Attach username to upload dropdown

apps/api/src/instrument-records/__tests__/instrument-records.service.spec.ts

@@ -6,6 +6,8 @@ import { NotFoundException } from '@nestjs/common';
 import { Test } from '@nestjs/testing';
 import { beforeEach, describe, expect, it } from 'vitest';
 
+import { UsersService } from '@/users/users.service';
+
 import { GroupsService } from '../../groups/groups.service';
 import { InstrumentsService } from '../../instruments/instruments.service';
 import { SessionsService } from '../../sessions/sessions.service';
@@ -19,13 +21,17 @@ describe('InstrumentRecordsService', () => {
   let instrumentRecordsService: InstrumentRecordsService;
   let instrumentRecordModel: MockedInstance<Model<'InstrumentRecord'>>;
   let instrumentsService: MockedInstance<InstrumentsService>;
+  let sessionsService: MockedInstance<SessionsService>;
+  let subjectsService: MockedInstance<SubjectsService>;
+  let usersService: MockedInstance<UsersService>;
 
   beforeEach(async () => {
     const moduleRef = await Test.createTestingModule({
       providers: [
         InstrumentRecordsService,
         MockFactory.createForModelToken(getModelToken('InstrumentRecord')),
         MockFactory.createForService(GroupsService),
+        MockFactory.createForService(UsersService),
         MockFactory.createForService(InstrumentMeasuresService),
         MockFactory.createForService(InstrumentsService),
         MockFactory.createForService(SessionsService),
@@ -36,6 +42,9 @@ describe('InstrumentRecordsService', () => {
     instrumentRecordModel = moduleRef.get(getModelToken('InstrumentRecord'));
     instrumentRecordsService = moduleRef.get(InstrumentRecordsService);
     instrumentsService = moduleRef.get(InstrumentsService);
+    sessionsService = moduleRef.get(SessionsService);
+    subjectsService = moduleRef.get(SubjectsService);
+    usersService = moduleRef.get(UsersService);
   });
 
   describe('findById', () => {
@@ -69,6 +78,67 @@ describe('InstrumentRecordsService', () => {
     });
   });
 
+  describe('upload', () => {
+    const mockInstrument = {
+      id: 'instrument-1',
+      kind: 'FORM',
+      measures: null,
+      validationSchema: {
+        safeParse: (data: unknown) => ({ data, success: true })
+      }
+    };
+
+    const mockSession = {
+      date: new Date(),
+      groupId: null,
+      id: 'session-1',
+      type: 'RETROSPECTIVE',
+      userId: null
+    };
+
+    const baseUploadData = {
+      instrumentId: 'instrument-1',
+      records: [{ data: { answer: 1 }, date: new Date(), subjectId: 'subject-1' }]
+    };
+
+    beforeEach(() => {
+      instrumentsService.findById.mockResolvedValue(mockInstrument as any);
+      subjectsService.createMany.mockResolvedValue([] as any);
+      sessionsService.create.mockResolvedValue(mockSession as any);
+      sessionsService.deleteByIds.mockResolvedValue(undefined as any);
+      instrumentRecordModel.createMany.mockResolvedValue([] as any);
+      instrumentRecordModel.findMany.mockResolvedValue([] as any);
+    });
+
+    it('should call sessionsService.create with the provided username', async () => {
+      usersService.findByUsername.mockResolvedValueOnce({ username: 'validuser' } as any);
+
+      await instrumentRecordsService.upload({ ...baseUploadData, username: 'validuser' });
+
+      expect(usersService.findByUsername).toHaveBeenCalledWith('validuser', undefined);
+      expect(sessionsService.create).toHaveBeenCalledWith(expect.objectContaining({ username: 'validuser' }));
+    });
+
+    it('should reject and not create any sessions when an unknown username is provided', async () => {
+      usersService.findByUsername.mockRejectedValueOnce(
+        new NotFoundException('Failed to find user with username: spoofed')
+      );
+
+      await expect(instrumentRecordsService.upload({ ...baseUploadData, username: 'spoofed' })).rejects.toBeInstanceOf(
+        NotFoundException
+      );
+
+      expect(sessionsService.create).not.toHaveBeenCalled();
+    });
+
+    it('should call sessionsService.create with username undefined when no username is provided', async () => {
+      await instrumentRecordsService.upload({ ...baseUploadData });
+
+      expect(usersService.findByUsername).not.toHaveBeenCalled();
+      expect(sessionsService.create).toHaveBeenCalledWith(expect.objectContaining({ username: undefined }));
+    });
+  });
+
   describe('exportRecords', () => {
     it('should return an array of export records with correct shape', async () => {
       const mockRecords = [

apps/api/src/instrument-records/instrument-records.module.ts

@@ -4,6 +4,7 @@ import { GroupsModule } from '@/groups/groups.module';
 import { InstrumentsModule } from '@/instruments/instruments.module';
 import { SessionsModule } from '@/sessions/sessions.module';
 import { SubjectsModule } from '@/subjects/subjects.module';
+import { UsersModule } from '@/users/users.module';
 
 import { InstrumentMeasuresService } from './instrument-measures.service';
 import { InstrumentRecordsController } from './instrument-records.controller';
@@ -12,7 +13,7 @@ import { InstrumentRecordsService } from './instrument-records.service';
 @Module({
   controllers: [InstrumentRecordsController],
   exports: [InstrumentRecordsService],
-  imports: [GroupsModule, InstrumentsModule, SessionsModule, SubjectsModule],
+  imports: [GroupsModule, InstrumentsModule, SessionsModule, SubjectsModule, UsersModule],
   providers: [InstrumentMeasuresService, InstrumentRecordsService]
 })
 export class InstrumentRecordsModule {}

apps/api/src/instrument-records/instrument-records.service.ts

@@ -6,7 +6,13 @@ import { replacer, reviver } from '@douglasneuroinformatics/libjs';
 import { InjectModel } from '@douglasneuroinformatics/libnest';
 import type { Model } from '@douglasneuroinformatics/libnest';
 import { linearRegression } from '@douglasneuroinformatics/libstats';
-import { BadRequestException, Injectable, NotFoundException, UnprocessableEntityException } from '@nestjs/common';
+import {
+  BadRequestException,
+  ForbiddenException,
+  Injectable,
+  NotFoundException,
+  UnprocessableEntityException
+} from '@nestjs/common';
 import type { Json, ScalarInstrument } from '@opendatacapture/runtime-core';
 import type {
   CreateInstrumentRecordData,
@@ -28,6 +34,7 @@ import { InstrumentsService } from '@/instruments/instruments.service';
 import { SessionsService } from '@/sessions/sessions.service';
 import { CreateSubjectDto } from '@/subjects/dto/create-subject.dto';
 import { SubjectsService } from '@/subjects/subjects.service';
+import { UsersService } from '@/users/users.service';
 
 import { InstrumentMeasuresService } from './instrument-measures.service';
 
@@ -45,6 +52,7 @@ export class InstrumentRecordsService {
   constructor(
     @InjectModel('InstrumentRecord') private readonly instrumentRecordModel: Model<'InstrumentRecord'>,
     private readonly groupsService: GroupsService,
+    private readonly usersService: UsersService,
     private readonly instrumentMeasuresService: InstrumentMeasuresService,
     private readonly instrumentsService: InstrumentsService,
     private readonly sessionsService: SessionsService,
@@ -330,7 +338,7 @@ export class InstrumentRecordsService {
   }
 
   async upload(
-    { groupId, instrumentId, records }: UploadInstrumentRecordsData,
+    { groupId, instrumentId, records, username }: UploadInstrumentRecordsData,
     options?: EntityOperationOptions
   ): Promise<InstrumentRecord[]> {
     if (groupId) {
@@ -344,6 +352,13 @@ export class InstrumentRecordsService {
       );
     }
 
+    if (username) {
+      const user = await this.usersService.findByUsername(username, options);
+      if (groupId && !user.groups.some((g) => g.id === groupId)) {
+        throw new ForbiddenException(`User '${username}' is not a member of group '${groupId}'`);
+      }
+    }
+
     const createdSessionsArray: Session[] = [];
 
     try {
@@ -372,7 +387,8 @@ export class InstrumentRecordsService {
             date: date,
             groupId: groupId ?? null,
             subjectData: { id: subjectId },
-            type: 'RETROSPECTIVE'
+            type: 'RETROSPECTIVE',
+            username: username ?? undefined
           });
 
           createdSessionsArray.push(session);

apps/api/src/users/users.service.ts

@@ -177,7 +177,7 @@ export class UsersService {
       data: {
         ...data,
         groups: {
-          connect: groupIds?.map((id) => ({ id }))
+          set: groupIds?.map((id) => ({ id }))
         },
         hashedPassword
       },

apps/web/src/hooks/useUsersQuery.ts

@@ -2,18 +2,22 @@ import { $User } from '@opendatacapture/schemas/user';
 import { queryOptions, useSuspenseQuery } from '@tanstack/react-query';
 import axios from 'axios';
 
+type UsersQueryParams = {
+  groupId?: string;
+};
+
 export const USERS_QUERY_KEY = 'users';
 
-export const usersQueryOptions = () => {
+export const usersQueryOptions = ({ params }: { params?: UsersQueryParams } = {}) => {
   return queryOptions({
     queryFn: async () => {
-      const response = await axios.get('/v1/users');
+      const response = await axios.get('/v1/users', { params });
       return $User.array().parse(response.data);
     },
-    queryKey: [USERS_QUERY_KEY]
+    queryKey: [USERS_QUERY_KEY, params?.groupId]
   });
 };
 
-export function useUsersQuery() {
-  return useSuspenseQuery(usersQueryOptions());
+export function useUsersQuery({ params }: { params?: UsersQueryParams } = {}) {
+  return useSuspenseQuery(usersQueryOptions({ params }));
 }

apps/web/src/routes/_app/admin/users/index.tsx

@@ -37,6 +37,7 @@ type UpdateUserFormInputData = {
     [id: string]: string;
   };
   initialValues?: FormTypes.PartialNullableData<UpdateUserFormData>;
+  selectedUserBasePermission?: User['basePermissionLevel'];
 };
 
 const UpdateUserForm: React.FC<{
@@ -91,6 +92,19 @@ const UpdateUserForm: React.FC<{
           });
         });
       })
+      .check((ctx) => {
+        if (ctx.value.groupIds.size <= 0 && data.selectedUserBasePermission !== 'ADMIN') {
+          ctx.issues.push({
+            code: 'custom',
+            input: ctx.value.confirmPassword,
+            message: t({
+              en: 'Standard user must be part of a group',
+              fr: "Un utilisateur standard doit faire partie d'un groupe"
+            }),
+            path: ['groupIds']
+          });
+        }
+      })
       .check((ctx) => {
         if (ctx.value.confirmPassword !== ctx.value.password) {
           ctx.issues.push({
@@ -335,6 +349,7 @@ const RouteComponent = () => {
       setData({
         disableDelete: selectedUser?.username === currentUser?.username,
         groupOptions: Object.fromEntries(groups.map((group) => [group.id, group.name])),
+        selectedUserBasePermission: selectedUser.basePermissionLevel,
         initialValues: selectedUser?.additionalPermissions.length
           ? {
               additionalPermissions: selectedUser.additionalPermissions,

apps/web/src/routes/_app/dashboard.tsx

@@ -28,7 +28,11 @@ const RouteComponent = () => {
   const [isUserModalOpen, setIsUserModalOpen] = useState(false);
   const [isRecordModalOpen, setIsRecordModalOpen] = useState(false);
   const instrumentInfoQuery = useInstrumentInfoQuery();
-  const userInfoQuery = useUsersQuery();
+  const userInfoQuery = useUsersQuery({
+    params: {
+      groupId: currentGroup?.id
+    }
+  });
 
   const recordsQuery = useInstrumentRecords({
     enabled: true,