample reviews.
# Student can click on back to go back to Assignment description page.
# Student can chose to review any of the team's assignment that is displayed.
# Student selects a team for review and fills in the review.
# Before submitting the review, student can select the check box that says "I agree to share this review anonymously as an example to the entire class".

== Project Tasks ==

1) Consent to make the review public - add a checkbox and an oncheck event handlers (JS) that sets a new field 'visibility' to public of Response object

2) Change the schema of Responses table (add the new column) and write db migrations.

3) Create new table, model, view, controller for similar_assignments and validate CRUD operations that access the table.

4) Add HTML (checkbox) to uncheck the consent such that the reviews becomes private.

5) On the "popup/team_users_popup" page (where instructor/TA can view all reviews), for all reviews with public visibility set, add a button to mark a review as a sample.

6) Write HTML for a popup that contains a list (of assignments) with checkboxes against each, and a submit button. Add validations for non-selection.

7) Modify view for the instructor/TA to include this popup to make the review available as sample. On submit of popup, update the similar_assignments table.

8) At the top of student_reviews/list page, add a link to a new page.

9) Create new route, model, view, controller for this new page at 'student_reviews/samples?id=<assignment_id>'. Write HTML to display the list
of sample reviews.

== Implementation Details ==

'''To be updated'''

== Test Plan ==

'''To be updated'''

=='''Additional Links and References'''==

#[https://github.com/expertiza/expertiza/pull/1291 Link to the Git Pull Request]
#[https://github.com/expertiza/expertiza Expertiza on GitHub]
#[https://github.com/chinmaiks/expertiza GitHub Project Repository Fork]
#[http://expertiza.ncsu.edu/ The Live Expertiza Website]

==Team==
[mailto:aagniho@ncsu.edu Amogh Agnihotri Subbanna]<br>
[mailto:ckaidab@ncsu.edu Chinmai Kaidabettu Srinivas]<br>
[mailto:smadhur@ncsu.edu Siddu Madhure Jayanna]<br>
[mailto:snaramb@ncsu.edu Suhas Naramballi Gururaja]

E1867 allow reviewer to say review can be shown to class as an example

2018-11-14T04:06:33Z

Ckaidab: /* Expected Flow */

== Introduction ==
[http://expertiza.ncsu.edu/ Expertiza] is a web based open source peer reviewing tool developed and maintained by current and past students of [https://en.wikipedia.org/wiki/North_Carolina_State_University North Carolina State University]. Peer review is a great way for a student to learn how to approach a project and get ideas for their own projects. Currently, there is no way for a student to view another student's work, unless they are reviewing the other student's work.

== Problem Statement ==
The objective of this project is to:
# Add a feature for students to make their reviews 'public', that is, allow other students to view them.
# Add a feature for TA to select a subset of 'public' reviews, and make those reviews visible as sample reviews of the particular assignment.
# Add a feature for Instructor to select a subset of 'public' reviews and make those reviews visible as sample reviews of any of his/her assignments in the course.
# Create a view where the student can see a list of sample reviews of the assignment and have a detailed view of each.
# Allow the student to toggle the visibility of a review he/she has submitted.

== Expected Flow ==
'''As a TA / Instructor'''
# Log in
# Click on Manage->Assignments
# Displays list of Assignments
# Click View Report/Review for a particular assignment.
# Displays a list of reviews submitted by students.
# Click on any review in "team reviewed" column for a particular student.
# Displays the summary of reviews submitted by that student.
# Click on "Make as sample" for the intended reviews, which opens a popup that displays a list of all assignments that are a part of the instructor's courses.
# From this list select all assignments for which the review has to be shown as a sample.
# Click on 'Submit' after selection (this closes the popup).
# Navigate to view reviews of that particular assignment and click on "Sample Reviews".
# A new page is opened that lists out all the sample reviews of the assignment.

During each review, there will be a checkbox that says "I agree to share this review anonymously as an example to the entire class", and students can decide to check this box or not just before they submit reviews. Behind the scenes, we need to set a "status" field to “public”of the Response object.

'''As a Student'''
# Log in.
# Click on Assignments
# List of assignments is displayed.
# Click on any assignment for which the review has to be submitted.
# Assignment description is displayed.
# Click on "Other's work" to submit review for other's work.
# At this point student can click on "Show sample reviews" to view all sample reviews for that assignment.
# On clicking this, it will display all the sample reviews.
# Student can click on back to go back to Assignment description page.
# Student can chose to review any of the team's assignment that is displayed.
# Student selects a team for review and fills in the review.
# Before submitting the review, student can

== Project Tasks ==

== Implementation Details ==

'''To be updated'''

== Test Plan ==

'''To be updated'''

=='''Additional Links and References'''==

#[https://github.com/expertiza/expertiza/pull/1291 Link to the Git Pull Request]
#[https://github.com/expertiza/expertiza Expertiza on GitHub]
#[https://github.com/chinmaiks/expertiza GitHub Project Repository Fork]
#[http://expertiza.ncsu.edu/ The Live Expertiza Website]

==Team==
[mailto:aagniho@ncsu.edu Amogh Agnihotri Subbanna]<br>
[mailto:ckaidab@ncsu.edu Chinmai Kaidabettu Srinivas]<br>
[mailto:smadhur@ncsu.edu Siddu Madhure Jayanna]<br>
[mailto:snaramb@ncsu.edu Suhas Naramballi Gururaja]

E1867 allow reviewer to say review can be shown to class as an example

2018-11-14T04:01:14Z

Ckaidab: /* Expected Flow */

E1867 allow reviewer to say review can be shown to class as an example

2018-11-14T03:54:03Z

Ckaidab: /* Expected Flow */

E1867 allow reviewer to say review can be shown to class as an example

2018-11-14T03:52:58Z

Ckaidab: /* Expected Flow */

E1867 allow reviewer to say review can be shown to class as an example

2018-11-14T03:51:48Z

Ckaidab: /* Expected Flow */

E1867 allow reviewer to say review can be shown to class as an example

2018-11-14T03:44:35Z

Ckaidab: /* Expected Flow */

E1867 allow reviewer to say review can be shown to class as an example

2018-11-14T03:43:09Z

Ckaidab: /* Expected Flow */

E1867 allow reviewer to say review can be shown to class as an example

2018-11-14T03:42:33Z

Ckaidab:

E1867 allow reviewer to say review can be shown to class as an example

2018-11-14T03:41:47Z

Ckaidab:

E1842 Issues Related To Participants

2018-11-09T21:45:41Z

Ckaidab:

This page provides a description of the Expertiza based OSS project.
__TOC__

=='''About Expertiza'''==

[http://expertiza.ncsu.edu/ Expertiza] is an open source project developed using Ruby on Rails framework.Expertiza allows the instructor to create new assignments and customize new or existing assignments.The application allows students to submit and peer-review learning objects (articles, code, web sites, etc)[1].Expertiza supports submission across various document types, including the URLs and wiki pages.

==='''Problem Statement'''===
In Expertiza, an instructor is responsible for adding a participant to his course or assignment. This makes the course material available to the participant (or student per se). Since the instructor has admin rights, he is capable of impersonating the participant. This creates a few problems. This project addresses those issues.

----
=='''Issues to be fixed'''==

Issues as described by the problem statement:

==='''Issue #536'''===
Once the instructor impersonates the participant, he/she is capable of accessing all of participant’s work, irrespective of the course or the assignment. This raises serious security concerns.
Suggested solution is to restrict the instructor to view only his coursework.

==='''Issue #1185'''===
After adding a participant, the page has to be manually refreshed to show the name of the participant on the list. This creates a bad user experience and needs to be fixed.

----

=='''Modified Files'''==

1) app/controllers/auth_controller.rb

2) app/controllers/impersonate_controller.rb

3) app/controllers/student_task_controller.rb

4) app/views/participants/add.js.erb

5) app/views/participants/_participant.html.erb

6) app/views/shared_scripts/_user_list.html.erb

----

=='''Approach taken to resolve the issues'''==

==='''Issue #536 '''===

Once the instructor or teaching assistant impersonates the participant, he/she is capable of accessing all the assignments of this participant irrespective of the course and this raises serious security concerns.
Ideally, when this happened, the system should have displayed only those assignments to which he/she is assigned as an instructor or teaching assistant.

'''This issue has been fixed by modifying the current implementations of data filtering and session/role handling features.'''

'''1. Impersonation and Session Handling:'''

Setting and resetting of all the session data associated with impersonation are handled in auth_controller.rb file.

i] After login, session[:impersonate] value is set to false by default.

session[:impersonate] = false

ii] Once the Instructor tries to impersonate any student, the following actions are performed.

a) Assign the instructor/TA data to a session variable and use this data when instructor/TA tries to switch back to their original role.
This data is used during data filtering also.

original_user = session[:super_user] || session[:user]
session[:original_user] = original_user

b) Impersonate flag is set to true and the session's user variable is set to the user data of impersonated student.

session[:impersonate] = true
session[:user] = user

iii] All the session data is cleared off when the user logs out.

session[:original_user] = nil
session[:impersonate] = nil

'''2. Data Filtering:'''

Logged in user's role data and impersonation status is used to filter the data for populating the assignments list.

This is implemented in student_task_controller.rb file:

// check if the user is impersonating as TA
def impersonating_as_ta?
original_user = session[:original_user]
ta_role = Role.where(name:['Teaching Assistant']).pluck(:id)
ta_role.include? original_user.role_id
end

// Filter and populate all the relevant data
def list
redirect_to(controller: 'eula', action: 'display') if current_user.is_new_user
session[:user] = User.find_by(id: current_user.id)
@student_tasks = StudentTask.from_user current_user
if session[:impersonate] && !impersonating_as_admin?
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.instructor_id }
if impersonating_as_ta?
ta_course_ids = TaMapping.where(:ta_id => session[:original_user].id).pluck(:course_id)
@student_tasks = @student_tasks.select {|t| ta_course_ids.include?t.assignment.course_id }
else
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.course.instructor_id }
end
end

==='''Issue #1185 '''===

The user (instructor, TA or admin) has to click the ''Add'' button on the course or assignment page to add a new participant to the course or assignment. On click of the button, the browser initiates an AJAX request and gets a response HTML representing success or failure of the action. The failure case was already handled - an error message appears at the top of the page.
On success, it was observed that, though the HTML for a new table row (representing the just added participant) was part of the response, it was not being appended properly to the page's DOM.
This is fixed by giving an '''id''' to the ''table'' HTML element, and appending the new row to its ''tbody'' element.
After appending, we must also ensure that the "Submit" button which is part of the new HTML must be functional. So, an onchange listener is added to the button element (in the file add.js.erb).

In app/views/shared_scripts/_user_list.html.erb:
<nowiki><</nowiki>table id="table_list" class="table table-striped" style="font-size: 15px"<nowiki>></nowiki>

In app/views/participants/add.js.erb
$("#table_list").find("tbody").append(
"<%= j render :partial => 'participant', :locals => {participant: @participant, :userid => @participant.user_id, :controller => 'participants'} %>");
)
$('#'.concat(student_id.toString())).change(function(){
$('#button'.concat(student_id.toString())).css("opacity",1);
});

----

=='''Test Plan'''==

==='''''Issue #536'''===

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.

