{result ? `${result.total} total` : 'Activation, enrollment, and password-reset emails — most recent first.'}
+ {error &&Loading…
: ( + <> +| When | Type | Recipient | Status | Attempts | Error |
|---|---|---|---|---|---|
| {new Date(n.created_at).toLocaleString()} | +{n.notification_type.replace(/_/g, ' ')} | +{n.recipient_email_masked || '—'} | +{n.status} | +{n.attempt_count} | +{n.last_error_code || '—'} | +
Logs in with {student.email || student.login_identifier}. {sessions ? `${sessions.length} active session(s).` : ''}
+Logs in with {student.email || student.login_identifier}. {sessions ? `${sessions.length} active session(s).` : ''} An email is sent automatically wherever possible — see Notifications below.
Not yet activated. An activation link was queued — use this if the student never got it or it expired.
+ + ) : (Loading…
: notifications.length === 0 ?None yet.
: ( +| When | Type | Status | Attempts |
|---|---|---|---|
| {new Date(n.created_at).toLocaleString()} | +{n.notification_type.replace(/_/g, ' ')} | +{n.status} | +{n.attempt_count} | +
No Lab provisioned.
: ( diff --git a/frontend/src/admin/api.js b/frontend/src/admin/api.js index fc2d812..89af425 100644 --- a/frontend/src/admin/api.js +++ b/frontend/src/admin/api.js @@ -128,4 +128,10 @@ export const adminApi = { activateEnrollment: (id) => post(`/api/admin/enrollments/${id}/activate`), cancelEnrollment: (id) => post(`/api/admin/enrollments/${id}/cancel`), studentEnrollments: (studentId) => get(`/api/admin/students/${studentId}/enrollments`), + + // ── Phase 5C §15/§16: enrollment operations & communications ──────────────────────────── + notifications: (page = 1) => get(`/api/admin/notifications?page=${page}`), + studentNotifications: (studentId) => get(`/api/admin/students/${studentId}/notifications`), + resendActivation: (studentId) => post(`/api/admin/students/${studentId}/resend-activation`), + sendEnrollmentConfirmation: (studentId, enrollmentId) => post(`/api/admin/students/${studentId}/send-enrollment-confirmation`, enrollmentId ? { enrollment_id: enrollmentId } : undefined), } diff --git a/platform/api/src/notification-routes.js b/platform/api/src/notification-routes.js new file mode 100644 index 0000000..f9a2074 --- /dev/null +++ b/platform/api/src/notification-routes.js @@ -0,0 +1,118 @@ +// Phase 5C §15/§16 — instructor/admin communication operations. Global notification visibility +// is owner/admin only (§16: "Do not grant global notification visibility to every instructor"); +// a plain instructor can still see/act on notifications for a SPECIFIC student they're +// authorized to manage via rbac.js's requireStudentRelationshipAccess (cohort-shared or an +// enrollment they created — the same rule admin-programs-routes.js already established for +// enrollment visibility). Every response here goes through notifications.js's toAdminView, +// which masks the recipient address and omits `metadata` entirely — no token, no full email, +// ever, through any route in this file. + +const notificationsLib = require('./notifications'); +const enrollmentLib = require('./enrollment'); +const programsLib = require('./programs'); +const studentsAuth = require('./students-auth'); +const { parsePagination, paginatedResponse } = require('./pagination'); + +module.exports = function registerNotificationRoutes(app, deps) { + const { instructorSession, rbac, getPool, recordAudit } = deps; + const { requireAdminOrOwner, requireStudentRelationshipAccess } = rbac; + + function wrap(fn) { + return (req, res, next) => { Promise.resolve(fn(req, res, next)).catch(next); }; + } + const admin = { + get: (p, ...mw) => app.get(p, instructorSession, ...mw.map(wrap)), + post: (p, ...mw) => app.post(p, instructorSession, ...mw.map(wrap)), + }; + + // Global operational view — owner/admin only. + admin.get('/api/admin/notifications', requireAdminOrOwner, async (req, res) => { + const pool = getPool(); + const { page, pageSize, offset } = parsePagination(req); + const [{ rows }, { rows: countRows }] = await Promise.all([ + pool.query(`SELECT * FROM notification_events ORDER BY created_at DESC LIMIT $1 OFFSET $2`, [pageSize, offset]), + pool.query(`SELECT count(*)::int AS n FROM notification_events`), + ]); + res.json(paginatedResponse(rows.map(notificationsLib.toAdminView), countRows[0].n, { page, pageSize })); + }); + + // Per-student view — the scoped surface a plain instructor can actually reach. + admin.get('/api/admin/students/:id/notifications', requireStudentRelationshipAccess('id'), async (req, res) => { + const rows = await notificationsLib.listForStudent(getPool(), req.params.id); + res.json(rows.map(notificationsLib.toAdminView)); + }); + + // §20 — dev/test ONLY: lets a test script (or a developer) see exactly what the dev provider + // would have sent, including the activation/reset URL, without a real inbox. Unconditionally + // refuses in production regardless of what's stored (mirrors student-auth-routes.js's + // dev_reset_token gate on the same