TD-4880- Prevent administrators from viewing Activity Delegates for self assessments in a category that doesn't match their own through URL manipulation.

Author: ABSinhaa

DigitalLearningSolutions.Data/DataServices/CourseDataService.cs

@@ -136,7 +136,8 @@ int EnrolOnActivitySelfAssessment(int selfAssessmentId, int candidateId, int sup
 
         public IEnumerable<CourseStatistics> GetDelegateCourseStatisticsAtCentre(string searchString, int centreId, int? categoryId, bool allCentreCourses, bool? hideInLearnerPortal, string isActive, string categoryName, string courseTopic, string hasAdminFields);
 
-        public IEnumerable<DelegateAssessmentStatistics> GetDelegateAssessmentStatisticsAtCentre(string searchString, int centreId, string categoryName, string isActive);
+        public IEnumerable<DelegateAssessmentStatistics> GetDelegateAssessmentStatisticsAtCentre(string searchString, int centreId, string categoryName, string isActive, int? categoryId);
+
         bool IsSelfEnrollmentAllowed(int customisationId);
         Customisation? GetCourse(int customisationId);
     }
@@ -541,9 +542,7 @@ LEFT OUTER JOIN UserCentreDetails AS UCD ON
                         new { candidateAssessmentId, enrolmentMethodId, completeByDateDynamic }
                     );
             }
-
             if (candidateAssessmentId > 1 && supervisorDelegateId !=0)
-
             {
                 string sqlQuery = $@"
                 BEGIN TRANSACTION
@@ -1976,7 +1975,7 @@ AND ap.DefaultContentTypeID <> 4
             return courseStatistics;
         }
 
-        public IEnumerable<DelegateAssessmentStatistics> GetDelegateAssessmentStatisticsAtCentre(string searchString, int centreId, string categoryName, string isActive)
+        public IEnumerable<DelegateAssessmentStatistics> GetDelegateAssessmentStatisticsAtCentre(string searchString, int centreId, string categoryName, string isActive, int? categoryId)
         {
             string assessmentStatisticsSelectQuery = $@"SELECT
                         sa.Name AS Name,
@@ -2006,11 +2005,12 @@ from CentreSelfAssessments AS csa
                         WHERE csa.CentreID= @centreId
                                 AND sa.[Name] LIKE '%' + @searchString + '%'
 		                        AND ((@categoryName = 'Any') OR (cc.CategoryName = @categoryName))
+                                AND (ISNULL(@categoryId, 0) = 0 OR sa.CategoryID = @categoryId)
 		                        AND ((@isActive = 'Any') OR (@isActive = 'true' AND  sa.ArchivedDate IS NULL) OR (@isActive = 'false' AND sa.ArchivedDate IS NOT NULL))
                                 ";
 
             IEnumerable<DelegateAssessmentStatistics> delegateAssessmentStatistics = connection.Query<DelegateAssessmentStatistics>(assessmentStatisticsSelectQuery,
-                new { searchString, centreId, categoryName, isActive }, commandTimeout: 3000);
+                new { searchString, centreId, categoryName, isActive, categoryId }, commandTimeout: 3000);
             return delegateAssessmentStatistics;
         }
 

DigitalLearningSolutions.Data/DataServices/SelfAssessmentDataService/SelfAssessmentDataService.cs

@@ -172,6 +172,7 @@ int GetSelfAssessmentActivityDelegatesExportCount(string searchString, string so
         bool IsUnsupervisedSelfAssessment(int selfAssessmentId);
         bool IsCentreSelfAssessment(int selfAssessmentId, int centreId);
         bool HasMinimumOptionalCompetencies(int selfAssessmentId, int delegateUserId);
+        int GetSelfAssessmentCategoryId(int selfAssessmentId);
     }
 
     public partial class SelfAssessmentDataService : ISelfAssessmentDataService
@@ -760,5 +761,13 @@ INNER JOIN SelfAssessments AS SA
                         new { selfAssessmentId, delegateUserId }
                     );
         }
+
+        public int GetSelfAssessmentCategoryId(int selfAssessmentId)
+        {
+            return connection.ExecuteScalar<int>(
+                @"SELECT CategoryID FROM SelfAssessments WHERE ID = @selfAssessmentId",
+                new { selfAssessmentId }
+            );
+        }
     }
 }

DigitalLearningSolutions.Web.Tests/Controllers/TrackingSystem/Delegates/CourseDelegatesControllerTests.cs

@@ -23,6 +23,7 @@
     public class CourseDelegatesControllerTests
     {
         private const int UserCentreId = 3;
+        private const int selfAssessmentId = 3;
         private ActivityDelegatesController controller = null!;
         private ICourseDelegatesDownloadFileService courseDelegatesDownloadFileService = null!;
         private ICourseDelegatesService courseDelegatesService = null!;
@@ -123,7 +124,7 @@ public void CourseDelegates_Index_returns_Not_Found_when_service_returns_null()
                 );
 
