Files that changed from the base of the PR and between b6b47e7 and 98b7184.

• src/main/resources/config/application-dev.yml is excluded by !**/*.yml
• src/main/resources/config/application.yml is excluded by !**/*.yml

• src/main/java/de/tum/cit/aet/artemis/core/config/SecurityConfiguration.java (3 hunks)
• src/main/java/de/tum/cit/aet/artemis/core/config/WebConfigurer.java (1 hunks)
• src/main/java/de/tum/cit/aet/artemis/core/config/websocket/WebsocketConfiguration.java (1 hunks)
• src/main/java/de/tum/cit/aet/artemis/core/security/filter/CsrfArtemisFilter.java (1 hunks)
• src/main/java/de/tum/cit/aet/artemis/core/security/jwt/JWTCookieService.java (3 hunks)
• src/main/java/de/tum/cit/aet/artemis/core/security/jwt/JWTFilter.java (2 hunks)
• src/main/java/de/tum/cit/aet/artemis/core/security/jwt/TokenProvider.java (1 hunks)
• src/main/java/de/tum/cit/aet/artemis/core/web/open/PublicUserJwtResource.java (5 hunks)
• src/main/java/de/tum/cit/aet/artemis/programming/domain/ProgrammingExerciseBuildConfig.java (1 hunks)
• src/main/java/de/tum/cit/aet/artemis/programming/repository/ProgrammingExerciseBuildConfigRepository.java (1 hunks)
• src/main/java/de/tum/cit/aet/artemis/programming/web/ProgrammingExerciseResource.java (7 hunks)
• src/main/webapp/app/app.module.ts (2 hunks)
• src/main/webapp/app/core/auth/account.service.ts (1 hunks)
• src/main/webapp/app/core/csrf/csrf.interceptor.ts (1 hunks)
• src/main/webapp/app/exercises/programming/manage/services/programming-exercise.service.ts (2 hunks)
• src/main/webapp/app/overview/exercise-details/exercise-details-student-actions.component.html (0 hunks)
• src/main/webapp/app/overview/exercise-details/exercise-details-student-actions.component.ts (1 hunks)
• src/main/webapp/app/shared/components/code-button/code-button.component.html (1 hunks)
• src/main/webapp/app/shared/components/code-button/code-button.component.ts (6 hunks)
• src/test/javascript/spec/component/overview/exercise-details/exercise-details-student-actions.component.spec.ts (0 hunks)
• src/test/javascript/spec/component/shared/code-button.component.spec.ts (5 hunks)
• src/test/javascript/spec/helpers/mocks/service/mock-account.service.ts (1 hunks)
• src/test/javascript/spec/helpers/mocks/service/mock-programming-exercise.service.ts (2 hunks)

• src/main/webapp/app/overview/exercise-details/exercise-details-student-actions.component.html
• src/test/javascript/spec/component/overview/exercise-details/exercise-details-student-actions.component.spec.ts

src/main/webapp/app/core/csrf/csrf.interceptor.ts (2)

1-2: LGTM: Imports are correct and follow guidelines.

The import statements are appropriate for the CSRF interceptor implementation and use single quotes as per the coding guidelines.

---

4-4: LGTM: Class declaration follows best practices and guidelines.

The CsrfInterceptor class is correctly exported and implements the HttpInterceptor interface. The class name uses PascalCase, adhering to the coding guidelines.

src/test/javascript/spec/helpers/mocks/service/mock-programming-exercise.service.ts (1)

5-5: LGTM: New import added correctly.

The new import for ProgrammingExerciseBuildConfig is correctly added and follows the existing import style in the file.

src/main/java/de/tum/cit/aet/artemis/core/security/jwt/JWTCookieService.java (2)

20-22: Improved constructor design

The simplified constructor aligns better with the single responsibility principle by removing the unnecessary Environment dependency. This change enhances the class's focus on JWT cookie-related operations.

---

Line range hint 1-72: Overall assessment: Well-structured and secure implementation

The changes to JWTCookieService have improved its design and functionality:

1. The constructor is now more focused, adhering to the single responsibility principle.
2. The new buildTheiaCookie method extends functionality while maintaining good coding practices.
3. Cookie security settings have been enhanced to support cross-site requests securely.

These modifications align well with the provided coding guidelines, particularly in terms of REST API best practices, security considerations, and code organization. The suggestions provided are minor and aimed at further improving flexibility and documentation.

src/main/webapp/app/app.module.ts (1)

29-29: LGTM: Import statement correctly added

The import of HTTP_INTERCEPTORS from @angular/common/http is correctly placed and follows Angular style guidelines. This import is necessary for adding the CSRF interceptor to the providers.

src/main/java/de/tum/cit/aet/artemis/core/config/WebConfigurer.java (2)

123-124: LGTM: Improved CORS configuration check.