COOKIE_SECURE-derived signal) — this is never how an + // admin inspects a real delivery, only how a dev/CI run verifies one. + admin.get('/api/admin/notifications/:id/dev-preview', requireAdminOrOwner, async (req, res) => { + if (process.env.COOKIE_SECURE === '1') return res.status(404).json({ error: 'not_found' }); + const preview = await notificationsLib.getDevPreview(getPool(), req.params.id); + if (!preview) return res.status(404).json({ error: 'no_preview_available' }); + res.json(preview); + }); + + // §15 — one action covers both "resend" and "regenerate": Phase 5A's issueCredentialToken + // already unconditionally invalidates any previous outstanding token on mint, so there is + // never a moment with two simultaneously valid activation links — a second button that did + // something different would have nothing different to do. See + // docs/PHASE5C_ENROLLMENT_COMMUNICATIONS.md §6 for the full reasoning. + admin.post('/api/admin/students/:id/resend-activation', requireStudentRelationshipAccess('id'), async (req, res) => { + const pool = getPool(); + const { rows } = await pool.query(`SELECT student_id, display_name, password_hash FROM students WHERE student_id = $1`, [req.params.id]); + if (!rows.length) return res.status(404).json({ error: 'not found' }); + if (rows[0].password_hash) return res.status(409).json({ error: 'already_activated', message: 'This student already has real credentials — use Send Password Reset instead.' }); + + const { rows: enrollmentRows } = await pool.query( + `SELECT enrollment_id, program_id FROM enrollments WHERE student_id = $1 ORDER BY enrolled_at DESC LIMIT 1`, [req.params.id] + ); + const enrollmentId = enrollmentRows[0]?.enrollment_id || null; + const program = enrollmentRows[0] ? await programsLib.getProgram(pool, enrollmentRows[0].program_id) : null; + + const notification = await notificationsLib.notifyForEnrollment(pool, studentsAuth, { + studentId: req.params.id, enrollmentId, programName: program?.name, isResend: true, + }); + await recordAudit(pool, { actorType: 'instructor', actorId: req.instructor.instructor_id, action: 'activation_resent', resourceType: 'student', resourceId: req.params.id, result: 'success', sourceIp: req.ip }); + res.json(notificationsLib.toAdminView(notification)); + }); + + admin.post('/api/admin/students/:id/send-enrollment-confirmation', requireStudentRelationshipAccess('id'), async (req, res) => { + const pool = getPool(); + const { enrollment_id } = req.body || {}; + const { rows } = await pool.query(`SELECT student_id, display_name, password_hash FROM students WHERE student_id = $1`, [req.params.id]); + if (!rows.length) return res.status(404).json({ error: 'not found' }); + if (!rows[0].password_hash) return res.status(409).json({ error: 'not_yet_activated', message: 'This student has no credentials yet — use Resend Activation instead.' }); + + let targetEnrollmentId = enrollment_id; + if (!targetEnrollmentId) { + const { rows: latest } = await pool.query( + `SELECT enrollment_id FROM enrollments WHERE student_id = $1 AND status = 'active' ORDER BY enrolled_at DESC LIMIT 1`, [req.params.id] + ); + targetEnrollmentId = latest[0]?.enrollment_id; + } + if (!targetEnrollmentId) return res.status(400).json({ error: 'no_active_enrollment', message: 'This student has no active enrollment to confirm.' }); + const enrollmentRow = await enrollmentLib.getEnrollment(pool, targetEnrollmentId); + const program = await programsLib.getProgram(pool, enrollmentRow.program_id); + + const notification = await notificationsLib.enqueue(pool, { + studentId: req.params.id, enrollmentId: targetEnrollmentId, notificationType: 'enrollment_confirmation', + metadata: { display_name: rows[0].display_name, program_name: program?.name }, + }); + await recordAudit(pool, { actorType: 'instructor', actorId: req.instructor.instructor_id, action: 'enrollment_confirmation_sent', resourceType: 'enrollment', resourceId: targetEnrollmentId, result: 'success', sourceIp: req.ip }); + res.json(notificationsLib.toAdminView(notification)); + }); + + // §8/§15's "admin may need a safe SEND PASSWORD RESET operation" is the EXISTING + // POST /api/admin/students/:id/reset-password (admin-routes.js, Phase 5A) — Phase 5C extended + // it to also enqueue a real email (see that route) rather than duplicating a second endpoint + // here. It still returns `reset_token` in its response, unchanged from Phase 5A: for a + // student with no deliverable address at all (no email, no enrollment contact), manually + // relaying that token is the ONLY way they can ever get in, so removing it would leave that + // population with no recovery path. §21's "admin cannot view token" is enforced for + // resend-activation/send-enrollment-confirmation above, which have no legitimate reason to + // ever expose one — reset-password's token-in-response is a deliberate, documented, + // unchanged exception for exactly the case automatic delivery can't cover. See + // docs/PHASE5C_ENROLLMENT_COMMUNICATIONS.md §6. +};