Implement class join codes back-end#789
Draft
fspeirs wants to merge 7 commits into
Draft
Conversation
Test coverage91.27% line coverage reported by SimpleCov. |
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
fspeirs
force-pushed
the
fs-implement-class-join-codes
branch
from
2b3e115 to
bb23e12
Compare
fspeirs
force-pushed
the
fs-implement-class-join-codes
branch
2 times, most recently
from
508b98b to
aec7f84
Compare
fspeirs
changed the title
Generate human-readable globally unique class join codes in the format CVDDCVDD (e.g. CE18LI80) — consonant, vowel, two digits, twice. The mixed alpha+numeric layout reads cleanly out loud, limits visual ambiguity (no I/1 or O/0 collisions in the consonant set), and is short enough to type from memory. Removes K, X, and Z from the consonant pool to reduce the chance of generating offensive substrings, and rejects any code whose consonant-vowel pairs match a small denylist of common offensive patterns. Generation retries up to 100 times before giving up.
Add a globally unique, regenerable join code to every class. The code is generated automatically on creation and backfilled for existing classes. Distinct from the existing per-school code: join codes are globally unique (so /join/:code can resolve without a school identifier), are designed to be regeneratable if a class needs a fresh code, and are surfaced in the school_class JSON payload for clients that display them. Two migrations following the existing pattern for the per-school code field — one to add the column and unique index, one to backfill existing rows. The backfill skips validations because existing rows may not satisfy other newer constraints.
Add POST /api/schools/:school_id/classes/:id/regenerate_join_code so teachers and school owners can rotate a class's join code if it has been over-shared. The endpoint authorises through CanCan; both school_owner and school_teacher abilities gain the regenerate_join_code permission for classes they have access to.
Add a public predicate that answers whether an email address belongs to one of the school's allowed domains. Extracts the domain from the email (after the last '@', stripped and lowercased) and delegates to the existing valid_domain? lookup against school_email_domains. Returns false for blank, malformed, or domain-less inputs. Lets callers gate behaviour on email domain without having to parse the address themselves.
Add the student-facing half of the join-code flow: a JSON API the
frontend can call to look up a class from its join code and enroll
the current user. Mirrors the teacher_invitations pattern — backend
is JSON-only, the frontend owns the public URL the user lands on.
GET /api/join/:join_code is unauthenticated and returns
{ status, school, school_class } where status is one of
unauthenticated, joinable, already_member, wrong_school, or
domain_mismatch. The frontend uses status to decide what to show.
POST /api/join/:join_code requires auth and performs enrollment.
On success or for already_member it returns
{ redirect_url } (a locale-less path so the frontend can prepend
the user's current locale); on a forbidden status it returns 403
with the status as the error. Membership creation is idempotent.
The endpoint normalises join codes by uppercasing and stripping
non-alphanumerics, so hyphenated forms like BAFA-1234 from
copy-and-pasted share links resolve to the canonical BAFA1234.
Adds a boolean sso_enabled? to School (true when at least one school_email_domain exists) and surfaces it through the school jbuilder partial so the front end can detect JIT-provisioning schools.
This will ease any concerns about accidentally generating rude words while also remaining visually distinct from class codes or school codes, which are DD-DD-DD.
fspeirs
force-pushed
the
fs-implement-class-join-codes
branch
from
85e8b32 to
efa9fd2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR implements the back-end for class join codes — students join a class by entering an 8-character code in the format
CDDD-CDDD(consonant + three digits, twice, separated by a hyphen).Based on #787 for the email-domain validation pieces; will be rebased on
mainonce that merges.Changes
join_codecolumn with a unique index toschool_classes, plus a backfill migration for existing classes.JoinCodeGeneratorwith.generateand.normalize(canonicalises user input to the hyphenated form for DB lookup).SchoolClasscreate/import with a uniqueness retry, plus aregenerate_join_code!helper.GET /api/join/:join_codereturning the prospective student's status:unauthenticated,joinable,already_member,wrong_school,domain_mismatch, ornot_a_student.POST /api/join/:join_codeto enrol the current user as a student of the school and class.POST /api/school_classes/:id/regenerate_join_code.join_codeon the school class JSON andsso_enabled?on the school JSON.School#valid_email?(built on Store school email domains #787's domain validation) for thedomain_mismatchcheck.regenerate_join_code.