2) Make ''student6400'' as the participant of that assignment and logout.

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.

14) Now suppose ''Instructor6'' logs in and impersonates the student ''student6400'', he will be able to see all the assignment details under his course i.e. all the details of the assignment that was created by ''Instructor6'' himself as well as the assignments created by his TA's.

15) Next, login as student6400 and click on assignments. The student will be able to see all the assignments of all the courses to which he/she is assigned to.

16) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

'''

== Screenshots of the flow ==
'''

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.

[[File: Instructor4 Page with Course.png]]

2) Make ''student6400'' as the participant of that assignment and logout.
[[File: Ins4 with student in course.png]]

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.
[[File:Ins6 homepage.png]]

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.
[[File: Ins6_entering_student_in_impersonate.png]]

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins6_result_after_impersonate.png]]

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.
[[File: Ins4_impersonating_6400.png]]

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins4_display_res_after_impersonate.png]]

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.
[[File: Ta_homepage.png]]

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.
[[File: TA_enters_student_impersonate.png]]

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.
[[File: TA_impersonate_res.png]]

14) Next, login as student6400 and click on assignments. The student will be able to see all the assignments of all the courses to which he/she is assigned to.

15) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.
[[File:Ins_adding_participant1.png]]

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.
[[File:Added_participant.png]]

6) This verifies the bug has been fixed.

E1842 Issues Related To Participants

2018-11-03T15:07:27Z

Ckaidab: /* Issue #1185 */

==Introduction==
==='''Problem Statement'''===
In Expertiza, an instructor is responsible for adding a participant to his course or assignment. This makes the course material available to the participant (or student per se). Since the instructor has admin rights, he is capable of impersonating the participant. This creates a few problems. This project addresses those issues.

----
=='''Issues to be fixed'''==

Issues as described by the problem statement:

==='''Issue #536'''===
Once the instructor impersonates the participant, he/she is capable of accessing all of participant’s work, irrespective of the course or the assignment. This raises serious security concerns.
Suggested solution is to restrict the instructor to view only his coursework.

==='''Issue #1185'''===
After adding a participant, the page has to be manually refreshed to show the name of the participant on the list. This creates a bad user experience and needs to be fixed.

----

=='''Modified Files'''==

1) app/controllers/auth_controller.rb

2) app/controllers/impersonate_controller.rb

3) app/controllers/student_task_controller.rb

4) app/views/participants/add.js.erb

5) app/views/participants/_participant.html.erb

6) app/views/shared_scripts/_user_list.html.erb

----

=='''Approach taken to resolve the issues'''==

==='''Issue #536 '''===

Once the instructor or teaching assistant impersonates the participant, he/she is capable of accessing all the assignments of this participant irrespective of the course and this raises serious security concerns.
Ideally, when this happened, the system should have displayed only those assignments to which he/she is assigned as an instructor or teaching assistant.

'''This issue has been fixed by modifying the current implementations of data filtering and session/role handling features.'''

'''1. Impersonation and Session Handling:'''

Setting and resetting of all the session data associated with impersonation are handled in auth_controller.rb file.

i] After login, session[:impersonate] value is set to false by default.

session[:impersonate] = false

ii] Once the Instructor tries to impersonate any student, the following actions are performed.

a) Assign the instructor/TA data to a session variable and use this data when instructor/TA tries to switch back to their original role.
This data is used during data filtering also.

original_user = session[:super_user] || session[:user]
session[:original_user] = original_user

b) Impersonate flag is set to true and the session's user variable is set to the user data of impersonated student.

session[:impersonate] = true
session[:user] = user

iii] All the session data is cleared off when the user logs out.

session[:original_user] = nil
session[:impersonate] = nil

'''2. Data Filtering:'''

Logged in user's role data and impersonation status is used to filter the data for populating the assignments list.

This is implemented in student_task_controller.rb file:

// check if the user is impersonating as TA
def impersonating_as_ta?
original_user = session[:original_user]
ta_role = Role.where(name:['Teaching Assistant']).pluck(:id)
ta_role.include? original_user.role_id
end

// Filter and populate all the relevant data
def list
redirect_to(controller: 'eula', action: 'display') if current_user.is_new_user
session[:user] = User.find_by(id: current_user.id)
@student_tasks = StudentTask.from_user current_user
if session[:impersonate] && !impersonating_as_admin?
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.instructor_id }
if impersonating_as_ta?
ta_course_ids = TaMapping.where(:ta_id => session[:original_user].id).pluck(:course_id)
@student_tasks = @student_tasks.select {|t| ta_course_ids.include?t.assignment.course_id }
else
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.course.instructor_id }
end
end

==='''Issue #1185 '''===

If a user has an assignment and a topic only then (s)he will be able to advertise for team members to join their team. If a user doesn't have a topic (s)he won't be able to advertise.
The scenario in which A, B were two users, A with a topic, B without a topic, A joins B's team but A's topic gets dropped; A,B become a team but with no topic. Such cases are now avoided as we have ensured that without first selecting a topic a user cannot advertise for team members nor can he send invitations to other users to join his team. This is done by quering in the database using inner join between tables-SignUpTopic, signed_up_teams, team_users; and checking if the user has a topic for a particular assignment. If (s)he has a topic then he'll be able to see the option for advertising for teammates.
If the assignment doesn't have a topic then the user will be able to send out team invitations.
Pseudocode representing the logic we have used to modify student_teams_helper.rb:

StudentTeamsHelper
If the concerned assignment has topics
return false if their are topics
else return true

User_Has_Topic(user_id, assignment_id)
Query the database using inner joins between SignUpTopic, signed_up_teams, team_users
rows= number of rows returned by the above query
If rows>0
return true
else
return false
Pseudocode representing the logic we have used to modify view.html.erb:

If concerned assignment does not have topics OR User_Has_Topic is true
Make Invite link visible

----

=='''Test Plan'''==

Automated tests cannot be written for this project. Automated tests will only be able to test the functionality of Rails and not the functionality of the amended files.
----
https://mymediasite.online.ncsu.edu/online/Play/3b649b16e7f7448d9d1ee79ee1448b221d
----
https://mymediasite.online.ncsu.edu/online/Play/31dcb783510c4322bcfbc894c71fbdd01d
----
==='''''Issue #536'''===

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.

2) Make ''student6400'' as the participant of that assignment and logout.

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

'''
== Screenshots of new feature ==
'''

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.
[[File: Instructor4 Page with Course.png]]

2) Make ''student6400'' as the participant of that assignment and logout.
[[File: Ins4 with student in course.png]]

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.
[[File:Ins6 homepage.png]]
4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.
[[File: Ins6_entering_student_in_impersonate.png]]

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins6_result_after_impersonate.png]]

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.
[[File: Ins4_impersonating_6400.png]]

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins4_display_res_after_impersonate.png]]

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.
[[File: Ta_homepage.png]]

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.
[[File: TA_enters_student_impersonate.png]]

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.
[[File: TA_impersonate_res.png]]

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.
[[File:Ins_adding_participant1.png]]

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.
[[File:Added_participant.png]]

6) This verifies the bug has been fixed.

File:Added participant.png

2018-11-03T15:05:57Z

Ckaidab: uploaded a new version of "File:Added participant.png"

File:Ins adding participant1.png

2018-11-03T15:04:24Z

Ckaidab:

E1842 Issues Related To Participants

2018-11-03T07:14:58Z

Ckaidab: /* Screenshots of new feature */

==Introduction==
==='''Problem Statement'''===
In Expertiza, an instructor is responsible for adding a participant to his course or assignment. This makes the course material available to the participant (or student per se). Since the instructor has admin rights, he is capable of impersonating the participant. This creates a few problems. This project addresses those issues.

----
=='''Issues to be fixed'''==

Issues as described by the problem statement:

==='''Issue #536'''===
Once the instructor impersonates the participant, he/she is capable of accessing all of participant’s work, irrespective of the course or the assignment. This raises serious security concerns.
Suggested solution is to restrict the instructor to view only his coursework.

==='''Issue #1185'''===
After adding a participant, the page has to be manually refreshed to show the name of the participant on the list. This creates a bad user experience and needs to be fixed.

----

=='''Modified Files'''==

1) app/controllers/auth_controller.rb

2) app/controllers/impersonate_controller.rb

3) app/controllers/student_task_controller.rb

4) app/views/participants/add.js.erb

5) app/views/participants/_participant.html.erb

6) app/views/shared_scripts/_user_list.html.erb

----

=='''Approach taken to resolve the issues'''==

==='''Issue #536 '''===

Once the instructor or teaching assistant impersonates the participant, he/she is capable of accessing all the assignments of this participant irrespective of the course and this raises serious security concerns.
Ideally, when this happened, the system should have displayed only those assignments to which he/she is assigned as an instructor or teaching assistant.

'''This issue has been fixed by modifying the current implementations of data filtering and session/role handling features.'''

'''1. Impersonation and Session Handling:'''

Setting and resetting of all the session data associated with impersonation are handled in auth_controller.rb file.

i] After login, session[:impersonate] value is set to false by default.

session[:impersonate] = false

ii] Once the Instructor tries to impersonate any student, the following actions are performed.

a) Assign the instructor/TA data to a session variable and use this data when instructor/TA tries to switch back to their original role.
This data is used during data filtering also.

original_user = session[:super_user] || session[:user]
session[:original_user] = original_user

b) Impersonate flag is set to true and the session's user variable is set to the user data of impersonated student.

session[:impersonate] = true
session[:user] = user

iii] All the session data is cleared off when the user logs out.

session[:original_user] = nil
session[:impersonate] = nil

'''2. Data Filtering:'''

Logged in user's role data and impersonation status is used to filter the data for populating the assignments list.

