From 8de8ca7e18eb35150ee591935b70d8ae6a92ca76 Mon Sep 17 00:00:00 2001
From: Matteo Pagliazzi <matteopagliazzi@gmail.com>
Date: Sun, 17 Jan 2016 12:01:57 +0100
Subject: [PATCH] add getChallengeMemberProgress route and misc fixes

---
 common/locales/en/api-v3.json                |  1 +
 website/src/controllers/api-v3/challenges.js | 57 +++++++++++++++++++-
 website/src/models/challenge.js              |  4 +-
 3 files changed, 59 insertions(+), 3 deletions(-)

diff --git a/common/locales/en/api-v3.json b/common/locales/en/api-v3.json
index 2d00b19192..d16b388769 100644
--- a/common/locales/en/api-v3.json
+++ b/common/locales/en/api-v3.json
@@ -37,6 +37,7 @@
   "onlyLeaderCanRemoveMember": "Only group leader can remove a member!",
   "memberCannotRemoveYourself": "You cannot remove yourself!",
   "groupMemberNotFound": "User not found among group's members",
+  "challengeMemberNotFound": "User not found among challenge's members",
   "mustBeGroupMember": "Must be member of the group.",
   "keepOrRemoveAll": "req.query.keep must be either \"keep-all\" or \"remove-all\"",
   "keepOrRemove": "req.query.keep must be either \"keep\" or \"remove\"",
diff --git a/website/src/controllers/api-v3/challenges.js b/website/src/controllers/api-v3/challenges.js
index da7a7e8afe..d0e54667af 100644
--- a/website/src/controllers/api-v3/challenges.js
+++ b/website/src/controllers/api-v3/challenges.js
@@ -2,7 +2,10 @@ import { authWithHeaders } from '../../middlewares/api-v3/auth';
 import cron from '../../middlewares/api-v3/cron';
 import { model as Challenge } from '../../models/challenge';
 import { model as Group } from '../../models/group';
-import { model as User } from '../../models/user';
+import {
+  model as User,
+  nameFields,
+} from '../../models/user';
 import {
   NotFound,
   NotAuthorized,
@@ -135,6 +138,8 @@ api.getChallenges = {
  * @apiName GetChallenge
  * @apiGroup Challenge
  *
+ * @apiParam {UUID} challengeId The challenge _id
+ *
  * @apiSuccess {object} challenge The challenge object
  */
 api.getChallenge = {
@@ -160,6 +165,56 @@ api.getChallenge = {
   },
 };
 
+/**
+ * @api {get} /challenges/:challengeId/members/:memberId Get a challenge member progress
+ * @apiVersion 3.0.0
+ * @apiName GetChallenge
+ * @apiGroup Challenge
+ *
+ * @apiParam {UUID} challengeId The challenge _id
+ * @apiParam {UUID} member The member _id
+ *
+ * @apiSuccess {object} member Return an object with member _id, profile.name and a tasks object with the challenge tasks for the member
+ */
+api.getChallengeMemberProgress = {
+  method: 'GET',
+  url: '/challenges/:challengeId/members/:memberId',
+  middlewares: [authWithHeaders(), cron],
+  async handler (req, res) {
+    req.checkQuery('challengeId', res.t('challengeIdRequired')).notEmpty().isUUID();
+    req.checkQuery('memberId', res.t('memberIdRequired')).notEmpty().isUUID();
+
+    let validationErrors = req.validationErrors();
+    if (validationErrors) throw validationErrors;
+
+    let user = res.locals.user;
+    let challengeId = req.params.challengeId;
+    let memberId = req.params.memberId;
+
+    let member = await User.findById(memberId).select(`${nameFields} challenges`).exec();
+    if (!member) throw new NotFound(res.t('userWithIDNotFound', {userId: memberId}));
+
+    let challenge = await Challenge.findById(challengeId).exec();
+    if (!challenge) throw new NotFound(res.t('challengeNotFound'));
+
+    let group = await Group.getGroup({user, groupId: challenge.groupId, fields: '_id type privacy'});
+    if (!group || !challenge.canView(user, group)) throw new NotFound(res.t('challengeNotFound'));
+    if (!challenge.isMember(member)) throw new NotFound(res.t('challengeMemberNotFound'));
+
+    let chalTasks = Tasks.Task.find({
+      userId: memberId,
+      'challenge.id': challengeId,
+    })
+    .select('-tags') // We don't want to return the tags publicly TODO same for other data?
+    .exec();
+
+    // manually call toJSON with minimize: true so empty paths aren't returned
+    let response = member.toJSON({minimize: true});
+    response.tasks = chalTasks.map(chalTask => chalTask.toJSON({minimize: true}));
+    res.respond(200, response);
+  },
+};
+
 // TODO everything here should be moved to a worker
 // actually even for a worker it's probably just to big and will kill mongo
 function _closeChal (challenge, broken = {}) {
diff --git a/website/src/models/challenge.js b/website/src/models/challenge.js
index a19ecd3b60..112926ef0c 100644
--- a/website/src/models/challenge.js
+++ b/website/src/models/challenge.js
@@ -23,7 +23,6 @@ let schema = new Schema({
   groupId: {type: String, ref: 'Group', validate: [validator.isUUID, 'Invalid uuid.'], required: true}, // TODO no update, no set?
   timestamp: {type: Date, default: Date.now, required: true}, // TODO what is this? use timestamps from plugin? not settable?
   memberCount: {type: Number, default: 0},
-  challengeCount: {type: Number, default: 0},
   prize: {type: Number, default: 0, min: 0}, // TODO no update?
 });
 
@@ -36,12 +35,13 @@ schema.methods.hasAccess = function hasAccessToChallenge (user) {
   let userGroups = user.guilds.slice(0);
   if (user.party._id) userGroups.push(user.party._id);
   userGroups.push('habitrpg'); // tavern challenges
-  return this.leader === user._id || user.contributor.admin || userGroups.indexOf(this.groupId) !== -1;
+  return this.leader === user._id || userGroups.indexOf(this.groupId) !== -1;
 };
 
 // Returns true if user can view the challenge
 // Different from hasAccess because challenges of public guilds can be viewed by everyone
 schema.methods.canView = function canViewChallenge (user, group) {
+  if (user.contributor.admin) return true;
   if (group.type === 'guild' && group.privacy === 'public') return true;
   return this.hasAccess(user);
 };