The expanded conditional check now considers both getAllowedOrigins and getAllowedOriginPatterns. This change provides more flexibility in CORS configuration and aligns with the PR objectives to adjust CORS settings.

---

120-124: Overall assessment: CORS configuration improvements look good.

The changes to the corsFilter method enhance the CORS configuration flexibility and provide better visibility into the settings. These modifications align well with the PR objectives to adjust CORS configuration and improve security measures.

A minor suggestion was made to adjust the log level for the new logging statements. Otherwise, the changes appear to be correct and improve the functionality as intended.

src/main/java/de/tum/cit/aet/artemis/programming/domain/ProgrammingExerciseBuildConfig.java (1)

28-28: LGTM: Improved JSON serialization handling

The addition of @JsonIgnoreProperties(value = { "programmingExercise" }) is a good change. It prevents the programmingExercise field from being included in JSON representations of this class, which can help avoid circular references during serialization. This aligns with the REST API best practice of using minimal DTOs as mentioned in the coding guidelines.

src/main/java/de/tum/cit/aet/artemis/core/config/SecurityConfiguration.java (1)

38-38: LGTM: New import for CsrfArtemisFilter.

The import statement for CsrfArtemisFilter is correctly placed and follows the naming conventions.

src/main/webapp/app/overview/exercise-details/exercise-details-student-actions.component.ts (3)

14-14: LGTM: Import statement updated correctly.

The removal of the faDesktop icon import is consistent with the changes made to the component, likely related to the removal of Theia-related functionality.

---

Line range hint 93-126: LGTM: Theia-related logic removed from ngOnInit.

The removal of Theia-related logic from the ngOnInit method is consistent with the overall changes to the component. The remaining initialization logic for other exercise types looks correct.

---

21-21: Verify usage of remaining IDE-related properties.

The removal of Theia-related properties (theiaEnabled and theiaPortalURL) is consistent with the changes mentioned in the summary. However, localVCEnabled and athenaEnabled properties are still present.

Please ensure that these remaining properties are still used and necessary. If not, consider removing them as well.

✅ Verification successful

IDE-related properties are still in use.

The properties localVCEnabled and athenaEnabled are found in multiple components within the codebase.

🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Verify usage of localVCEnabled and athenaEnabled properties
rg --type typescript "localVCEnabled|athenaEnabled" src/main/webapp

Length of output: 104

---

Script:

#!/bin/bash
# Verify usage of localVCEnabled and athenaEnabled properties in TypeScript files
rg "localVCEnabled|athenaEnabled" src/main/webapp --glob "*.ts"

Length of output: 5562

src/main/webapp/app/exercises/programming/manage/services/programming-exercise.service.ts (2)

30-30: LGTM: New import statement is correctly implemented.

The import for ProgrammingExerciseBuildConfig is properly placed and follows the correct naming convention.

---

30-30: Summary: Excellent addition of build configuration retrieval functionality.

The new import and getBuildConfig method have been implemented cleanly and efficiently. They follow Angular best practices and the existing coding style of the file. These changes enhance the service's capabilities without disrupting the existing codebase.

Great job on maintaining code quality while expanding functionality!

Also applies to: 664-667

src/main/java/de/tum/cit/aet/artemis/core/security/filter/CsrfArtemisFilter.java (1)

38-38: Verify All API Endpoints Are Protected

The shouldNotFilter method excludes requests that do not start with /api/, meaning only /api/** endpoints are protected by this filter. It's important to verify that there are no other endpoints that require CSRF protection but do not start with /api/.

Run the following script to identify endpoints outside /api/:

This script searches for REST controller methods with mappings not starting with /api/. Verify if any of these endpoints should be protected by the CSRF filter.

src/main/java/de/tum/cit/aet/artemis/core/security/jwt/JWTFilter.java (1)

36-41: Handle Missing or Invalid JWT Gracefully

Ensure that the application handles missing or invalid JWT tokens appropriately. If the token is invalid or absent, and the request requires authentication, the user should receive a proper error response.

To verify the behavior, you can test unauthorized requests:

src/main/java/de/tum/cit/aet/artemis/core/security/jwt/TokenProvider.java (1)

98-99: Ensure correct method delegation

The createToken(Authentication authentication, boolean rememberMe) method now delegates token creation to the new method with a duration parameter. This change maintains the original functionality while promoting code reuse.

src/main/java/de/tum/cit/aet/artemis/core/web/open/PublicUserJwtResource.java (6)

5-7: Approval of Added Imports

The imports of Duration, Date, and Map are appropriate and necessary for the new functionality implemented in the class.

---

33-33: Approval of Added Import for RequestParam

The import of RequestParam is correctly added to support request parameter handling in the new method getTheiaToken.

