feat: add deliberation schemas for session creation, update, and deci…#35
Merged
Conversation
|
Warning Review limit reached
More reviews will be available in 50 minutes and 24 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis PR introduces a complete student deliberation (approval/decision) module across database, backend API, and frontend. It adds new schema with deliberation sessions and decisions, validates inputs via Zod, implements five async controllers with role-based access control, exposes API endpoints under the class notes router, and replaces the deliberation UI placeholder with a fully functional React component using React Query for state management. ChangesStudent Deliberation Workflow
Sequence Diagram(s)sequenceDiagram
participant Client
participant Route
participant Auth
participant Controller
participant Prisma
Client->>Route: POST/PUT /deliberations
Route->>Auth: authorizeRoles
Auth->>Route: verify role/school
Route->>Controller: handle request
Controller->>Controller: validate with Zod
Controller->>Prisma: query/create/update session/decision
Prisma->>Controller: return result or error
Controller->>Route: send response
Route->>Client: 200/400/403/404/500
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/api/src/controllers/deliberationController.ts`:
- Around line 190-205: The update call on prisma.deliberationSession in the
deliberationController is using the wrong field name `perdiodeLabel`, so updates
from `payload.periodeLabel` are ignored; fix it by changing the key in the
update payload to the correct `periodeLabel` (inside the object constructed
where you currently spread { perdiodeLabel: payload.periodeLabel }) so that
prisma.deliberationSession.update correctly applies the period label change and
returns the updatedSession with decisions.
In `@apps/api/src/routes/notesRoute.ts`:
- Around line 132-174: The route-level authorization in notesRoute.ts currently
allows Role.USER but not Role.PROF, while deliberationController.ts's canEdit()
allows Role.SUDO_ADMIN, Role.ADMIN, Role.PROF; update the authorizeRoles(...)
calls for the four deliberation endpoints (the handlers
createDeliberationSession, updateDeliberationSession,
upsertDeliberationDecisions, validateDeliberationSession) to match canEdit() by
replacing Role.USER with Role.PROF so the middleware and canEdit() enforce the
same set: Role.SUDO_ADMIN, Role.ADMIN, Role.PROF.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 0e1b52f5-aeec-48b2-9459-6f4ca3b84f1f
⛔ Files ignored due to path filters (14)
apps/api/src/generated/prisma/browser.tsis excluded by!**/generated/**apps/api/src/generated/prisma/client.tsis excluded by!**/generated/**apps/api/src/generated/prisma/commonInputTypes.tsis excluded by!**/generated/**apps/api/src/generated/prisma/enums.tsis excluded by!**/generated/**apps/api/src/generated/prisma/internal/class.tsis excluded by!**/generated/**apps/api/src/generated/prisma/internal/prismaNamespace.tsis excluded by!**/generated/**apps/api/src/generated/prisma/internal/prismaNamespaceBrowser.tsis excluded by!**/generated/**apps/api/src/generated/prisma/models.tsis excluded by!**/generated/**apps/api/src/generated/prisma/models/Classe.tsis excluded by!**/generated/**apps/api/src/generated/prisma/models/DeliberationDecision.tsis excluded by!**/generated/**apps/api/src/generated/prisma/models/DeliberationSession.tsis excluded by!**/generated/**apps/api/src/generated/prisma/models/Eleve.tsis excluded by!**/generated/**apps/api/src/generated/prisma/models/School.tsis excluded by!**/generated/**apps/api/src/generated/prisma/models/User.tsis excluded by!**/generated/**
📒 Files selected for processing (7)
apps/api/prisma/migrations/20260604065820_add_deliberation_module/migration.sqlapps/api/prisma/migrations/20260608071106_fix_commentaire_deliberation_decision/migration.sqlapps/api/prisma/schema.prismaapps/api/src/controllers/deliberationController.tsapps/api/src/routes/notesRoute.tsapps/api/src/schemas/deliberationSchema.tsapps/web/src/components/notes/DeliberationTab.tsx
Comment on lines
+132
to
+174
| /** | ||
| * POST /api/classes/:classeId/notes/deliberations | ||
| * Modification : USER, ADMIN, SUDO_ADMIN | ||
| */ | ||
| router.post( | ||
| "/deliberations", | ||
| authenticate, | ||
| authorizeRoles(Role.SUDO_ADMIN, Role.ADMIN, Role.USER), | ||