This is implemented in student_task_controller.rb file:

// check if the user is impersonating as TA
def impersonating_as_ta?
original_user = session[:original_user]
ta_role = Role.where(name:['Teaching Assistant']).pluck(:id)
ta_role.include? original_user.role_id
end

// Filter and populate all the relevant data
def list
redirect_to(controller: 'eula', action: 'display') if current_user.is_new_user
session[:user] = User.find_by(id: current_user.id)
@student_tasks = StudentTask.from_user current_user
if session[:impersonate] && !impersonating_as_admin?
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.instructor_id }
if impersonating_as_ta?
ta_course_ids = TaMapping.where(:ta_id => session[:original_user].id).pluck(:course_id)
@student_tasks = @student_tasks.select {|t| ta_course_ids.include?t.assignment.course_id }
else
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.course.instructor_id }
end
end

==='''Issue #1185 '''===

If a user has an assignment and a topic only then (s)he will be able to advertise for team members to join their team. If a user doesn't have a topic (s)he won't be able to advertise.
The scenario in which A, B were two users, A with a topic, B without a topic, A joins B's team but A's topic gets dropped; A,B become a team but with no topic. Such cases are now avoided as we have ensured that without first selecting a topic a user cannot advertise for team members nor can he send invitations to other users to join his team. This is done by quering in the database using inner join between tables-SignUpTopic, signed_up_teams, team_users; and checking if the user has a topic for a particular assignment. If (s)he has a topic then he'll be able to see the option for advertising for teammates.
If the assignment doesn't have a topic then the user will be able to send out team invitations.
Pseudocode representing the logic we have used to modify student_teams_helper.rb:

StudentTeamsHelper
If the concerned assignment has topics
return false if their are topics
else return true

User_Has_Topic(user_id, assignment_id)
Query the database using inner joins between SignUpTopic, signed_up_teams, team_users
rows= number of rows returned by the above query
If rows>0
return true
else
return false
Pseudocode representing the logic we have used to modify view.html.erb:

If concerned assignment does not have topics OR User_Has_Topic is true
Make Invite link visible

----

=='''Test Plan'''==

Automated tests cannot be written for this project. Automated tests will only be able to test the functionality of Rails and not the functionality of the amended files.
----
https://mymediasite.online.ncsu.edu/online/Play/3b649b16e7f7448d9d1ee79ee1448b221d
----
https://mymediasite.online.ncsu.edu/online/Play/31dcb783510c4322bcfbc894c71fbdd01d
----
==='''''Issue #536'''===

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.

2) Make ''student6400'' as the participant of that assignment and logout.

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

'''
== Screenshots of new feature ==
'''

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.
[[File: Instructor4 Page with Course.png]]

2) Make ''student6400'' as the participant of that assignment and logout.
[[File: Ins4 with student in course.png]]

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.
[[File:Ins6 homepage.png]]
4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.
[[File: Ins6_entering_student_in_impersonate.png]]

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins6_result_after_impersonate.png]]

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.
[[File: Ins4_impersonating_6400.png]]

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins4_display_res_after_impersonate.png]]

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.
[[File: Ta_homepage.png]]

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.
[[File: TA_enters_student_impersonate.png]]

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.
[[File: TA_impersonate_res.png]]

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

E1842 Issues Related To Participants

2018-11-03T07:13:09Z

Ckaidab: /* Screenshots of new feature */

==Introduction==
==='''Problem Statement'''===
In Expertiza, an instructor is responsible for adding a participant to his course or assignment. This makes the course material available to the participant (or student per se). Since the instructor has admin rights, he is capable of impersonating the participant. This creates a few problems. This project addresses those issues.

----
=='''Issues to be fixed'''==

Issues as described by the problem statement:

==='''Issue #536'''===
Once the instructor impersonates the participant, he/she is capable of accessing all of participant’s work, irrespective of the course or the assignment. This raises serious security concerns.
Suggested solution is to restrict the instructor to view only his coursework.

==='''Issue #1185'''===
After adding a participant, the page has to be manually refreshed to show the name of the participant on the list. This creates a bad user experience and needs to be fixed.

----

=='''Modified Files'''==

1) app/controllers/auth_controller.rb

2) app/controllers/impersonate_controller.rb

3) app/controllers/student_task_controller.rb

4) app/views/participants/add.js.erb

5) app/views/participants/_participant.html.erb

6) app/views/shared_scripts/_user_list.html.erb

----

=='''Approach taken to resolve the issues'''==

==='''Issue #536 '''===

Once the instructor or teaching assistant impersonates the participant, he/she is capable of accessing all the assignments of this participant irrespective of the course and this raises serious security concerns.
Ideally, when this happened, the system should have displayed only those assignments to which he/she is assigned as an instructor or teaching assistant.

'''This issue has been fixed by modifying the current implementations of data filtering and session/role handling features.'''

'''1. Impersonation and Session Handling:'''

Setting and resetting of all the session data associated with impersonation are handled in auth_controller.rb file.

i] After login, session[:impersonate] value is set to false by default.

session[:impersonate] = false

ii] Once the Instructor tries to impersonate any student, the following actions are performed.

a) Assign the instructor/TA data to a session variable and use this data when instructor/TA tries to switch back to their original role.
This data is used during data filtering also.

original_user = session[:super_user] || session[:user]
session[:original_user] = original_user

b) Impersonate flag is set to true and the session's user variable is set to the user data of impersonated student.

session[:impersonate] = true
session[:user] = user

iii] All the session data is cleared off when the user logs out.

session[:original_user] = nil
session[:impersonate] = nil

'''2. Data Filtering:'''

Logged in user's role data and impersonation status is used to filter the data for populating the assignments list.

This is implemented in student_task_controller.rb file:

// check if the user is impersonating as TA
def impersonating_as_ta?
original_user = session[:original_user]
ta_role = Role.where(name:['Teaching Assistant']).pluck(:id)
ta_role.include? original_user.role_id
end

// Filter and populate all the relevant data
def list
redirect_to(controller: 'eula', action: 'display') if current_user.is_new_user
session[:user] = User.find_by(id: current_user.id)
@student_tasks = StudentTask.from_user current_user
if session[:impersonate] && !impersonating_as_admin?
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.instructor_id }
if impersonating_as_ta?
ta_course_ids = TaMapping.where(:ta_id => session[:original_user].id).pluck(:course_id)
@student_tasks = @student_tasks.select {|t| ta_course_ids.include?t.assignment.course_id }
else
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.course.instructor_id }
end
end

==='''Issue #1185 '''===

If a user has an assignment and a topic only then (s)he will be able to advertise for team members to join their team. If a user doesn't have a topic (s)he won't be able to advertise.
The scenario in which A, B were two users, A with a topic, B without a topic, A joins B's team but A's topic gets dropped; A,B become a team but with no topic. Such cases are now avoided as we have ensured that without first selecting a topic a user cannot advertise for team members nor can he send invitations to other users to join his team. This is done by quering in the database using inner join between tables-SignUpTopic, signed_up_teams, team_users; and checking if the user has a topic for a particular assignment. If (s)he has a topic then he'll be able to see the option for advertising for teammates.
If the assignment doesn't have a topic then the user will be able to send out team invitations.
Pseudocode representing the logic we have used to modify student_teams_helper.rb:

StudentTeamsHelper
If the concerned assignment has topics
return false if their are topics
else return true

User_Has_Topic(user_id, assignment_id)
Query the database using inner joins between SignUpTopic, signed_up_teams, team_users
rows= number of rows returned by the above query
If rows>0
return true
else
return false
Pseudocode representing the logic we have used to modify view.html.erb:

If concerned assignment does not have topics OR User_Has_Topic is true
Make Invite link visible

----

=='''Test Plan'''==

Automated tests cannot be written for this project. Automated tests will only be able to test the functionality of Rails and not the functionality of the amended files.
----
https://mymediasite.online.ncsu.edu/online/Play/3b649b16e7f7448d9d1ee79ee1448b221d
----
https://mymediasite.online.ncsu.edu/online/Play/31dcb783510c4322bcfbc894c71fbdd01d
----
==='''''Issue #536'''===

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.

2) Make ''student6400'' as the participant of that assignment and logout.

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

'''
== Screenshots of new feature ==
'''

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.
[[File: Instructor4 Page with Course.png]]

2) Make ''student6400'' as the participant of that assignment and logout.
[[File: Ins4 with student in course.png]]

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.
[[File: Ins6 homepage.png]]

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.
[[File: Ins6_entering_student_in_impersonate.png]]

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins6_result_after_impersonate.png]]

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.
[[File: Ins4_impersonating_6400.png]]

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins4_display_res_after_impersonate.png]]

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.
[[File: Ta_homepage.png]]

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.
[[File: TA_enters_student_impersonate.png]]

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.
[[File: TA_impersonate_res.png]]

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

E1842 Issues Related To Participants

2018-11-03T07:10:20Z

Ckaidab: /* Screenshots of new feature */

==Introduction==
==='''Problem Statement'''===
In Expertiza, an instructor is responsible for adding a participant to his course or assignment. This makes the course material available to the participant (or student per se). Since the instructor has admin rights, he is capable of impersonating the participant. This creates a few problems. This project addresses those issues.

----
=='''Issues to be fixed'''==

Issues as described by the problem statement:

==='''Issue #536'''===
Once the instructor impersonates the participant, he/she is capable of accessing all of participant’s work, irrespective of the course or the assignment. This raises serious security concerns.
Suggested solution is to restrict the instructor to view only his coursework.

==='''Issue #1185'''===
After adding a participant, the page has to be manually refreshed to show the name of the participant on the list. This creates a bad user experience and needs to be fixed.

----

=='''Modified Files'''==

1) app/controllers/auth_controller.rb

2) app/controllers/impersonate_controller.rb

3) app/controllers/student_task_controller.rb

4) app/views/participants/add.js.erb

5) app/views/participants/_participant.html.erb

6) app/views/shared_scripts/_user_list.html.erb

----

=='''Approach taken to resolve the issues'''==

==='''Issue #536 '''===

Once the instructor or teaching assistant impersonates the participant, he/she is capable of accessing all the assignments of this participant irrespective of the course and this raises serious security concerns.
Ideally, when this happened, the system should have displayed only those assignments to which he/she is assigned as an instructor or teaching assistant.

'''This issue has been fixed by modifying the current implementations of data filtering and session/role handling features.'''

'''1. Impersonation and Session Handling:'''

Setting and resetting of all the session data associated with impersonation are handled in auth_controller.rb file.

i] After login, session[:impersonate] value is set to false by default.

session[:impersonate] = false

ii] Once the Instructor tries to impersonate any student, the following actions are performed.

a) Assign the instructor/TA data to a session variable and use this data when instructor/TA tries to switch back to their original role.
This data is used during data filtering also.

original_user = session[:super_user] || session[:user]
session[:original_user] = original_user

b) Impersonate flag is set to true and the session's user variable is set to the user data of impersonated student.

session[:impersonate] = true
session[:user] = user

iii] All the session data is cleared off when the user logs out.

session[:original_user] = nil
session[:impersonate] = nil

'''2. Data Filtering:'''

Logged in user's role data and impersonation status is used to filter the data for populating the assignments list.

