Feat 331 data export - #320
Conversation
| documentTypes = [0, 1, 2, 4]; | ||
| } | ||
|
|
||
| const docs = await server.db.models.document.findAll({ |
There was a problem hiding this comment.
Neither processDocumentBasedExport nor processStudyBasedExport verifies that the requesting user (currentUserId) actually has access to projectId, the route only checks that the project row exists (loadExportRequestContext), not that the caller is a member/owner/has rights on it. Any authenticated user can POST an arbitrary projectId + userIds here and receive that project's documents, annotations, comments, document edits, and study session data in the ZIP.
The same gap applies to processStudyBasedExport (routes/export.js:608, server.db.models.study.findAll({ where: studyWhere })).
| return this.userSelection.some(row => row.acceptDataSharing === 'No'); | ||
| }, | ||
| exportTypeLabel() { | ||
| const labels = { |
There was a problem hiding this comment.
What about 'userBehaviour'? Can we do it dynamic?
| return submissionsByUser[uid]; | ||
| }; | ||
|
|
||
| if (this.exportType === 'submissions' || this.exportType === 'userBehaviour') { |
There was a problem hiding this comment.
I'm not sure if we can reuse the submission export type here. The count in getExportTypeColumn would be wrong as it is based of the user's submission documents.
| try { | ||
| const rows = await fetchPage(lastId, pageSize); | ||
| if (rows.length === 0) { | ||
| if (!started) this.push(Papa.unparse([mapRow].length ? [] : [])); |
There was a problem hiding this comment.
If the userBehaviour CSV export has zero rows, the stream would push an empty string instead of the CSV header and empty rows. Just use Papa.unparse([])
| return { success: false, status: 400, message: "Unsupported grade format. Use json or csv." }; | ||
| } | ||
| if (userIds.length === 0) { | ||
| console.warn("Export aborted: No valid users selected."); |
There was a problem hiding this comment.
we should not use console.warn, we should use our logging mechanismn
There was a problem hiding this comment.
Can we split this file, it still feels too much in one file
2 participants
This pull request includes: