From 0d48dac8c33213295020e4c82077c4b7715f3eeb Mon Sep 17 00:00:00 2001 From: Eric Bouchut Date: Mon, 13 Jul 2026 10:14:42 +0200 Subject: [PATCH 1/4] feat(course): Add the published course catalogue Students can browse the published courses at /courses and open a course page listing its published lessons. CourseService owns the student visibility rule: PUBLISHED is visible, an enrolled student keeps read access to an ARCHIVED course, DRAFT is never visible, and invisible content answers 404 so drafts do not leak. New derived queries: lessons by course and status in reading order, enrollment by (user, course). The navigation gains a Courses entry for logged-in users, and the security matrix tightens /courses from gate-pass 404 to 200 now that the controller exists. --- .../learndev/course/CourseController.java | 63 ++++++++++++++ .../learndev/course/CourseService.java | 87 +++++++++++++++++++ .../repository/EnrollmentRepository.java | 4 + .../course/repository/LessonRepository.java | 4 + .../resources/templates/courses/catalog.html | 32 +++++++ .../resources/templates/courses/detail.html | 30 +++++++ .../resources/templates/fragments/layout.html | 6 +- .../common/config/SecurityMatrixTest.java | 2 +- .../CourseDomainRepositoryTest.java | 47 ++++++++++ 9 files changed, 272 insertions(+), 3 deletions(-) create mode 100644 src/main/java/com/ericbouchut/learndev/course/CourseController.java create mode 100644 src/main/java/com/ericbouchut/learndev/course/CourseService.java create mode 100644 src/main/resources/templates/courses/catalog.html create mode 100644 src/main/resources/templates/courses/detail.html diff --git a/src/main/java/com/ericbouchut/learndev/course/CourseController.java b/src/main/java/com/ericbouchut/learndev/course/CourseController.java new file mode 100644 index 0000000..81c16fa --- /dev/null +++ b/src/main/java/com/ericbouchut/learndev/course/CourseController.java @@ -0,0 +1,63 @@ +package com.ericbouchut.learndev.course; + +import com.ericbouchut.learndev.course.entity.Course; +import com.ericbouchut.learndev.user.entity.User; +import com.ericbouchut.learndev.user.repository.UserRepository; +import org.springframework.stereotype.Controller; +import org.springframework.ui.Model; +import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.PathVariable; + +import java.security.Principal; + +/** + * Web endpoints of the student course experience: the published + * course catalogue and the course detail page. Access requires + * authentication ({@code /courses/**} in the security rules); visibility of + * individual courses is decided by {@link CourseService}. + */ +@Controller +public class CourseController { + + private final CourseService courseService; + private final UserRepository users; + + public CourseController(CourseService courseService, UserRepository users) { + this.courseService = courseService; + this.users = users; + } + + /** + * Display the catalogue of published courses. + * + * @param model receives the published courses + * @return the catalogue view name + */ + @GetMapping("/courses") + public String catalogue(Model model) { + model.addAttribute("courses", courseService.catalogue()); + return "courses/catalog"; + } + + /** + * Display one course with its published lessons. + * + * @param courseId the course to show + * @param principal the logged-in student (drives visibility) + * @param model receives the course and its readable lessons + * @return the course detail view name + */ + @GetMapping("/courses/{courseId}") + public String detail(@PathVariable Long courseId, Principal principal, Model model) { + Course course = courseService.visibleCourse(courseId, currentUser(principal)); + model.addAttribute("course", course); + model.addAttribute("lessons", courseService.publishedLessons(course)); + return "courses/detail"; + } + + private User currentUser(Principal principal) { + return users.findByUsername(principal.getName()) + .orElseThrow(() -> new IllegalStateException( + "Authenticated user not found: " + principal.getName())); + } +} diff --git a/src/main/java/com/ericbouchut/learndev/course/CourseService.java b/src/main/java/com/ericbouchut/learndev/course/CourseService.java new file mode 100644 index 0000000..8f1ddb2 --- /dev/null +++ b/src/main/java/com/ericbouchut/learndev/course/CourseService.java @@ -0,0 +1,87 @@ +package com.ericbouchut.learndev.course; + +import com.ericbouchut.learndev.course.entity.Course; +import com.ericbouchut.learndev.course.entity.Lesson; +import com.ericbouchut.learndev.course.entity.PublicationStatus; +import com.ericbouchut.learndev.course.repository.CourseRepository; +import com.ericbouchut.learndev.course.repository.EnrollmentRepository; +import com.ericbouchut.learndev.course.repository.LessonRepository; +import com.ericbouchut.learndev.user.entity.User; +import