From 2b8a2b78cd83cc551ebbe4c64c64c73058eba84e Mon Sep 17 00:00:00 2001 From: Joseph Ortiz Date: Fri, 10 Oct 2025 10:53:24 -0700 Subject: [PATCH 01/14] Add Courses management for instructors Added a "Courses" navigation link in `_Layout.cshtml` visible only to authenticated users with the "Instructor" role. Implemented a `CoursesController` with full CRUD functionality, restricted to instructors via `[Authorize(Roles = "Instructor")]`. Created views (`Create.cshtml`, `Delete.cshtml`, `Details.cshtml`, `Edit.cshtml`, `Index.cshtml`) to manage courses, including forms for adding, editing, and deleting courses, as well as displaying course details and a list of all courses. --- .../Controllers/CoursesController.cs | 158 ++++++++++++++++++ SpeakingInBitsWeb/Views/Courses/Create.cshtml | 43 +++++ SpeakingInBitsWeb/Views/Courses/Delete.cshtml | 39 +++++ .../Views/Courses/Details.cshtml | 36 ++++ SpeakingInBitsWeb/Views/Courses/Edit.cshtml | 44 +++++ SpeakingInBitsWeb/Views/Courses/Index.cshtml | 47 ++++++ SpeakingInBitsWeb/Views/Shared/_Layout.cshtml | 6 + 7 files changed, 373 insertions(+) create mode 100644 SpeakingInBitsWeb/Controllers/CoursesController.cs create mode 100644 SpeakingInBitsWeb/Views/Courses/Create.cshtml create mode 100644 SpeakingInBitsWeb/Views/Courses/Delete.cshtml create mode 100644 SpeakingInBitsWeb/Views/Courses/Details.cshtml create mode 100644 SpeakingInBitsWeb/Views/Courses/Edit.cshtml create mode 100644 SpeakingInBitsWeb/Views/Courses/Index.cshtml diff --git a/SpeakingInBitsWeb/Controllers/CoursesController.cs b/SpeakingInBitsWeb/Controllers/CoursesController.cs new file mode 100644 index 0000000..b46e913 --- /dev/null +++ b/SpeakingInBitsWeb/Controllers/CoursesController.cs @@ -0,0 +1,158 @@ +using System; +using System.Collections.Generic; +using System.Linq; +using System.Threading.Tasks; +using Microsoft.AspNetCore.Authorization; +using Microsoft.AspNetCore.Mvc; +using Microsoft.AspNetCore.Mvc.Rendering; +using Microsoft.EntityFrameworkCore; +using SpeakingInBitsWeb.Data; +using SpeakingInBitsWeb.Models; + +namespace SpeakingInBitsWeb.Controllers; + +[Authorize(Roles = "Instructor")] +public class CoursesController : Controller +{ + private readonly ApplicationDbContext _context; + + public CoursesController(ApplicationDbContext context) + { + _context = context; + } + + // GET: Courses + public async Task Index() + { + return View(await _context.Courses.ToListAsync()); + } + + // GET: Courses/Details/5 + public async Task Details(int? id) + { + if (id == null) + { + return NotFound(); + } + + var course = await _context.Courses + .FirstOrDefaultAsync(m => m.Id == id); + if (course == null) + { + return NotFound(); + } + + return View(course); + } + + // GET: Courses/Create + public IActionResult Create() + { + return View(); + } + + // POST: Courses/Create + // To protect from overposting attacks, enable the specific properties you want to bind to. + // For more details, see http://go.microsoft.com/fwlink/?LinkId=317598. + [HttpPost] + [ValidateAntiForgeryToken] + public async Task Create([Bind("Id,Title,CourseCode,Description")] Course course) + { + if (ModelState.IsValid) + { + _context.Add(course); + await _context.SaveChangesAsync(); + return RedirectToAction(nameof(Index)); + } + return View(course); + } + + // GET: Courses/Edit/5 + public async Task Edit(int? id) + { + if (id == null) + { + return NotFound(); + } + + var course = await _context.Courses.FindAsync(id); + if (course == null) + { + return NotFound(); + } + return View(course); + } + + // POST: Courses/Edit/5 + // To protect from overposting attacks, enable the specific properties you want to bind to. + // For more details, see http://go.microsoft.com/fwlink/?LinkId=317598. + [HttpPost] + [ValidateAntiForgeryToken] + public async Task Edit(int id, [Bind("Id,Title,CourseCode,Description")] Course course) + { + if (id != course.Id) + { + return NotFound(); + } + + if (ModelState.IsValid) + { + try + { + _context.Update(course); + await _context.SaveChangesAsync(); + } + catch (DbUpdateConcurrencyException) + { + if (!CourseExists(course.Id)) + { + return NotFound(); + } + else + { + throw; + } + } + return RedirectToAction(nameof(Index)); + } + return View(course); + } + + // GET: Courses/Delete/5 + public async Task Delete(int? id) + { + if (id == null) + { + return NotFound(); + } + + var course = await _context.Courses + .FirstOrDefaultAsync(m => m.Id == id); + if (course == null) + { + return NotFound(); + } + + return View(course); + } + + // POST: Courses/Delete/5 + [HttpPost, ActionName("Delete")] + [ValidateAntiForgeryToken] + public async Task DeleteConfirmed(int id) + { + var course = await _context.Courses.FindAsync(id); + if (course != null) + { + _context.Courses.Remove(course); + } + + await _context.SaveChangesAsync(); + return RedirectToAction(nameof(Index)); + } + + private bool CourseExists(int id) + { + return _context.Courses.Any(e => e.Id == id); + } +} diff --git a/SpeakingInBitsWeb/Views/Courses/Create.cshtml b/SpeakingInBitsWeb/Views/Courses/Create.cshtml new file mode 100644 index 0000000..f45472b --- /dev/null +++ b/SpeakingInBitsWeb/Views/Courses/Create.cshtml @@ -0,0 +1,43 @@ +@model SpeakingInBitsWeb.Models.Course + +@{ + ViewData["Title"] = "Create"; +} + +

