world-class / compass Goto Github PK

Users should be able to edit or delete their reviews somehow.

We can achieve this by giving each review a specific page e.g. /review/id/ or as get parameter. Either way it would work.

Another way is to have per user reviews page. A page showing all reviews from logged in user.

Depends on #31

• Design the schema
• Create the table
• Add the CREATE command to the .sql file
• Add a few rows of dummy data

Steps taken:

Following any link to any specific review - for example following the path reviews -> link to specific review from the home page, I get the following error:

It seems the end of the url with the review id is not being appended properly or similar error?

• make ejs template that will accept course table w/ review data
• make route that queries database for course/review data and renders template

Replace all instances of REPL-reviews branding with Compass. e.g. logo, titles, package names etc.

Use Google or Slack to verify that user is enrolled in the degree program.

• Sanitize review text
• limit review text to some maximum limit #44
• Validate difficulty, workload, rating and sessions on server side too
• Validate sessions field
  - [ ] Remove weird UTF-8 characters that go out of review card.
  - [x] Sanitize username updates.

We can use express-validator for this.

I don't know if you want to but it might be worth having EJS escape all output just as a precaution to avoid any potential XSS issues.

The code looks safe but escaping all output would prevent any issues if some user input did accidentally sneak in. I can create a PR for it if you want to do it.

See slack discussion here for more context: https://londoncs.slack.com/archives/G01C41CSD16/p1601327287080200?thread_ts=1601326818.076000&cid=G01C41CSD16

The idea is to limit the session options to current or past sessions in the add review form.

Add a markdown editor to add/edit review forms.

Some ideas for relevant libraries

Currently routes file is >300 lines long. It should be split into different files.

e.g.
Two more files with routes following this pattern:

• /auth/* or /user/* or equivalent.
• /reviews/*

express.Router can be used for creating routes that share common "prefix".

Documentation: https://expressjs.com/en/guide/routing.html

Sub goal of #32

• Add a route for a single review, determined by query parameter
• Add a link to the cards in review.html that passes that review's id to the new route and leads to page with just that review

Summary of slack discussions:

• Allow users to select modules they are taking and save this information.
• Each module should have a resource page like REPL, so others can quickly submit resources they found useful.
• Some important messages should be fetched from Slack channels. 👍 reactions can be used as proxy for usefulness. Pinned messages should also be pulled automatically. This will give a single page where user can see summary of all important resources for a module.

Issues

• "1 courses" in review section of profile
• Flash message repetition when user tries to submit duplicate review

At present secrets are present in files. Since they are dummy secrets, it's okay but storing auth secrets in files is not a good idea as we might accidentally commit them.

I propose using dotenv: https://www.npmjs.com/package/dotenv it seems straightforward to setup and will integrate nicely with rest of the system.

"Report" button next to reviews, in case of abusive comments. Or if the review appears to be, for example, completely the wrong course. Could lead to a simple form with a free text box to type the reason to report in, to email the admin for a human to review it.

Could maybe have some text around it with valid (and invalid) reasons to report reviews?

Just an opinion. This looks bit too huge compared to rest of the text.

• move Login and greeting to the right side
• change greeting styling. Currently it's a normal link. Could be changed to a different element or maybe use the bootstrap "disabled" class which removes on hover and attributes and link styling

Review pages are currently showing all reviews at once.

Add pagination support on all review pages (common and filtered by subjects)

This might be helpful: https://www.npmjs.com/package/express-paginate

Some pages do not clearly specify absence of relevant data.

• /review/id/num should let user know if review with id num does not exist. Right now it's a blank page.
• /reviews?course_id=subjcode should let user know if subject code is not valid. right now it returns blank page.

Improve review text in cards in reviews.html. For example, paragraphs defined in addreview form are not observed. Everything get's condensed to a continuous line.

UI of review cards is very basic and textual. Some CSS jazz can be added to improve the looks of it.

Some suggestions:

• print only date instead of huge date string with timezone details
• Add filters on top of page
• Change the layout a bit to use horizontal space. Move username / difficulty / workload / rating details to right side.
• Add some visuals like stars or rotary sliders with relevant colors for showing numbers.

