Implemented course APIs as edge functions (#349)

Author: VictorAKang

server/supabase/functions/_shared/utils/auth.ts

@@ -1,5 +1,7 @@
 import { supa } from "../db.ts";
+import { Context } from "jsr:@hono/hono";
 import { AuthError } from "../errors.ts";
+import { createMiddleware } from "jsr:@hono/hono/factory";
 
 export async function signUpByEmailPassword(
   email: string,
@@ -40,3 +42,33 @@ export async function validateUserFromToken(token: string) {
 
   return data.user;
 }
+
+const validateUser = async (c: Context) => {
+  const token = c.req.header("Authorization")?.split(" ")[1];
+  if (!token) {
+    return c.json({ error: "Unauthorized" }, 401);
+  }
+  try {
+    const user = await validateUserFromToken(token);
+    return user;
+  } catch {
+    return c.json({ error: "Unauthorized" }, 401);
+  }
+};
+
+export type UserVariables = {
+  user: any;
+};
+
+export const authMiddleware = createMiddleware<{
+  Variables: UserVariables;
+}>(
+  async (
+    c: Context<{ Variables: UserVariables }>,
+    next: () => Promise<void>,
+  ) => {
+    const user = await validateUser(c);
+    c.set("user", user);
+    await next();
+  },
+);

server/supabase/functions/_shared/utils/permission_manager.ts

@@ -0,0 +1,86 @@
+import { supa } from '../db.ts';
+import { PermissionError } from '../errors.ts';
+import { DefaultRoles, instructorRole, Permissions } from '../../../../../shared/schema/course.ts';
+
+export async function isUserMemberOfCourse(user_id: string, course_id: string): Promise<boolean> {
+    const { data, error } = await supa.from('course_members')
+        .select('*')
+        .eq('user_id', user_id)
+        .eq('course_id', course_id);
+    
+    if (error) {
+        throw new Error(`Failed to check if user ${user_id} is a member of course ${course_id}: ${error.message}`);
+    }
+
+    return data.length > 0;
+}
+
+export async function getRoleInCourse(user_id: string, course_id: string): Promise<DefaultRoles> {
+    const { data: courseRoleData, error: courseRoleError } = await supa.from('course_members')
+        .select('role_id')
+        .eq('user_id', user_id)
+        .eq('course_id', course_id); 
+
+    if (courseRoleError) {
+        throw new Error(`Failed to get role for user ${user_id} in course ${course_id}: ${courseRoleError.message}`);
+    }
+
+    if (!courseRoleData || courseRoleData.length !== 1) {
+        throw new PermissionError(`User ${user_id} is not a member of course ${course_id}`);	
+    }
+
+    const role_id = courseRoleData[0].role_id;
+    const { data: roleData, error: roleError } = await supa.from('account_roles')
+        .select('name')
+        .eq('id', role_id);
+    
+    if (roleError) {
+        console.error(`Failed to get role for user ${user_id} in course ${course_id}: ${roleError.message}`);
+    }
+
+    if (!roleData || roleData.length !== 1) {
+        throw new Error(`Role ${role_id} for user ${user_id} in course ${course_id} was expected but to exist but did not`);
+    }
+
+    return roleData[0].name as DefaultRoles;
+}
+
+export async function isUserInstructorInCourse(user_id: string, course_id: string): Promise<boolean> {
+    if (!isUserMemberOfCourse(user_id, course_id)) {
+        return false;
+    }
+
+    const role = await getRoleInCourse(user_id, course_id);
+    return role === instructorRole;
+}
+
+export async function getUserPermissionsInCourse(user_id: string, course_id: string): Promise<Permissions> {
+    // TODO: This likely need to be more complicated or refactored to only get the default permissions
+    const { data: courseRoleData, error: courseRoleError } = await supa.from('course_members')
+        .select('role_id')
+        .eq('user_id', user_id)
+        .eq('course_id', course_id); 
+
+    if (courseRoleError) {
+        throw new Error(`Failed to get role for user ${user_id} in course ${course_id}: ${courseRoleError.message}`);
+    }
+
+    if (!courseRoleData || courseRoleData.length !== 1) {
+        throw new PermissionError(`User ${user_id} is not a member of course ${course_id}`);	
+    }
+
+    const role_id = courseRoleData[0].role_id;
+    const { data: roleData, error: roleError } = await supa.from('account_roles')
+        .select('default_permissions')
+        .eq('id', role_id);
+    
+    if (roleError) {
+        console.error(`Failed to get permissions for user ${user_id} in course ${course_id}: ${roleError.message}`);
+    }
+
+    if (!roleData || roleData.length !== 1) {
+        throw new Error(`Role ${role_id} for user ${user_id} in course ${course_id} was expected but to exist but did not`);
+    }
+
+    return roleData[0].default_permissions as Permissions;
+}

server/supabase/functions/courses/controller/add_course_member_activity.ts

@@ -24,8 +24,6 @@ export async function addUserToCourse(
     if (joinError) {
         throw new Error(`Failed to add user to course: ${joinError.message}`);
     }
-
-    return true;
 }
 
 async function getCourse(course_id: string): Promise<Course> { 

server/supabase/functions/courses/controller/remove_course_member_activity.ts

@@ -53,6 +53,6 @@ async function checkIfUserInCourse(user_id: string, course_id: string) {
         .single();
 
     if (!existingUserCourse) {
-        throw new InputValidationError(`User ${user_id} already registered in course ${course_id}`);
+        throw new InputValidationError(`User ${user_id} not in course ${course_id}`);
     }
 }