Create

+ +

Course

+
+
+
+
+
+
+ + + +
+
+ + + +
+
+ + + +
+
+ +
+
+
+
+ + + +@section Scripts { + @{await Html.RenderPartialAsync("_ValidationScriptsPartial");} +} diff --git a/SpeakingInBitsWeb/Views/Courses/Delete.cshtml b/SpeakingInBitsWeb/Views/Courses/Delete.cshtml new file mode 100644 index 0000000..8bce683 --- /dev/null +++ b/SpeakingInBitsWeb/Views/Courses/Delete.cshtml @@ -0,0 +1,39 @@ +@model SpeakingInBitsWeb.Models.Course + +@{ + ViewData["Title"] = "Delete"; +} + +

Delete

+ +

Are you sure you want to delete this?

+
+

Course

+
+
+
+ @Html.DisplayNameFor(model => model.Title) +
+
+ @Html.DisplayFor(model => model.Title) +
+
+ @Html.DisplayNameFor(model => model.CourseCode) +
+
+ @Html.DisplayFor(model => model.CourseCode) +
+
+ @Html.DisplayNameFor(model => model.Description) +
+
+ @Html.DisplayFor(model => model.Description) +
+
+ +
+ + | + Back to List +
+
diff --git a/SpeakingInBitsWeb/Views/Courses/Details.cshtml b/SpeakingInBitsWeb/Views/Courses/Details.cshtml new file mode 100644 index 0000000..c69eae6 --- /dev/null +++ b/SpeakingInBitsWeb/Views/Courses/Details.cshtml @@ -0,0 +1,36 @@ +@model SpeakingInBitsWeb.Models.Course + +@{ + ViewData["Title"] = "Details"; +} + +

Details

+ +
+

Course

+
+
+
+ @Html.DisplayNameFor(model => model.Title) +
+
+ @Html.DisplayFor(model => model.Title) +
+
+ @Html.DisplayNameFor(model => model.CourseCode) +
+
+ @Html.DisplayFor(model => model.CourseCode) +
+
+ @Html.DisplayNameFor(model => model.Description) +
+
+ @Html.DisplayFor(model => model.Description) +
+
+
+ diff --git a/SpeakingInBitsWeb/Views/Courses/Edit.cshtml b/SpeakingInBitsWeb/Views/Courses/Edit.cshtml new file mode 100644 index 0000000..7efd64d --- /dev/null +++ b/SpeakingInBitsWeb/Views/Courses/Edit.cshtml @@ -0,0 +1,44 @@ +@model SpeakingInBitsWeb.Models.Course + +@{ + ViewData["Title"] = "Edit"; +} + +

Edit

+ +

Course

+
+
+
+
+
+ +
+ + + +
+
+ + + +
+
+ + + +
+
+ +
+
+
+
+ + + +@section Scripts { + @{await Html.RenderPartialAsync("_ValidationScriptsPartial");} +} diff --git a/SpeakingInBitsWeb/Views/Courses/Index.cshtml b/SpeakingInBitsWeb/Views/Courses/Index.cshtml new file mode 100644 index 0000000..86036b2 --- /dev/null +++ b/SpeakingInBitsWeb/Views/Courses/Index.cshtml @@ -0,0 +1,47 @@ +@model IEnumerable + +@{ + ViewData["Title"] = "Index"; +} + +