This is implemented in student_task_controller.rb file:

// check if the user is impersonating as TA
def impersonating_as_ta?
original_user = session[:original_user]
ta_role = Role.where(name:['Teaching Assistant']).pluck(:id)
ta_role.include? original_user.role_id
end

// Filter and populate all the relevant data
def list
redirect_to(controller: 'eula', action: 'display') if current_user.is_new_user
session[:user] = User.find_by(id: current_user.id)
@student_tasks = StudentTask.from_user current_user
if session[:impersonate] && !impersonating_as_admin?
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.instructor_id }
if impersonating_as_ta?
ta_course_ids = TaMapping.where(:ta_id => session[:original_user].id).pluck(:course_id)
@student_tasks = @student_tasks.select {|t| ta_course_ids.include?t.assignment.course_id }
else
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.course.instructor_id }
end
end

==='''Issue #1185 '''===

If a user has an assignment and a topic only then (s)he will be able to advertise for team members to join their team. If a user doesn't have a topic (s)he won't be able to advertise.
The scenario in which A, B were two users, A with a topic, B without a topic, A joins B's team but A's topic gets dropped; A,B become a team but with no topic. Such cases are now avoided as we have ensured that without first selecting a topic a user cannot advertise for team members nor can he send invitations to other users to join his team. This is done by quering in the database using inner join between tables-SignUpTopic, signed_up_teams, team_users; and checking if the user has a topic for a particular assignment. If (s)he has a topic then he'll be able to see the option for advertising for teammates.
If the assignment doesn't have a topic then the user will be able to send out team invitations.
Pseudocode representing the logic we have used to modify student_teams_helper.rb:

StudentTeamsHelper
If the concerned assignment has topics
return false if their are topics
else return true

User_Has_Topic(user_id, assignment_id)
Query the database using inner joins between SignUpTopic, signed_up_teams, team_users
rows= number of rows returned by the above query
If rows>0
return true
else
return false
Pseudocode representing the logic we have used to modify view.html.erb:

If concerned assignment does not have topics OR User_Has_Topic is true
Make Invite link visible

----

=='''Test Plan'''==

Automated tests cannot be written for this project. Automated tests will only be able to test the functionality of Rails and not the functionality of the amended files.
----
https://mymediasite.online.ncsu.edu/online/Play/3b649b16e7f7448d9d1ee79ee1448b221d
----
https://mymediasite.online.ncsu.edu/online/Play/31dcb783510c4322bcfbc894c71fbdd01d
----
==='''''Issue #536'''===

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.

2) Make ''student6400'' as the participant of that assignment and logout.

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

'''
== Screenshots of new feature ==
'''

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.
[[File: Instructor4 Page with Course.png]]

2) Make ''student6400'' as the participant of that assignment and logout.
[[File: Ins4 with student in course.png]]

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.
[[File: Ins6_homepage.png]]

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.
[[File: Ins6_entering_student_in_impersonate.png]]

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins6_result_after_impersonate.png]]

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.
[[File: Ins4_impersonating_6400.png]]

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins4_display_res_after_impersonate.png]]

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.
[[File: Ta_homepage.png]]

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.
[[File: TA_enters_student_impersonate.png]]

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.
[[File: TA_impersonate_res.png]]

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

E1842 Issues Related To Participants

2018-11-03T07:08:38Z

Ckaidab: /* Screenshots of new feature */

==Introduction==
==='''Problem Statement'''===
In Expertiza, an instructor is responsible for adding a participant to his course or assignment. This makes the course material available to the participant (or student per se). Since the instructor has admin rights, he is capable of impersonating the participant. This creates a few problems. This project addresses those issues.

----
=='''Issues to be fixed'''==

Issues as described by the problem statement:

==='''Issue #536'''===
Once the instructor impersonates the participant, he/she is capable of accessing all of participant’s work, irrespective of the course or the assignment. This raises serious security concerns.
Suggested solution is to restrict the instructor to view only his coursework.

==='''Issue #1185'''===
After adding a participant, the page has to be manually refreshed to show the name of the participant on the list. This creates a bad user experience and needs to be fixed.

----

=='''Modified Files'''==

1) app/controllers/auth_controller.rb

2) app/controllers/impersonate_controller.rb

3) app/controllers/student_task_controller.rb

4) app/views/participants/add.js.erb

5) app/views/participants/_participant.html.erb

6) app/views/shared_scripts/_user_list.html.erb

----

=='''Approach taken to resolve the issues'''==

==='''Issue #536 '''===

Once the instructor or teaching assistant impersonates the participant, he/she is capable of accessing all the assignments of this participant irrespective of the course and this raises serious security concerns.
Ideally, when this happened, the system should have displayed only those assignments to which he/she is assigned as an instructor or teaching assistant.

'''This issue has been fixed by modifying the current implementations of data filtering and session/role handling features.'''

'''1. Impersonation and Session Handling:'''

Setting and resetting of all the session data associated with impersonation are handled in auth_controller.rb file.

i] After login, session[:impersonate] value is set to false by default.

session[:impersonate] = false

ii] Once the Instructor tries to impersonate any student, the following actions are performed.

a) Assign the instructor/TA data to a session variable and use this data when instructor/TA tries to switch back to their original role.
This data is used during data filtering also.

original_user = session[:super_user] || session[:user]
session[:original_user] = original_user

b) Impersonate flag is set to true and the session's user variable is set to the user data of impersonated student.

session[:impersonate] = true
session[:user] = user

iii] All the session data is cleared off when the user logs out.

session[:original_user] = nil
session[:impersonate] = nil

'''2. Data Filtering:'''

Logged in user's role data and impersonation status is used to filter the data for populating the assignments list.

This is implemented in student_task_controller.rb file:

// check if the user is impersonating as TA
def impersonating_as_ta?
original_user = session[:original_user]
ta_role = Role.where(name:['Teaching Assistant']).pluck(:id)
ta_role.include? original_user.role_id
end

// Filter and populate all the relevant data
def list
redirect_to(controller: 'eula', action: 'display') if current_user.is_new_user
session[:user] = User.find_by(id: current_user.id)
@student_tasks = StudentTask.from_user current_user
if session[:impersonate] && !impersonating_as_admin?
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.instructor_id }
if impersonating_as_ta?
ta_course_ids = TaMapping.where(:ta_id => session[:original_user].id).pluck(:course_id)
@student_tasks = @student_tasks.select {|t| ta_course_ids.include?t.assignment.course_id }
else
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.course.instructor_id }
end
end

==='''Issue #1185 '''===

If a user has an assignment and a topic only then (s)he will be able to advertise for team members to join their team. If a user doesn't have a topic (s)he won't be able to advertise.
The scenario in which A, B were two users, A with a topic, B without a topic, A joins B's team but A's topic gets dropped; A,B become a team but with no topic. Such cases are now avoided as we have ensured that without first selecting a topic a user cannot advertise for team members nor can he send invitations to other users to join his team. This is done by quering in the database using inner join between tables-SignUpTopic, signed_up_teams, team_users; and checking if the user has a topic for a particular assignment. If (s)he has a topic then he'll be able to see the option for advertising for teammates.
If the assignment doesn't have a topic then the user will be able to send out team invitations.
Pseudocode representing the logic we have used to modify student_teams_helper.rb:

StudentTeamsHelper
If the concerned assignment has topics
return false if their are topics
else return true

User_Has_Topic(user_id, assignment_id)
Query the database using inner joins between SignUpTopic, signed_up_teams, team_users
rows= number of rows returned by the above query
If rows>0
return true
else
return false
Pseudocode representing the logic we have used to modify view.html.erb:

If concerned assignment does not have topics OR User_Has_Topic is true
Make Invite link visible

----

=='''Test Plan'''==

Automated tests cannot be written for this project. Automated tests will only be able to test the functionality of Rails and not the functionality of the amended files.
----
https://mymediasite.online.ncsu.edu/online/Play/3b649b16e7f7448d9d1ee79ee1448b221d
----
https://mymediasite.online.ncsu.edu/online/Play/31dcb783510c4322bcfbc894c71fbdd01d
----
==='''''Issue #536'''===

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.

2) Make ''student6400'' as the participant of that assignment and logout.

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

'''
== Screenshots of new feature ==
'''

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.
[[File: Instructor4 Page with Course.png]]

2) Make ''student6400'' as the participant of that assignment and logout.
[[File: Ins4 with student in course.png]]

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.
[[File: Ins6_homepage_new.png]]

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.
[[File: Ins6_entering_student_in_impersonate.png]]

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins6_result_after_impersonate.png]]

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.
[[File: Ins4_impersonating_6400.png]]

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins4_display_res_after_impersonate.png]]

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.
[[File: Ta_homepage.png]]

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.
[[File: TA_enters_student_impersonate.png]]

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.
[[File: TA_impersonate_res.png]]

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

E1842 Issues Related To Participants

2018-11-03T07:07:12Z

Ckaidab: /* Screenshots of new feature */

==Introduction==
==='''Problem Statement'''===
In Expertiza, an instructor is responsible for adding a participant to his course or assignment. This makes the course material available to the participant (or student per se). Since the instructor has admin rights, he is capable of impersonating the participant. This creates a few problems. This project addresses those issues.

----
=='''Issues to be fixed'''==

Issues as described by the problem statement:

==='''Issue #536'''===
Once the instructor impersonates the participant, he/she is capable of accessing all of participant’s work, irrespective of the course or the assignment. This raises serious security concerns.
Suggested solution is to restrict the instructor to view only his coursework.

==='''Issue #1185'''===
After adding a participant, the page has to be manually refreshed to show the name of the participant on the list. This creates a bad user experience and needs to be fixed.

----

=='''Modified Files'''==

1) app/controllers/auth_controller.rb

2) app/controllers/impersonate_controller.rb

3) app/controllers/student_task_controller.rb

4) app/views/participants/add.js.erb

5) app/views/participants/_participant.html.erb

6) app/views/shared_scripts/_user_list.html.erb

----

=='''Approach taken to resolve the issues'''==

==='''Issue #536 '''===

Once the instructor or teaching assistant impersonates the participant, he/she is capable of accessing all the assignments of this participant irrespective of the course and this raises serious security concerns.
Ideally, when this happened, the system should have displayed only those assignments to which he/she is assigned as an instructor or teaching assistant.

'''This issue has been fixed by modifying the current implementations of data filtering and session/role handling features.'''

'''1. Impersonation and Session Handling:'''

Setting and resetting of all the session data associated with impersonation are handled in auth_controller.rb file.

i] After login, session[:impersonate] value is set to false by default.

session[:impersonate] = false

ii] Once the Instructor tries to impersonate any student, the following actions are performed.

a) Assign the instructor/TA data to a session variable and use this data when instructor/TA tries to switch back to their original role.
This data is used during data filtering also.

original_user = session[:super_user] || session[:user]
session[:original_user] = original_user

b) Impersonate flag is set to true and the session's user variable is set to the user data of impersonated student.

session[:impersonate] = true
session[:user] = user

iii] All the session data is cleared off when the user logs out.

session[:original_user] = nil
session[:impersonate] = nil

'''2. Data Filtering:'''

Logged in user's role data and impersonation status is used to filter the data for populating the assignments list.