org.springframework.http.HttpStatus; +import org.springframework.stereotype.Service; +import org.springframework.transaction.annotation.Transactional; +import org.springframework.web.server.ResponseStatusException; + +import java.util.List; + +/** + * Read side of the course catalogue, applying the student visibility rule: + * a student sees {@code PUBLISHED} courses; a student who is enrolled keeps + * read access to the course and its published lessons if the course is later + * {@code ARCHIVED} (content continuity); {@code DRAFT} content is never + * visible to students. Invisible content surfaces as 404, not 403, so the + * URL space does not leak which drafts exist. + */ +@Service +@Transactional(readOnly = true) +public class CourseService { + + private final CourseRepository courses; + private final LessonRepository lessons; + private final EnrollmentRepository enrollments; + + public CourseService( + CourseRepository courses, + LessonRepository lessons, + EnrollmentRepository enrollments + ) { + this.courses = courses; + this.lessons = lessons; + this.enrollments = enrollments; + } + + /** The public catalogue: published courses only. */ + public List catalogue() { + return courses.findByStatus(PublicationStatus.PUBLISHED); + } + + /** + * The course as visible to the given student, or 404 when the course + * does not exist or the visibility rule (see class Javadoc) hides it. + */ + public Course visibleCourse(Long courseId, User student) { + Course course = courses.findById(courseId) + .orElseThrow(CourseService::notFound); + if (course.getStatus() == PublicationStatus.PUBLISHED) { + return course; + } + boolean enrolledInArchived = + course.getStatus() == PublicationStatus.ARCHIVED + && enrollments.findByUserAndCourse(student, course).isPresent(); + if (enrolledInArchived) { + return course; + } + throw notFound(); + } + + /** The lessons of a course a student may read, in reading order. */ + public List publishedLessons(Course course) { + return lessons.findByCourseAndStatusOrderByPositionAsc( + course, PublicationStatus.PUBLISHED); + } + + /** + * One published lesson of the given course, or 404 when the lesson does + * not exist, is not published, or belongs to another course. + */ + public Lesson publishedLesson(Course course, Long lessonId) { + return lessons.findById(lessonId) + .filter(lesson -> lesson.getCourse().getCourseId().equals(course.getCourseId())) + .filter(lesson -> lesson.getStatus() == PublicationStatus.PUBLISHED) + .orElseThrow(CourseService::notFound); + } + + private static ResponseStatusException notFound() { + return new ResponseStatusException(HttpStatus.NOT_FOUND); + } +} diff --git a/src/main/java/com/ericbouchut/learndev/course/repository/EnrollmentRepository.java b/src/main/java/com/ericbouchut/learndev/course/repository/EnrollmentRepository.java index 42186f8..088561a 100644 --- a/src/main/java/com/ericbouchut/learndev/course/repository/EnrollmentRepository.java +++ b/src/main/java/com/ericbouchut/learndev/course/repository/EnrollmentRepository.java @@ -7,12 +7,16 @@ import org.springframework.data.jpa.repository.JpaRepository; import java.util.List; +import java.util.Optional; public interface EnrollmentRepository extends JpaRepository { /** A student's enrollments (their personal course list). */ List findByUser(User user); + /** The single enrollment of a student in a course, if any. */ + Optional findByUserAndCourse(User user, Course course); + /** The roster of a course. */ List findByCourse(Course course); } diff --git a/src/main/java/com/ericbouchut/learndev/course/repository/LessonRepository.java b/src/main/java/com/ericbouchut/learndev/course/repository/LessonRepository.java index ee9e3d4..b389bed 100644 --- a/src/main/java/com/ericbouchut/learndev/course/repository/LessonRepository.java +++ b/src/main/java/com/ericbouchut/learndev/course/repository/LessonRepository.java @@ -2,6 +2,7 @@ import com.ericbouchut.learndev.course.entity.Course; import com.ericbouchut.learndev.course.entity.Lesson; +import com.ericbouchut.learndev.course.entity.PublicationStatus; import org.springframework.data.jpa.repository.JpaRepository; import java.util.List; @@ -10,4 +11,7 @@ public interface LessonRepository extends JpaRepository { /** The lessons of a course in reading order (position ascending). */ List findByCourseOrderByPositionAsc(Course course); + + /** The lessons of a course in one status, in reading order. */ + List findByCourseAndStatusOrderByPositionAsc(Course course, PublicationStatus status); } diff --git a/src/main/resources/templates/courses/catalog.html b/src/main/resources/templates/courses/catalog.html new file mode 100644 index 0000000..db2eb40 --- /dev/null +++ b/src/main/resources/templates/courses/catalog.html @@ -0,0 +1,32 @@ + + + + + + +
+

