From a614278386bba437e5f246a5569396653cd5bb0d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Kruli=C5=A1?= <krulis@d3s.mff.cuni.cz>
Date: Wed, 28 Jan 2026 15:55:39 +0100
Subject: [PATCH] Preventing students to see stats from assignments that are
 not visible to students (yet).

---
 app/model/entity/Group.php          | 20 -----------
 app/model/view/GroupViewFactory.php | 51 ++++++++++++++++++++---------
 2 files changed, 35 insertions(+), 36 deletions(-)

diff --git a/app/model/entity/Group.php b/app/model/entity/Group.php
index 1400700b7..1238e7978 100644
--- a/app/model/entity/Group.php
+++ b/app/model/entity/Group.php
@@ -779,26 +779,6 @@ function (ShadowAssignment $pointsAssignment) {
         );
     }
 
-    public function getMaxPoints(): int
-    {
-        $pointsAss = array_reduce(
-            $this->getAssignments()->getValues(),
-            function ($carry, Assignment $assignment) {
-                return $carry + $assignment->getGroupPoints();
-            },
-            0
-        );
-        $pointsShadow = array_reduce(
-            $this->getShadowAssignments()->getValues(),
-            function ($carry, ShadowAssignment $shadowAssignment) {
-                return $carry + $shadowAssignment->getGroupPoints();
-            },
-            0
-        );
-
-        return $pointsAss + $pointsShadow;
-    }
-
     public function getLocalizedTextByLocale(string $locale): ?LocalizedGroup
     {
         $criteria = Criteria::create()->where(Criteria::expr()->eq("locale", $locale));
diff --git a/app/model/view/GroupViewFactory.php b/app/model/view/GroupViewFactory.php
index 74c441e42..3f3dfc482 100644
--- a/app/model/view/GroupViewFactory.php
+++ b/app/model/view/GroupViewFactory.php
@@ -20,6 +20,7 @@
 use App\Security\ACL\IShadowAssignmentPermissions;
 use App\Security\ACL\IGroupPermissions;
 use Nette\Utils\Arrays;
+use Doctrine\Common\Collections\Collection;
 
 /**
  * Factory for group views which somehow do not fit into json serialization of
@@ -94,6 +95,30 @@ function ($carry, ShadowAssignmentPoints $points) {
         );
     }
 
+    /**
+     * Get assignments of the group which current user can view.
+     */
+    private function getAssignments(Group $group): Collection
+    {
+        return $group->getAssignments()->filter(
+            function (Assignment $assignment) {
+                return $this->assignmentAcl->canViewDetail($assignment);
+            }
+        );
+    }
+
+    /**
+     * Get shadow assignments of the group which current user can view.
+     */
+    private function getShadowAssignments(Group $group): Collection
+    {
+        return $group->getShadowAssignments()->filter(
+            function (ShadowAssignment $assignment) {
+                return $this->shadowAssignmentAcl->canViewDetail($assignment);
+            }
+        );
+    }
+
     /**
      * Get the statistics of an individual student.
      * @param Group $group
@@ -108,9 +133,9 @@ private function getStudentStatsInternal(
         array $assignmentSolutions,
         array $reviewRequests
     ) {
-        $maxPoints = $group->getMaxPoints();
+        $maxPoints = 0;
         $shadowPointsMap = $this->shadowAssignmentPointsRepository->findPointsForAssignments(
-            $group->getShadowAssignments()->getValues(),
+            $this->getShadowAssignments($group)->getValues(),
             $student
         );
         $gainedPoints = $this->getPointsGainedByStudentForSolutions($assignmentSolutions);
@@ -119,10 +144,11 @@ private function getStudentStatsInternal(
         $studentReviewRequests = $reviewRequests[$student->getId()] ?? [];
 
         $assignments = [];
-        foreach ($group->getAssignments()->getValues() as $assignment) {
+        foreach ($this->getAssignments($group) as $assignment) {
             /**
              * @var Assignment $assignment
              */
+            $maxPoints += $assignment->getGroupPoints();
             $best = Arrays::get($assignmentSolutions, $assignment->getId(), null);
             $submission = $best ? $best->getLastSubmission() : null;
 
@@ -141,10 +167,11 @@ private function getStudentStatsInternal(
         }
 
         $shadowAssignments = [];
-        foreach ($group->getShadowAssignments()->getValues() as $shadowAssignment) {
+        foreach ($this->getShadowAssignments($group) as $shadowAssignment) {
             /**
              * @var ShadowAssignment $shadowAssignment
              */
+            $maxPoints += $shadowAssignment->getGroupPoints();
             $shadowPoints = Arrays::get($shadowPointsMap, $shadowAssignment->getId(), null);
 
             $shadowAssignments[] = [
@@ -189,7 +216,7 @@ private function getStudentStatsInternal(
     public function getStudentsStats(Group $group, User $student)
     {
         $assignmentSolutions = $this->assignmentSolutions->findBestUserSolutionsForAssignments(
-            $group->getAssignments()->getValues(),
+            $this->getAssignments($group)->getValues(),
             $student
         );
         $reviewRequestSolutions = $this->assignmentSolutions->findReviewRequestSolutionsIndexed($group, $student);
@@ -204,7 +231,7 @@ public function getStudentsStats(Group $group, User $student)
     public function getAllStudentsStats(Group $group)
     {
         $assignmentSolutions = $this->assignmentSolutions->findBestSolutionsForAssignments(
-            $group->getAssignments()->getValues()
+            $this->getAssignments($group)->getValues()
         );
         $reviewRequestSolutions = $this->assignmentSolutions->findReviewRequestSolutionsIndexed($group);
         return array_map(
@@ -237,20 +264,12 @@ public function getGroup(Group $group, bool $ignoreArchived = true): array
                 "students" => $this->groupAcl->canViewStudents($group) ? $group->getStudentsIds() : [],
                 "instanceId" => $group->getInstance() ? $group->getInstance()->getId() : null,
                 "hasValidLicence" => $group->hasValidLicense(),
-                "assignments" => $group->getAssignments()->filter(
-                    function (Assignment $assignment) {
-                        return $this->assignmentAcl->canViewDetail($assignment);
-                    }
-                )->map(
+                "assignments" => $this->getAssignments($group)->map(
                     function (Assignment $assignment) {
                         return $assignment->getId();
                     }
                 )->getValues(),
-                "shadowAssignments" => $group->getShadowAssignments()->filter(
-                    function (ShadowAssignment $assignment) {
-                        return $this->shadowAssignmentAcl->canViewDetail($assignment);
-                    }
-                )->map(
+                "shadowAssignments" => $this->getShadowAssignments($group)->map(
                     function (ShadowAssignment $assignment) {
                         return $assignment->getId();
                     }