This is implemented in student_task_controller.rb file:

// check if the user is impersonating as TA
def impersonating_as_ta?
original_user = session[:original_user]
ta_role = Role.where(name:['Teaching Assistant']).pluck(:id)
ta_role.include? original_user.role_id
end

// Filter and populate all the relevant data
def list
redirect_to(controller: 'eula', action: 'display') if current_user.is_new_user
session[:user] = User.find_by(id: current_user.id)
@student_tasks = StudentTask.from_user current_user
if session[:impersonate] && !impersonating_as_admin?
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.instructor_id }
if impersonating_as_ta?
ta_course_ids = TaMapping.where(:ta_id => session[:original_user].id).pluck(:course_id)
@student_tasks = @student_tasks.select {|t| ta_course_ids.include?t.assignment.course_id }
else
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.course.instructor_id }
end
end

==='''Issue #1185 '''===

If a user has an assignment and a topic only then (s)he will be able to advertise for team members to join their team. If a user doesn't have a topic (s)he won't be able to advertise.
The scenario in which A, B were two users, A with a topic, B without a topic, A joins B's team but A's topic gets dropped; A,B become a team but with no topic. Such cases are now avoided as we have ensured that without first selecting a topic a user cannot advertise for team members nor can he send invitations to other users to join his team. This is done by quering in the database using inner join between tables-SignUpTopic, signed_up_teams, team_users; and checking if the user has a topic for a particular assignment. If (s)he has a topic then he'll be able to see the option for advertising for teammates.
If the assignment doesn't have a topic then the user will be able to send out team invitations.
Pseudocode representing the logic we have used to modify student_teams_helper.rb:

StudentTeamsHelper
If the concerned assignment has topics
return false if their are topics
else return true

User_Has_Topic(user_id, assignment_id)
Query the database using inner joins between SignUpTopic, signed_up_teams, team_users
rows= number of rows returned by the above query
If rows>0
return true
else
return false
Pseudocode representing the logic we have used to modify view.html.erb:

If concerned assignment does not have topics OR User_Has_Topic is true
Make Invite link visible

----

=='''Test Plan'''==

Automated tests cannot be written for this project. Automated tests will only be able to test the functionality of Rails and not the functionality of the amended files.
----
https://mymediasite.online.ncsu.edu/online/Play/3b649b16e7f7448d9d1ee79ee1448b221d
----
https://mymediasite.online.ncsu.edu/online/Play/31dcb783510c4322bcfbc894c71fbdd01d
----
==='''''Issue #536'''===

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.

2) Make ''student6400'' as the participant of that assignment and logout.

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

'''
== Screenshots of new feature ==
'''

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.
[[File: Instructor4 Page with Course.png]]

2) Make ''student6400'' as the participant of that assignment and logout.
[[File: Ins4 with student in course.png]]

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.
[[File: Ins6_homepage.png]]

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.
[[File: Ins6_entering_student_in_impersonate.png]]

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins6_result_after_impersonate.png]]

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.
[[File: Ins4_impersonating_6400.png]]

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins4_display_res_after_impersonate.png]]

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.
[[File: Ta_homepage.png]]

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.
[[File: TA_enters_student_impersonate.png]]

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.
[[File: TA_impersonate_res.png]]

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

E1842 Issues Related To Participants

2018-11-03T07:06:22Z

Ckaidab:

==Introduction==
==='''Problem Statement'''===
In Expertiza, an instructor is responsible for adding a participant to his course or assignment. This makes the course material available to the participant (or student per se). Since the instructor has admin rights, he is capable of impersonating the participant. This creates a few problems. This project addresses those issues.

----
=='''Issues to be fixed'''==

Issues as described by the problem statement:

==='''Issue #536'''===
Once the instructor impersonates the participant, he/she is capable of accessing all of participant’s work, irrespective of the course or the assignment. This raises serious security concerns.
Suggested solution is to restrict the instructor to view only his coursework.

==='''Issue #1185'''===
After adding a participant, the page has to be manually refreshed to show the name of the participant on the list. This creates a bad user experience and needs to be fixed.

----

=='''Modified Files'''==

1) app/controllers/auth_controller.rb

2) app/controllers/impersonate_controller.rb

3) app/controllers/student_task_controller.rb

4) app/views/participants/add.js.erb

5) app/views/participants/_participant.html.erb

6) app/views/shared_scripts/_user_list.html.erb

----

=='''Approach taken to resolve the issues'''==

==='''Issue #536 '''===

Once the instructor or teaching assistant impersonates the participant, he/she is capable of accessing all the assignments of this participant irrespective of the course and this raises serious security concerns.
Ideally, when this happened, the system should have displayed only those assignments to which he/she is assigned as an instructor or teaching assistant.

'''This issue has been fixed by modifying the current implementations of data filtering and session/role handling features.'''

'''1. Impersonation and Session Handling:'''

Setting and resetting of all the session data associated with impersonation are handled in auth_controller.rb file.

i] After login, session[:impersonate] value is set to false by default.

session[:impersonate] = false

ii] Once the Instructor tries to impersonate any student, the following actions are performed.

a) Assign the instructor/TA data to a session variable and use this data when instructor/TA tries to switch back to their original role.
This data is used during data filtering also.

original_user = session[:super_user] || session[:user]
session[:original_user] = original_user

b) Impersonate flag is set to true and the session's user variable is set to the user data of impersonated student.

session[:impersonate] = true
session[:user] = user

iii] All the session data is cleared off when the user logs out.

session[:original_user] = nil
session[:impersonate] = nil

'''2. Data Filtering:'''

Logged in user's role data and impersonation status is used to filter the data for populating the assignments list.

This is implemented in student_task_controller.rb file:

// check if the user is impersonating as TA
def impersonating_as_ta?
original_user = session[:original_user]
ta_role = Role.where(name:['Teaching Assistant']).pluck(:id)
ta_role.include? original_user.role_id
end

// Filter and populate all the relevant data
def list
redirect_to(controller: 'eula', action: 'display') if current_user.is_new_user
session[:user] = User.find_by(id: current_user.id)
@student_tasks = StudentTask.from_user current_user
if session[:impersonate] && !impersonating_as_admin?
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.instructor_id }
if impersonating_as_ta?
ta_course_ids = TaMapping.where(:ta_id => session[:original_user].id).pluck(:course_id)
@student_tasks = @student_tasks.select {|t| ta_course_ids.include?t.assignment.course_id }
else
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.course.instructor_id }
end
end

==='''Issue #1185 '''===

If a user has an assignment and a topic only then (s)he will be able to advertise for team members to join their team. If a user doesn't have a topic (s)he won't be able to advertise.
The scenario in which A, B were two users, A with a topic, B without a topic, A joins B's team but A's topic gets dropped; A,B become a team but with no topic. Such cases are now avoided as we have ensured that without first selecting a topic a user cannot advertise for team members nor can he send invitations to other users to join his team. This is done by quering in the database using inner join between tables-SignUpTopic, signed_up_teams, team_users; and checking if the user has a topic for a particular assignment. If (s)he has a topic then he'll be able to see the option for advertising for teammates.
If the assignment doesn't have a topic then the user will be able to send out team invitations.
Pseudocode representing the logic we have used to modify student_teams_helper.rb:

StudentTeamsHelper
If the concerned assignment has topics
return false if their are topics
else return true

User_Has_Topic(user_id, assignment_id)
Query the database using inner joins between SignUpTopic, signed_up_teams, team_users
rows= number of rows returned by the above query
If rows>0
return true
else
return false
Pseudocode representing the logic we have used to modify view.html.erb:

If concerned assignment does not have topics OR User_Has_Topic is true
Make Invite link visible

----

=='''Test Plan'''==

Automated tests cannot be written for this project. Automated tests will only be able to test the functionality of Rails and not the functionality of the amended files.
----
https://mymediasite.online.ncsu.edu/online/Play/3b649b16e7f7448d9d1ee79ee1448b221d
----
https://mymediasite.online.ncsu.edu/online/Play/31dcb783510c4322bcfbc894c71fbdd01d
----
==='''''Issue #536'''===

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.

2) Make ''student6400'' as the participant of that assignment and logout.

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

'''
== Screenshots of new feature ==
'''

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.
[[File: Instructor4 Page with Course.png]]

2) Make ''student6400'' as the participant of that assignment and logout.
[[File: Ins4 with student in course.png]]

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.
[[File: Ins6 homepage.png]]

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.
[[File: Ins6_entering_student_in_impersonate.png]]

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins6_result_after_impersonate.png]]

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.
[[File: Ins4_impersonating_6400.png]]

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins4_display_res_after_impersonate.png]]

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.
[[File: Ta_homepage.png]]

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.
[[File: TA_enters_student_impersonate.png]]

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.
[[File: TA_impersonate_res.png]]

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

E1842 Issues Related To Participants

2018-11-03T07:04:44Z

Ckaidab: /* Screenshots of new feature */

==Introduction==
==='''Problem Statement'''===
In Expertiza, an instructor is responsible for adding a participant to his course or assignment. This makes the course material available to the participant (or student per se). Since the instructor has admin rights, he is capable of impersonating the participant. This creates a few problems. This project addresses those issues.

----
=='''Issues to be fixed'''==

Issues as described by the problem statement:

==='''Issue #536'''===
Once the instructor impersonates the participant, he/she is capable of accessing all of participant’s work, irrespective of the course or the assignment. This raises serious security concerns.
Suggested solution is to restrict the instructor to view only his coursework.

==='''Issue #1185'''===
After adding a participant, the page has to be manually refreshed to show the name of the participant on the list. This creates a bad user experience and needs to be fixed.

----

=='''Modified Files'''==

1) app/controllers/auth_controller.rb

2) app/controllers/impersonate_controller.rb

3) app/controllers/student_task_controller.rb

4) app/views/participants/add.js.erb

5) app/views/participants/_participant.html.erb

6) app/views/shared_scripts/_user_list.html.erb

----

=='''Approach taken to resolve the issues'''==

==='''Issue #536 '''===

Once the instructor or teaching assistant impersonates the participant, he/she is capable of accessing all the assignments of this participant irrespective of the course and this raises serious security concerns.
Ideally, when this happened, the system should have displayed only those assignments to which he/she is assigned as an instructor or teaching assistant.

'''This issue has been fixed by modifying the current implementations of data filtering and session/role handling features.'''

'''1. Impersonation and Session Handling:'''

Setting and resetting of all the session data associated with impersonation are handled in auth_controller.rb file.

i] After login, session[:impersonate] value is set to false by default.

session[:impersonate] = false

ii] Once the Instructor tries to impersonate any student, the following actions are performed.

a) Assign the instructor/TA data to a session variable and use this data when instructor/TA tries to switch back to their original role.
This data is used during data filtering also.

original_user = session[:super_user] || session[:user]
session[:original_user] = original_user

b) Impersonate flag is set to true and the session's user variable is set to the user data of impersonated student.

session[:impersonate] = true
session[:user] = user

iii] All the session data is cleared off when the user logs out.

session[:original_user] = nil
session[:impersonate] = nil

'''2. Data Filtering:'''

Logged in user's role data and impersonation status is used to filter the data for populating the assignments list.