Courses

+ +

+ No course is published yet. Come back soon! +

+ +
    +
  • +

    + Course title +

    +

    + By instructor +

    +

    + Course description +

    +
    • +
+
+ + + + diff --git a/src/main/resources/templates/courses/detail.html b/src/main/resources/templates/courses/detail.html new file mode 100644 index 0000000..20960f9 --- /dev/null +++ b/src/main/resources/templates/courses/detail.html @@ -0,0 +1,30 @@ + + + + + + +
+

Course title

+

+ By instructor +

+ +

+ Course description +

+ +
+

Lessons

+

No lesson is published yet.

+
    +
  1. Lesson title
    2. +
+
+ +

Back to all courses

+
+ + + + diff --git a/src/main/resources/templates/fragments/layout.html b/src/main/resources/templates/fragments/layout.html index 3dceece..56af4b5 100644 --- a/src/main/resources/templates/fragments/layout.html +++ b/src/main/resources/templates/fragments/layout.html @@ -4,8 +4,8 @@ - head(title): document head with the design stylesheets - header(current): skip link + banner + auth-aware navigation; `current` names the nav entry of the calling page ('home', 'login', - 'register', 'dashboard', 'instructor', 'admin' or null) and drives - aria-current="page" + 'register', 'dashboard', 'courses', 'instructor', 'admin' or null) and + drives aria-current="page" - footer: site footer Each page keeps its own (privacy.html is lang="fr"). --> @@ -39,6 +39,8 @@
  • Dashboard
    • +
  • Courses
  • Instructor
    • diff --git a/src/test/java/com/ericbouchut/learndev/common/config/SecurityMatrixTest.java b/src/test/java/com/ericbouchut/learndev/common/config/SecurityMatrixTest.java index bb12d74..3bdd787 100644 --- a/src/test/java/com/ericbouchut/learndev/common/config/SecurityMatrixTest.java +++ b/src/test/java/com/ericbouchut/learndev/common/config/SecurityMatrixTest.java @@ -49,7 +49,7 @@ void anonymous_is_redirected_to_login_on_gated_prefixes() throws Exception { @Test @WithMockUser(roles = "STUDENT") void student_passes_courses_gate() throws Exception { - mvc.perform(get("/courses")).andExpect(status().isNotFound()); + mvc.perform(get("/courses")).andExpect(status().isOk()); } @Test diff --git a/src/test/java/com/ericbouchut/learndev/course/repository/CourseDomainRepositoryTest.java b/src/test/java/com/ericbouchut/learndev/course/repository/CourseDomainRepositoryTest.java index f3d6d4f..5584c98 100644 --- a/src/test/java/com/ericbouchut/learndev/course/repository/CourseDomainRepositoryTest.java +++ b/src/test/java/com/ericbouchut/learndev/course/repository/CourseDomainRepositoryTest.java @@ -151,6 +151,53 @@ void deleting_a_course_cascades_to_its_lessons_and_enrollments() { .isEmpty(); } + @Test + void finds_only_the_published_lessons_of_a_course_in_reading_order() { + // Arrange (Given): a course with published and draft lessons + User instructor = newUser("instructor6"); + Course course = newCourse(instructor, "Publication filter"); + Lesson second = newLesson(course, 2, "Published second"); + Lesson first = newLesson(course, 1, "Published first"); + newLesson(course, 3, "Still a draft"); + first.setStatus(PublicationStatus.PUBLISHED); + second.setStatus(PublicationStatus.PUBLISHED); + lessonRepository.saveAndFlush(first); + lessonRepository.saveAndFlush(second); + entityManager.clear(); + + // Act (When): fetch the published lessons only + Course reloaded = courseRepository.findById(course.getCourseId()).orElseThrow(); + var published = lessonRepository + .findByCourseAndStatusOrderByPositionAsc(reloaded, PublicationStatus.PUBLISHED); + + // Assert (Then): the draft is filtered out, order is by position + assertThat(published) + .extracting(Lesson::getTitle) + .containsExactly("Published first", "Published second"); + } + + @Test + void finds_the_enrollment_of_a_user_in_a_course() { + // Arrange (Given): a student enrolled in one of two courses + User instructor = newUser("instructor7"); + User student = newUser("student7"); + Course joined = newCourse(instructor, "Joined course"); + Course other = newCourse(instructor, "Other course"); + enrollmentRepository.saveAndFlush(new Enrollment(student, joined)); + entityManager.clear(); + + // Act (When): look enrollments up by (user, course) + User reloadedStudent = userRepository.findById(student.getUserId()).orElseThrow(); + Course reloadedJoined = courseRepository.findById(joined.getCourseId()).orElseThrow(); + Course reloadedOther = courseRepository.findById(other.getCourseId()).orElseThrow(); + + // Assert (Then): present for the joined course, empty for the other + assertThat(enrollmentRepository.findByUserAndCourse(reloadedStudent, reloadedJoined)) + .isPresent(); + assertThat(enrollmentRepository.findByUserAndCourse(reloadedStudent, reloadedOther)) + .isEmpty(); + } + @Test void deleting_an_instructor_with_courses_is_rejected() { // Arrange (Given): an instructor who teaches a course From 290d088afe673db71ebf2476d54ae4a8cad6a171 Mon Sep 17 00:00:00 2001 From: Eric Bouchut Date: Mon, 13 Jul 2026 10:18:44 +0200 Subject: [PATCH 2/4] feat(course): Let students enroll in and drop a course EnrollmentService owns the student-side lifecycle: enrolling is idempotent, only published courses accept new enrollments (404 otherwise, drafts do not leak), a DROPPED row is re-activated instead of inserted twice (the (user, course) pair is the primary key), and dropping stamps dropped_at while leaving COMPLETED untouched. The course page gains Register and Quit actions (POST + CSRF, PRG redirects with ?enrolled / ?dropped confirmation alerts, matching the ?registered idiom), hides Register on non-published courses, and the catalogue marks the courses the student is enrolled in. --- .../learndev/course/CourseController.java | 79 +++++++++-- .../learndev/course/EnrollmentService.java | 89 ++++++++++++ .../resources/templates/courses/catalog.html | 2 + .../resources/templates/courses/detail.html | 22 +++ .../common/config/SecurityMatrixTest.java | 24 +++- .../course/EnrollmentServiceTest.java | 133 ++++++++++++++++++ 6 files changed, 337 insertions(+), 12 deletions(-) create mode 100644 src/main/java/com/ericbouchut/learndev/course/EnrollmentService.java create mode 100644 src/test/java/com/ericbouchut/learndev/course/EnrollmentServiceTest.java diff --git a/src/main/java/com/ericbouchut/learndev/course/CourseController.java b/src/main/java/com/ericbouchut/learndev/course/CourseController.java index 81c16fa..229f6bc 100644 --- a/src/main/java/com/ericbouchut/learndev/course/CourseController.java +++ b/src/main/java/com/ericbouchut/learndev/course/CourseController.java @@ -1,60 +1,119 @@ package com.ericbouchut.learndev.course; import com.ericbouchut.learndev.course.entity.Course; +import com.ericbouchut.learndev.course.entity.Enrollment; +import com.ericbouchut.learndev.course.entity.EnrollmentStatus; import com.ericbouchut.learndev.user.entity.User; import com.ericbouchut.learndev.user.repository.UserRepository; import org.springframework.stereotype.Controller; import org.springframework.ui.Model; import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.PathVariable; +import org.springframework.web.bind.annotation.PostMapping; import java.security.Principal; +import java.util.Map; +import java.util.stream.Collectors; /** * Web endpoints of the student course experience: the published - * course catalogue and the course detail page. Access requires - * authentication ({@code /courses/**} in the security rules); visibility of - * individual courses is decided by {@link CourseService}. + * course catalogue, the course detail page, and the enroll/drop actions. + * Access requires authentication ({@code /courses/**} in the security + * rules); visibility of individual courses is decided by + * {@link CourseService} and the enrollment lifecycle by + * {@link EnrollmentService}. */ @Controller public class CourseController { private final CourseService courseService; + private final EnrollmentService enrollmentService; private final UserRepository users; - public CourseController(CourseService courseService, UserRepository users) { + public CourseController( + CourseService courseService, + EnrollmentService enrollmentService, + UserRepository users + ) { this.courseService = courseService; + this.enrollmentService = enrollmentService; this.users = users; } /** - * Display the catalogue of published courses. + * Display the catalogue of published courses, with the logged-in + * student's active enrollments marked. * - * @param model receives the published courses + * @param principal the logged-in student + * @param model receives the courses and the enrolled course ids * @return the catalogue view name */ @GetMapping("/courses") - public String catalogue(Model model) { + public String catalogue(Principal principal, Model model) { + Map enrollmentByCourseId = + enrollmentService.myEnrollments(currentUser(principal)).stream() + .filter(e -> e.getStatus() != EnrollmentStatus.DROPPED) + .collect(Collectors.toMap( + e -> e.getCourse().getCourseId(), + Enrollment::getStatus)); model.addAttribute("courses", courseService.catalogue()); + model.addAttribute("enrollmentByCourseId", enrollmentByCourseId); return "courses/catalog"; } /** - * Display one course with its published lessons. + * Display one course with its published lessons and the enroll or quit + * action matching the student's enrollment state. * * @param courseId the course to show * @param principal the logged-in student (drives visibility) - * @param model receives the course and its readable lessons + * @param model receives the course, its readable lessons, and the + * student's enrollment (null when never enrolled) * @return the course detail view name */ @GetMapping("/courses/{courseId}") public String detail(@PathVariable Long courseId, Principal principal, Model model) { - Course course = courseService.visibleCourse(courseId, currentUser(principal)); + User student = currentUser(principal); + Course course = courseService.visibleCourse(courseId, student); model.addAttribute("course", course); model.addAttribute("lessons", courseService.publishedLessons(course)); + model.addAttribute("enrollment", + enrollmentService.enrollmentFor(student, course).orElse(null)); return "courses/detail"; } + /** + * Register the student in the course, then redirect back to the course + * page with an {@code enrolled} confirmation flag (PRG). + * + * @param courseId the course to join + * @param principal the logged-in student + * @return a redirect to the course detail page + */ + @PostMapping("/courses/{courseId}/enroll") + public String enroll(@PathVariable Long courseId, Principal principal) { + User student = currentUser(principal); + Course course = courseService.visibleCourse(courseId, student); + enrollmentService.enroll(student, course); + return "redirect:/courses/" + courseId + "?enrolled"; + } + + /** + * Drop the student from the course, then redirect back to the course + * page with a {@code dropped} confirmation flag (PRG). + * + * @param courseId the course to leave + * @param principal the logged-in student + * @return a redirect to the course detail page + */ + @PostMapping("/courses/{courseId}/drop") + public String drop(@PathVariable Long courseId, Principal principal) { + User student = currentUser(principal); + Course course = courseService.visibleCourse(courseId, student); + enrollmentService.drop(student, course); + return "redirect:/courses/" + courseId + "?dropped"; + } + private User currentUser(Principal principal) { return users.findByUsername(principal.getName()) .orElseThrow(() -> new IllegalStateException( diff --git a/src/main/java/com/ericbouchut/learndev/course/EnrollmentService.java b/src/main/java/com/ericbouchut/learndev/course/EnrollmentService.java new file mode 100644 index 0000000..10bd56a --- /dev/null +++ b/src/main/java/com/ericbouchut/learndev/course/EnrollmentService.java @@ -0,0 +1,89 @@ +package com.ericbouchut.learndev.course; + +import com.ericbouchut.learndev.course.entity.Course; +import com.ericbouchut.learndev.course.entity.Enrollment; +import com.ericbouchut.learndev.course.entity.EnrollmentStatus; +import com.ericbouchut.learndev.course.entity.PublicationStatus; +import com.ericbouchut.learndev.course.repository.EnrollmentRepository; +import com.ericbouchut.learndev.user.entity.User; +import org.springframework.http.HttpStatus; +import org.springframework.stereotype.Service; +import org.springframework.transaction.annotation.Transactional; +import org.springframework.web.server.ResponseStatusException; + +import java.time.OffsetDateTime; +import java.util.List; +import java.util.Optional; + +/** + * Student-side enrollment lifecycle (see the diagram in CONTRIBUTING.md). + * The (user, course) pair is the primary key, so a student has at most one + * enrollment row per course: enrolling again re-activates a {@code DROPPED} + * row instead of inserting a second one, and both operations are idempotent + * (re-posting a form must not fail). + */ +@Service +public class EnrollmentService { + + private final EnrollmentRepository enrollments; + + public EnrollmentService(EnrollmentRepository enrollments) { + this.enrollments = enrollments; + } + + /** + * Enroll the student in a published course. A {@code DROPPED} enrollment + * is re-activated (back to {@code ENROLLED}, drop timestamp cleared, + * enrollment timestamp refreshed); an active one is left untouched. + * + * @throws ResponseStatusException 404 when the course is not published + * (only published courses accept new enrollments) + */ + @Transactional + public void enroll(User student, Course course) { + Optional existing = enrollments.findByUserAndCourse(student, course); + if (existing.isPresent() && existing.get().getStatus() != EnrollmentStatus.DROPPED) { + return; + } + if (course.getStatus() != PublicationStatus.PUBLISHED) { + throw new ResponseStatusException(HttpStatus.NOT_FOUND); + } + if (existing.isPresent()) { + Enrollment enrollment = existing.get(); + enrollment.setStatus(EnrollmentStatus.ENROLLED); + enrollment.setDroppedAt(null); + enrollment.setEnrolledAt(OffsetDateTime.now()); + enrollments.save(enrollment); + } else { + enrollments.save(new Enrollment(student, course)); + } + } + + /** + * Drop the student from a course: {@code ENROLLED} or + * {@code IN_PROGRESS} becomes {@code DROPPED} with a drop timestamp. + * No-op when the student is not enrolled, already dropped, or completed + * the course (the lifecycle has no transition out of COMPLETED). + */ + @Transactional + public void drop(User student, Course course) { + enrollments.findByUserAndCourse(student, course) + .filter(enrollment -> enrollment.getStatus() == EnrollmentStatus.ENROLLED + || enrollment.getStatus() == EnrollmentStatus.IN_PROGRESS) + .ifPresent(enrollment -> { + enrollment.setStatus(EnrollmentStatus.DROPPED); + enrollment.setDroppedAt(OffsetDateTime.now()); + enrollments.save(enrollment); + }); + } + + /** The enrollment of a student in a course, if any (dropped included). */ + public Optional enrollmentFor(User student, Course course) { + return enrollments.findByUserAndCourse(student, course); + } + + /** All enrollments of a student, dropped included (the dashboard filters). */ + public List myEnrollments(User student) { + return enrollments.findByUser(student); + } +} diff --git a/src/main/resources/templates/courses/catalog.html b/src/main/resources/templates/courses/catalog.html index db2eb40..4f9b051 100644 --- a/src/main/resources/templates/courses/catalog.html +++ b/src/main/resources/templates/courses/catalog.html @@ -19,6 +19,8 @@

