E2550 Response hierarchy and responses_controller back end

Gemfile.lock

@@ -253,7 +253,7 @@ GEM
       date
       stringio
     public_suffix (6.0.2)
-    puma (6.6.1)
+    puma (6.4.2)
       nio4r (~> 2.0)
     racc (1.8.1)
     rack (3.2.1)

app/controllers/responses_controller.rb

@@ -0,0 +1,216 @@
+# frozen_string_literal: true
+
+class ResponsesController < ApplicationController
+  before_action :set_response, only: [:update, :submit, :unsubmit, :destroy]
+
+  # Authorization: determines if current user can perform the action
+  def action_allowed?
+    case action_name
+    when 'create'
+      true
+    when 'update', 'submit'
+      @response = Response.find(params[:id])
+      unless response_belongs_to? || current_user_is_parent_of_assignment_instructor_for_response? || 
+             current_user_is_teaching_staff_for_response_assignment?
+        render json: { error: 'forbidden' }, status: :forbidden
+      end
+    when 'unsubmit', 'destroy'
+      # Only allow if user is the instructor of the associated assignment or has admin privileges
+      unless current_user_is_parent_of_assignment_instructor_for_response? || 
+             current_user_is_teaching_staff_for_response_assignment?
+        render json: { error: 'forbidden' }, status: :forbidden
+      end
+    else
+      render json: { error: 'forbidden' }, status: :forbidden
+    end
+    true
+  end
+
+  # POST /responses
+  def create
+    @response_map = ResponseMap.find_by(id: params[:response_map_id] || params[:map_id])
+    return render json: { error: 'ResponseMap not found' }, status: :not_found unless @response_map
+
+    @response = Response.new(
+      map_id: @response_map.id,
+      is_submitted: false,
+      created_at: Time.current
+    )
+
+    if @response.save
+      render json: { message: "#{response_map_label} submission started successfully", response: @response }, status: :created
+    else
+      render json: { error: @response.errors.full_messages.to_sentence }, status: :unprocessable_entity
+    end
+  end
+
+  # PATCH /responses/:id
+  # Reviewer edits existing draft (still unsubmitted)
+  def update
+    return render json: { error: 'forbidden' }, status: :forbidden if @response.is_submitted?
+
+    if @response.update(response_params)
+      render json: { message: "#{response_map_label} submission saved successfully", response: @response }, status: :ok
+    else
+      render json: { error: @response.errors.full_messages.to_sentence }, status: :unprocessable_entity
+    end
+  end
+
+  # PATCH /responses/:id/submit
+  # Lock the response and calculate final score
+  def submit
+    return render json: { error: 'Submission not found' }, status: :not_found unless @response
+    if @response.is_submitted?
+      return render json: { error: 'Submission has already been locked' }, status: :unprocessable_entity
+    end
+    # Check deadline
+    unless submission_window_open?(@response)
+      return render json: { error: 'Submission deadline has passed' }, status: :forbidden
+    end
+
+    # Lock response
+    @response.is_submitted = true
+
+    # Calculate score via ScorableHelper
+    total_score = @response.aggregate_questionnaire_score
+
+    if @response.save
+      render json: {
+        message: "#{response_map_label} submission locked and scored successfully",
+        response: @response,
+        total_score: total_score
+      }, status: :ok
+    else
+      render json: { error: @response.errors.full_messages.to_sentence }, status: :unprocessable_entity
+    end
+  end
+
+  # PATCH /responses/:id/unsubmit
+  # Instructor/Admin reopens a submitted response for further editing
+  def unsubmit
+    return render json: { error: "#{response_map_label} submission not found" }, status: :not_found unless @response
+
+    if @response.is_submitted?
+      @response.update(is_submitted: false)
+      render json: { message: "#{response_map_label} submission reopened for edits. The reviewer can now make changes.", response: @response }, status: :ok
+    else
+      render json: { error: "This #{response_map_label.downcase} submission is not locked, so it cannot be reopened" }, status: :unprocessable_entity
+    end
+  end
+
+  # DELETE /responses/:id
+  # Instructor/Admin deletes invalid/test response
+  def destroy
+    return render json: { error: 'Submission not found' }, status: :not_found unless @response
+
+    @response.destroy
+    head :no_content
+  rescue StandardError => e
+    render json: { error: e.message }, status: :unprocessable_entity
+  end
+
+  private
+
+  def set_response
+    @response = Response.find_by(id: params[:id])
+  end
+
+  def response_params
+    params.require(:response).permit(
+      :map_id,
+      :is_submitted,
+      :submitted_at,
+      scores_attributes: [:id, :question_id, :answer, :comment]
+    )
+  end
+
+  def response_belongs_to?
+    # Member actions: we have @response from set_response
+    return @response.map&.reviewer&.id == current_user.id if @response&.map&.reviewer && current_user
+
+    # Collection actions (create, next_action): check map ownership
+    map_id = params[:response_map_id] || params[:map_id]
+    return false if map_id.blank?
+
+    map = ResponseMap.find_by(id: map_id)
+    return false unless map
+
+    map.reviewer == current_user
+  end
+
+  # Checks whether the current_user is the instructor for the assignment
+  # associated with the response identified by params[:id].
+  # Uses the shared authorization method from Authorization concern.
+  def current_user_instructs_response_assignment?
+    resp = Response.find_by(id: params[:id])
+    return false unless resp&.response_map
+
+    assignment = resp.response_map&.assignment
+    return false unless assignment
+
+    # Delegate to the shared authorization helper
+    current_user_instructs_assignment?(assignment)
+  end
+
+  # Returns true if current user is teaching staff for the assignment associated
+  # with the current response (instructor or TA mapped to the assignment's course)
+  def current_user_is_teaching_staff_for_response_assignment?
+    resp = Response.find_by(id: params[:id])
+    return false unless resp&.response_map
+
+    assignment = resp.response_map&.assignment
+    return false unless assignment
+
+    # Uses Authorization concern helper to check instructor OR TA mapping
+    current_user_teaching_staff_of_assignment?(assignment.id)
+  end
+
+  # Returns true if the current user is the parent (creator) of the instructor
+  # for the assignment associated with the current response (params[:id]).
+  def current_user_is_parent_of_assignment_instructor_for_response?
+    resp = Response.find_by(id: params[:id])
+    return false unless resp&.response_map
+
+    assignment = resp.response_map&.assignment
+    return false unless assignment
+
+    instructor = find_assignment_instructor(assignment)
+    return false unless instructor
+
+    user_logged_in? && instructor.parent_id == current_user.id
+  end
+
+  # Returns the friendly label for the response's map type (e.g., "Review", "Assignment Survey")
+  # Falls back to a generic "Submission" if the label cannot be determined.
+  def response_map_label
+    return 'Submission' unless @response&.response_map
+
+    map_label = @response.response_map&.response_map_label
+    map_label.presence || 'Submission'
+  end
+
+  # Returns true if the assignment's due date is in the future or no due date is set
+  def submission_window_open?(response)
+    assignment = response&.response_map&.assignment
+    return true if assignment.nil?
+    return true if assignment.due_dates.nil?
+
+    # Check if due_date has a future? method, otherwise compare timestamps
+    due_dates = assignment.due_dates
+    # Prefer the `upcoming` API if available 
+    if due_dates.respond_to?(:upcoming)
+      next_due = due_dates.upcoming.first
+      return true if next_due.nil?
+      return next_due.due_at > Time.current
+    end
+    # Fallback to legacy `future?` if present
+    if due_dates.respond_to?(:future?)
+      return due_dates.first.future?
+    end
+
+    # Fallback: compare timestamps
+    return true if due_dates.first.nil?
+
+    due_dates.first.due_at > Time.current
+  end
+end