This is implemented in student_task_controller.rb file:

// check if the user is impersonating as TA
def impersonating_as_ta?
original_user = session[:original_user]
ta_role = Role.where(name:['Teaching Assistant']).pluck(:id)
ta_role.include? original_user.role_id
end

// Filter and populate all the relevant data
def list
redirect_to(controller: 'eula', action: 'display') if current_user.is_new_user
session[:user] = User.find_by(id: current_user.id)
@student_tasks = StudentTask.from_user current_user
if session[:impersonate] && !impersonating_as_admin?
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.instructor_id }
if impersonating_as_ta?
ta_course_ids = TaMapping.where(:ta_id => session[:original_user].id).pluck(:course_id)
@student_tasks = @student_tasks.select {|t| ta_course_ids.include?t.assignment.course_id }
else
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.course.instructor_id }
end
end

==='''Issue #1185 '''===

If a user has an assignment and a topic only then (s)he will be able to advertise for team members to join their team. If a user doesn't have a topic (s)he won't be able to advertise.
The scenario in which A, B were two users, A with a topic, B without a topic, A joins B's team but A's topic gets dropped; A,B become a team but with no topic. Such cases are now avoided as we have ensured that without first selecting a topic a user cannot advertise for team members nor can he send invitations to other users to join his team. This is done by quering in the database using inner join between tables-SignUpTopic, signed_up_teams, team_users; and checking if the user has a topic for a particular assignment. If (s)he has a topic then he'll be able to see the option for advertising for teammates.
If the assignment doesn't have a topic then the user will be able to send out team invitations.
Pseudocode representing the logic we have used to modify student_teams_helper.rb:

StudentTeamsHelper
If the concerned assignment has topics
return false if their are topics
else return true

User_Has_Topic(user_id, assignment_id)
Query the database using inner joins between SignUpTopic, signed_up_teams, team_users
rows= number of rows returned by the above query
If rows>0
return true
else
return false
Pseudocode representing the logic we have used to modify view.html.erb:

If concerned assignment does not have topics OR User_Has_Topic is true
Make Invite link visible

----

=='''Test Plan'''==

Automated tests cannot be written for this project. Automated tests will only be able to test the functionality of Rails and not the functionality of the amended files.
----
https://mymediasite.online.ncsu.edu/online/Play/3b649b16e7f7448d9d1ee79ee1448b221d
----
https://mymediasite.online.ncsu.edu/online/Play/31dcb783510c4322bcfbc894c71fbdd01d
----
==='''''Issue #536'''===

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.

2) Make ''student6400'' as the participant of that assignment and logout.

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

'''
== Screenshots of new feature ==
'''

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.
[[File: Instructor4 Page with Course.png]]

2) Make ''student6400'' as the participant of that assignment and logout.
[[File: Ins4 with student in course.png]]

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.
[[File: Ins6 homepage.png]]

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.
[[File: entering student in impersonate.png]]

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins6_result_after_impersonate.png]]

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.
[[File: Ins4_impersonating_6400.png]]

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins4_display_res_after_impersonate.png]]

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.
[[File: Ta_homepage.png]]

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.
[[File: TA_enters_student_impersonate.png]]

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.
[[File: TA_impersonate_res.png]]

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

E1842 Issues Related To Participants

2018-11-03T07:02:51Z

Ckaidab: /* Screenshots of new feature */

==Introduction==
==='''Problem Statement'''===
In Expertiza, an instructor is responsible for adding a participant to his course or assignment. This makes the course material available to the participant (or student per se). Since the instructor has admin rights, he is capable of impersonating the participant. This creates a few problems. This project addresses those issues.

----
=='''Issues to be fixed'''==

Issues as described by the problem statement:

==='''Issue #536'''===
Once the instructor impersonates the participant, he/she is capable of accessing all of participant’s work, irrespective of the course or the assignment. This raises serious security concerns.
Suggested solution is to restrict the instructor to view only his coursework.

==='''Issue #1185'''===
After adding a participant, the page has to be manually refreshed to show the name of the participant on the list. This creates a bad user experience and needs to be fixed.

----

=='''Modified Files'''==

1) app/controllers/auth_controller.rb

2) app/controllers/impersonate_controller.rb

3) app/controllers/student_task_controller.rb

4) app/views/participants/add.js.erb

5) app/views/participants/_participant.html.erb

6) app/views/shared_scripts/_user_list.html.erb

----

=='''Approach taken to resolve the issues'''==

==='''Issue #536 '''===

Once the instructor or teaching assistant impersonates the participant, he/she is capable of accessing all the assignments of this participant irrespective of the course and this raises serious security concerns.
Ideally, when this happened, the system should have displayed only those assignments to which he/she is assigned as an instructor or teaching assistant.

'''This issue has been fixed by modifying the current implementations of data filtering and session/role handling features.'''

'''1. Impersonation and Session Handling:'''

Setting and resetting of all the session data associated with impersonation are handled in auth_controller.rb file.

i] After login, session[:impersonate] value is set to false by default.

session[:impersonate] = false

ii] Once the Instructor tries to impersonate any student, the following actions are performed.

a) Assign the instructor/TA data to a session variable and use this data when instructor/TA tries to switch back to their original role.
This data is used during data filtering also.

original_user = session[:super_user] || session[:user]
session[:original_user] = original_user

b) Impersonate flag is set to true and the session's user variable is set to the user data of impersonated student.

session[:impersonate] = true
session[:user] = user

iii] All the session data is cleared off when the user logs out.

session[:original_user] = nil
session[:impersonate] = nil

'''2. Data Filtering:'''

Logged in user's role data and impersonation status is used to filter the data for populating the assignments list.

This is implemented in student_task_controller.rb file:

// check if the user is impersonating as TA
def impersonating_as_ta?
original_user = session[:original_user]
ta_role = Role.where(name:['Teaching Assistant']).pluck(:id)
ta_role.include? original_user.role_id
end

// Filter and populate all the relevant data
def list
redirect_to(controller: 'eula', action: 'display') if current_user.is_new_user
session[:user] = User.find_by(id: current_user.id)
@student_tasks = StudentTask.from_user current_user
if session[:impersonate] && !impersonating_as_admin?
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.instructor_id }
if impersonating_as_ta?
ta_course_ids = TaMapping.where(:ta_id => session[:original_user].id).pluck(:course_id)
@student_tasks = @student_tasks.select {|t| ta_course_ids.include?t.assignment.course_id }
else
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.course.instructor_id }
end
end

==='''Issue #1185 '''===

If a user has an assignment and a topic only then (s)he will be able to advertise for team members to join their team. If a user doesn't have a topic (s)he won't be able to advertise.
The scenario in which A, B were two users, A with a topic, B without a topic, A joins B's team but A's topic gets dropped; A,B become a team but with no topic. Such cases are now avoided as we have ensured that without first selecting a topic a user cannot advertise for team members nor can he send invitations to other users to join his team. This is done by quering in the database using inner join between tables-SignUpTopic, signed_up_teams, team_users; and checking if the user has a topic for a particular assignment. If (s)he has a topic then he'll be able to see the option for advertising for teammates.
If the assignment doesn't have a topic then the user will be able to send out team invitations.
Pseudocode representing the logic we have used to modify student_teams_helper.rb:

StudentTeamsHelper
If the concerned assignment has topics
return false if their are topics
else return true

User_Has_Topic(user_id, assignment_id)
Query the database using inner joins between SignUpTopic, signed_up_teams, team_users
rows= number of rows returned by the above query
If rows>0
return true
else
return false
Pseudocode representing the logic we have used to modify view.html.erb:

If concerned assignment does not have topics OR User_Has_Topic is true
Make Invite link visible

----

=='''Test Plan'''==

Automated tests cannot be written for this project. Automated tests will only be able to test the functionality of Rails and not the functionality of the amended files.
----
https://mymediasite.online.ncsu.edu/online/Play/3b649b16e7f7448d9d1ee79ee1448b221d
----
https://mymediasite.online.ncsu.edu/online/Play/31dcb783510c4322bcfbc894c71fbdd01d
----
==='''''Issue #536'''===

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.

2) Make ''student6400'' as the participant of that assignment and logout.

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

'''
== Screenshots of new feature ==
'''

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.
[[File: Instructor4 Page with Course.png]]

2) Make ''student6400'' as the participant of that assignment and logout.
[[File: Ins4 with student in course.png]]

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.
[[File: Ins6_homepage.png]]

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.
[[File: entering student in impersonate.png]]

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins6_result_after_impersonate.png]]

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.
[[File: Ins4_impersonating_6400.png]]

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins4_display_res_after_impersonate.png]]

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.
[[File: Ta_homepage.png]]

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.
[[File: TA_enters_student_impersonate.png]]

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.
[[File: TA_impersonate_res.png]]

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

File:Ins6 homepage.png

2018-11-03T07:02:42Z

Ckaidab: uploaded a new version of "File:Ins6 homepage.png"

E1842 Issues Related To Participants

2018-11-03T07:00:50Z

Ckaidab: /* Screenshots of new feature */

==Introduction==
==='''Problem Statement'''===
In Expertiza, an instructor is responsible for adding a participant to his course or assignment. This makes the course material available to the participant (or student per se). Since the instructor has admin rights, he is capable of impersonating the participant. This creates a few problems. This project addresses those issues.

----
=='''Issues to be fixed'''==

Issues as described by the problem statement:

==='''Issue #536'''===
Once the instructor impersonates the participant, he/she is capable of accessing all of participant’s work, irrespective of the course or the assignment. This raises serious security concerns.
Suggested solution is to restrict the instructor to view only his coursework.

==='''Issue #1185'''===
After adding a participant, the page has to be manually refreshed to show the name of the participant on the list. This creates a bad user experience and needs to be fixed.

----

=='''Modified Files'''==

1) app/controllers/auth_controller.rb

2) app/controllers/impersonate_controller.rb

3) app/controllers/student_task_controller.rb

4) app/views/participants/add.js.erb

5) app/views/participants/_participant.html.erb

6) app/views/shared_scripts/_user_list.html.erb

----

=='''Approach taken to resolve the issues'''==

==='''Issue #536 '''===

Once the instructor or teaching assistant impersonates the participant, he/she is capable of accessing all the assignments of this participant irrespective of the course and this raises serious security concerns.
Ideally, when this happened, the system should have displayed only those assignments to which he/she is assigned as an instructor or teaching assistant.

'''This issue has been fixed by modifying the current implementations of data filtering and session/role handling features.'''

'''1. Impersonation and Session Handling:'''

Setting and resetting of all the session data associated with impersonation are handled in auth_controller.rb file.

i] After login, session[:impersonate] value is set to false by default.

session[:impersonate] = false

ii] Once the Instructor tries to impersonate any student, the following actions are performed.

a) Assign the instructor/TA data to a session variable and use this data when instructor/TA tries to switch back to their original role.
This data is used during data filtering also.

original_user = session[:super_user] || session[:user]
session[:original_user] = original_user

b) Impersonate flag is set to true and the session's user variable is set to the user data of impersonated student.

session[:impersonate] = true
session[:user] = user

iii] All the session data is cleared off when the user logs out.

session[:original_user] = nil
session[:impersonate] = nil

'''2. Data Filtering:'''

Logged in user's role data and impersonation status is used to filter the data for populating the assignments list.

