Global search: Resolve and forward the user access context to Pyris

[Nayer-kotry]

Warning

Must be tested together with the paired Iris PR (ls1intum/edutelligence#712) — the access context is a cross-repo wire contract. Deploy both branches to the same test server before reviewing.

Summary

Artemis resolves the requesting user's role-grouped course access and forwards it to Pyris on both global-search endpoints, so Iris can scope and filter lecture results exactly like the Artemis UI: course scope for everyone, plus the staff/admin bypass that lets authorized users see their own unreleased lecture content. Almost entirely a server change. The client side is limited to the global search modal (4 files, about 38 changed lines): the Lectures filter now also covers lecture_unit, and removing a grouped filter chip clears every underlying type in that group rather than only the one it is labelled with. No exam-mode or programming-exercise impact.

Checklist

General

• I tested all changes and their related features with all corresponding user types on a test server.
• Language: I followed the guidelines for inclusive, diversity-sensitive, and appreciative language.
• I chose a title conforming to the naming conventions for pull requests.

Server

• Important: I implemented the changes with a very good performance and prevented too many (unnecessary) and too complex database calls.
• I strictly followed the principle of data economy for all database calls.
• I strictly followed the server coding and design guidelines and the REST API guidelines.
• I added multiple integration tests (Spring) related to the features (with a high test coverage).
• I added pre-authorization annotations according to the guidelines and checked the course groups for all new REST Calls (security).
• I documented the Java code using JavaDoc style.

Motivation and Context

Global search must show each user exactly what they can already reach in the Artemis UI. The role-based access model is enforced for the direct Weaviate search (GlobalSearchResource), but the Iris pipeline path only had course scope and a role-blind release filter, so admins and staff saw less than the UI. This PR makes Artemis the single source of truth: it resolves the user's role-grouped access and hands it to Pyris, which applies it as an opaque filter.

Description

• PyrisAccessContextDTO (new): role-grouped course IDs (courseIds, editorCourseIds, taCourseIds, studentCourseIds, staffCourseIds), the request timestamp now, and an admin unrestricted flag. Added as an optional field on the lecture-search and answer request DTOs sent to Pyris, serialized NON_EMPTY so an absent context leaves the wire identical to today.
• IrisAccessContextService.resolveAccessContext (new): admins get a present context with unrestricted = true; non-admins get their accessible courses classified into editor / TA / student, with staff = editor + TA, now = ZonedDateTime.now(), and unrestricted = false.
• Both endpoints (IrisGlobalSearchResource lecture-search and search-answer) load the user with groups, resolve the context, and forward it through IrisLectureSearchApi / PyrisConnectorService. GlobalSearchLectureRequestDTO carries the optional client courseIds filter.
• Backward compatible: every new field is optional; old Iris against new Artemis is a no-op, and an admin is sent as a present unrestricted context rather than a null one.

Steps for Testing

Prerequisites:

• 1 admin, 1 instructor (of course X), 1 student (of course X)
• Course X with at least one lecture unit whose release date is in the future (unreleased)

1. Log in to Artemis and open global search; select the lecture-content filter.
2. As the student, search for content of the unreleased unit: it must not appear.
3. As the instructor (staff of course X), run the same search: the unreleased unit must appear.
4. As the admin, run the same search: the unreleased unit must appear.
5. Confirm every role only ever sees courses they can access, matching what they can open in the UI.

Testserver States

You can manage test servers using Helios. Check environment statuses in the environment list. To deploy to a test server, go to the CI/CD page, find your PR or branch, and trigger the deployment.

Review Progress

Code Review

• Code Review 1
• Code Review 2

Manual Tests

• Role matrix (admin / instructor / student) on a test server

Test Coverage

Note: Some tests in the Test job did not pass (failure). Coverage below may be partial.

Client

Class/File	Line Coverage	Lines	Expects	Ratio
global-search-modal.component.ts	94.08%	315	117	37.1
search-input.component.ts	97.87%	89	13	14.6
global-search-navigation-view.component.ts	89.74%	339	53	15.6

Server

Class/File	Line Coverage	Lines
GlobalSearchResource.java	not found (modified)	570
IrisLectureSearchApi.java	not found (modified)	30
IrisAccessContextService.java	not found (modified)	49
PyrisConnectorService.java	not found (modified)	306
GlobalSearchLectureRequestDTO.java	not found (modified)	10
PyrisAccessContextDTO.java	not found (modified)	15
PyrisGlobalSearchAnswerRequestDTO.java	not found (modified)	11
PyrisLectureSearchRequestDTO.java	not found (modified)	10
IrisGlobalSearchResource.java	not found (modified)	57

Last updated: 2026-08-25 20:37:41 UTC

[github-actions]

End-to-End Test Results

Phase	Status	Details
Phase 1 (Relevant)	✅ Passed	Tests Passed ✅ Skipped Failed Time ⏱ Phase 1: E2E Test Report 24 ran 24 passed 0 skipped 0 failed 3m 4s
Phase 2 (Remaining)	❌ Failed	Tests Passed ☑️ Skipped ⚠️ Failed ❌️ Time ⏱ Phase 2: E2E Test Report 337 ran 329 passed 7 skipped 1 failed 40m 6s