---

40-40: Approval of Security-Related Imports

The added imports for EnforceAtLeastStudent, JWTFilter, and TokenProvider are necessary for implementing the enhanced security features.

Also applies to: 43-44

---

59-60: Proper Use of Dependency Injection for TokenProvider

Injecting TokenProvider via constructor injection aligns with best practices and the project's dependency injection guidelines.

Also applies to: 65-67

---

59-60: Field Access Modifiers Align with Best Practices

The tokenProvider field is declared as private final, adhering to the principle of least privilege and ensuring immutability.

---

119-122: Verification of JWT Extraction Logic

Please verify that the JWTFilter.extractValidJwt method correctly handles edge cases and does not introduce security vulnerabilities.

Verification Script:

This script searches for the implementation and all usages of extractValidJwt to help ensure it is implemented securely and used consistently.

src/main/webapp/app/shared/components/code-button/code-button.component.ts (1)

360-375: ⚠️ Potential issue

Avoid using non-null assertion operator; handle potential null values

Using the non-null assertion operator ! in this.exercise.id! (line 363) can lead to runtime errors if this.exercise.id is null or undefined. It's safer to add a null check to ensure this.exercise.id is defined before using it.

Apply this diff to fix the issue:

 private initTheia(profileInfo: ProfileInfo) {
     if (profileInfo.activeProfiles?.includes(PROFILE_THEIA) && this.exercise) {
+        if (this.exercise.id) {
             this.programmingExerciseService.getBuildConfig(this.exercise.id).subscribe((buildConfig) => {
                 if (this.exercise) {
                     this.exercise.buildConfig = buildConfig;
                     // Set variables now, sanitize later on
                     this.theiaPortalURL = profileInfo.theiaPortalURL ?? '';
                     // Verify that all conditions are met
                     if (this.theiaPortalURL !== '' && this.exercise.allowOnlineIde && this.exercise.buildConfig?.theiaImage) {
                         this.theiaEnabled = true;
                     }
                 }
             });
+        }
     }
 }

⛔ Skipped due to learnings

Learnt from: iyannsch
PR: ls1intum/Artemis#9379
File: src/main/webapp/app/shared/components/code-button/code-button.component.ts:143-170
Timestamp: 2024-10-08T15:35:42.972Z
Learning: In `code-button.component.ts`, `this.exercise.id` is checked before use, so it's acceptable to use the non-null assertion operator `!` on `this.exercise.id!`.

Learnt from: iyannsch
PR: ls1intum/Artemis#9379
File: src/main/webapp/app/shared/components/code-button/code-button.component.ts:143-170
Timestamp: 2024-09-30T08:34:49.363Z
Learning: In `code-button.component.ts`, `this.exercise.id` is checked before use, so it's acceptable to use the non-null assertion operator `!` on `this.exercise.id!`.

Learnt from: florian-glombik
PR: ls1intum/Artemis#8858
File: src/main/webapp/app/shared/exercise-filter/exercise-filter-modal.component.ts:97-107
Timestamp: 2024-10-08T15:35:48.768Z
Learning: In the context of PR ls1intum/Artemis#8858, avoid suggesting the removal of non-null assertions.

Learnt from: florian-glombik
PR: ls1intum/Artemis#8858
File: src/main/webapp/app/shared/exercise-filter/exercise-filter-modal.component.ts:97-107
Timestamp: 2024-10-08T15:35:42.972Z
Learning: In the context of PR ls1intum/Artemis#8858, avoid suggesting the removal of non-null assertions.

Learnt from: florian-glombik
PR: ls1intum/Artemis#8858
File: src/main/webapp/app/shared/exercise-filter/exercise-filter-modal.component.ts:97-107
Timestamp: 2024-07-09T19:10:33.905Z
Learning: In the context of PR ls1intum/Artemis#8858, avoid suggesting the removal of non-null assertions.

Learnt from: florian-glombik
PR: ls1intum/Artemis#8858
File: src/main/webapp/app/shared/exercise-filter/exercise-filter-modal.component.ts:97-111
Timestamp: 2024-10-08T15:35:52.595Z
Learning: In the context of PR ls1intum/Artemis#8858, non-null assertions should not be flagged or suggested for removal.

Learnt from: florian-glombik
PR: ls1intum/Artemis#8858
File: src/main/webapp/app/shared/exercise-filter/exercise-filter-modal.component.ts:97-111
Timestamp: 2024-07-09T19:06:18.665Z
Learning: In the context of PR ls1intum/Artemis#8858, non-null assertions should not be flagged or suggested for removal.

🧰 Tools

🪛 Biome

[error] 363-363: Forbidden non-null assertion.

(lint/style/noNonNullAssertion)