Nasty raw JS error when review text is too large (afraid I didn't note how many characters it was, I just pasted a lot). Suggest a more user-friendly error, or some validation:

PayloadTooLargeError: request entity too large
at readStream (/home/ubuntu/compass/node_modules/raw-body/index.js:155:17)
at getRawBody (/home/ubuntu/compass/node_modules/raw-body/index.js:108:12)
at read (/home/ubuntu/compass/node_modules/body-parser/lib/read.js:77:3)
at urlencodedParser (/home/ubuntu/compass/node_modules/body-parser/lib/types/urlencoded.js:116:5)
at Layer.handle [as handle_request] (/home/ubuntu/compass/node_modules/express/lib/router/layer.js:95:5)
at trim_prefix (/home/ubuntu/compass/node_modules/express/lib/router/index.js:317:13)
at /home/ubuntu/compass/node_modules/express/lib/router/index.js:284:7
at Function.process_params (/home/ubuntu/compass/node_modules/express/lib/router/index.js:335:12)
at next (/home/ubuntu/compass/node_modules/express/lib/router/index.js:275:10)
at serveStatic (/home/ubuntu/compass/node_modules/serve-static/index.js:75:16)

Currently user sessions are in MemoryStore, so when server reboots all users will get logged out.

Use mysql or any other persistent method for session storage.

Documentation: https://www.npmjs.com/package/express-session#compatible-session-stores

Reviews should be linked with user table and author name should be shown on review page

Example:

In long term, I think we should support basic formatting like headings and lists.

Best way IMO is to use some sort of markdown-to-html library with basic MD syntax support.

Example library: https://github.com/showdownjs/showdown

If supplied session doesn't exist in database then server crashes instead of asking user to login again.

User has to manually remove the cookie to get it to work again.

Journey:

1. Already reviewed ITP1
2. Go to Courses and select ITP1 again (and fill in other boxes with valid input)
3. Hit Submit
4. My original review is presented to me (not the new review), however this page also has "You have already reviewed this course. Would you like to edit it? Visit review" link on it which is redundant, as I am already there.

Suggest after hitting Submit, the new review remains on the page, in case the user has selected the wrong module by accident. Then their text isn't lost.

Journey:

1. Complete a review for ITP1, October to March 2020, valid content for Difficulty, Workload, Rating; Comment field contains an emoji (invalid character)
2. Submit
3. 500: internal server error
4. Browser back button
5. All fields except Module and Session are remembered
6. Original Module and Session (ITP1, October to March 2020) are unable to be selected - visible in list but clicking does not select them
7. Select any other Module and Session
8. Able now to select original Module and Session
9. Remove cat emoji from comment field :(
10. Submit (successfully)

I will upload a screen recording on Slack, makes it clearer.

Add TLS support

Reference:

• Let's encrypt - https://letsencrypt.org/
• certbot - https://certbot.eff.org

Some suggestions received:

- [ ] Password double-typing to improve accessibility.
- [ ] Fix duplicate alerts for account/profile verification.
- [ ] Show proper errors in login/registration forms
- [ ] Account creation form: Change the label of the button from "Submit" to "Create account"
- [ ] Use red alerts only if an error occurred, use amber or blue otherwise
- [ ] "Already an account?" -> "Already have an account?"

• Allow logins with slack. Since we are already using it for account verification it would be a good idea to let users log in directly with Slack.

User authentication should cover following pages:

1. Adding new reviews

On creating an account I encountered the error message attached.

Steps taken:

Followed the login -> register for an account steps from the home page
Entered name, email, and password, hit 'submit' or equivalent button.
Was taken to the route: http://www.ucompass.tech/profile where I saw this error message.

On http://ucompass.tech/reviews?course_id=CMxxxx page it might be good to have an "Add a review for this course" button (if you have not already reviewed it). If the button just goes to the normal Add review page that's good, but maybe it could auto-populate the course in the drop-down list?

At the moment, from this page you have to go to Courses > Add a review > Drop down the list, which is slightly non-intuitive.

Something like https://omscentral.com/course/CS-6035.

Where each table row is a link to the associated course's page where you can find the review data and all reviews for that course.