This is implemented in student_task_controller.rb file:

// check if the user is impersonating as TA
def impersonating_as_ta?
original_user = session[:original_user]
ta_role = Role.where(name:['Teaching Assistant']).pluck(:id)
ta_role.include? original_user.role_id
end

// Filter and populate all the relevant data
def list
redirect_to(controller: 'eula', action: 'display') if current_user.is_new_user
session[:user] = User.find_by(id: current_user.id)
@student_tasks = StudentTask.from_user current_user
if session[:impersonate] && !impersonating_as_admin?
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.instructor_id }
if impersonating_as_ta?
ta_course_ids = TaMapping.where(:ta_id => session[:original_user].id).pluck(:course_id)
@student_tasks = @student_tasks.select {|t| ta_course_ids.include?t.assignment.course_id }
else
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.course.instructor_id }
end
end

==='''Issue #1185 '''===

If a user has an assignment and a topic only then (s)he will be able to advertise for team members to join their team. If a user doesn't have a topic (s)he won't be able to advertise.
The scenario in which A, B were two users, A with a topic, B without a topic, A joins B's team but A's topic gets dropped; A,B become a team but with no topic. Such cases are now avoided as we have ensured that without first selecting a topic a user cannot advertise for team members nor can he send invitations to other users to join his team. This is done by quering in the database using inner join between tables-SignUpTopic, signed_up_teams, team_users; and checking if the user has a topic for a particular assignment. If (s)he has a topic then he'll be able to see the option for advertising for teammates.
If the assignment doesn't have a topic then the user will be able to send out team invitations.
Pseudocode representing the logic we have used to modify student_teams_helper.rb:

StudentTeamsHelper
If the concerned assignment has topics
return false if their are topics
else return true

User_Has_Topic(user_id, assignment_id)
Query the database using inner joins between SignUpTopic, signed_up_teams, team_users
rows= number of rows returned by the above query
If rows>0
return true
else
return false
Pseudocode representing the logic we have used to modify view.html.erb:

If concerned assignment does not have topics OR User_Has_Topic is true
Make Invite link visible

----

=='''Test Plan'''==

Automated tests cannot be written for this project. Automated tests will only be able to test the functionality of Rails and not the functionality of the amended files.
----
https://mymediasite.online.ncsu.edu/online/Play/3b649b16e7f7448d9d1ee79ee1448b221d
----
https://mymediasite.online.ncsu.edu/online/Play/31dcb783510c4322bcfbc894c71fbdd01d
----
==='''''Issue #536'''===

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.

2) Make ''student6400'' as the participant of that assignment and logout.

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

'''
== Screenshots of new feature ==
'''

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.
[[File: Instructor4 Page with Course.png]]

2) Make ''student6400'' as the participant of that assignment and logout.
[[File: Ins4 with student in course.png]]

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.
[[File: Ins6 homepage.png]]

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.
[[File: entering student in impersonate.png]]

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins6_result_after_impersonate.png]]

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.
[[File: Ins4_impersonating_6400.png]]

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins4_display_res_after_impersonate.png]]

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.
[[File: Ta_homepage.png]]

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.
[[File: TA_enters_student_impersonate.png]]

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.
[[File: TA_impersonate_res.png]]

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

E1842 Issues Related To Participants

2018-11-03T07:00:07Z

Ckaidab: /* Screenshots of new feature */

==Introduction==
==='''Problem Statement'''===
In Expertiza, an instructor is responsible for adding a participant to his course or assignment. This makes the course material available to the participant (or student per se). Since the instructor has admin rights, he is capable of impersonating the participant. This creates a few problems. This project addresses those issues.

----
=='''Issues to be fixed'''==

Issues as described by the problem statement:

==='''Issue #536'''===
Once the instructor impersonates the participant, he/she is capable of accessing all of participant’s work, irrespective of the course or the assignment. This raises serious security concerns.
Suggested solution is to restrict the instructor to view only his coursework.

==='''Issue #1185'''===
After adding a participant, the page has to be manually refreshed to show the name of the participant on the list. This creates a bad user experience and needs to be fixed.

----

=='''Modified Files'''==

1) app/controllers/auth_controller.rb

2) app/controllers/impersonate_controller.rb

3) app/controllers/student_task_controller.rb

4) app/views/participants/add.js.erb

5) app/views/participants/_participant.html.erb

6) app/views/shared_scripts/_user_list.html.erb

----

=='''Approach taken to resolve the issues'''==

==='''Issue #536 '''===

Once the instructor or teaching assistant impersonates the participant, he/she is capable of accessing all the assignments of this participant irrespective of the course and this raises serious security concerns.
Ideally, when this happened, the system should have displayed only those assignments to which he/she is assigned as an instructor or teaching assistant.

'''This issue has been fixed by modifying the current implementations of data filtering and session/role handling features.'''

'''1. Impersonation and Session Handling:'''

Setting and resetting of all the session data associated with impersonation are handled in auth_controller.rb file.

i] After login, session[:impersonate] value is set to false by default.

session[:impersonate] = false

ii] Once the Instructor tries to impersonate any student, the following actions are performed.

a) Assign the instructor/TA data to a session variable and use this data when instructor/TA tries to switch back to their original role.
This data is used during data filtering also.

original_user = session[:super_user] || session[:user]
session[:original_user] = original_user

b) Impersonate flag is set to true and the session's user variable is set to the user data of impersonated student.

session[:impersonate] = true
session[:user] = user

iii] All the session data is cleared off when the user logs out.

session[:original_user] = nil
session[:impersonate] = nil

'''2. Data Filtering:'''

Logged in user's role data and impersonation status is used to filter the data for populating the assignments list.

This is implemented in student_task_controller.rb file:

// check if the user is impersonating as TA
def impersonating_as_ta?
original_user = session[:original_user]
ta_role = Role.where(name:['Teaching Assistant']).pluck(:id)
ta_role.include? original_user.role_id
end

// Filter and populate all the relevant data
def list
redirect_to(controller: 'eula', action: 'display') if current_user.is_new_user
session[:user] = User.find_by(id: current_user.id)
@student_tasks = StudentTask.from_user current_user
if session[:impersonate] && !impersonating_as_admin?
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.instructor_id }
if impersonating_as_ta?
ta_course_ids = TaMapping.where(:ta_id => session[:original_user].id).pluck(:course_id)
@student_tasks = @student_tasks.select {|t| ta_course_ids.include?t.assignment.course_id }
else
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.course.instructor_id }
end
end

==='''Issue #1185 '''===

If a user has an assignment and a topic only then (s)he will be able to advertise for team members to join their team. If a user doesn't have a topic (s)he won't be able to advertise.
The scenario in which A, B were two users, A with a topic, B without a topic, A joins B's team but A's topic gets dropped; A,B become a team but with no topic. Such cases are now avoided as we have ensured that without first selecting a topic a user cannot advertise for team members nor can he send invitations to other users to join his team. This is done by quering in the database using inner join between tables-SignUpTopic, signed_up_teams, team_users; and checking if the user has a topic for a particular assignment. If (s)he has a topic then he'll be able to see the option for advertising for teammates.
If the assignment doesn't have a topic then the user will be able to send out team invitations.
Pseudocode representing the logic we have used to modify student_teams_helper.rb:

StudentTeamsHelper
If the concerned assignment has topics
return false if their are topics
else return true

User_Has_Topic(user_id, assignment_id)
Query the database using inner joins between SignUpTopic, signed_up_teams, team_users
rows= number of rows returned by the above query
If rows>0
return true
else
return false
Pseudocode representing the logic we have used to modify view.html.erb:

If concerned assignment does not have topics OR User_Has_Topic is true
Make Invite link visible

----

=='''Test Plan'''==

Automated tests cannot be written for this project. Automated tests will only be able to test the functionality of Rails and not the functionality of the amended files.
----
https://mymediasite.online.ncsu.edu/online/Play/3b649b16e7f7448d9d1ee79ee1448b221d
----
https://mymediasite.online.ncsu.edu/online/Play/31dcb783510c4322bcfbc894c71fbdd01d
----
==='''''Issue #536'''===

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.

2) Make ''student6400'' as the participant of that assignment and logout.

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

'''
== Screenshots of new feature ==
'''

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.
[[File: Instructor4 Page with Course.png]]

2) Make ''student6400'' as the participant of that assignment and logout.
[[File: Ins4 with student in course.png]]

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.
[[File: Ins6_homepage.png]]

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.
[[File: entering student in impersonate.png]]

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins6_result_after_impersonate.png]]

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.
[[File: Ins4_impersonating_6400.png]]

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins4_display_res_after_impersonate.png]]

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.
[[File: Ta_homepage.png]]

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.
[[File: TA_enters_student_impersonate.png]]

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.
[[File: TA_impersonate_res.png]]

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

E1842 Issues Related To Participants

2018-11-03T06:58:59Z

Ckaidab: /* Screenshots of new feature */

==Introduction==
==='''Problem Statement'''===
In Expertiza, an instructor is responsible for adding a participant to his course or assignment. This makes the course material available to the participant (or student per se). Since the instructor has admin rights, he is capable of impersonating the participant. This creates a few problems. This project addresses those issues.

----
=='''Issues to be fixed'''==

Issues as described by the problem statement:

==='''Issue #536'''===
Once the instructor impersonates the participant, he/she is capable of accessing all of participant’s work, irrespective of the course or the assignment. This raises serious security concerns.
Suggested solution is to restrict the instructor to view only his coursework.

==='''Issue #1185'''===
After adding a participant, the page has to be manually refreshed to show the name of the participant on the list. This creates a bad user experience and needs to be fixed.

----

=='''Modified Files'''==

1) app/controllers/auth_controller.rb

2) app/controllers/impersonate_controller.rb

3) app/controllers/student_task_controller.rb

4) app/views/participants/add.js.erb

5) app/views/participants/_participant.html.erb

6) app/views/shared_scripts/_user_list.html.erb

----

=='''Approach taken to resolve the issues'''==

==='''Issue #536 '''===

Once the instructor or teaching assistant impersonates the participant, he/she is capable of accessing all the assignments of this participant irrespective of the course and this raises serious security concerns.
Ideally, when this happened, the system should have displayed only those assignments to which he/she is assigned as an instructor or teaching assistant.

'''This issue has been fixed by modifying the current implementations of data filtering and session/role handling features.'''

'''1. Impersonation and Session Handling:'''

Setting and resetting of all the session data associated with impersonation are handled in auth_controller.rb file.

i] After login, session[:impersonate] value is set to false by default.

session[:impersonate] = false

ii] Once the Instructor tries to impersonate any student, the following actions are performed.

a) Assign the instructor/TA data to a session variable and use this data when instructor/TA tries to switch back to their original role.
This data is used during data filtering also.

original_user = session[:super_user] || session[:user]
session[:original_user] = original_user

b) Impersonate flag is set to true and the session's user variable is set to the user data of impersonated student.

session[:impersonate] = true
session[:user] = user

iii] All the session data is cleared off when the user logs out.

session[:original_user] = nil
session[:impersonate] = nil

'''2. Data Filtering:'''

Logged in user's role data and impersonation status is used to filter the data for populating the assignments list.

