merge prod to main

2026-05-16 13:44:12 -04:00
parent 663c0cdbda
commit b32fb853f6
901 changed files with 11241 additions and 1340 deletions
@@ -224,6 +224,10 @@ class FilesController extends Controller
            throw PageNotFoundException::forPageNotFound();
        }

+        if (!$this->canAccessExamDraftFile($name, $subdir)) {
+            return $this->response->setStatusCode(403, 'You are not allowed to access this file.');
+        }
+
        $mime = 'application/octet-stream';
        if (function_exists('finfo_open')) {
            $fi = finfo_open(FILEINFO_MIME_TYPE);
@@ -271,8 +275,8 @@ class FilesController extends Controller

    private function buildDraftDownloadName(string $filename, string $subdir): string
    {
-        $column = $subdir === 'finals' ? 'final_file' : 'teacher_file';
        $db = Database::connect();
+        $column = $subdir === 'finals' ? 'final_file' : $this->resolveExamDraftFileColumn($db);
        $row = $db->table('exam_drafts ed')
            ->select('ed.version, ed.exam_type, ed.class_section_id, cs.class_section_name')
            ->join('classSection cs', 'cs.class_section_id = ed.class_section_id', 'left')
@@ -301,4 +305,124 @@ class FilesController extends Controller
        $value = trim($value, '_');
        return $value === '' ? 'Exam' : mb_strtolower($value);
    }
+
+    private function resolveExamDraftFileColumn($db): string
+    {
+        try {
+            $fields = $db->getFieldNames('exam_drafts');
+            if (in_array('teacher_file', $fields, true)) {
+                return 'teacher_file';
+            }
+            if (in_array('author_file', $fields, true)) {
+                return 'author_file';
+            }
+        } catch (\Throwable $e) {
+            log_message('error', 'FilesController::resolveExamDraftFileColumn error: ' . $e->getMessage());
+        }
+        return 'teacher_file';
+    }
+
+    private function resolveExamDraftAuthorIdColumn($db): string
+    {
+        try {
+            $fields = $db->getFieldNames('exam_drafts');
+            if (in_array('teacher_id', $fields, true)) {
+                return 'teacher_id';
+            }
+            if (in_array('author_id', $fields, true)) {
+                return 'author_id';
+            }
+        } catch (\Throwable $e) {
+            log_message('error', 'FilesController::resolveExamDraftAuthorIdColumn error: ' . $e->getMessage());
+        }
+
+        return 'teacher_id';
+    }
+
+    private function canAccessExamDraftFile(string $filename, string $subdir): bool
+    {
+        $userId = (int) (session()->get('user_id') ?? 0);
+        if ($userId <= 0) {
+            return false;
+        }
+
+        $role = strtolower((string) (session()->get('role') ?? ''));
+        if (in_array($role, ['admin', 'administrator', 'principal'], true)) {
+            return true;
+        }
+
+        $db = Database::connect();
+        $fileColumn = $subdir === 'finals' ? 'final_file' : $this->resolveExamDraftFileColumn($db);
+        $authorIdColumn = $this->resolveExamDraftAuthorIdColumn($db);
+
+        $draft = $db->table('exam_drafts ed')
+            ->select('ed.class_section_id, ed.school_year, ed.semester, ed.status, ed.' . $authorIdColumn . ' AS draft_author_id')
+            ->where('ed.' . $fileColumn, $filename)
+            ->limit(1)
+            ->get()
+            ->getRowArray();
+
+        if (empty($draft)) {
+            return false;
+        }
+
+        $authorId = (int) ($draft['draft_author_id'] ?? 0);
+        if ($authorId > 0 && $authorId === $userId) {
+            return true;
+        }
+
+        $classSectionId = (int) ($draft['class_section_id'] ?? 0);
+        if ($classSectionId <= 0) {
+            return false;
+        }
+
+        $status = strtolower(trim((string) ($draft['status'] ?? '')));
+        if ($subdir === 'drafts' && $status === 'draft') {
+            return false;
+        }
+
+        $currentSchoolYear = trim((string) (session()->get('school_year') ?? ''));
+        $currentSemester = trim((string) (session()->get('semester') ?? ''));
+        $draftSchoolYear = trim((string) ($draft['school_year'] ?? ''));
+        $draftSemester = trim((string) ($draft['semester'] ?? ''));
+
+        $hasCurrentAssignment = $db->table('teacher_class')
+            ->select('id')
+            ->where('teacher_id', $userId)
+            ->where('class_section_id', $classSectionId);
+
+        if ($currentSchoolYear !== '') {
+            $hasCurrentAssignment->where('school_year', $currentSchoolYear);
+        }
+
+        $hasCurrentAssignment = $hasCurrentAssignment->limit(1)->countAllResults() > 0;
+
+        if ($hasCurrentAssignment) {
+            if ($subdir === 'finals') {
+                return true;
+            }
+
+            return $draftSchoolYear === '' || $currentSchoolYear === '' || $draftSchoolYear === $currentSchoolYear;
+        }
+
+        $assignmentQuery = $db->table('teacher_class')
+            ->select('id')
+            ->where('teacher_id', $userId)
+            ->where('class_section_id', $classSectionId);
+
+        if ($draftSchoolYear !== '') {
+            $assignmentQuery->where('school_year', $draftSchoolYear);
+        }
+
+        $hasDraftYearAssignment = $assignmentQuery->limit(1)->countAllResults() > 0;
+        if (!$hasDraftYearAssignment) {
+            return false;
+        }
+
+        if ($subdir === 'finals') {
+            return true;
+        }
+
+        return $draftSemester === '' || $currentSemester === '' || $draftSemester === $currentSemester;
+    }
 }