Index

+ +

+ Create New +

+ + + + + + + + + + +@foreach (var item in Model) { + + + + + + +} + +
+ @Html.DisplayNameFor(model => model.Title) + + @Html.DisplayNameFor(model => model.CourseCode) + + @Html.DisplayNameFor(model => model.Description) +
+ @Html.DisplayFor(modelItem => item.Title) + + @Html.DisplayFor(modelItem => item.CourseCode) + + @Html.DisplayFor(modelItem => item.Description) + + Edit | + Details | + Delete +
diff --git a/SpeakingInBitsWeb/Views/Shared/_Layout.cshtml b/SpeakingInBitsWeb/Views/Shared/_Layout.cshtml index 628e80b..d8e05b0 100644 --- a/SpeakingInBitsWeb/Views/Shared/_Layout.cshtml +++ b/SpeakingInBitsWeb/Views/Shared/_Layout.cshtml @@ -26,6 +26,12 @@
  • Privacy
    • + @if (User.Identity?.IsAuthenticated == true && User.IsInRole("Instructor")) + { +
  • + Courses +
    • + } From 4c290ce0b869c3339eaeb5c63a1e531e64e516df Mon Sep 17 00:00:00 2001 From: Joseph Ortiz Date: Fri, 10 Oct 2025 11:00:04 -0700 Subject: [PATCH 02/14] Refactor role management to use centralized constants Replaced hardcoded role names with constants from a new `Roles` class to improve maintainability and consistency. Updated the `CoursesController` to use `Roles.Instructor` in the `[Authorize]` attribute. Modified `SeedData.cs` to use `Roles` constants for role creation and assignment. Updated `_Layout.cshtml` to use `Roles.Instructor` in role checks and added the necessary namespace import. Added a new `Roles.cs` file to define role constants for "Instructor" and "Student". --- .../Controllers/CoursesController.cs | 2 +- SpeakingInBitsWeb/Models/Roles.cs | 17 +++++++++++++++++ SpeakingInBitsWeb/Models/SeedData.cs | 4 ++-- SpeakingInBitsWeb/Views/Shared/_Layout.cshtml | 5 +++-- 4 files changed, 23 insertions(+), 5 deletions(-) create mode 100644 SpeakingInBitsWeb/Models/Roles.cs diff --git a/SpeakingInBitsWeb/Controllers/CoursesController.cs b/SpeakingInBitsWeb/Controllers/CoursesController.cs index b46e913..510b5bc 100644 --- a/SpeakingInBitsWeb/Controllers/CoursesController.cs +++ b/SpeakingInBitsWeb/Controllers/CoursesController.cs @@ -11,7 +11,7 @@ namespace SpeakingInBitsWeb.Controllers; -[Authorize(Roles = "Instructor")] +[Authorize(Roles = Roles.Instructor)] public class CoursesController : Controller { private readonly ApplicationDbContext _context; diff --git a/SpeakingInBitsWeb/Models/Roles.cs b/SpeakingInBitsWeb/Models/Roles.cs new file mode 100644 index 0000000..ca0ba1c --- /dev/null +++ b/SpeakingInBitsWeb/Models/Roles.cs @@ -0,0 +1,17 @@ +namespace SpeakingInBitsWeb.Models; + +/// +/// Defines constant values for application roles. +/// +public static class Roles +{ + /// + /// Role name for instructors who can manage courses. + /// + public const string Instructor = "Instructor"; + + /// + /// Role name for students who can enroll in courses. + /// + public const string Student = "Student"; +} diff --git a/SpeakingInBitsWeb/Models/SeedData.cs b/SpeakingInBitsWeb/Models/SeedData.cs index 61db0f2..c1ffad1 100644 --- a/SpeakingInBitsWeb/Models/SeedData.cs +++ b/SpeakingInBitsWeb/Models/SeedData.cs @@ -13,7 +13,7 @@ public static class SeedData /// The role manager service. public static async Task CreateRolesAsync(RoleManager roleManager) { - string[] roles = ["Instructor", "Student"]; + string[] roles = [Roles.Instructor, Roles.Student]; foreach (var role in roles) { @@ -49,7 +49,7 @@ public static async Task CreateDefaultUserAsync(UserManager use if (result.Succeeded) { - await userManager.AddToRoleAsync(newUser, "Instructor"); + await userManager.AddToRoleAsync(newUser, Roles.Instructor); } } } diff --git a/SpeakingInBitsWeb/Views/Shared/_Layout.cshtml b/SpeakingInBitsWeb/Views/Shared/_Layout.cshtml index d8e05b0..8ac05ee 100644 --- a/SpeakingInBitsWeb/Views/Shared/_Layout.cshtml +++ b/SpeakingInBitsWeb/Views/Shared/_Layout.cshtml @@ -1,4 +1,5 @@ - +@using SpeakingInBitsWeb.Models + @@ -26,7 +27,7 @@
  • Privacy
    • - @if (User.Identity?.IsAuthenticated == true && User.IsInRole("Instructor")) + @if (User.Identity?.IsAuthenticated == true && User.IsInRole(Roles.Instructor)) {
