Allow classroom members to add themselves to course instances

This is so that the client will be able to add themselves to the
intro to computer science course, so that students joining classes will
have a course to enter.
This commit is contained in:
Scott Erickson 2015-11-05 13:27:26 -08:00
parent f57cf3a83d
commit 6b5e13501e
2 changed files with 6 additions and 2 deletions

View file

@ -45,11 +45,13 @@ CourseInstanceHandler = class CourseInstanceHandler extends Handler
CourseInstance.findById courseInstanceID, (err, courseInstance) =>
return @sendDatabaseError(res, err) if err
return @sendNotFoundError(res, 'Course instance not found') unless courseInstance
return @sendForbiddenError(res) unless courseInstance.get('ownerID').equals(req.user.get('_id'))
Classroom.findById courseInstance.get('classroomID'), (err, classroom) =>
return @sendDatabaseError(res, err) if err
return @sendNotFoundError(res, 'Classroom referenced by course instance not found') unless classroom
return @sendForbiddenError(res) unless _.any(classroom.get('members'), (memberID) -> memberID.toString() is userID)
ownsCourseInstance = courseInstance.get('ownerID').equals(req.user.get('_id'))
addingSelf = userID is req.user.id
return @sendForbiddenError(res) unless ownsCourseInstance or addingSelf
Prepaid.find({ 'redeemers.userID': mongoose.Types.ObjectId(userID) }).count (err, userIsPrepaid) =>
return @sendDatabaseError(res, err) if err
Course.findById courseInstance.get('courseID'), (err, course) =>

View file

@ -99,7 +99,7 @@ describe 'POST /db/course_instance/:id/members', ->
], makeTestIterator(@), done)
it 'returns 403 if the user does not own the course instance', (done) ->
it 'returns 403 if the user does not own the course instance and is not adding self', (done) ->
async.eachSeries([
addTestUserToClassroom,
@ -111,6 +111,8 @@ describe 'POST /db/course_instance/:id/members', ->
cb()
], makeTestIterator(@), done)
it 'returns 200 if the user is a member of the classroom and is adding self', ->
it 'return 402 if the course is not free and the user is not in a prepaid', (done) ->
async.eachSeries([