Test Strategy: Two-phase execution

• Phase 1: e2e/Login.spec.ts e2e/Logout.spec.ts e2e/SystemHealth.spec.ts e2e/course/CourseManagement.spec.ts
• Phase 2: e2e/Passkey.spec.ts e2e/PasskeyReminderPersistence.spec.ts e2e/admin/ e2e/atlas/ e2e/course/CourseChannelMessages.spec.ts e2e/course/CourseDirectMessages.spec.ts e2e/course/CourseExercise.spec.ts e2e/course/CourseGroupChatMessages.spec.ts e2e/course/CourseMessageInteractions.spec.ts e2e/course/CourseOnboarding.spec.ts e2e/course/CourseOverviewSingleLoad.spec.ts e2e/course/CourseTabs.spec.ts e2e/exam/ExamAssessment.spec.ts e2e/exam/ExamChecklists.spec.ts e2e/exam/ExamCreationDeletion.spec.ts e2e/exam/ExamDateVerification.spec.ts e2e/exam/ExamManagement.spec.ts e2e/exam/ExamParticipation.spec.ts e2e/exam/ExamResults.spec.ts e2e/exam/ExamTestRun.spec.ts e2e/exam/test-exam/ e2e/exercise/ExerciseImport.spec.ts e2e/exercise/file-upload/ e2e/exercise/modeling/ e2e/exercise/programming/ e2e/exercise/quiz-exercise/ e2e/exercise/text/ e2e/iris/ e2e/lecture/ e2e/shared/

❌ Failed Tests (Phase 2)

• Static code analysis tests › Verifies SCA feedback is displayed correctly after submission (7m 51s)

Overall: ❌ E2E: real (non-flaky) test failure

🔗 Workflow Run · 📊 Test Report Phase 1 · 📊 Test Report Phase 2

[Claudia-Anthropica]

@Nayer-kotry Static inspection found two independent compilation blockers in the production and test sources, so the access-context behavior cannot currently build or execute. Both calls need to use the current user-course-role APIs instead of the removed group-era interfaces.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

Lecture search and asynchronous global-search answers now receive server-resolved Iris access contexts. The context contains role-based course scopes or unrestricted administrator access. Integration tests verify authorization mapping and consistent propagation.

Changes

Iris access-context propagation

Layer / File(s)	Summary
Access-context contracts src/main/java/de/tum/cit/aet/artemis/iris/service/pyris/dto/search/*	New records define validated lecture-search input and serialized, role-based course access contexts.
Access-context resolution src/main/java/de/tum/cit/aet/artemis/iris/service/IrisAccessContextService.java	The service resolves unrestricted administrator access and role-based course scopes.
Search endpoint propagation src/main/java/de/tum/cit/aet/artemis/iris/web/IrisGlobalSearchResource.java, src/main/java/de/tum/cit/aet/artemis/iris/service/pyris/PyrisConnectorService.java, src/main/java/de/tum/cit/aet/artemis/iris/api/IrisLectureSearchApi.java	The resource and lecture-search API resolve access contexts. The connector includes them in Pyris requests.
Integration validation src/test/java/de/tum/cit/aet/artemis/iris/IrisGlobalSearchIntegrationTest.java, src/test/java/de/tum/cit/aet/artemis/core/connector/IrisRequestMockProvider.java	Tests cover course roles, inaccessible courses, administrators, and equivalent contexts across search flows.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Principal
  participant IrisGlobalSearchResource
  participant IrisAccessContextService
  participant PyrisConnectorService
  participant Pyris
  Principal->>IrisGlobalSearchResource: submit search request
  IrisGlobalSearchResource->>IrisAccessContextService: resolveAccessContext(user)
  IrisAccessContextService-->>IrisGlobalSearchResource: return PyrisAccessContextDTO
  IrisGlobalSearchResource->>PyrisConnectorService: forward request and context
  PyrisConnectorService->>Pyris: send serialized request

Loading

Possibly related PRs

• ls1intum/Artemis#12788: Introduces the course-role memberships used to resolve Iris access contexts.
• ls1intum/Artemis#12803: Modifies the lecture-search flow that this change extends with access-context propagation.
• ls1intum/Artemis#13314: Introduces the global lecture content search flows that now receive access contexts.

Suggested labels: globalsearch

Suggested reviewers: krusche, claudia-anthropica

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: resolving the user access context and forwarding it to Pyris for global search.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/global-search/access-rights

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

src/main/java/de/tum/cit/aet/artemis/iris/web/IrisGlobalSearchResource.java (1)

73-95: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Update the ask() javadoc to mention access-context resolution.

The @param principal javadoc on line 78 says the principal is "used to route the WebSocket response." The implementation now also uses it to resolve the caller's PyrisAccessContextDTO (line 87) and forwards that context to executeGlobalSearchIrisAnswer (line 93). Update the javadoc to reflect this added responsibility, since a future reader could miss that this endpoint also enforces role-based course scoping.