  • Courses From d161caffd311484ca4b3feabe4bea592c04efa77 Mon Sep 17 00:00:00 2001 From: Joseph Ortiz Date: Fri, 10 Oct 2025 11:54:15 -0700 Subject: [PATCH 03/14] Add instructor association to course creation Updated `CoursesController` to inject `UserManager` for retrieving the logged-in user's ID. Modified the `Create` action to associate courses with the currently logged-in instructor and adjusted `ModelState` validation accordingly. Updated `SeedData` to create a default user of type `Instructor`. Added a `Services` folder to the project structure in `SpeakingInBitsWeb.csproj`. Improved role-based authorization and user management by ensuring courses are linked to the correct instructor. Minor cleanup and updates to `using` statements and constructor dependencies. --- .../Controllers/CoursesController.cs | 20 +++++++++++++++++-- SpeakingInBitsWeb/Models/SeedData.cs | 2 +- SpeakingInBitsWeb/SpeakingInBitsWeb.csproj | 4 ++++ 3 files changed, 23 insertions(+), 3 deletions(-) diff --git a/SpeakingInBitsWeb/Controllers/CoursesController.cs b/SpeakingInBitsWeb/Controllers/CoursesController.cs index 510b5bc..65f6edc 100644 --- a/SpeakingInBitsWeb/Controllers/CoursesController.cs +++ b/SpeakingInBitsWeb/Controllers/CoursesController.cs @@ -3,6 +3,7 @@ using System.Linq; using System.Threading.Tasks; using Microsoft.AspNetCore.Authorization; +using Microsoft.AspNetCore.Identity; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Mvc.Rendering; using Microsoft.EntityFrameworkCore; @@ -15,10 +16,12 @@ namespace SpeakingInBitsWeb.Controllers; public class CoursesController : Controller { private readonly ApplicationDbContext _context; + private readonly UserManager _userManager; - public CoursesController(ApplicationDbContext context) + public CoursesController(ApplicationDbContext context, UserManager userManager) { _context = context; + _userManager = userManager; } // GET: Courses @@ -56,8 +59,21 @@ public IActionResult Create() // For more details, see http://go.microsoft.com/fwlink/?LinkId=317598. [HttpPost] [ValidateAntiForgeryToken] - public async Task Create([Bind("Id,Title,CourseCode,Description")] Course course) + public async Task Create(Course course) { + string? userId = _userManager.GetUserId(User); + Instructor? instructor = await _context.Users.OfType() + .FirstOrDefaultAsync(i => i.Id == userId); + + if (instructor != null) + { + course.CourseInstructor = instructor; + } + + // Remove CourseInstructor from ModelState since it's being set here programmatically + // It must be removed because it's happening after model binding and validation + ModelState.Remove(nameof(Course.CourseInstructor)); + if (ModelState.IsValid) { _context.Add(course); diff --git a/SpeakingInBitsWeb/Models/SeedData.cs b/SpeakingInBitsWeb/Models/SeedData.cs index c1ffad1..82dc804 100644 --- a/SpeakingInBitsWeb/Models/SeedData.cs +++ b/SpeakingInBitsWeb/Models/SeedData.cs @@ -35,7 +35,7 @@ public static async Task CreateDefaultUserAsync(UserManager use if (defaultUser == null) { - ApplicationUser newUser = new() + Instructor newUser = new() { UserName = "DefaultInstructor", Email = defaultEmail, diff --git a/SpeakingInBitsWeb/SpeakingInBitsWeb.csproj b/SpeakingInBitsWeb/SpeakingInBitsWeb.csproj index c2a5e4b..4f3387a 100644 --- a/SpeakingInBitsWeb/SpeakingInBitsWeb.csproj +++ b/SpeakingInBitsWeb/SpeakingInBitsWeb.csproj @@ -17,4 +17,8 @@ + + + + From 82c8e1ca70ee318ff5b2be1642fcfeace8f76404 Mon Sep 17 00:00:00 2001 From: Joseph Ortiz Date: Fri, 10 Oct 2025 12:00:11 -0700 Subject: [PATCH 04/14] Update course index layout to use responsive card design Replaced the table-based layout for displaying courses with a modern, responsive card-based design using Bootstrap. Updated the page title and header to "Courses" for clarity. Added a "Create New Course" button for quick access to course creation. Introduced a conditional block to display an informational alert when no courses are available, encouraging users to create a new course. Improved overall styling and layout responsiveness for better user experience. --- SpeakingInBitsWeb/Views/Courses/Index.cshtml | 70 +++++++++----------- 1 file changed, 30 insertions(+), 40 deletions(-) diff --git a/SpeakingInBitsWeb/Views/Courses/Index.cshtml b/SpeakingInBitsWeb/Views/Courses/Index.cshtml index 86036b2..92dad2b 100644 --- a/SpeakingInBitsWeb/Views/Courses/Index.cshtml +++ b/SpeakingInBitsWeb/Views/Courses/Index.cshtml @@ -1,47 +1,37 @@ @model IEnumerable @{ - ViewData["Title"] = "Index"; + ViewData["Title"] = "Courses"; } -

