added access variable to exams soo we can distinguish private, public and confidential exams and also bugfixes and improvements

src/pages/api/code/entities.ts

@@ -3,16 +3,8 @@ import type { NextApiRequest, NextApiResponse } from "next";
 import client from "@/lib/mongodb";
 import { withIronSessionApiRoute } from "iron-session/next";
 import { sessionOptions } from "@/lib/session";
-import { Code, Group, Type } from "@/interfaces/user";
-import { PERMISSIONS } from "@/constants/userPermissions";
-import { prepareMailer, prepareMailOptions } from "@/email";
-import { isAdmin } from "@/utils/users";
+import { Code, } from "@/interfaces/user";
 import { requestUser } from "@/utils/api";
-import { doesEntityAllow } from "@/utils/permissions";
-import { getEntity, getEntityWithRoles } from "@/utils/entities.be";
-import { findBy } from "@/utils";
-import { EntityWithRoles } from "@/interfaces/entity";
-
 const db = client.db(process.env.MONGODB_DB);
 
 export default withIronSessionApiRoute(handler, sessionOptions);
@@ -30,7 +22,7 @@ async function get(req: NextApiRequest, res: NextApiResponse) {
 
 	const { entities } = req.query as { entities?: string[] };
 	if (entities)
-		return res.status(200).json(await db.collection("codes").find<Code>({ entity: { $in: entities } }).toArray());
+		return res.status(200).json(await db.collection("codes").find<Code>({ entity: { $in: Array.isArray(entities) ? entities : [entities] } }).toArray());
 
 	return res.status(200).json(await db.collection("codes").find<Code>({}).toArray());
 }

src/pages/api/code/index.ts

@@ -32,6 +32,7 @@ async function get(req: NextApiRequest, res: NextApiResponse) {
 	}
 
 	const { entity } = req.query as { entity?: string };
+
 	const snapshot = await db.collection("codes").find(entity ? { entity } : {}).toArray();
 
 	res.status(200).json(snapshot);

src/pages/api/exam/[module]/index.ts

@@ -10,6 +10,7 @@ import { getApprovalWorkflowsByExamId, updateApprovalWorkflows } from "@/utils/a
 import { generateExamDifferences } from "@/utils/exam.differences";
 import { getExams } from "@/utils/exams.be";
 import { isAdmin } from "@/utils/users";
+import { access } from "fs";
 import { withIronSessionApiRoute } from "iron-session/next";
 import type { NextApiRequest, NextApiResponse } from "next";
 
@@ -52,6 +53,7 @@ async function POST(req: NextApiRequest, res: NextApiResponse) {
 
 	try {
 		const exam = {
+			access: "public", // default access is public
 			...req.body,
 			module: module,
 			entities,

src/pages/api/exam/index.ts

@@ -1,11 +1,13 @@
 // Next.js API route support: https://nextjs.org/docs/api-routes/introduction
-import type {NextApiRequest, NextApiResponse} from "next";
+import type { NextApiRequest, NextApiResponse } from "next";
 import client from "@/lib/mongodb";
-import {withIronSessionApiRoute} from "iron-session/next";
-import {sessionOptions} from "@/lib/session";
-import {flatten} from "lodash";
-import {Exam} from "@/interfaces/exam";
-import {MODULE_ARRAY} from "@/utils/moduleUtils";
+import { withIronSessionApiRoute } from "iron-session/next";
+import { sessionOptions } from "@/lib/session";
+import { flatten, map } from "lodash";
+import { AccessType, Exam } from "@/interfaces/exam";
+import { MODULE_ARRAY } from "@/utils/moduleUtils";
+import { requestUser } from "../../../utils/api";
+import { mapBy } from "../../../utils";
 
 const db = client.db(process.env.MONGODB_DB);
 
@@ -14,17 +16,37 @@ export default withIronSessionApiRoute(handler, sessionOptions);
 async function handler(req: NextApiRequest, res: NextApiResponse) {
 	if (req.method === "GET") return await GET(req, res);
 
-	res.status(404).json({ok: false});
+	res.status(404).json({ ok: false });
 }
 
 async function GET(req: NextApiRequest, res: NextApiResponse) {
 	if (!req.session.user) {
-		res.status(401).json({ok: false});
+		res.status(401).json({ ok: false });
 		return;
 	}
+	const user = await requestUser(req, res)
+	if (!user)
+		return res.status(401).json({ ok: false, reason: "You must be logged in!" })
+	const isAdmin = ["admin", "developer"].includes(user.type)
+	const { entities = [] } = req.query as { access?: AccessType, entities?: string[] | string };
+	let entitiesToFetch = Array.isArray(entities) ? entities : entities ? [entities] : []
+
+	if (!isAdmin) {
+		const userEntitiesIDs = mapBy(user.entities || [], 'id')
+		entitiesToFetch = entities ? entitiesToFetch.filter((entity): entity is string => entity ? userEntitiesIDs.includes(entity) : false) : userEntitiesIDs
+		if ((entitiesToFetch.length ?? 0) === 0) {
+			res.status(200).json([])
+			return
+		}
+	}
 
 	const moduleExamsPromises = MODULE_ARRAY.map(async (module) => {
-		const snapshot = await db.collection(module).find<Exam>({ isDiagnostic: false }).toArray();
+		const snapshot = await db.collection(module).find<Exam>({
+			isDiagnostic: false, ...(isAdmin && (entitiesToFetch.length ?? 0) === 0 ? {
+			} : {
+				entity: { $in: entitiesToFetch }
+			})
+		}).toArray();
 
 		return snapshot.map((doc) => ({
 			...doc,