    By instructor + + · You are enrolled

    Course description diff --git a/src/main/resources/templates/courses/detail.html b/src/main/resources/templates/courses/detail.html index 20960f9..e01a086 100644 --- a/src/main/resources/templates/courses/detail.html +++ b/src/main/resources/templates/courses/detail.html @@ -5,6 +5,16 @@

    +

    + You are enrolled in this course. +

    +

    + You have left this course. +

    +

    + Register for the course to read its lessons. +

    +

    Course title

    By instructor @@ -14,6 +24,18 @@

    Course title

    Course description

    + +
    +
    + +
    +
    + +
    +
    +

    Lessons

    No lesson is published yet.

    diff --git a/src/test/java/com/ericbouchut/learndev/common/config/SecurityMatrixTest.java b/src/test/java/com/ericbouchut/learndev/common/config/SecurityMatrixTest.java index 3bdd787..c91fef6 100644 --- a/src/test/java/com/ericbouchut/learndev/common/config/SecurityMatrixTest.java +++ b/src/test/java/com/ericbouchut/learndev/common/config/SecurityMatrixTest.java @@ -1,6 +1,9 @@ package com.ericbouchut.learndev.common.config; import com.ericbouchut.learndev.support.AbstractPostgresIT; +import com.ericbouchut.learndev.user.entity.User; +import com.ericbouchut.learndev.user.repository.UserRepository; +import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.Test; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc; @@ -8,6 +11,7 @@ import org.springframework.security.test.context.support.WithMockUser; import org.springframework.test.web.servlet.MockMvc; +import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.user; import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrlPattern; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; @@ -33,6 +37,22 @@ class SecurityMatrixTest extends AbstractPostgresIT { @Autowired MockMvc mvc; + @Autowired + UserRepository userRepository; + + // The catalogue controller resolves the domain user, so the gate-pass + // check needs a real users row, not just a mock principal. + @BeforeEach + void seedStudent() { + if (userRepository.findByUsername("matrix-student").isEmpty()) { + User student = new User(); + student.setUsername("matrix-student"); + student.setEmail("matrix-student@example.com"); + student.setPassword("hashed"); + userRepository.save(student); + } + } + // Anonymous: every gated prefix redirects to the login page. @Test @@ -47,9 +67,9 @@ void anonymous_is_redirected_to_login_on_gated_prefixes() throws Exception { // Student: may pass the /courses gate, denied on instructor and admin. @Test - @WithMockUser(roles = "STUDENT") void student_passes_courses_gate() throws Exception { - mvc.perform(get("/courses")).andExpect(status().isOk()); + mvc.perform(get("/courses").with(user("matrix-student").roles("STUDENT"))) + .andExpect(status().isOk()); } @Test diff --git a/src/test/java/com/ericbouchut/learndev/course/EnrollmentServiceTest.java b/src/test/java/com/ericbouchut/learndev/course/EnrollmentServiceTest.java new file mode 100644 index 0000000..d3fa4e7 --- /dev/null +++ b/src/test/java/com/ericbouchut/learndev/course/EnrollmentServiceTest.java @@ -0,0 +1,133 @@ +package com.ericbouchut.learndev.course; + +import com.ericbouchut.learndev.course.entity.Course; +import com.ericbouchut.learndev.course.entity.Enrollment; +import com.ericbouchut.learndev.course.entity.EnrollmentStatus; +import com.ericbouchut.learndev.course.entity.PublicationStatus; +import com.ericbouchut.learndev.course.repository.EnrollmentRepository; +import com.ericbouchut.learndev.user.entity.User; +import org.junit.jupiter.api.Test; +import org.mockito.ArgumentCaptor; +import org.springframework.web.server.ResponseStatusException; + +import java.time.OffsetDateTime; +import java.util.Optional; +import java.util.UUID; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.assertThatThrownBy; +import static org.mockito.ArgumentMatchers.any; +import static org.mockito.Mockito.*; + +class EnrollmentServiceTest { + + private final EnrollmentRepository enrollments = mock(EnrollmentRepository.class); + private final EnrollmentService service = new EnrollmentService(enrollments); + + private final User student = studentWithId(); + private final Course course = publishedCourse(); + + private static User studentWithId() { + User user = new User(); + user.setUserId(UUID.randomUUID()); + user.setUsername("student"); + return user; + } + + private static Course publishedCourse() { + Course c = new Course(); + c.setCourseId(42L); + c.setTitle("Course"); + c.setStatus(PublicationStatus.PUBLISHED); + return c; + } + + @Test + void enrolls_a_new_student_in_a_published_course() { + // Arrange (Given): no enrollment row yet + when(enrollments.findByUserAndCourse(student, course)).thenReturn(Optional.empty()); + + // Act (When) + service.enroll(student, course); + + // Assert (Then): a fresh ENROLLED row is saved + ArgumentCaptor saved = ArgumentCaptor.forClass(Enrollment.class); + verify(enrollments).save(saved.capture()); + assertThat(saved.getValue().getStatus()).isEqualTo(EnrollmentStatus.ENROLLED); + assertThat(saved.getValue().getDroppedAt()).isNull(); + } + + @Test + void enrolling_twice_is_a_no_op() { + // Arrange (Given): an active enrollment already exists + Enrollment active = new Enrollment(student, course); + when(enrollments.findByUserAndCourse(student, course)).thenReturn(Optional.of(active)); + + // Act (When) + service.enroll(student, course); + + // Assert (Then): nothing is written + verify(enrollments, never()).save(any()); + } + + @Test + void re_enrolling_reactivates_a_dropped_row_and_clears_the_drop_timestamp() { + // Arrange (Given): the student dropped the course earlier + Enrollment dropped = new Enrollment(student, course); + dropped.setStatus(EnrollmentStatus.DROPPED); + dropped.setDroppedAt(OffsetDateTime.now().minusDays(3)); + when(enrollments.findByUserAndCourse(student, course)).thenReturn(Optional.of(dropped)); + + // Act (When) + service.enroll(student, course); + + // Assert (Then): the same row flips back to ENROLLED + verify(enrollments).save(dropped); + assertThat(dropped.getStatus()).isEqualTo(EnrollmentStatus.ENROLLED); + assertThat(dropped.getDroppedAt()).isNull(); + } + + @Test + void refuses_to_enroll_in_an_unpublished_course() { + // Arrange (Given): the course is only a draft + Course draft = publishedCourse(); + draft.setStatus(PublicationStatus.DRAFT); + when(enrollments.findByUserAndCourse(student, draft)).thenReturn(Optional.empty()); + + // Act + Assert (When/Then): surfaces as 404, drafts do not leak + assertThatThrownBy(() -> service.enroll(student, draft)) + .isInstanceOf(ResponseStatusException.class) + .hasMessageContaining("404"); + verify(enrollments, never()).save(any()); + } + + @Test + void dropping_sets_the_status_and_the_drop_timestamp() { + // Arrange (Given): an active enrollment + Enrollment active = new Enrollment(student, course); + when(enrollments.findByUserAndCourse(student, course)).thenReturn(Optional.of(active)); + + // Act (When) + service.drop(student, course); + + // Assert (Then) + verify(enrollments).save(active); + assertThat(active.getStatus()).isEqualTo(EnrollmentStatus.DROPPED); + assertThat(active.getDroppedAt()).isNotNull(); + } + + @Test + void dropping_a_completed_course_is_a_no_op() { + // Arrange (Given): the lifecycle has no transition out of COMPLETED + Enrollment completed = new Enrollment(student, course); + completed.setStatus(EnrollmentStatus.COMPLETED); + when(enrollments.findByUserAndCourse(student, course)).thenReturn(Optional.of(completed)); + + // Act (When) + service.drop(student, course); + + // Assert (Then): nothing is written + verify(enrollments, never()).save(any()); + assertThat(completed.getStatus()).isEqualTo(EnrollmentStatus.COMPLETED); + } +} From dd060d2ee6aec17e76d714109c02f5a2dc734ae1 Mon Sep 17 00:00:00 2001 From: Eric Bouchut Date: Mon, 13 Jul 2026 10:20:35 +0200 Subject: [PATCH 3/4] feat(course): Render lessons for enrolled students An actively enrolled student reads a published lesson at /courses/{courseId}/lessons/{lessonId}: the Markdown is rendered to sanitized HTML by MarkdownRenderer (cached, ADR-0013) and emitted with th:utext, with previous/next links in reading order. A student who is not enrolled is redirected to the course page with an enroll-required hint instead of a 403 (the Register button is right there). Lessons that are draft, archived, or belong to another course answer 404. The course page lesson list now links each lesson. --- .../learndev/course/CourseController.java | 55 +++++++++++++++++++ .../resources/templates/courses/detail.html | 5 +- .../resources/templates/courses/lesson.html | 33 +++++++++++ 3 files changed, 92 insertions(+), 1 deletion(-) create mode 100644 src/main/resources/templates/courses/lesson.html diff --git a/src/main/java/com/ericbouchut/learndev/course/CourseController.java b/src/main/java/com/ericbouchut/learndev/course/CourseController.java index 229f6bc..80d88cb 100644 --- a/src/main/java/com/ericbouchut/learndev/course/CourseController.java +++ b/src/main/java/com/ericbouchut/learndev/course/CourseController.java @@ -3,6 +3,7 @@ import com.ericbouchut.learndev.course.entity.Course; import com.ericbouchut.learndev.course.entity.Enrollment; import com.ericbouchut.learndev.course.entity.EnrollmentStatus; +import com.ericbouchut.learndev.course.entity.Lesson; import com.ericbouchut.learndev.user.entity.User; import com.ericbouchut.learndev.user.repository.UserRepository; import org.springframework.stereotype.Controller; @@ -12,6 +13,7 @@ import org.springframework.web.bind.annotation.PostMapping; import java.security.Principal; +import java.util.List; import java.util.Map; import java.util.stream.Collectors; @@ -28,15 +30,18 @@ public class CourseController { private final CourseService courseService; private final EnrollmentService enrollmentService; + private final MarkdownRenderer markdownRenderer; private final UserRepository users; public CourseController( CourseService courseService, EnrollmentService enrollmentService, + MarkdownRenderer markdownRenderer, UserRepository users ) { this.courseService = courseService; this.enrollmentService = enrollmentService; + this.markdownRenderer = markdownRenderer; this.users = users; } @@ -114,6 +119,56 @@ public String drop(@PathVariable Long courseId, Principal principal) { return "redirect:/courses/" + courseId + "?dropped"; } + /** + * Display one published lesson to an enrolled student, with the lesson + * Markdown rendered to sanitized HTML and previous/next links in + * reading order. A student who is not actively enrolled is sent back to + * the course page with an {@code enroll-required} hint instead of a 403: + * the Register button is right there. + * + * @param courseId the course the lesson belongs to + * @param lessonId the lesson to read + * @param principal the logged-in student + * @param model receives the course, lesson, rendered content, and + * the previous/next lessons (null at the edges) + * @return the lesson view name, or a redirect when not enrolled + */ + @GetMapping("/courses/{courseId}/lessons/{lessonId}") + public String lesson( + @PathVariable Long courseId, + @PathVariable Long lessonId, + Principal principal, + Model model + ) { + User student = currentUser(principal); + Course course = courseService.visibleCourse(courseId, student); + boolean activelyEnrolled = enrollmentService.enrollmentFor(student, course) + .filter(e -> e.getStatus() != EnrollmentStatus.DROPPED) + .isPresent(); + if (!activelyEnrolled) { + return "redirect:/courses/" + courseId + "?enroll-required"; + } + Lesson lesson = courseService.publishedLesson(course, lessonId); + List lessons = courseService.publishedLessons(course); + int index = indexOf(lessons, lesson); + model.addAttribute("course", course); + model.addAttribute("lesson", lesson); + model.addAttribute("contentHtml", markdownRenderer.render(lesson.getContentMarkdown())); + model.addAttribute("previousLesson", index > 0 ? lessons.get(index - 1) : null); + model.addAttribute("nextLesson", + index < lessons.size() - 1 ? lessons.get(index + 1) : null); + return "courses/lesson"; + } + + private static int indexOf(List lessons, Lesson lesson) { + for (int i = 0; i < lessons.size(); i++) { + if (lessons.get(i).getLessonId().equals(lesson.getLessonId())) { + return i; + } + } + return -1; + } + private User currentUser(Principal principal) { return users.findByUsername(principal.getName()) .orElseThrow(() -> new IllegalStateException( diff --git a/src/main/resources/templates/courses/detail.html b/src/main/resources/templates/courses/detail.html index e01a086..b022a90 100644 --- a/src/main/resources/templates/courses/detail.html +++ b/src/main/resources/templates/courses/detail.html @@ -40,7 +40,10 @@

    Course title

    Lessons

    No lesson is published yet.

