all: Aggiunte varie feature e riscritte svariate cose

server/routes.ts

@@ -3,9 +3,7 @@ import crypto from 'crypto'
 import bodyParser from 'body-parser'
 import cookieParser from 'cookie-parser'
 
-import express, { Request, Response, Router } from 'express'
-
-import { createStatusRouter } from './middlewares'
+import express, { Request, Router } from 'express'
 
 import { StatusCodes } from 'http-status-codes'
 
@@ -13,13 +11,15 @@ import {
     createDatabase,
     createProblem,
     createSolution,
+    deleteProblem,
+    deleteSolution,
     getProblem,
     getProblems,
     getSolution,
     getSolutions,
     getUser,
     getUsers,
-    getVisibleSolutions,
+    updateProblem,
     updateSolution,
 } from './db/database'
 
@@ -28,10 +28,11 @@ import {
     isAdministrator,
     isStudent,
     Opaque,
-    Problem,
+    Problem as ProblemModel,
     ProblemId,
     Solution as SolutionModel,
     SolutionId,
+    User as UserModel,
     UserId,
 } from '../shared/model'
 import { initialDatabaseValue } from './db/example-data'
@@ -55,14 +56,12 @@ export async function createApiRouter() {
 
     const db = createDatabase(process.env.DATABASE_PATH ?? './db.local.json', initialDatabaseValue)
 
-    async function getRequestUser(req: Request) {
+    async function getRequestUser(req: Request): Promise<UserModel | null> {
         const userId = sessions.getUserForSession(req.cookies.sid)
         if (!userId) {
             return null
         }
 
-        console.log(userId)
-
         return await getUser(db, userId)
     }
 
@@ -71,8 +70,9 @@ export async function createApiRouter() {
     r.use(bodyParser.json())
     r.use(cookieParser())
 
-    r.use('/api/status', createStatusRouter())
-    // r.use('/api/ping', new PingRouter())
+    r.get('/api/status', (req, res) => {
+        res.json({ url: req.originalUrl, status: 'ok' })
+    })
 
     r.get('/api/current-user', async (req, res) => {
         res.json(await getRequestUser(req))
@@ -108,7 +108,7 @@ export async function createApiRouter() {
     })
 
     r.get('/api/problems', async (req, res) => {
-        type ProblemWithSolutionsCount = Problem & { solutionsCount?: number }
+        type ProblemWithSolutionsCount = ProblemModel & { solutionsCount?: number }
 
         const problems: ProblemWithSolutionsCount[] = await getProblems(db)
         const solutions = await getSolutions(db)
@@ -131,18 +131,76 @@ export async function createApiRouter() {
         res.json(await getProblem(db, req.params.id))
     })
 
-    r.post('/api/problem', async (req, res) => {
+    r.patch('/api/problem/:id', async (req, res) => {
+        const id = req.params.id as ProblemId
+
+        const user = await getRequestUser(req)
+        // l'utente deve essere loggato
+        if (!user) {
+            res.sendStatus(StatusCodes.UNAUTHORIZED)
+            return
+        }
+
+        // l'utente deve essere un admin o un moderatore
+        if (!isAdministrator(user.role)) {
+            res.sendStatus(StatusCodes.UNAUTHORIZED)
+            return
+        }
+
+        // uno studente può modificare solo il campo "content"
+        if (user.role === 'moderator' && !validateObjectKeys<keyof ProblemModel>(req.body, ['content'])) {
+            res.status(StatusCodes.UNAUTHORIZED)
+            res.send(`a moderator can only modify the field "content"`)
+            return
+        }
+
+        await updateProblem(db, id, req.body)
+
+        res.send({ status: 'ok' })
+    })
+
+    r.delete('/api/problem/:id', async (req, res) => {
+        const id = req.params.id as ProblemId
+
         const user = await getRequestUser(req)
         if (!user) {
             res.sendStatus(StatusCodes.UNAUTHORIZED)
             return
         }
+
+        if (user.role !== 'admin') {
+            res.status(StatusCodes.UNAUTHORIZED)
+            res.send(`only an admin can delete this entity`)
+            return
+        }
+
+        await deleteProblem(db, id)
+
+        res.send({ status: 'ok' })
+    })
+
+    r.post('/api/problem', async (req, res) => {
+        const user = await getRequestUser(req)
+        // l'utente deve essere loggato
+        if (!user) {
+            res.sendStatus(StatusCodes.UNAUTHORIZED)
+            return
+        }
+        // Solo un amministratore può inviare nuovi problemi
         if (user.role !== 'admin' && user.role !== 'moderator') {
             res.sendStatus(StatusCodes.UNAUTHORIZED)
             return
         }
+        // Il contenuto del problema deve essere non vuoto
+        if (req.body.content.trim().length === 0) {
+            res.sendStatus(StatusCodes.UNPROCESSABLE_ENTITY)
+            return
+        }
+
+        const problemNextId = (await getProblems(db)).map(p => parseInt(p.id)).reduce((acc, v) => Math.max(acc, v), 1) + 1
 
         const id = await createProblem(db, {
+            title: req.body.title ?? `Problema ${problemNextId}`,
             content: req.body.content,
             createdBy: user.id,
         })
@@ -236,10 +294,7 @@ export async function createApiRouter() {
             return
         }
         // un moderatore può modificare solo i campi "content", "visible", "status"
-        if (
-            user.role === 'moderator' &&
-            !validateObjectKeys<keyof SolutionModel>(req.body, ['content', 'status', 'visible'])
-        ) {
+        if (user.role === 'moderator' && !validateObjectKeys<keyof SolutionModel>(req.body, ['content', 'status', 'visible'])) {
             res.status(StatusCodes.UNAUTHORIZED)
             res.send(`a moderator can only modify the fields "content", "visible", "status"`)
             return
@@ -250,6 +305,35 @@ export async function createApiRouter() {
         res.json({ status: 'ok' })
     })
 
+    r.delete('/api/solution/:id', async (req, res) => {
+        const id = req.params.id as SolutionId
+
+        const user = await getRequestUser(req)
+        // l'utente deve essere loggato
+        if (!user) {
+            res.sendStatus(StatusCodes.UNAUTHORIZED)
+            return
+        }
+
+        const solution = await getSolution(db, id)
+
+        // la soluzione deve esistere
+        if (solution === null) {
+            res.sendStatus(StatusCodes.NOT_FOUND)
+            return
+        }
+
+        // solo un admin può eliminare le soluzioni degli utenti
+        if (user.role !== 'admin' && solution.sentBy !== user.id) {
+            res.sendStatus(StatusCodes.UNAUTHORIZED)
+            return
+        }
+
+        await deleteSolution(db, id)
+
+        res.send({ status: 'ok' })
+    })
+
     r.get('/api/user/:id', async (req, res) => {
         const user = await getRequestUser(req)