app/models/concerns/response_map_subclass_titles.rb

@@ -9,5 +9,6 @@ module ResponseMapSubclassTitles
     METAREVIEW_RESPONSE_MAP_TITLE = 'Metareview'
     QUIZ_RESPONSE_MAP_TITLE = 'Quiz'
     REVIEW_RESPONSE_MAP_TITLE = 'Review'
+    SURVEY_RESPONSE_MAP_TITLE = 'Survey'
     TEAMMATE_REVIEW_RESPONSE_MAP_TITLE = 'Teammate Review' 
-end
+end

app/models/response.rb

@@ -6,6 +6,7 @@ class Response < ApplicationRecord
 
   belongs_to :response_map, class_name: 'ResponseMap', foreign_key: 'map_id', inverse_of: false
   has_many :scores, class_name: 'Answer', foreign_key: 'response_id', dependent: :destroy, inverse_of: false
+  accepts_nested_attributes_for :scores
 
   alias map response_map
   delegate :response_assignment, :reviewee, :reviewer, to: :map
@@ -15,32 +16,62 @@ def questionnaire
     response_assignment.assignment_questionnaires.find_by(used_in_round: self.round).questionnaire
   end
 
+  # returns a string of response name, needed so the front end can tell students which rubric they are filling out
+  def rubric_label
+    return 'Response' if map.nil?
+
+    if map.respond_to?(:response_map_label)
+      label = map.response_map_label
+      return label if label.present?
+    end
+
+    # response type doesn't exist
+    'Unknown Type'
+  end
+
+  # Returns true if this response's score differs from peers by more than the assignment notification limit
   def reportable_difference?
     map_class = map.class
     # gets all responses made by a reviewee
     existing_responses = map_class.assessments_for(map.reviewee)
 
-    count = 0
-    total = 0
+  count = 0
+  total_numerator = BigDecimal('0')
+  total_denominator = BigDecimal('0')
     # gets the sum total percentage scores of all responses that are not this response
+    # (each response can omit questions, so maximum_score may differ and we normalize before averaging)
     existing_responses.each do |response|
       unless id == response.id # the current_response is also in existing_responses array
         count += 1
-        total +=  response.aggregate_questionnaire_score.to_f / response.maximum_score
+        # Accumulate raw sums and divide once to minimize rounding error
+        total_numerator += BigDecimal(response.aggregate_questionnaire_score.to_s)
+        total_denominator += BigDecimal(response.maximum_score.to_s)
       end
     end
 
     # if this response is the only response by the reviewee, there's no grade conflict
     return false if count.zero?
 
-    # calculates the average score of all other responses
-    average_score = total / count
+    # Calculate average of peers by dividing once at the end
+    average_score = if total_denominator.zero?
+                      0.0
+                    else
+                      (total_numerator / total_denominator).to_f
+                    end
 
     # This score has already skipped the unfilled scorable item(s)
-    score = aggregate_questionnaire_score.to_f / maximum_score
+    # Normalize this response similarly, dividing once
+    this_numerator = BigDecimal(aggregate_questionnaire_score.to_s)
+    this_denominator = BigDecimal(maximum_score.to_s)
+    score = if this_denominator.zero?
+              0.0
+            else
+              (this_numerator / this_denominator).to_f
+            end
     questionnaire = questionnaire_by_answer(scores.first)
     assignment = map.assignment
-    assignment_questionnaire = AssignmentQuestionnaire.find_by(assignment_id: assignment.id, questionnaire_id: questionnaire.id)
+    assignment_questionnaire = AssignmentQuestionnaire.find_by(assignment_id: assignment.id,
+                                                               questionnaire_id: questionnaire.id)
 
     # notification_limit can be specified on 'Rubrics' tab on assignment edit page.
     allowed_difference_percentage = assignment_questionnaire.notification_limit.to_f