      -
    1. Lesson title
      2. +
    2. + Lesson title +
    diff --git a/src/main/resources/templates/courses/lesson.html b/src/main/resources/templates/courses/lesson.html new file mode 100644 index 0000000..1e1a220 --- /dev/null +++ b/src/main/resources/templates/courses/lesson.html @@ -0,0 +1,33 @@ + + + + + + +
    +

    + Course title +

    + +
    +

    Lesson title

    + +
    Lesson content
    +
    + + +
    + + + + From b97224e476e320449895a077a7ce85db982cfed3 Mon Sep 17 00:00:00 2001 From: Eric Bouchut Date: Mon, 13 Jul 2026 10:26:37 +0200 Subject: [PATCH 4/4] feat(dashboard): List the student's courses The dashboard placeholder becomes the real "My courses" view: the active enrollments of the logged-in user (dropped ones excluded), each with its status and enrollment date, linking back to the course page. GET /dashboard moves from AuthController to a DashboardController in the course package, since the page renders enrollment data. StudentCourseFlowTest drives the whole student journey end to end: browse (draft courses hidden), bounce off a lesson before enrolling, enroll, read a lesson (Markdown rendered to HTML), reject an unknown lesson, see the dashboard list the course, drop, and see it gone. --- .../learndev/auth/AuthController.java | 12 +- .../learndev/course/DashboardController.java | 48 +++++ src/main/resources/templates/dashboard.html | 22 ++- .../course/StudentCourseFlowTest.java | 166 ++++++++++++++++++ 4 files changed, 235 insertions(+), 13 deletions(-) create mode 100644 src/main/java/com/ericbouchut/learndev/course/DashboardController.java create mode 100644 src/test/java/com/ericbouchut/learndev/course/StudentCourseFlowTest.java diff --git a/src/main/java/com/ericbouchut/learndev/auth/AuthController.java b/src/main/java/com/ericbouchut/learndev/auth/AuthController.java index b134e44..b49c57c 100644 --- a/src/main/java/com/ericbouchut/learndev/auth/AuthController.java +++ b/src/main/java/com/ericbouchut/learndev/auth/AuthController.java @@ -13,8 +13,9 @@ /** * Web endpoints for authentication pages: - * home, login and dashboard views, and the registration form + * home and login views, and the registration form * (display and submission). + * The dashboard lives in the course package (it renders enrollments). * Spring Security handles the login POST and logout itself. * This controller renders the pages around them. */ @@ -47,15 +48,6 @@ public String login() { return "login"; } - /** - * Display the dashboard page. - * @return the name of the dashboard template - */ - @GetMapping("/dashboard") - public String dashboard() { - return "dashboard"; - } - /** * Display the User registration form. * @param model diff --git a/src/main/java/com/ericbouchut/learndev/course/DashboardController.java b/src/main/java/com/ericbouchut/learndev/course/DashboardController.java new file mode 100644 index 0000000..deddaf0 --- /dev/null +++ b/src/main/java/com/ericbouchut/learndev/course/DashboardController.java @@ -0,0 +1,48 @@ +package com.ericbouchut.learndev.course; + +import com.ericbouchut.learndev.course.entity.EnrollmentStatus; +import com.ericbouchut.learndev.user.entity.User; +import com.ericbouchut.learndev.user.repository.UserRepository; +import org.springframework.stereotype.Controller; +import org.springframework.ui.Model; +import org.springframework.web.bind.annotation.GetMapping; + +import java.security.Principal; + +/** + * Web endpoint of the student dashboard: the logged-in user's active + * courses with their enrollment status. Lives in the course package because + * the page renders enrollment data (the auth package only brings the user + * here after login). + */ +@Controller +public class DashboardController { + + private final EnrollmentService enrollmentService; + private final UserRepository users; + + public DashboardController(EnrollmentService enrollmentService, UserRepository users) { + this.enrollmentService = enrollmentService; + this.users = users; + } + + /** + * Display the dashboard with the student's active enrollments + * (dropped ones are not listed; re-enrolling brings them back). + * + * @param principal the logged-in user + * @param model receives the active enrollments + * @return the dashboard view name + */ + @GetMapping("/dashboard") + public String dashboard(Principal principal, Model model) { + User user = users.findByUsername(principal.getName()) + .orElseThrow(() -> new IllegalStateException( + "Authenticated user not found: " + principal.getName())); + model.addAttribute("enrollments", + enrollmentService.myEnrollments(user).stream() + .filter(e -> e.getStatus() != EnrollmentStatus.DROPPED) + .toList()); + return "dashboard"; + } +} diff --git a/src/main/resources/templates/dashboard.html b/src/main/resources/templates/dashboard.html index bf56e38..93283af 100644 --- a/src/main/resources/templates/dashboard.html +++ b/src/main/resources/templates/dashboard.html @@ -12,10 +12,26 @@

    Your courses

    -

    - No courses yet. Course enrollment arrives with the course catalog; - this is where your progress will live. + +

    + You are not enrolled in any course yet. + Browse the courses to get started.