             // When
-            var result = controller.Index(2);
+            var result = controller.Index(2, selfAssessmentId);
 
             // Then
             result.Should().BeNotFoundResult();
@@ -207,7 +208,7 @@ public void Index_should_default_to_Active_filter()
                 );
 
             // When
-            var result = courseDelegatesController.Index(customisationId);
+            var result = courseDelegatesController.Index(customisationId, selfAssessmentId);
 
             // Then
             using (new AssertionScope())

DigitalLearningSolutions.Web.Tests/Controllers/TrackingSystem/Delegates/DelegateCoursesControllerTests.cs

@@ -99,7 +99,9 @@ public void Index_calls_expected_methods_and_returns_view()
                 var delegateCourses = Builder<CourseStatisticsWithAdminFieldResponseCounts>.CreateListOfSize(5).Build();
                 A.CallTo(() => courseService.GetDelegateCourses(string.Empty, 1, 1, true, true, string.Empty, string.Empty, string.Empty, string.Empty)).Returns(delegateCourses);
 
-                A.CallTo(() => courseService.GetDelegateAssessments(A<string>._, A<int>._, A<string>._, A<string>._)).MustHaveHappened();
+
+                var delegateSelfAssessments = Builder<DelegateAssessmentStatistics>.CreateListOfSize(5).Build();
+                A.CallTo(() => courseService.GetDelegateAssessments(A<string>._, A<int>._, A<string>._, A<string>._, A<int>._)).Returns(delegateSelfAssessments);
                 A.CallTo(
                     () => paginateService.Paginate(A<IEnumerable<CourseStatistics>>._,
                          A<int>._,

DigitalLearningSolutions.Web.Tests/Services/CourseServiceTests.cs

@@ -982,15 +982,15 @@ public void GetDelegateAssessments_GetDelegateAssessments_ShouldBeInvokedAndRetu
         {
             // Given
             var delegateAssessments = Builder<DelegateAssessmentStatistics>.CreateListOfSize(5).Build();
-            A.CallTo(() => courseDataService.GetDelegateAssessmentStatisticsAtCentre(string.Empty, 1, string.Empty, string.Empty)).Returns(delegateAssessments);
+            A.CallTo(() => courseDataService.GetDelegateAssessmentStatisticsAtCentre(string.Empty, 1, string.Empty, string.Empty, 1)).Returns(delegateAssessments);
 
             // When
-            var result = courseService.GetDelegateAssessments(string.Empty, 1, string.Empty, string.Empty);
+            var result = courseService.GetDelegateAssessments(string.Empty, 1, string.Empty, string.Empty, 1);
 
             // Then
             using (new AssertionScope())
             {
-                A.CallTo(() => courseDataService.GetDelegateAssessmentStatisticsAtCentre(string.Empty, 1, string.Empty, string.Empty))
+                A.CallTo(() => courseDataService.GetDelegateAssessmentStatisticsAtCentre(string.Empty, 1, string.Empty, string.Empty, 1))
                     .MustHaveHappenedOnceExactly();
                 result.Count().Should().BeGreaterOrEqualTo(0);
             }

DigitalLearningSolutions.Web/Controllers/TrackingSystem/Delegates/ActivityDelegatesController.cs

@@ -131,6 +131,12 @@ public IActionResult Index(
 
             var centreId = User.GetCentreIdKnownNotNull();
             var adminCategoryId = User.GetAdminCategoryId();
+            var selfAssessmentCategoryId = selfAssessmentService.GetSelfAssessmentCategoryId((int)selfAssessmentId);
+
+            if (adminCategoryId > 0 && adminCategoryId != selfAssessmentCategoryId)
+            {
+                return RedirectToAction("StatusCode", "LearningSolutions", new { code = 403 });
+            }
 
             bool? isDelegateActive, isProgressLocked, removed, hasCompleted, submitted, signedOff;
             isDelegateActive = isProgressLocked = removed = hasCompleted = submitted = signedOff = null;

DigitalLearningSolutions.Web/Controllers/TrackingSystem/Delegates/DelegateCoursesController.cs

