Iris: Fix an error related to Iris settings when tutors navigate to course management
#9725
Conversation
github-actions
bot
added
server
WalkthroughThe changes in this pull request involve modifications to the Changes
Possibly related PRs
Suggested labels
Suggested reviewers
Warning There were issues while running some tools. Please review the errors and either fix the tool’s configuration or disable the tool if it’s a critical failure. 🔧 pmdsrc/main/java/de/tum/cit/aet/artemis/iris/web/IrisSettingsResource.javaThe following rules are missing or misspelled in your ruleset file category/vm/bestpractices.xml: BooleanInstantiation, DontImportJavaLang, DuplicateImports, EmptyFinallyBlock, EmptyIfStmt, EmptyInitializer, EmptyStatementBlock, EmptyStatementNotInLoop, EmptySwitchStatements, EmptySynchronizedBlock, EmptyTryBlock, EmptyWhileStmt, ExcessiveClassLength, ExcessiveMethodLength, ImportFromSamePackage, MissingBreakInSwitch, SimplifyBooleanAssertion. Please check your ruleset configuration. 📜 Recent review detailsConfiguration used: .coderabbit.yaml 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Outside diff range and nitpick comments (3)
src/main/java/de/tum/cit/aet/artemis/iris/web/IrisSettingsResource.java (3)
Line range hint
92-98: Remove redundant authorization check.There's a logical inconsistency in the authorization checks:
- The
@EnforceAtLeastTutorInExerciseannotation already ensures the user has at least TUTOR role- The subsequent
checkHasAtLeastRoleForExerciseElseThrow(Role.STUDENT, ...)check is redundant since tutors inherently have higher privileges than studentsApply this diff to remove the redundant check:
@EnforceAtLeastTutorInExercise public ResponseEntity<IrisSettings> getRawExerciseSettings(@PathVariable Long exerciseId) { var exercise = exerciseRepository.findByIdElseThrow(exerciseId); - var user = userRepository.getUserWithGroupsAndAuthorities(); - authCheckService.checkHasAtLeastRoleForExerciseElseThrow(Role.STUDENT, exercise, user); var combinedIrisSettings = irisSettingsService.getRawIrisSettingsFor(exercise); return ResponseEntity.ok(combinedIrisSettings); }
Line range hint
78-98: Consider implementing a consistent settings access model.The current changes create an architectural inconsistency in how settings are exposed:
getCourseSettingsandgetExerciseSettingsimplement reduced views for non-editors- The raw settings endpoints now expose full settings to tutors without any filtering
Consider implementing a consistent approach:
- Create a service method that returns filtered raw settings based on user role
- Apply this filtering consistently across all settings endpoints
- Document the security model clearly, specifying which roles can access what level of settings detail
Would you like me to propose a detailed design for implementing role-based settings filtering?
Based on the gathered information, I can now provide a final response:
Security concern: Raw settings contain sensitive authentication tokens and API configurations
The raw settings contain sensitive data that should not be exposed to tutors:
- Authentication tokens for Pyris integration (
authenticationTokenin settings)- API secrets and credentials for service communication
- Configuration that determines system security boundaries
The existing endpoint
getCourseSettingsalready implements proper security filtering for non-editors by usinggetReducedparameter. The raw settings endpoint should maintain the same security level as it exposes unfiltered configuration.Recommendation: Keep
@EnforceAtLeastEditorInCoursefor the raw settings endpoint to align with the existing security model where only editors and above can access sensitive configuration.🔗 Analysis chain
Line range hint
78-83: Verify security implications of exposing raw course settings to tutors.While this change aligns with the PR's objective to fix tutor permissions, exposing raw course settings to tutors requires careful consideration:
- The method provides unrestricted access to raw settings, unlike
getCourseSettingswhich has logic to show reduced settings to non-editors.- Consider whether tutors should see the complete raw settings or if a filtered view would be more appropriate.
Let me gather more information about the security implications by checking how the raw settings are used and what sensitive data they might contain.
Let me gather more information about the IrisSettings class and its usage to understand what sensitive data it might contain.