    + +

    diff --git a/src/test/java/com/ericbouchut/learndev/course/StudentCourseFlowTest.java b/src/test/java/com/ericbouchut/learndev/course/StudentCourseFlowTest.java new file mode 100644 index 0000000..9fa123f --- /dev/null +++ b/src/test/java/com/ericbouchut/learndev/course/StudentCourseFlowTest.java @@ -0,0 +1,166 @@ +package com.ericbouchut.learndev.course; + +import com.ericbouchut.learndev.course.entity.Course; +import com.ericbouchut.learndev.course.entity.Lesson; +import com.ericbouchut.learndev.course.entity.PublicationStatus; +import com.ericbouchut.learndev.course.repository.CourseRepository; +import com.ericbouchut.learndev.course.repository.LessonRepository; +import com.ericbouchut.learndev.support.AbstractPostgresIT; +import com.ericbouchut.learndev.user.entity.User; +import com.ericbouchut.learndev.user.repository.UserRepository; +import org.junit.jupiter.api.BeforeEach; +import org.junit.jupiter.api.Test; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc; +import org.springframework.boot.test.context.SpringBootTest; +import org.springframework.test.web.servlet.MockMvc; + +import static org.hamcrest.Matchers.containsString; +import static org.hamcrest.Matchers.not; +import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf; +import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.user; +import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; +import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrlPattern; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; + +/** + * End-to-end journey of a student through the course catalogue: browse + * (published only), open a course, enroll, read a lesson (Markdown rendered + * to HTML), drop, and see the dashboard reflect it all. Boots the full + * context against the shared Postgres container and drives MockMvc with a + * registered user. + * + *

    Named with the {@code Test} suffix (not {@code IT}) so Surefire runs it + * as part of {@code mvn test}; this project does not use the Failsafe plugin. + */ +@SpringBootTest(properties = { + // This feature does not use MongoDB; keep the test context Postgres-only. + "spring.autoconfigure.exclude=org.springframework.boot.autoconfigure.mongo.MongoAutoConfiguration," + + "org.springframework.boot.autoconfigure.data.mongo.MongoDataAutoConfiguration" +}) +@AutoConfigureMockMvc +class StudentCourseFlowTest extends AbstractPostgresIT { + + @Autowired + MockMvc mvc; + + @Autowired + UserRepository userRepository; + + @Autowired + CourseRepository courseRepository; + + @Autowired + LessonRepository lessonRepository; + + private Course published; + private Lesson lessonOne; + private Lesson lessonTwo; + + @BeforeEach + void seedCatalogue() { + User instructor = userRepository.findByUsername("flow-instructor") + .orElseGet(() -> { + User u = new User(); + u.setUsername("flow-instructor"); + u.setEmail("flow-instructor@example.com"); + u.setPassword("hashed"); + return userRepository.save(u); + }); + + published = new Course(); + published.setTitle("Spring in practice"); + published.setDescription("From zero to controller."); + published.setStatus(PublicationStatus.PUBLISHED); + published.setInstructor(instructor); + courseRepository.save(published); + + Course draft = new Course(); + draft.setTitle("Secret draft course"); + draft.setInstructor(instructor); + courseRepository.save(draft); + + lessonOne = lesson(published, 1, "Getting started", + "# Hello\n\nSome **bold** content."); + lessonTwo = lesson(published, 2, "Controllers", "More content."); + Lesson draftLesson = new Lesson(); + draftLesson.setCourse(published); + draftLesson.setPosition(3); + draftLesson.setTitle("Unfinished lesson"); + lessonRepository.save(draftLesson); + } + + private Lesson lesson(Course course, int position, String title, String markdown) { + Lesson l = new Lesson(); + l.setCourse(course); + l.setPosition(position); + l.setTitle(title); + l.setContentMarkdown(markdown); + l.setStatus(PublicationStatus.PUBLISHED); + return lessonRepository.save(l); + } + + private String registerStudent(String username) throws Exception { + mvc.perform(post("/auth/register").with(csrf()) + .param("username", username) + .param("email", username + "@example.com") + .param("password", "secret12")) + .andExpect(status().is3xxRedirection()); + return username; + } + + @Test + void student_browses_enrolls_reads_and_drops() throws Exception { + String student = registerStudent("flow-student"); + + // The catalogue lists the published course, never the draft. + mvc.perform(get("/courses").with(user(student).roles("STUDENT"))) + .andExpect(status().isOk()) + .andExpect(content().string(containsString("Spring in practice"))) + .andExpect(content().string(not(containsString("Secret draft course")))); + + // Reading a lesson before enrolling bounces back to the course page. + mvc.perform(get("/courses/{c}/lessons/{l}", + published.getCourseId(), lessonOne.getLessonId()) + .with(user(student).roles("STUDENT"))) + .andExpect(redirectedUrl( + "/courses/" + published.getCourseId() + "?enroll-required")); + + // Enroll (PRG confirmation), then the course page offers to quit. + mvc.perform(post("/courses/{c}/enroll", published.getCourseId()) + .with(user(student).roles("STUDENT")).with(csrf())) + .andExpect(redirectedUrl("/courses/" + published.getCourseId() + "?enrolled")); + mvc.perform(get("/courses/{c}", published.getCourseId()) + .with(user(student).roles("STUDENT"))) + .andExpect(content().string(containsString("Quit this course"))) + .andExpect(content().string(not(containsString("Unfinished lesson")))); + + // The lesson renders its Markdown as HTML and links the next lesson. + mvc.perform(get("/courses/{c}/lessons/{l}", + published.getCourseId(), lessonOne.getLessonId()) + .with(user(student).roles("STUDENT"))) + .andExpect(status().isOk()) + .andExpect(content().string(containsString("bold"))) + .andExpect(content().string(containsString("Controllers"))); + + // The draft lesson is not readable even when enrolled. + mvc.perform(get("/courses/{c}/lessons/{l}", published.getCourseId(), + lessonTwo.getLessonId() + 1000) + .with(user(student).roles("STUDENT"))) + .andExpect(status().isNotFound()); + + // The dashboard lists the enrolled course. + mvc.perform(get("/dashboard").with(user(student).roles("STUDENT"))) + .andExpect(content().string(containsString("Spring in practice"))); + + // Drop (PRG confirmation); the dashboard no longer lists the course. + mvc.perform(post("/courses/{c}/drop", published.getCourseId()) + .with(user(student).roles("STUDENT")).with(csrf())) + .andExpect(redirectedUrl("/courses/" + published.getCourseId() + "?dropped")); + mvc.perform(get("/dashboard").with(user(student).roles("STUDENT"))) + .andExpect(content().string(not(containsString("Spring in practice")))); + } +}