@@ -156,13 +156,13 @@ public IActionResult Index(
             {
                 delegateActivities = courseService.GetDelegateCourses(searchString, centreId, categoryId, true, null, isActive, categoryName, courseTopic, hasAdminFields).ToList();
                 if (courseTopic == "Any" && hasAdminFields == "Any")
-                    delegateAssessments = courseService.GetDelegateAssessments(searchString, centreId, categoryName, isActive);
+                    delegateAssessments = courseService.GetDelegateAssessments(searchString, centreId, categoryName, isActive, categoryId);
             }
 
             if (isCourse == "true")
                 delegateActivities = courseService.GetDelegateCourses(searchString ?? string.Empty, centreId, categoryId, true, null, isActive, categoryName, courseTopic, hasAdminFields).ToList();
             if (isSelfAssessment == "true" && courseTopic == "Any" && hasAdminFields == "Any")
-                delegateAssessments = courseService.GetDelegateAssessments(searchString, centreId, categoryName, isActive);
+                delegateAssessments = courseService.GetDelegateAssessments(searchString, centreId, categoryName, isActive, categoryId);
 
             delegateAssessments = UpdateCompletedCount(delegateAssessments);
 

DigitalLearningSolutions.Web/Services/CourseDelegatesDownloadFileService.cs

@@ -227,12 +227,12 @@ string sortDirection
             {
                 courses = GetCoursesToExport(centreId, adminCategoryId, searchString, sortBy, filterString, sortDirection);
                 if (courseTopic == "Any" && hasAdminFields == "Any")
-                    selfAssessments = courseService.GetDelegateAssessments(searchString, centreId, categoryName, isActive);
+                    selfAssessments = courseService.GetDelegateAssessments(searchString, centreId, categoryName, isActive, adminCategoryId);
             }
             if (isCourse == "true")
                 courses = GetCoursesToExport(centreId, adminCategoryId, searchString, sortBy, filterString, sortDirection);
             if (isSelfAssessment == "true" && courseTopic == "Any" && hasAdminFields == "Any")
-                selfAssessments = courseService.GetDelegateAssessments(searchString, centreId, categoryName, isActive);
+                selfAssessments = courseService.GetDelegateAssessments(searchString, centreId, categoryName, isActive, adminCategoryId);
 
             if (selfAssessments.Any())
             {

DigitalLearningSolutions.Web/Services/CourseService.cs

@@ -120,7 +120,7 @@ int diagCompletionThreshold
            string isActive, string categoryName, string courseTopic, string hasAdminFields);
 
         public IEnumerable<CourseStatisticsWithAdminFieldResponseCounts> GetDelegateCourses(string searchString, int centreId, int? categoryId, bool allCentreCourses, bool? hideInLearnerPortal, string isActive, string categoryName, string courseTopic, string hasAdminFields);
-        public IEnumerable<DelegateAssessmentStatistics> GetDelegateAssessments(string searchString, int centreId, string categoryName, string isActive);
+        public IEnumerable<DelegateAssessmentStatistics> GetDelegateAssessments(string searchString, int centreId, string categoryName, string isActive, int? categoryId);
         IEnumerable<AvailableCourse> GetAvailableCourses(int delegateId, int? centreId, int categoryId);
         bool IsCourseCompleted(int candidateId, int customisationId);
         bool IsCourseCompleted(int candidateId, int customisationId, int progressID);
@@ -563,9 +563,9 @@ public IEnumerable<CourseStatisticsWithAdminFieldResponseCounts> GetDelegateCour
             );
         }
 
-        public IEnumerable<DelegateAssessmentStatistics> GetDelegateAssessments(string searchString, int centreId, string categoryName, string isActive)
+        public IEnumerable<DelegateAssessmentStatistics> GetDelegateAssessments(string searchString, int centreId, string categoryName, string isActive, int? categoryId)
         {
-            return courseDataService.GetDelegateAssessmentStatisticsAtCentre(searchString, centreId, categoryName, isActive);
+            return courseDataService.GetDelegateAssessmentStatisticsAtCentre(searchString, centreId, categoryName, isActive, categoryId);
         }
 
         public IEnumerable<AvailableCourse> GetAvailableCourses(int delegateId, int? centreId, int categoryId)

DigitalLearningSolutions.Web/Services/SelfAssessmentService.cs

@@ -149,6 +149,7 @@ public int GetSelfAssessmentActivityDelegatesExportCount(string searchString, st
         IEnumerable<CandidateAssessment> GetCandidateAssessments(int delegateUserId, int selfAssessmentId);
         bool IsCentreSelfAssessment(int selfAssessmentId, int centreId);
         bool HasMinimumOptionalCompetencies(int selfAssessmentId, int delegateUserId);
+        public int GetSelfAssessmentCategoryId(int selfAssessmentId);
 
     }
 
@@ -557,5 +558,10 @@ public bool HasMinimumOptionalCompetencies(int selfAssessmentId, int delegateUse
         {
             return selfAssessmentDataService.HasMinimumOptionalCompetencies(selfAssessmentId, delegateUserId);
         }
+
+        public int GetSelfAssessmentCategoryId(int selfAssessmentId)
+        {
+            return selfAssessmentDataService.GetSelfAssessmentCategoryId(selfAssessmentId);
+        }
     }
 }