This is implemented in student_task_controller.rb file:

// check if the user is impersonating as TA
def impersonating_as_ta?
original_user = session[:original_user]
ta_role = Role.where(name:['Teaching Assistant']).pluck(:id)
ta_role.include? original_user.role_id
end

// Filter and populate all the relevant data
def list
redirect_to(controller: 'eula', action: 'display') if current_user.is_new_user
session[:user] = User.find_by(id: current_user.id)
@student_tasks = StudentTask.from_user current_user
if session[:impersonate] && !impersonating_as_admin?
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.instructor_id }
if impersonating_as_ta?
ta_course_ids = TaMapping.where(:ta_id => session[:original_user].id).pluck(:course_id)
@student_tasks = @student_tasks.select {|t| ta_course_ids.include?t.assignment.course_id }
else
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.course.instructor_id }
end
end

==='''Issue #1185 '''===

If a user has an assignment and a topic only then (s)he will be able to advertise for team members to join their team. If a user doesn't have a topic (s)he won't be able to advertise.
The scenario in which A, B were two users, A with a topic, B without a topic, A joins B's team but A's topic gets dropped; A,B become a team but with no topic. Such cases are now avoided as we have ensured that without first selecting a topic a user cannot advertise for team members nor can he send invitations to other users to join his team. This is done by quering in the database using inner join between tables-SignUpTopic, signed_up_teams, team_users; and checking if the user has a topic for a particular assignment. If (s)he has a topic then he'll be able to see the option for advertising for teammates.
If the assignment doesn't have a topic then the user will be able to send out team invitations.
Pseudocode representing the logic we have used to modify student_teams_helper.rb:

StudentTeamsHelper
If the concerned assignment has topics
return false if their are topics
else return true

User_Has_Topic(user_id, assignment_id)
Query the database using inner joins between SignUpTopic, signed_up_teams, team_users
rows= number of rows returned by the above query
If rows>0
return true
else
return false
Pseudocode representing the logic we have used to modify view.html.erb:

If concerned assignment does not have topics OR User_Has_Topic is true
Make Invite link visible

----

=='''Test Plan'''==

Automated tests cannot be written for this project. Automated tests will only be able to test the functionality of Rails and not the functionality of the amended files.
----
https://mymediasite.online.ncsu.edu/online/Play/3b649b16e7f7448d9d1ee79ee1448b221d
----
https://mymediasite.online.ncsu.edu/online/Play/31dcb783510c4322bcfbc894c71fbdd01d
----
==='''''Issue #536'''===

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.

2) Make ''student6400'' as the participant of that assignment and logout.

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

'''
== Screenshots of new feature ==
'''

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.
[[File: Instructor4 Page with Course.png]]

2) Make ''student6400'' as the participant of that assignment and logout.
[[File: Ins4 with student in course.png]]

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.
[[File: Ins6 homepage.png]]

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.
[[File: entering student in impersonate.png]]

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins6_result_after_impersonate.png]]

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.
[[File: Ins4_impersonating_6400.png]]

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins4_display_res_after_impersonate.png]]

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.
[[File: Ta_homepage.png]]

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.
[[File: TA_enters_student_impersonate.png]]

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.
[[File: TA_impersonate_res.png]]

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

File:Instructor4 Page with Course.png

2018-11-03T06:57:48Z

Ckaidab: uploaded a new version of "File:Instructor4 Page with Course.png"

E1842 Issues Related To Participants

2018-11-03T06:53:35Z

Ckaidab:

==Introduction==
==='''Problem Statement'''===
In Expertiza, an instructor is responsible for adding a participant to his course or assignment. This makes the course material available to the participant (or student per se). Since the instructor has admin rights, he is capable of impersonating the participant. This creates a few problems. This project addresses those issues.

----
=='''Issues to be fixed'''==

Issues as described by the problem statement:

==='''Issue #536'''===
Once the instructor impersonates the participant, he/she is capable of accessing all of participant’s work, irrespective of the course or the assignment. This raises serious security concerns.
Suggested solution is to restrict the instructor to view only his coursework.

==='''Issue #1185'''===
After adding a participant, the page has to be manually refreshed to show the name of the participant on the list. This creates a bad user experience and needs to be fixed.

----

=='''Modified Files'''==

1) app/controllers/auth_controller.rb

2) app/controllers/impersonate_controller.rb

3) app/controllers/student_task_controller.rb

4) app/views/participants/add.js.erb

5) app/views/participants/_participant.html.erb

6) app/views/shared_scripts/_user_list.html.erb

----

=='''Approach taken to resolve the issues'''==

==='''Issue #536 '''===

Once the instructor or teaching assistant impersonates the participant, he/she is capable of accessing all the assignments of this participant irrespective of the course and this raises serious security concerns.
Ideally, when this happened, the system should have displayed only those assignments to which he/she is assigned as an instructor or teaching assistant.

'''This issue has been fixed by modifying the current implementations of data filtering and session/role handling features.'''

'''1. Impersonation and Session Handling:'''

Setting and resetting of all the session data associated with impersonation are handled in auth_controller.rb file.

i] After login, session[:impersonate] value is set to false by default.

session[:impersonate] = false

ii] Once the Instructor tries to impersonate any student, the following actions are performed.

a) Assign the instructor/TA data to a session variable and use this data when instructor/TA tries to switch back to their original role.
This data is used during data filtering also.

original_user = session[:super_user] || session[:user]
session[:original_user] = original_user

b) Impersonate flag is set to true and the session's user variable is set to the user data of impersonated student.

session[:impersonate] = true
session[:user] = user

iii] All the session data is cleared off when the user logs out.

session[:original_user] = nil
session[:impersonate] = nil

'''2. Data Filtering:'''

Logged in user's role data and impersonation status is used to filter the data for populating the assignments list.

This is implemented in student_task_controller.rb file:

// check if the user is impersonating as TA
def impersonating_as_ta?
original_user = session[:original_user]
ta_role = Role.where(name:['Teaching Assistant']).pluck(:id)
ta_role.include? original_user.role_id
end

// Filter and populate all the relevant data
def list
redirect_to(controller: 'eula', action: 'display') if current_user.is_new_user
session[:user] = User.find_by(id: current_user.id)
@student_tasks = StudentTask.from_user current_user
if session[:impersonate] && !impersonating_as_admin?
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.instructor_id }
if impersonating_as_ta?
ta_course_ids = TaMapping.where(:ta_id => session[:original_user].id).pluck(:course_id)
@student_tasks = @student_tasks.select {|t| ta_course_ids.include?t.assignment.course_id }
else
@student_tasks = @student_tasks.select {|t| session[:original_user].id == t.assignment.course.instructor_id }
end
end

==='''Issue #1185 '''===

If a user has an assignment and a topic only then (s)he will be able to advertise for team members to join their team. If a user doesn't have a topic (s)he won't be able to advertise.
The scenario in which A, B were two users, A with a topic, B without a topic, A joins B's team but A's topic gets dropped; A,B become a team but with no topic. Such cases are now avoided as we have ensured that without first selecting a topic a user cannot advertise for team members nor can he send invitations to other users to join his team. This is done by quering in the database using inner join between tables-SignUpTopic, signed_up_teams, team_users; and checking if the user has a topic for a particular assignment. If (s)he has a topic then he'll be able to see the option for advertising for teammates.
If the assignment doesn't have a topic then the user will be able to send out team invitations.
Pseudocode representing the logic we have used to modify student_teams_helper.rb:

StudentTeamsHelper
If the concerned assignment has topics
return false if their are topics
else return true

User_Has_Topic(user_id, assignment_id)
Query the database using inner joins between SignUpTopic, signed_up_teams, team_users
rows= number of rows returned by the above query
If rows>0
return true
else
return false
Pseudocode representing the logic we have used to modify view.html.erb:

If concerned assignment does not have topics OR User_Has_Topic is true
Make Invite link visible

----

=='''Test Plan'''==

Automated tests cannot be written for this project. Automated tests will only be able to test the functionality of Rails and not the functionality of the amended files.
----
https://mymediasite.online.ncsu.edu/online/Play/3b649b16e7f7448d9d1ee79ee1448b221d
----
https://mymediasite.online.ncsu.edu/online/Play/31dcb783510c4322bcfbc894c71fbdd01d
----
==='''''Issue #536'''===

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.

2) Make ''student6400'' as the participant of that assignment and logout.

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

'''
== Screenshots of new feature ==
'''

1) Login as ''Instructor4''. Add a new assignment ''Assignment_Instructor4'' under the course ''Course 617, Spring 2016''.
[[File: Instructor4 Page with Course.jpg]]

2) Make ''student6400'' as the participant of that assignment and logout.
[[File: Ins4 with student in course.jpg]]

3) Login as ''Instructor6''. Add a new assignment ''Assignment_Instructor6'' under the course ''Course 517, Spring 2016''.
[[File: Ins6 homepage.png]]

4) Make ''student6400'' as the participant of that assignment and logout.

5) Click on Manage -> Impersonate User and enter ''student6400'' as the user to be impersonated.
[[File: entering student in impersonate.png]]

6) After impersonation, ''Instructor6'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins6_result_after_impersonate.png]]

7) We need to login as ''Instructor4'' and verify that ''Instructor4'' is not able to see other assignment details of the other instructors.

8) Login as ''Instructor4''. Click on Manage -> Impersonate user. Enter ''student6400'' as the user to be impersonated.
[[File: Ins4_impersonating_6400.png]]

9) After impersonation, ''Instructor4'' will be able to see only his/her assignment details and not of any other instructors.
[[File: Ins4_display_res_after_impersonate.png]]

10) Login as ''TeachingAssistant1274'' who is a TA for the Course 517, Spring 2016, who is a TA under Instructor6.

11) Create an assignment ''TA_Assignment'' and make ''student6400'' as a participant.
[[File: Ta_homepage.png]]

12) Click on Manage->Impersonate user and enter ''student6400'' as the student to be impersonated.
[[File: TA_enters_student_impersonate.png]]

13) After impersonation, ''TeachingAssistant1274'' will be able to see all the assignment details of all courses for which (s)he is the TA and not the details of the other assignments.
[[File: TA_impersonate_res.png]]

14) This verifies that the bugs have been fixed.

==='''Issue #1185'''===

1) Login as an ''Instructor'' or ''Admin'' or ''Super-Admin'' or ''TA''.

2) Click on Manage -> Assignments. In the ''Actions'' column click on ''Add Participant''.

3) After the list of all the participants you will be able to see ''Enter a user login'' text box.

4) Enter the user login in the text box (Ex: student9000) and click on ''Add'' button.

5) After clicking on the ''Add'' button, you will see the participant added at end of the list.

6) This verifies the bug has been fixed.

File:TA impersonate res.png

2018-11-03T06:53:25Z

Ckaidab:

File:TA enters student impersonate.png

2018-11-03T06:52:26Z

Ckaidab: