UP-166 Support for CourseContextTokens to support multiple courseIds for a sessioned user - #15
Open
karendolan wants to merge 2 commits into
Open
UP-166 Support for CourseContextTokens to support multiple courseIds for a sessioned user#15karendolan wants to merge 2 commits into
karendolan wants to merge 2 commits into
Conversation
…ort to allow users to make validatable API calls when different course contexts are open (i.e. multiple tabs) in the same browser session
There was a problem hiding this comment.
Pull request overview
This pull request adds a per-tab “course context” mechanism to dce-expresskit so a single sessioned user can operate in multiple courses simultaneously (e.g., multiple browser tabs), by carrying a signed course-context token per request and letting genRouteHandler prefer that verified context over the single shared session launch course.
Changes:
- Introduces HMAC-signed course-context tokens (mint + verify) and a shared header constant (
COURSE_CONTEXT_HEADER). - Updates
genRouteHandlerto optionally verify/consume the token and to log the verified course/role context for accurate auditing. - Adds types and example usage for the new per-request verified course authorization flow.
Reviewed changes
Copilot reviewed 9 out of 29 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| src/types/VerifiedCourseAuth.ts | Adds a consumer-facing type + Express Request augmentation for per-request verified course authorization. |
| src/types/ExpressKitErrorCode.ts | Adds new error codes for course-context token failures and bumps “highest code” comment. |
| src/types/CourseContextTokenPayload.ts | Defines the internal payload shape for the signed course-context token. |
| src/index.ts | Exports course-context helpers, endpoint helper, and shared header constant. |
| src/helpers/genRouteHandler.ts | Verifies course-context tokens (when present) and prefers verified course/roles; updates audit logging accordingly. |
| src/helpers/courseContext.ts | Implements minting and verification for HMAC-signed course-context tokens. |
| src/helpers/addCourseContextEndpoint.ts | Adds a helper to mount a token-minting endpoint (/api/course-context by default). |
| src/constants/COURSE_CONTEXT_HEADER.ts | Adds a shared constant for the header name carrying the course-context token. |
| examples/courseContext.example.ts | Provides an end-to-end example of minting/storing/sending course-context tokens per tab. |
| lib/types/VerifiedCourseAuth.js.map | Build artifact for the new VerifiedCourseAuth type. |
| lib/types/VerifiedCourseAuth.js | Build artifact for the new VerifiedCourseAuth type. |
| lib/types/VerifiedCourseAuth.d.ts | Build artifact for the new VerifiedCourseAuth type and Express augmentation. |
| lib/types/ExpressKitErrorCode.js.map | Build artifact reflecting updated error codes. |
| lib/types/ExpressKitErrorCode.js | Build artifact reflecting updated error codes. |
| lib/types/ExpressKitErrorCode.d.ts | Build artifact reflecting updated error codes. |
| lib/types/CourseContextTokenPayload.js.map | Build artifact for the new token payload type. |
| lib/types/CourseContextTokenPayload.js | Build artifact for the new token payload type. |
| lib/types/CourseContextTokenPayload.d.ts | Build artifact for the new token payload type. |
| lib/index.js.map | Build artifact reflecting new exports (course-context-related). |
| lib/index.js | Build artifact reflecting new exports (course-context-related). |
| lib/index.d.ts | Build artifact reflecting new exports/types (course-context-related). |
| lib/helpers/genRouteHandler.js.map | Build artifact reflecting genRouteHandler changes (token verification + logging). |
| lib/helpers/genRouteHandler.js | Build artifact reflecting genRouteHandler changes (token verification + logging). |
| lib/helpers/courseContext.js.map | Build artifact for new courseContext helper. |
| lib/helpers/courseContext.js | Build artifact for new courseContext helper. |
| lib/helpers/courseContext.d.ts | Build artifact for new courseContext helper typings. |
| lib/constants/COURSE_CONTEXT_HEADER.js.map | Build artifact for new header constant. |
| lib/constants/COURSE_CONTEXT_HEADER.js | Build artifact for new header constant. |
| lib/constants/COURSE_CONTEXT_HEADER.d.ts | Build artifact for new header constant typings. |
Files not reviewed (7)
- lib/constants/COURSE_CONTEXT_HEADER.js: Generated file
- lib/helpers/courseContext.js: Generated file
- lib/helpers/genRouteHandler.js: Generated file
- lib/index.js: Generated file
- lib/types/CourseContextTokenPayload.js: Generated file
- lib/types/ExpressKitErrorCode.js: Generated file
- lib/types/VerifiedCourseAuth.js: Generated file
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+558
to
+568
| } catch (err) { | ||
| // A present-but-invalid token is an auth failure (401), not a 500 | ||
| return handleError( | ||
| res, | ||
| { | ||
| message: (err as any).message, | ||
| code: (err as any).code, | ||
| status: 401, | ||
| }, | ||
| ); | ||
| } |
Comment on lines
+61
to
+77
| app.get( | ||
| path, | ||
| genRouteHandler({ | ||
| handler: async ( | ||
| handlerOpts: { | ||
| req: any, | ||
| }, | ||
| ) => { | ||
| // genRouteHandler has already enforced a valid session/launch, so the | ||
| // request is safe to mint a token from. | ||
| return genCourseContext({ | ||
| req: handlerOpts.req, | ||
| ttlMs, | ||
| }); | ||
| }, | ||
| }), | ||
| ); |
Member
Author
There was a problem hiding this comment.
This is related to the dce-expresskit needing to allow POST custom headers
…xt token for the current session
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull enhances the genRouteHandler to support an optional additional token for CourseContext. The CourseContext token allows a user to have multiple browser tabs open to different courses and keep the course context valid for each browser tab. The CourseContextTokenPayload includes the role of the user within that course context, so the user could have a teacher in one course, but a student context in another, and the session still holds the userId but the CACCL app has the option to use the CourseContextToken to enable overlapped course support.
Currently, genRouteHandler only supports one course context at a time.