    Index

    +
    +

    Courses

    + Create New Course +
    -

    - Create New -

    - - - - - - - - - - -@foreach (var item in Model) { - - - - - - +
    + @foreach (var item in Model) + { +
    +
    +
    +
    @item.Title
    +
    @item.CourseCode
    +

    @item.Description

    +
    + Edit + Delete +
    +
    +
    +
    + } +
    + +@if (!Model.Any()) +{ + } - -
    - @Html.DisplayNameFor(model => model.Title) - - @Html.DisplayNameFor(model => model.CourseCode) - - @Html.DisplayNameFor(model => model.Description) -
    - @Html.DisplayFor(modelItem => item.Title) - - @Html.DisplayFor(modelItem => item.CourseCode) - - @Html.DisplayFor(modelItem => item.Description) - - Edit | - Details | - Delete -
    From b65a626c2c9e99f8cd9907de5123c999540072cd Mon Sep 17 00:00:00 2001 From: Joseph Ortiz Date: Fri, 10 Oct 2025 12:06:17 -0700 Subject: [PATCH 05/14] Refactor Edit method in CoursesController Removed [Bind] attribute to allow full Course object binding. Excluded CourseInstructor from ModelState validation to prevent unnecessary validation errors. Marked CourseInstructor navigation property as unchanged to avoid unintended updates during save. --- SpeakingInBitsWeb/Controllers/CoursesController.cs | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/SpeakingInBitsWeb/Controllers/CoursesController.cs b/SpeakingInBitsWeb/Controllers/CoursesController.cs index 65f6edc..6f60a1c 100644 --- a/SpeakingInBitsWeb/Controllers/CoursesController.cs +++ b/SpeakingInBitsWeb/Controllers/CoursesController.cs @@ -104,18 +104,25 @@ public async Task Edit(int? id) // For more details, see http://go.microsoft.com/fwlink/?LinkId=317598. [HttpPost] [ValidateAntiForgeryToken] - public async Task Edit(int id, [Bind("Id,Title,CourseCode,Description")] Course course) + public async Task Edit(int id, Course course) { if (id != course.Id) { return NotFound(); } + // Remove CourseInstructor from ModelState since we're not updating it + ModelState.Remove(nameof(Course.CourseInstructor)); + if (ModelState.IsValid) { try { _context.Update(course); + + // Explicitly tell EF that the CourseInstructor navigation property is unchanged + _context.Entry(course).Reference(c => c.CourseInstructor).IsModified = false; + await _context.SaveChangesAsync(); } catch (DbUpdateConcurrencyException) From a3925dbff75b4a01bfb4d55810389b2e73f400bd Mon Sep 17 00:00:00 2001 From: Joseph Ortiz Date: Fri, 10 Oct 2025 12:07:27 -0700 Subject: [PATCH 06/14] Remove course details functionality The `Details` action method in `CoursesController` has been removed, along with the corresponding `Details.cshtml` view. This eliminates the ability to view detailed information about individual courses, including their `Title`, `CourseCode`, and `Description`. Links to edit a course or return to the course list from the details view have also been removed. --- .../Controllers/CoursesController.cs | 18 ---------- .../Views/Courses/Details.cshtml | 36 ------------------- 2 files changed, 54 deletions(-) delete mode 100644 SpeakingInBitsWeb/Views/Courses/Details.cshtml diff --git a/SpeakingInBitsWeb/Controllers/CoursesController.cs b/SpeakingInBitsWeb/Controllers/CoursesController.cs index 6f60a1c..6fb73b3 100644 --- a/SpeakingInBitsWeb/Controllers/CoursesController.cs +++ b/SpeakingInBitsWeb/Controllers/CoursesController.cs @@ -30,24 +30,6 @@ public async Task Index() return View(await _context.Courses.ToListAsync()); } - // GET: Courses/Details/5 - public async Task Details(int? id) - { - if (id == null) - { - return NotFound(); - } - - var course = await _context.Courses - .FirstOrDefaultAsync(m => m.Id == id); - if (course == null) - { - return NotFound(); - } - - return View(course); - } - // GET: Courses/Create public IActionResult Create() { diff --git a/SpeakingInBitsWeb/Views/Courses/Details.cshtml b/SpeakingInBitsWeb/Views/Courses/Details.cshtml deleted file mode 100644 index c69eae6..0000000 --- a/SpeakingInBitsWeb/Views/Courses/Details.cshtml +++ /dev/null @@ -1,36 +0,0 @@ -@model SpeakingInBitsWeb.Models.Course - -@{ - ViewData["Title"] = "Details"; -} - -

    Details

    - -
    -

    Course

    -
    -
    -
    - @Html.DisplayNameFor(model => model.Title) -
    -
    - @Html.DisplayFor(model => model.Title) -
    -
    - @Html.DisplayNameFor(model => model.CourseCode) -
    -
    - @Html.DisplayFor(model => model.CourseCode) -
    -
    - @Html.DisplayNameFor(model => model.Description) -
    -
    - @Html.DisplayFor(model => model.Description) -
    -
    -
    - From 470cf343a1ef8f9f36971500fd6529f538690a80 Mon Sep 17 00:00:00 2001 From: Joseph Ortiz Date: Fri, 10 Oct 2025 12:10:30 -0700 Subject: [PATCH 07/14] Update SpeakingInBitsWeb/Controllers/CoursesController.cs Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- SpeakingInBitsWeb/Controllers/CoursesController.cs | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/SpeakingInBitsWeb/Controllers/CoursesController.cs b/SpeakingInBitsWeb/Controllers/CoursesController.cs index 6fb73b3..1facec8 100644 --- a/SpeakingInBitsWeb/Controllers/CoursesController.cs +++ b/SpeakingInBitsWeb/Controllers/CoursesController.cs @@ -27,7 +27,11 @@ public CoursesController(ApplicationDbContext context, UserManager Index() { - return View(await _context.Courses.ToListAsync()); + string? userId = _userManager.GetUserId(User); + var courses = await _context.Courses + .Where(c => c.CourseInstructor != null && c.CourseInstructor.Id == userId) + .ToListAsync(); + return View(courses); } // GET: Courses/Create From 580e8a5a7b2489c1f6b1ef7aa8736c4efb9512e5 Mon Sep 17 00:00:00 2001 From: Joseph Ortiz Date: Thu, 19 Mar 2026 09:20:01 -0700 Subject: [PATCH 08/14] Apply suggestions from code review Ensure the Delete also verifies Course ownership Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- .../Controllers/CoursesController.cs | 31 ++++++++++++++++--- 1 file changed, 26 insertions(+), 5 deletions(-) diff --git a/SpeakingInBitsWeb/Controllers/CoursesController.cs b/SpeakingInBitsWeb/Controllers/CoursesController.cs index 1facec8..d5fdad8 100644 --- a/SpeakingInBitsWeb/Controllers/CoursesController.cs +++ b/SpeakingInBitsWeb/Controllers/CoursesController.cs @@ -102,13 +102,34 @@ public async Task Edit(int id, Course course) if (ModelState.IsValid) { + // Get current user ID + string? userId = _userManager.GetUserId(User); + + // Fetch the course from the database, including the instructor + var courseToUpdate = await _context.Courses + .Include(c => c.CourseInstructor) + .FirstOrDefaultAsync(c => c.Id == id); + + if (courseToUpdate == null) + { + return NotFound(); + } + + // Check ownership + if (courseToUpdate.CourseInstructor == null || courseToUpdate.CourseInstructor.Id != userId) + { + return Forbid(); + } + + // Update allowed properties only (do not update instructor) + courseToUpdate.Title = course.Title; + courseToUpdate.Description = course.Description; + courseToUpdate.StartDate = course.StartDate; + courseToUpdate.EndDate = course.EndDate; + // Add other properties as needed, but do not update CourseInstructor + try { - _context.Update(course); - - // Explicitly tell EF that the CourseInstructor navigation property is unchanged - _context.Entry(course).Reference(c => c.CourseInstructor).IsModified = false; - await _context.SaveChangesAsync(); } catch (DbUpdateConcurrencyException) From 575274a9f1556bd30298827d358c58d8d1710943 Mon Sep 17 00:00:00 2001 From: JoeProgrammer88 Date: Thu, 19 Mar 2026 09:48:28 -0700 Subject: [PATCH 09/14] Update NuGet packages to stable versions, adjust dependencies Upgraded project dependencies to stable 10.0.x releases, removed EF Core Sqlite, and added Microsoft.Build packages. Updated EF Core Tools metadata for improved build configuration. --- SpeakingInBitsWeb/SpeakingInBitsWeb.csproj | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/SpeakingInBitsWeb/SpeakingInBitsWeb.csproj b/SpeakingInBitsWeb/SpeakingInBitsWeb.csproj index 4f3387a..1418dcb 100644 --- a/SpeakingInBitsWeb/SpeakingInBitsWeb.csproj +++ b/SpeakingInBitsWeb/SpeakingInBitsWeb.csproj @@ -1,4 +1,4 @@ - + net10.0 @@ -8,13 +8,17 @@ - - - - - - - + + + + + + all + runtime; build; native; contentfiles; analyzers; buildtransitive + + + + From cabadf00b636db6003a76b73f891463788da0612 Mon Sep 17 00:00:00 2001 From: JoeProgrammer88 Date: Thu, 19 Mar 2026 09:54:42 -0700 Subject: [PATCH 10/14] Add ownership checks to Edit/Delete in CoursesController Edit and Delete actions now verify course ownership by checking the logged-in user against the course instructor. Only owners can modify or delete courses. Also, removed concurrency check from Edit POST for simplification. --- .../Controllers/CoursesController.cs | 86 ++++++++++++------- 1 file changed, 53 insertions(+), 33 deletions(-) diff --git a/SpeakingInBitsWeb/Controllers/CoursesController.cs b/SpeakingInBitsWeb/Controllers/CoursesController.cs index d5fdad8..d9cc513 100644 --- a/SpeakingInBitsWeb/Controllers/CoursesController.cs +++ b/SpeakingInBitsWeb/Controllers/CoursesController.cs @@ -77,12 +77,26 @@ public async Task Edit(int? id) return NotFound(); } - var course = await _context.Courses.FindAsync(id); - if (course == null) + + + // Fetch the course from the database, including the instructor + var courseToUpdate = await _context.Courses + .Include(c => c.CourseInstructor) + .FirstOrDefaultAsync(c => c.Id == id); + + if (courseToUpdate == null) { return NotFound(); } - return View(course); + + // Get current user ID to check ownership + string? userId = _userManager.GetUserId(User); + if (courseToUpdate.CourseInstructor == null || courseToUpdate.CourseInstructor.Id != userId) + { + return Forbid(); + } + + return View(courseToUpdate); } // POST: Courses/Edit/5 @@ -124,25 +138,9 @@ public async Task Edit(int id, Course course) // Update allowed properties only (do not update instructor) courseToUpdate.Title = course.Title; courseToUpdate.Description = course.Description; - courseToUpdate.StartDate = course.StartDate; - courseToUpdate.EndDate = course.EndDate; - // Add other properties as needed, but do not update CourseInstructor - try - { - await _context.SaveChangesAsync(); - } - catch (DbUpdateConcurrencyException) - { - if (!CourseExists(course.Id)) - { - return NotFound(); - } - else - { - throw; - } - } + await _context.SaveChangesAsync(); + return RedirectToAction(nameof(Index)); } return View(course); @@ -156,14 +154,26 @@ public async Task Delete(int? id) return NotFound(); } - var course = await _context.Courses - .FirstOrDefaultAsync(m => m.Id == id); - if (course == null) + // Get current user ID + string? userId = _userManager.GetUserId(User); + + // Fetch the course from the database, including the instructor + var courseToDelete = await _context.Courses + .Include(c => c.CourseInstructor) + .FirstOrDefaultAsync(c => c.Id == id); + + if (courseToDelete == null) { return NotFound(); } - return View(course); + // Check ownership + if (courseToDelete.CourseInstructor == null || courseToDelete.CourseInstructor.Id != userId) + { + return Forbid(); + } + + return View(courseToDelete); } // POST: Courses/Delete/5 @@ -171,18 +181,28 @@ public async Task Delete(int? id) [ValidateAntiForgeryToken] public async Task DeleteConfirmed(int id) { - var course = await _context.Courses.FindAsync(id); - if (course != null) + // Get current user ID + string? userId = _userManager.GetUserId(User); + + // Fetch the course from the database, including the instructor + var courseToDelete = await _context.Courses + .Include(c => c.CourseInstructor) + .FirstOrDefaultAsync(c => c.Id == id); + + if (courseToDelete == null) { - _context.Courses.Remove(course); + return NotFound(); + } + + // Check ownership + if (courseToDelete.CourseInstructor == null || courseToDelete.CourseInstructor.Id != userId) + { + return Forbid(); } + _context.Courses.Remove(courseToDelete); await _context.SaveChangesAsync(); - return RedirectToAction(nameof(Index)); - } - private bool CourseExists(int id) - { - return _context.Courses.Any(e => e.Id == id); + return RedirectToAction(nameof(Index)); } } From c8fc0dc61697ddf0d7cfbaa5dfb13fbb407787a3 Mon Sep 17 00:00:00 2001 From: Joseph Ortiz Date: Thu, 19 Mar 2026 10:36:42 -0700 Subject: [PATCH 11/14] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- SpeakingInBitsWeb/Controllers/CoursesController.cs | 1 + 1 file changed, 1 insertion(+) diff --git a/SpeakingInBitsWeb/Controllers/CoursesController.cs b/SpeakingInBitsWeb/Controllers/CoursesController.cs index d9cc513..da05269 100644 --- a/SpeakingInBitsWeb/Controllers/CoursesController.cs +++ b/SpeakingInBitsWeb/Controllers/CoursesController.cs @@ -138,6 +138,7 @@ public async Task Edit(int id, Course course) // Update allowed properties only (do not update instructor) courseToUpdate.Title = course.Title; courseToUpdate.Description = course.Description; + courseToUpdate.CourseCode = course.CourseCode; await _context.SaveChangesAsync(); From 6f8b1f310b76c82be16d724350cdf97855d012de Mon Sep 17 00:00:00 2001 From: Joseph Ortiz Date: Thu, 19 Mar 2026 10:37:03 -0700 Subject: [PATCH 12/14] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- SpeakingInBitsWeb/Controllers/CoursesController.cs | 1 - 1 file changed, 1 deletion(-) diff --git a/SpeakingInBitsWeb/Controllers/CoursesController.cs b/SpeakingInBitsWeb/Controllers/CoursesController.cs index da05269..9de72a3 100644 --- a/SpeakingInBitsWeb/Controllers/CoursesController.cs +++ b/SpeakingInBitsWeb/Controllers/CoursesController.cs @@ -5,7 +5,6 @@ using Microsoft.AspNetCore.Authorization; using Microsoft.AspNetCore.Identity; using Microsoft.AspNetCore.Mvc; -using Microsoft.AspNetCore.Mvc.Rendering; using Microsoft.EntityFrameworkCore; using SpeakingInBitsWeb.Data; using SpeakingInBitsWeb.Models; From 8b1e65eb92fc567b1495ca908ec2f3d6eac45ea0 Mon Sep 17 00:00:00 2001 From: Joseph Ortiz Date: Thu, 19 Mar 2026 10:37:33 -0700 Subject: [PATCH 13/14] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- SpeakingInBitsWeb/SpeakingInBitsWeb.csproj | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/SpeakingInBitsWeb/SpeakingInBitsWeb.csproj b/SpeakingInBitsWeb/SpeakingInBitsWeb.csproj index 1418dcb..5477e23 100644 --- a/SpeakingInBitsWeb/SpeakingInBitsWeb.csproj +++ b/SpeakingInBitsWeb/SpeakingInBitsWeb.csproj @@ -17,8 +17,12 @@ runtime; build; native; contentfiles; analyzers; buildtransitive     - - + + all + + + all + From 7f810115d190059ce800d69a08e4ce4345ebe095 Mon Sep 17 00:00:00 2001 From: Joseph Ortiz Date: Thu, 19 Mar 2026 10:37:53 -0700 Subject: [PATCH 14/14] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- SpeakingInBitsWeb/Views/Shared/_Layout.cshtml | 1 - 1 file changed, 1 deletion(-) diff --git a/SpeakingInBitsWeb/Views/Shared/_Layout.cshtml b/SpeakingInBitsWeb/Views/Shared/_Layout.cshtml index 8ac05ee..f24b606 100644 --- a/SpeakingInBitsWeb/Views/Shared/_Layout.cshtml +++ b/SpeakingInBitsWeb/Views/Shared/_Layout.cshtml @@ -1,4 +1,3 @@ -@using SpeakingInBitsWeb.Models