Instructors an also view students' time logs

Backend queries have been adjusted to retrieve limited version of the
groups and students data. Instructors should only have access to groups
and students that are participating in the latest configuration (time
period) of the course.

Configuration and time log information is retrieved for instructors in
full.

backend/controllers/configurations.js

@@ -1,6 +1,6 @@
 const configurationsRouter = require('express').Router()
 const db = require('../models/index')
-const { checkAdmin, checkLogin } = require('../middleware')
+const { checkAdmin, checkLogin, checkInstructor } = require('../middleware')
 
 // determines which associated models are returned with configuration
 const includeArray = [
@@ -154,7 +154,7 @@ configurationsRouter.put('/:id', checkAdmin, (req, res) => {
   updateChecks(req, res)
 })
 
-configurationsRouter.get('/', checkAdmin, (req, res) => {
+configurationsRouter.get('/', checkInstructor, (req, res) => {
   db.Configuration.findAll({
     include: includeArray,
   })

backend/controllers/groups.js

@@ -1,7 +1,7 @@
 const router = require('express').Router()
 const { Op } = require('sequelize')
 const db = require('../models')
-const { checkAdmin, checkLogin } = require('../middleware')
+const { checkAdmin, checkInstructor, checkLogin } = require('../middleware')
 
 const formatGroup = (dbGroup) => {
   // pluck only fields we know and need, map student object to student_number
@@ -27,19 +27,39 @@ const formatGroup = (dbGroup) => {
   }
 }
 
-router.get('/', checkAdmin, async (req, res) => {
-  const groups = await db.Group.findAll({
-    include: [
-      {
-        as: 'students',
-        model: db.User,
-        attributes: ['student_number'], // only select the student number
-        through: { attributes: [] } // don't ignore junction table stuff
-      }
-    ]
-  })
-  const deserialized = groups.map(formatGroup)
-  res.json(deserialized)
+router.get('/', checkInstructor, async (req, res) => {
+  if (req.user.admin) {
+    const groups = await db.Group.findAll({
+      include: [
+        {
+          as: 'students',
+          model: db.User,
+          attributes: ['student_number'], // only select the student number
+          through: { attributes: [] } // don't ignore junction table stuff
+        }
+      ]
+    })
+    const deserialized = groups.map(formatGroup)
+    res.json(deserialized)
+  } else {
+    const latestConfiguration = await db.Configuration.findOne({
+      order: [['createdAt', 'DESC']]
+    })
+
+    const groups = await db.Group.findAll({
+      where: { configuration_id: [latestConfiguration.id] },
+      include: [
+        {
+          as: 'students',
+          model: db.User,
+          attributes: ['student_number'], // only select the student number
+          through: { attributes: [] } // don't ignore junction table stuff
+        }
+      ]
+    })
+    const deserialized = groups.map(formatGroup)
+    res.json(deserialized)
+  }
 })
 
 const isNil = (obj) => obj === null || obj === undefined

backend/controllers/timeLogs.js

@@ -171,7 +171,7 @@ const fetchAllFromDb = async () => {
 
 timeLogsRouter.get('/', checkLogin, async (req, res) => {
   try {
-    if (req.user.admin) {
+    if (req.user.admin || req.user.instructor) {
       const timeLogs = await fetchAllFromDb()
       return res.status(200).json(timeLogs)
     }

backend/controllers/users.js

@@ -1,6 +1,6 @@
 const usersRouter = require('express').Router()
 const db = require('../models/index')
-const { checkLogin, checkAdmin } = require('../middleware')
+const { checkLogin, checkInstructor, checkAdmin } = require('../middleware')
 
 usersRouter.put('/:studentNumber', checkLogin, async (req, res) => {
   const { email } = req.body
@@ -31,13 +31,39 @@ usersRouter.put('/:studentNumber', checkLogin, async (req, res) => {
   }
 })
 
-usersRouter.get('/', checkAdmin, async (req, res) => {
-  try {
-    const users = await db.User.findAll()
-    res.status(200).json(users)
-  } catch (error) {
-    console.log(error)
-    res.status(500).json({ error: 'Something is wrong... try reloading the page' })
+// If the user is an instructor, the get all of the student numbers for
+// the students in the current configuration, then gets the corresponding
+// users from the database.
+usersRouter.get('/', checkInstructor, async (req, res) => {
+  if (req.user.admin) {
+    try {
+      const users = await db.User.findAll()
+      res.status(200).json(users)
+    } catch (error) {
+      console.log(error)
+      res.status(500).json({ error: 'Something is wrong... try reloading the page' })
+    }
+  } else {
+    try {
+      const configuration = await db.Configuration.findOne({
+        order: [['createdAt', 'DESC']]
+      })
+      const groups = await db.Group.findAll({
+        where: { configurationId: configuration.id },
+        include: [{ model: db.User, as: 'students' }],
+      })
+      const studentNumbersInGroups = groups.map(
+        group => group.students.map(
+          student => student.student_number)).flat()
+
+      const users = await db.User.findAll({
+        where: { student_number: studentNumbersInGroups }
+      })
+      res.status(200).json(users)
+    } catch (error) {
+      console.log(error)
+      res.status(500).json({ error: 'Something is wrong... try reloading the page' })
+    }
   }
 })