diff --git a/.gitlab/CODEOWNERS b/.gitlab/CODEOWNERS new file mode 100644 index 0000000000000000000000000000000000000000..a69023229f36573edb56148d0e187d8e397ce110 --- /dev/null +++ b/.gitlab/CODEOWNERS @@ -0,0 +1,4 @@ +# Code owners file + +## Changes to these file(s) require approval from the teaching team +sonar-project.properties @addianto @hafiyyan94 \ No newline at end of file diff --git a/README.md b/README.md index 3020546098563953b463aa84d24bb2958f22f589..3734ba0a5f9c94947bcea0145748b6214280794a 100755 --- a/README.md +++ b/README.md @@ -2,6 +2,13 @@ > Internship matchmaking platform for students and companies. +[](https://gitlab.cs.ui.ac.id/pmpl/class-project/kape/commits/master) +[](https://gitlab.cs.ui.ac.id/pmpl/class-project/kape/commits/master) + +[](https://pmpl.cs.ui.ac.id/sonarqube/dashboard?id=id.ac.ui.cs.foss%3Akape) +[](https://pmpl.cs.ui.ac.id/sonarqube/dashboard?id=id.ac.ui.cs.foss%3Akape) +[](https://pmpl.cs.ui.ac.id/sonarqube/dashboard?id=id.ac.ui.cs.foss%3Akape) + ## Table of Contents - [Install](#install) diff --git a/core/models/vacancies.py b/core/models/vacancies.py index f2b5dc4956206082a74c1e656b05a698d8c01d18..8968e62646db29af77d83f8be56f2260f64c2fc4 100644 --- a/core/models/vacancies.py +++ b/core/models/vacancies.py @@ -23,6 +23,7 @@ class Application(models.Model): BOOKMARKED = 2 REJECTED = 3 ACCEPTED = 4 + ABORTED = 5 cover_letter = models.TextField(null=True, blank=True) student = models.ForeignKey(Student, on_delete=models.CASCADE) diff --git a/core/serializers/vacancies.py b/core/serializers/vacancies.py index 313f2064622806a59994a83eba2ea82f0eb7a4a8..a2bd2e4f2d6284ab20d8eb620fd84cf4b28e1609 100644 --- a/core/serializers/vacancies.py +++ b/core/serializers/vacancies.py @@ -61,7 +61,7 @@ class ApplicationStatusSerializer(serializers.ModelSerializer): class SupervisorStudentApplicationSerializer(serializers.ModelSerializer): def to_representation(self, instance): - status_map = ["new", "read", "bookmarked", "rejected", "accepted" ] + status_map = ["new", "read", "bookmarked", "rejected", "accepted","aborted" ] return { 'name' : instance.student.full_name, 'npm' : instance.student.npm, diff --git a/core/tests/test_accounts.py b/core/tests/test_accounts.py index 35458deb5cb4174f6856ffcdfd95439d6ba6e3a6..25281a7cc774e3a409d4eebb22cabca899f6d795 100644 --- a/core/tests/test_accounts.py +++ b/core/tests/test_accounts.py @@ -8,6 +8,7 @@ from core.models.accounts import Company, Supervisor, Student class LoginTests(APITestCase): @requests_mock.Mocker() def test_succesful_student_login_relogin(self, m): + m.get('https://akun.cs.ui.ac.id/oauth/token/verify/?client_id=X3zNkFmepkdA47ASNMDZRX3Z9gqSU1Lwywu5WepG', json={"username": 'dummy.mahasiswa', "role": 'mahasiswa', "identity_number": '1234567890'}, status_code=200) m.post('https://api.cs.ui.ac.id/authentication/ldap/v2/', json={ "username": "dummy.mahasiswa", "nama": "Dummy Mahasiswa", @@ -16,7 +17,7 @@ class LoginTests(APITestCase): "kodeidentitas": "1234567890", "nama_role": "mahasiswa" }, status_code=200) - m.get('https://api.cs.ui.ac.id/siakngcs/mahasiswa/1234567890/', json={ + m.get('https://api.cs.ui.ac.id/siakngcs/mahasiswa/1234567890?client_id=X3zNkFmepkdA47ASNMDZRX3Z9gqSU1Lwywu5WepG', json={ "kota_lahir": "kota_kota", "tgl_lahir": "2017-12-31", "program": [{ @@ -35,6 +36,7 @@ class LoginTests(APITestCase): @requests_mock.Mocker() def test_successful_supervisor_login_relogin(self, m): + m.get('https://akun.cs.ui.ac.id/oauth/token/verify/?client_id=X3zNkFmepkdA47ASNMDZRX3Z9gqSU1Lwywu5WepG', json={"username": 'dummy.mahasiswa', "role": 'mahasiswa', "identity_number": '1234567890'}, status_code=200) m.post('https://api.cs.ui.ac.id/authentication/ldap/v2/', json={ "username": "dummy.dosen", "nama": "Dummy Dosen", @@ -106,6 +108,7 @@ class ProfileUpdateTests(APITestCase): @requests_mock.Mocker() def test_student_profile_update(self, m): + m.get('https://akun.cs.ui.ac.id/oauth/token/verify/?client_id=X3zNkFmepkdA47ASNMDZRX3Z9gqSU1Lwywu5WepG', json={"username": 'dummy.mahasiswa', "role": 'mahasiswa', "identity_number": '1234567890'}, status_code=200) m.post('https://api.cs.ui.ac.id/authentication/ldap/v2/', json={ "username": "dummy.mahasiswa", "nama": "Dummy Mahasiswa", @@ -114,7 +117,7 @@ class ProfileUpdateTests(APITestCase): "kodeidentitas": "1234567890", "nama_role": "mahasiswa" }, status_code=200) - m.get('https://api.cs.ui.ac.id/siakngcs/mahasiswa/1234567890/', json={ + m.get('https://api.cs.ui.ac.id/siakngcs/mahasiswa/1234567890?client_id=X3zNkFmepkdA47ASNMDZRX3Z9gqSU1Lwywu5WepG', json={ "kota_lahir": "kota_kota", "tgl_lahir": "2017-12-31", "program": [{ diff --git a/core/tests/test_vacancies.py b/core/tests/test_vacancies.py index 78cdc5a2a71e0fcf48249f1a28df4277fb5221d7..a2a8b1b9be3b3af98f25658e690def6a19c2aaa0 100644 --- a/core/tests/test_vacancies.py +++ b/core/tests/test_vacancies.py @@ -1,5 +1,6 @@ from datetime import datetime +import json import requests_mock from django.contrib.auth.models import User from rest_framework import status @@ -12,6 +13,7 @@ from core.models.vacancies import Vacancy, Application class ApplicationTests(APITestCase): @requests_mock.Mocker() def test_application_list(self, m): + m.get('https://akun.cs.ui.ac.id/oauth/token/verify/?client_id=X3zNkFmepkdA47ASNMDZRX3Z9gqSU1Lwywu5WepG', json={"username": 'dummy.mahasiswa', "role": 'mahasiswa', "identity_number": '1234567890'}, status_code=200) m.post('https://api.cs.ui.ac.id/authentication/ldap/v2/', json={ "username": "dummy.mahasiswa", "nama": "Dummy Mahasiswa", @@ -20,7 +22,7 @@ class ApplicationTests(APITestCase): "kodeidentitas": "1234567890", "nama_role": "mahasiswa" }, status_code=200) - m.get('https://api.cs.ui.ac.id/siakngcs/mahasiswa/1234567890/', json={ + m.get('https://api.cs.ui.ac.id/siakngcs/mahasiswa/1234567890?client_id=X3zNkFmepkdA47ASNMDZRX3Z9gqSU1Lwywu5WepG', json={ "kota_lahir": "kota_kota", "tgl_lahir": "2017-12-31", "program": [{ @@ -42,6 +44,7 @@ class ApplicationTests(APITestCase): @requests_mock.Mocker() def test_application_create_and_delete(self, m): + m.get('https://akun.cs.ui.ac.id/oauth/token/verify/?client_id=X3zNkFmepkdA47ASNMDZRX3Z9gqSU1Lwywu5WepG', json={"username": 'dummy.mahasiswa', "role": 'mahasiswa', "identity_number": '1234567890'}, status_code=200) m.post('https://api.cs.ui.ac.id/authentication/ldap/v2/', json={ "username": "dummy.mahasiswa", "nama": "Dummy Mahasiswa", @@ -50,7 +53,7 @@ class ApplicationTests(APITestCase): "kodeidentitas": "1234567890", "nama_role": "mahasiswa" }, status_code=200) - m.get('https://api.cs.ui.ac.id/siakngcs/mahasiswa/1234567890/', json={ + m.get('https://api.cs.ui.ac.id/siakngcs/mahasiswa/1234567890?client_id=X3zNkFmepkdA47ASNMDZRX3Z9gqSU1Lwywu5WepG', json={ "kota_lahir": "kota_kota", "tgl_lahir": "2017-12-31", "program": [{ @@ -84,6 +87,7 @@ class ApplicationTests(APITestCase): class BookmarkApplicationTests(APITestCase): @requests_mock.Mocker() def test_application_list(self, m): + m.get('https://akun.cs.ui.ac.id/oauth/token/verify/?client_id=X3zNkFmepkdA47ASNMDZRX3Z9gqSU1Lwywu5WepG', json={"username": 'dummy.mahasiswa', "role": 'mahasiswa', "identity_number": '1234567890'}, status_code=200) m.post('https://api.cs.ui.ac.id/authentication/ldap/v2/', json={ "username": "dummy.mahasiswa", "nama": "Dummy Mahasiswa", @@ -92,7 +96,7 @@ class BookmarkApplicationTests(APITestCase): "kodeidentitas": "1234567890", "nama_role": "mahasiswa" }, status_code=200) - m.get('https://api.cs.ui.ac.id/siakngcs/mahasiswa/1234567890/', json={ + m.get('https://api.cs.ui.ac.id/siakngcs/mahasiswa/1234567890?client_id=X3zNkFmepkdA47ASNMDZRX3Z9gqSU1Lwywu5WepG', json={ "kota_lahir": "kota_kota", "tgl_lahir": "2017-12-31", "program": [{ @@ -114,6 +118,7 @@ class BookmarkApplicationTests(APITestCase): @requests_mock.Mocker() def test_application_create_and_delete(self, m): + m.get('https://akun.cs.ui.ac.id/oauth/token/verify/?client_id=X3zNkFmepkdA47ASNMDZRX3Z9gqSU1Lwywu5WepG', json={"username": 'dummy.mahasiswa', "role": 'mahasiswa', "identity_number": '1234567890'}, status_code=200) m.post('https://api.cs.ui.ac.id/authentication/ldap/v2/', json={ "username": "dummy.mahasiswa", "nama": "Dummy Mahasiswa", @@ -122,7 +127,7 @@ class BookmarkApplicationTests(APITestCase): "kodeidentitas": "1234567890", "nama_role": "mahasiswa" }, status_code=200) - m.get('https://api.cs.ui.ac.id/siakngcs/mahasiswa/1234567890/', json={ + m.get('https://api.cs.ui.ac.id/siakngcs/mahasiswa/1234567890?client_id=X3zNkFmepkdA47ASNMDZRX3Z9gqSU1Lwywu5WepG', json={ "kota_lahir": "kota_kota", "tgl_lahir": "2017-12-31", "program": [{ @@ -429,3 +434,95 @@ class SupervisorApprovalTests(APITestCase): response = self.client.patch(url, format='json') self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN) self.assertEqual(new_vacancy.verified, False) + +class AcceptOneOfferTests(APITestCase): + + def generateObject(self): + new_user = User.objects.create_user('dummy.company', 'dummy.company@company.com', 'lalala123') + new_company = Company.objects.create(user=new_user, description="lalala", status=Company.VERIFIED, logo=None, + address=None) + + new_user2 = User.objects.create_user('dummy.company2', 'dummy.company2@company.com', 'lalala123') + new_company2 = Company.objects.create(user=new_user2, description="lalala", status=Company.VERIFIED, logo=None, + address=None) + + new_vacancy = Vacancy.objects.create(company=new_company, verified=True, open_time=datetime.fromtimestamp(0), + description="lalala", close_time=datetime.today()) + + new_vacancy2 = Vacancy.objects.create(company=new_company2, verified=True, open_time=datetime.fromtimestamp(0), + description="lalala", close_time=datetime.today()) + + new_user3 = User.objects.create_user('dummy.student', 'dummy.student@company.com', 'lalala123') + new_student = Student.objects.create(user=new_user3, npm=1234123412) + + return new_user3, new_vacancy, new_vacancy2, new_student + + def test_number_of_content_response_object_given_id_auth(self): + + new_user3, new_vacancy, new_vacancy2, new_student = self.generateObject() + + self.client.force_authenticate(new_user3) + + Application.objects.create(student=new_student, vacancy=new_vacancy, cover_letter="asdasdasd") + Application.objects.create(student=new_student, vacancy=new_vacancy2, cover_letter="asdasdasd") + + url = '/api/acceptoffer/' + str(new_student.pk) + '/vacancy/' + str(new_vacancy.pk) + '/' + + response = self.client.patch(url, format='json') + body = json.loads(response.content) + + status_response = [] + for app in body: + status_response.append(app['status']) + + self.assertEqual(response.status_code, status.HTTP_200_OK) + self.assertTrue(len(body) >= 2) + self.assertFalse(len(body) == 0) + self.assertTrue('new' in status_response) + self.assertTrue('aborted' in status_response) + + def test_student_not_exist_given_auth(self): + new_user3,new_vacancy, new_vacancy2, new_student = self.generateObject() + + self.client.force_authenticate(new_user3) + + user4 = User.objects.create_user('student_user_4', 'student_user_4@company.com', 'lalala123') + other_student = Student.objects.create(user=user4, npm=1098765432) + + Application.objects.create(student=other_student, vacancy=new_vacancy, cover_letter="asdasdasd") + Application.objects.create(student=other_student, vacancy=new_vacancy2, cover_letter="asdasdasd") + + url = '/api/acceptoffer/' + str(new_student.pk) + '/vacancy/' + str(new_vacancy.pk) + '/' + + response = self.client.patch(url, format='json') + body = json.loads(response.content) + + self.assertEqual(response.status_code, status.HTTP_200_OK) + self.assertTrue(len(body) == 0) + + def test_type_error_if_input_null(self): + new_user3, new_vacancy, new_vacancy2, new_student = self.generateObject() + + self.client.force_authenticate(new_user3) + + Application.objects.create(student=new_student, vacancy=new_vacancy, cover_letter="asdasdasd") + Application.objects.create(student=new_student, vacancy=new_vacancy2, cover_letter="asdasdasd") + + with self.assertRaises(TypeError): + url = '/api/acceptoffer/' + None + '/vacancy/' + str(new_vacancy.pk) + '/' + + with self.assertRaises(TypeError): + url = '/api/acceptoffer/' + str(new_student.pk) + '/vacancy/' + None + '/' + + def test_if_requester_is_not_authenticated(self): + new_user3, new_vacancy, new_vacancy2, new_student = self.generateObject() + + Application.objects.create(student=new_student, vacancy=new_vacancy, cover_letter="asdasdasd") + Application.objects.create(student=new_student, vacancy=new_vacancy2, cover_letter="asdasdasd") + + url = '/api/acceptoffer/' + str(new_student.pk) + '/vacancy/' + str(new_vacancy.pk) + '/' + + response = self.client.patch(url, format='json') + body = json.loads(response.content) + + self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN) diff --git a/core/views/accounts.py b/core/views/accounts.py index 0b74350fbc0a57c6d6d6a22562cfd647bc7f99a9..9ea10d861229a65fbb8bef2ac4ff23f8803f9539 100644 --- a/core/views/accounts.py +++ b/core/views/accounts.py @@ -9,6 +9,7 @@ from rest_framework.parsers import FormParser,MultiPartParser from rest_framework.permissions import AllowAny from rest_framework.permissions import IsAdminUser, IsAuthenticated from rest_framework.response import Response +from .sso_login import get_access_token, verify_user, get_riwayat_user, get_summary_user from core.lib.permissions import IsAdminOrStudent, IsAdminOrSelfOrReadOnly, IsAdminOrCompany, IsAdminOrSupervisor, \ IsAdminOrSupervisorOrCompanyOrSelf @@ -81,14 +82,9 @@ class StudentViewSet(viewsets.ModelViewSet): raise PermissionDenied("You are not allowed to see other student's transcript") if student.show_transcript: - s = requests.Session() - credentials = settings.API_CS_CREDENTIALS - s.get('https://api.cs.ui.ac.id/api-auth/login/') - csrf = s.cookies['csrftoken'] - resp = s.post('https://api.cs.ui.ac.id/api-auth/login/', - data={'username': credentials["user"], 'password': credentials["password"], - 'csrfmiddlewaretoken': csrf}) - response = s.get('https://api.cs.ui.ac.id/siakngcs/mahasiswa/' + str(student.npm) + '/riwayat/') + access_token = get_access_token(credentials["user"], credentials["password"]) + ver_user = verify_user(access_token) + response = get_riwayat_user(access_token, ver_user['identity_number']) return Response({'name': student.full_name, 'transcript': response.json()}, status=status.HTTP_200_OK) else: return Response({'name': student.full_name, 'error': 'student does not allow transcript to be shown'}, @@ -146,7 +142,7 @@ class LoginViewSet(viewsets.GenericViewSet): return Response(status=status.HTTP_400_BAD_REQUEST) if login_type == "sso-ui": r = requests.post('https://api.cs.ui.ac.id/authentication/ldap/v2/', - json={"username": username, "password": password}) + data={"username": username, "password": password}) resp = r.json() if resp.get('state') != 0: # create user @@ -167,8 +163,9 @@ class LoginViewSet(viewsets.GenericViewSet): login(request, user) if created: if resp.get('nama_role') == "mahasiswa": - student_detail = requests.get('https://api.cs.ui.ac.id/siakngcs/mahasiswa/{}/'.format(resp.get("kodeidentitas"))) - resp_student_detail = student_detail.json() + access_token = get_access_token(username, password) + ver_user = verify_user(access_token) + resp_student_detail = get_summary_user(access_token, ver_user['identity_number']) student = Student.objects.create( user=user, npm=resp.get("kodeidentitas"), diff --git a/core/views/sso_login.py b/core/views/sso_login.py new file mode 100644 index 0000000000000000000000000000000000000000..669bf2be7327b5e268015c8b4e303734ee64cd47 --- /dev/null +++ b/core/views/sso_login.py @@ -0,0 +1,48 @@ +import requests + +API_MAHASISWA = "https://api.cs.ui.ac.id/siakngcs/mahasiswa/" +API_RIWAYAT_MAHASISWA = API_MAHASISWA+'{npm}/riwayat/' +API_VERIFY_USER = "https://akun.cs.ui.ac.id/oauth/token/verify/" +def get_access_token(username, password): + try: + url = "https://akun.cs.ui.ac.id/oauth/token/" + + payload = "username=" + username + "&password=" + password + "&grant_type=password" + headers = { + 'authorization': "Basic WDN6TmtGbWVwa2RBNDdBU05NRFpSWDNaOWdxU1UxTHd5d3U1V2VwRzpCRVFXQW43RDl6a2k3NEZ0bkNpWVhIRk50Ymg3eXlNWmFuNnlvMU1uaUdSVWNGWnhkQnBobUU5TUxuVHZiTTEzM1dsUnBwTHJoTXBkYktqTjBxcU9OaHlTNGl2Z0doczB0OVhlQ3M0Ym1JeUJLMldwbnZYTXE4VU5yTEFEMDNZeA==", + 'cache-control': "no-cache", + 'content-type': "application/x-www-form-urlencoded" + } + response = requests.request("POST", url, data=payload, headers=headers) + + return response.json()["access_token"] + except Exception as e: + return None + # raise Exception("username atau password sso salah, input : [{}, {}]".format(username, password,)) + +def get_client_id(): + client_id = 'X3zNkFmepkdA47ASNMDZRX3Z9gqSU1Lwywu5WepG' + return client_id + +def verify_user(access_token): + print ("#get identity number") + parameters = {"access_token": access_token, "client_id": get_client_id()} + response = requests.get(API_VERIFY_USER, params=parameters) + print ("response => ", response.json()) + return response.json() + +def get_summary_user(access_token, npm): + print ("#get summary user => ", npm) + parameters = {"access_token": access_token, "client_id": get_client_id()} + response = requests.get(API_MAHASISWA+str(npm), params=parameters) + print ("response => ", response.text) + print ("response => ", response.json()) + return response.json() + +def get_riwayat_user(access_token, npm): + print ("#get riwayat user => ", npm) + parameters = {"access_token": access_token, "client_id": get_client_id()} + response = requests.get(API_RIWAYAT_MAHASISWA.format(npm=npm), params=parameters) + print ("response => ", response.text) + print ("response => ", response.json()) + return response.json() diff --git a/core/views/vacancies.py b/core/views/vacancies.py index e4b8b989272617ceaa00475a79293ee2eb266d9a..12fdbef612bdc4cdd784db07b42b273633412346 100644 --- a/core/views/vacancies.py +++ b/core/views/vacancies.py @@ -275,3 +275,23 @@ class BookmarkedVacancyByStudentViewSet(viewsets.GenericViewSet): student.bookmarked_vacancies.remove(vacancy) return Response( self.serializer_class(student.bookmarked_vacancies, many=True, context={'request': request}).data) + +class AcceptOfferByStudentViewSet(MultiSerializerViewSetMixin, viewsets.GenericViewSet): + queryset = Application.objects.all() + permission_classes = [IsAdminOrStudent] + + def partial_update(self, request, student_id, pk=None): + """ + Get list of a student {student_id}'s cancel offered vacancies + --- + """ + student = get_object_or_404(Student.objects.all().order_by('-updated'), pk=student_id) + apps = Application.objects.filter(student=student) + + for a in apps: + if a.vacancy_id != int(pk): + serializer = ApplicationStatusSerializer(a, data={'status': 5}, partial=True) + if serializer.is_valid(): + serializer.save() + + return Response(SupervisorStudentApplicationSerializer(apps, many=True, context={'request': request}).data) \ No newline at end of file diff --git a/kape/urls.py b/kape/urls.py index 21a1d46bafe92dfd1c3fbfee2bc1545dff38d28d..5cb90a79f2076765f22f6ad32160122dabf43279 100755 --- a/kape/urls.py +++ b/kape/urls.py @@ -25,7 +25,7 @@ from core import apps from core.views.accounts import StudentViewSet, CompanyViewSet, SupervisorViewSet, UserViewSet, LoginViewSet, \ CompanyRegisterViewSet from core.views.vacancies import VacancyViewSet, BookmarkedVacancyByStudentViewSet, StudentApplicationViewSet, \ - CompanyApplicationViewSet, CompanyVacanciesViewSet, ApplicationViewSet + CompanyApplicationViewSet, CompanyVacanciesViewSet, ApplicationViewSet, AcceptOfferByStudentViewSet schema_view = get_swagger_view() router = routers.DefaultRouter() @@ -38,6 +38,7 @@ router.register(r'register', CompanyRegisterViewSet) router.register(r'vacancies', VacancyViewSet) router.register(r'applications', ApplicationViewSet) # router.register(r'students/(?P<student_id>\d+)/profile', StudentProfileViewSet) +router.register(r'acceptoffer/(?P<student_id>\d+)/vacancy', AcceptOfferByStudentViewSet) router.register(r'students/(?P<student_id>\d+)/bookmarked-vacancies', BookmarkedVacancyByStudentViewSet, base_name='bookmarked-vacancy-list') router.register(r'students/(?P<student_id>\d+)/applied-vacancies', StudentApplicationViewSet, diff --git a/sonar-project.properties b/sonar-project.properties index 48a6c493c8cf0d1ead4cb49babe175535621ae67..c3db74cddc82e00230c7f6527111959ce3a27b3d 100644 --- a/sonar-project.properties +++ b/sonar-project.properties @@ -7,6 +7,7 @@ sonar.projectKey=id.ac.ui.cs.foss:kape sonar.exclusions=/.devcontainer/,/.gitlab/,*.config.js,/.tmp/, sonar.scm.provider=git +sonar.projectVersion=1.0.0 ## Authentication ### sonar.login=[pass token via CLI/CI]