Let me gather one final piece of information about the authentication tokens and sensitive configuration in the settings.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Search for any existing security checks or filtering for raw settings access rg -A 5 "getRawIrisSettingsFor.*course" # Look for any existing tutor-specific handling in the codebase ast-grep --pattern 'class $_ { $$$ @EnforceAtLeastTutorInCourse $$$ }'Length of output: 3466
Script:
#!/bin/bash # Check the IrisCourseSettings class to understand what data it contains rg -l "class IrisCourseSettings" rg -A 20 "class IrisCourseSettings" # Check if there's any filtering/security logic in getCourseSettings rg -A 10 "getCourseSettings.*course" # Check if there are any other endpoints with similar security annotations ast-grep --pattern '@EnforceAtLeastTutorInCourse $$$ public $_ get$_($$$) { $$$ }'Length of output: 295415
Script:
#!/bin/bash # Check IrisSettings class and its fields rg -A 10 "class IrisSettings" # Check if there are any other endpoints that expose raw settings rg -A 5 "getRawIrisSettingsFor" # Check if there are any security-sensitive fields in the settings rg -A 5 "class IrisCourseSettings|class IrisExerciseSettings|class IrisChatSettings|class IrisLectureIngestionSettings|class IrisCompetencyGenerationSettings"Length of output: 24418
Script:
#!/bin/bash # Check for sensitive fields in IrisSettings and related classes rg -A 5 "authenticationToken|apiKey|secret|password|credential|token" src/main/java/de/tum/cit/aet/artemis/iris/ # Check if there's any filtering logic in the service rg -A 10 "getCombinedIrisSettingsFor" src/main/java/de/tum/cit/aet/artemis/iris/service/settings/Length of output: 41740
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
📒 Files selected for processing (1)
src/main/java/de/tum/cit/aet/artemis/iris/web/IrisSettingsResource.java(3 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
src/main/java/de/tum/cit/aet/artemis/iris/web/IrisSettingsResource.java (1)
Pattern src/main/java/**/*.java: naming:CamelCase; principles:{single_responsibility,small_methods,no_duplication}; db:{perf_queries,datetime_not_timestamp}; rest:{stateless,singleton,delegate_logic,http_only,minimal_dtos}; dtos:{java_records,no_entities,min_data,single_resp}; di:constructor_injection; kiss:simple_code; file_handling:os_indep_paths; practices:{least_access,avoid_transactions,code_reuse,static_member_ref,prefer_primitives}; sql:{param_annotation,uppercase,avoid_subqueries};java:avoid_star_imports
🔇 Additional comments (1)
src/main/java/de/tum/cit/aet/artemis/iris/web/IrisSettingsResource.java (1)
20-20: LGTM: Import statements are correctly added.
The new security annotation imports align with the PR's objective to adjust tutor permissions.
Also applies to: 23-23
HawKhiem
temporarily deployed
to
artemis-test5.artemis.cit.tum.de
GitHub Actions
Inactive
HawKhiem
temporarily deployed
to
artemis-test3.artemis.cit.tum.de
GitHub Actions
Inactive
bassner
changed the title
Iris: Fix Course Management View Permission Bug as Tutor UserIris: Fix an error related to Iris settings when tutors navigate to course management
bassner
deleted the
bugfix/iris/fix-course-management-view-permission-bug-as-tutor
branch
Checklist
General
Server
Changes affecting Programming Exercises
Motivation and Context
The changes were needed to fix Issue#7797. The bug was that every time a tutor opened the setting, a not allowed error was displayed.
Description
The problem was that the Iris Settings permission was checked for Tutors, but the permission to check the settings was only allowed for accounts with at least editors. This has been fixed by adding the correct permission.
Steps for Testing
Prerequisites:
Testserver States
Note
These badges show the state of the test servers.
Green = Currently available, Red = Currently locked
Click on the badges to get to the test servers.
Review Progress
Performance Review
Code Review
Manual Tests
Exam Mode Test
Performance Tests
Summary by CodeRabbit
New Features
Bug Fixes