| createDeliberationSession, | ||
| ); | ||
|
|
||
| /** | ||
| * PUT /api/classes/:classeId/notes/deliberations/:sessionId | ||
| * Modification : USER, ADMIN, SUDO_ADMIN | ||
| */ | ||
| router.put( | ||
| "/deliberations/:sessionId", | ||
| authenticate, | ||
| authorizeRoles(Role.SUDO_ADMIN, Role.ADMIN, Role.USER), | ||
| updateDeliberationSession, | ||
| ); | ||
|
|
||
| /** | ||
| * PUT /api/classes/:classeId/notes/deliberations/:sessionId/decisions | ||
| * Modification : USER, ADMIN, SUDO_ADMIN | ||
| */ | ||
| router.put( | ||
| "/deliberations/:sessionId/decisions", | ||
| authenticate, | ||
| authorizeRoles(Role.SUDO_ADMIN, Role.ADMIN, Role.USER), | ||
| upsertDeliberationDecisions, | ||
| ); | ||
|
|
||
| /** | ||
| * POST /api/classes/:classeId/notes/deliberations/:sessionId/validate | ||
| * Validation finale : USER, ADMIN, SUDO_ADMIN | ||
| */ | ||
| router.post( | ||
| "/deliberations/:sessionId/validate", | ||
| authenticate, | ||
| authorizeRoles(Role.SUDO_ADMIN, Role.ADMIN, Role.USER), | ||
| validateDeliberationSession, | ||
| ); |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify the canEdit function in the controller
rg -n "function canEdit" apps/api/src/controllers/deliberationController.ts -A 3
# Check if there's a consistent pattern for similar routes
rg -n "authorizeRoles.*PROF" apps/api/src/routes/Repository: codeline401/school-mgt-saas
Length of output: 2228
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the exact route middleware definitions around lines ~120-180
nl -ba apps/api/src/routes/notesRoute.ts | sed -n '100,200p'
# Show canEdit definition (already found) and where it’s used in deliberation controller
nl -ba apps/api/src/controllers/deliberationController.ts | sed -n '1,220p'
# Specifically find call sites of canEdit in the controller
rg -n "canEdit\(" apps/api/src/controllers/deliberationController.ts -nRepository: codeline401/school-mgt-saas
Length of output: 114
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# routes: exact middleware definitions for deliberation endpoints
cat -n apps/api/src/routes/notesRoute.ts | sed -n '100,220p'
# controller: canEdit definition and relevant sections
cat -n apps/api/src/controllers/deliberationController.ts | sed -n '1,260p'
# where canEdit is used
rg -n "canEdit\\(" apps/api/src/controllers/deliberationController.tsRepository: codeline401/school-mgt-saas
Length of output: 14159
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the validateDeliberationSession implementation area (around the last canEdit call)
cat -n apps/api/src/controllers/deliberationController.ts | sed -n '260,420p'Repository: codeline401/school-mgt-saas
Length of output: 5987
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n "createDeliberationSession|updateDeliberationSession|upsertDeliberationDecisions|validateDeliberationSession" apps/api/src/routes/Repository: codeline401/school-mgt-saas
Length of output: 611
Role authorization mismatch for deliberation modification endpoints.
apps/api/src/routes/notesRoute.tsauthorizes modification endpoints (/deliberations,/deliberations/:sessionId,/deliberations/:sessionId/decisions,/deliberations/:sessionId/validate) forRole.SUDO_ADMIN, Role.ADMIN, Role.USER(noRole.PROF).apps/api/src/controllers/deliberationController.tscanEdit()allowsRole.SUDO_ADMIN, Role.ADMIN, Role.PROF(noRole.USER) and each modification handler returns403whencanEdit()fails.
Consequence: PROF is blocked at middleware (403) and USER passes middleware but is rejected by canEdit() (403).
Align authorizeRoles(...) in the routes with canEdit() access policy.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@apps/api/src/routes/notesRoute.ts` around lines 132 - 174, The route-level
authorization in notesRoute.ts currently allows Role.USER but not Role.PROF,
while deliberationController.ts's canEdit() allows Role.SUDO_ADMIN, Role.ADMIN,
Role.PROF; update the authorizeRoles(...) calls for the four deliberation
endpoints (the handlers createDeliberationSession, updateDeliberationSession,
upsertDeliberationDecisions, validateDeliberationSession) to match canEdit() by
replacing Role.USER with Role.PROF so the middleware and canEdit() enforce the
same set: Role.SUDO_ADMIN, Role.ADMIN, Role.PROF.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…sion upsert
Summary by CodeRabbit
Release Notes