Admin course and student management pages don't work for admins
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- javascript, python
- Domain
- backend-api-design, full-stack
Research direction
Start with pages/admin/courses/manage.js and pages/admin/students/manage.js, then trace the backend routes those pages call, including require_course_role and get_user_enrollments. Compare the proposed admin-only endpoints with the existing course-role checks; the issue notes that option 2 keeps those checks simple. Done means admins can manage courses and view the selected student's enrollments without granting access to non-admins.
Written by the indexing model from the issue text.
Description
The admin pages for managing a course and viewing a student call routes that only allow people enrolled in that course, or that ignore the parameter the page sends. An admin who isn't enrolled in the course gets 403s or the wrong data. This is separate from the auth fix in #366, which made the admin pages send the session cookie but didn't change these routes.
pages/admin/courses/manage.js:
get_course_info: requires student, TA or instructor in the course.get_course_enrollment: requires instructor or TA in the course.update_course: requires instructor in the course.delete_course: requires instructor in the course.create_enrollment: requires a staff role in the course.leave_course: has no auth at all (see the other issue).
pages/admin/students/manage.js:
- Calls
get_user_enrollments?user_id=<student>, but the backend ignoresuser_idand returns the logged-in user's own enrollments. The page shows the admin's courses, not the student's.
Options:
- Let a global admin pass these course checks, either inside
require_course_roleor with separate admin endpoints. - Add admin-only endpoints for the admin panel (for example, a user's enrollments by id) and point the admin pages at them.
Option 2 keeps the course role checks simple and makes admin access explicit.
- Dominant language
- Python
- Stars
- 13
- Forks
- 0
- Avg merge
- 2h 4m
- Merged PRs (30d)
- 1
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from kiat/codeAssist
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
kiat/codeAssist#391 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
kiat/codeAssist#364 · 1 comment ·
-
Difficulty 3/5 1-2 days Newbie friendliness 42/100
kiat/codeAssist#393 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 63/100
kiat/codeAssist#392 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 52/100
kiat/codeAssist#390 ·
Similar issues
-
`burr` fails to start when the Python path has a space in itPossibly taken @enekoreto claimed this today. Openstatus/needs-triage
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 5 days
-
gemini 出现了新的域名需要加入Open
Difficulty 1/5 Under an hour Newbie friendliness 72/100
-
Difficulty 2/5 Half a day Newbie friendliness 72/100
debpalash/VoiceStudio#2903 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
dagster-io/community-integrations#367 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
aws-samples/sample-per-model-bedrock#243 ·
Maintainers usually reply within 1 day