📝 Proposed javadoc update

      * `@param` requestDTO the request containing the query and result limit
-     * `@param` principal  the authenticated user (used to route the WebSocket response)
+     * `@param` principal  the authenticated user; used to route the WebSocket response and to resolve the role-based
+     *                   course access forwarded to Pyris
      * `@return` the {`@link` ResponseEntity} with status {`@code` 202 (Accepted)}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/main/java/de/tum/cit/aet/artemis/iris/web/IrisGlobalSearchResource.java`
around lines 73 - 95, Update the ask() method’s `@param` principal Javadoc to
mention that the authenticated user is also used to resolve the Pyris access
context for role-based course scoping, while retaining the existing WebSocket
response routing description.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@src/main/java/de/tum/cit/aet/artemis/iris/service/IrisAccessContextService.java`:
- Around line 45-50: Update resolveAccessContext in IrisAccessContextService so
its findAllAccessibleCoursesForUser call matches the CourseRepository API:
either add the required Set<String> groups overload to CourseRepository or pass
a non-null user ID to the existing (Long, boolean) method and preserve separate
role-membership evaluation. Ensure the code compiles and retains the intended
access filtering.

---

Nitpick comments:
In `@src/main/java/de/tum/cit/aet/artemis/iris/web/IrisGlobalSearchResource.java`:
- Around line 73-95: Update the ask() method’s `@param` principal Javadoc to
mention that the authenticated user is also used to resolve the Pyris access
context for role-based course scoping, while retaining the existing WebSocket
response routing description.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 0f5bef00-c891-4098-b956-148a492ef4a0

📥 Commits

Reviewing files that changed from the base of the PR and between c674710 and 740e466.

📒 Files selected for processing (10)

• src/main/java/de/tum/cit/aet/artemis/iris/api/IrisLectureSearchApi.java
• src/main/java/de/tum/cit/aet/artemis/iris/service/IrisAccessContextService.java
• src/main/java/de/tum/cit/aet/artemis/iris/service/pyris/PyrisConnectorService.java
• src/main/java/de/tum/cit/aet/artemis/iris/service/pyris/dto/search/GlobalSearchLectureRequestDTO.java
• src/main/java/de/tum/cit/aet/artemis/iris/service/pyris/dto/search/PyrisAccessContextDTO.java
• src/main/java/de/tum/cit/aet/artemis/iris/service/pyris/dto/search/PyrisGlobalSearchAnswerRequestDTO.java
• src/main/java/de/tum/cit/aet/artemis/iris/service/pyris/dto/search/PyrisLectureSearchRequestDTO.java
• src/main/java/de/tum/cit/aet/artemis/iris/web/IrisGlobalSearchResource.java
• src/test/java/de/tum/cit/aet/artemis/core/connector/IrisRequestMockProvider.java
• src/test/java/de/tum/cit/aet/artemis/iris/IrisGlobalSearchIntegrationTest.java

[coderabbitai]

Actionable comments posted: 1

♻️ Duplicate comments (1)

src/main/java/de/tum/cit/aet/artemis/iris/service/IrisAccessContextService.java (1)

45-70: 🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win

Fix the findAllAccessibleCoursesForUser call: argument type mismatch breaks the build.

Line 50 calls courseRepository.findAllAccessibleCoursesForUser(user.getGroups(), false). user.getGroups() returns Set<String>. CI failures (CodeQL, Build, Bean Instantiation Check, Server Code Style, Server Tests) all report "cannot find symbol" at this exact line, confirming no matching overload accepts a Set<String> as the first argument. This was already flagged on a previous commit, where the reviewer noted the repository method requires a Long userId. The issue is still present in this version.

Also related to the same fix: once courses resolves correctly, the loop at lines 54-64 calls authCheckService.isAtLeastEditorInCourse and isAtLeastTeachingAssistantInCourse once per course. If these checks query course membership per call, this causes one query per accessible course. Loading the user with preloaded course roles (as previously suggested) would let this loop use an in-memory role index instead of per-course queries.

🔧 Suggested direction

-        var courses = courseRepository.findAllAccessibleCoursesForUser(user.getGroups(), false);
+        var courses = courseRepository.findAllAccessibleCoursesForUser(user.getId(), false);

Verify the exact repository method signature before applying; adjust the argument accordingly if it takes groups directly.

Run the following script to confirm the real signature and existing call sites:

#!/bin/bash
# Description: Locate CourseRepository.findAllAccessibleCoursesForUser declaration and all call sites.
fd -e java CourseRepository | xargs rg -n -B2 -A6 'findAllAccessibleCoursesForUser'
echo "---- call sites ----"
rg -n -B3 -A3 'findAllAccessibleCoursesForUser' --type=java

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@src/main/java/de/tum/cit/aet/artemis/iris/service/IrisAccessContextService.java`
around lines 45 - 70, Update resolveAccessContext in IrisAccessContextService to
call CourseRepository.findAllAccessibleCoursesForUser with the user identifier
required by its actual method signature, rather than user.getGroups(). Then
reuse preloaded user course-role data for the editor and teaching-assistant
checks so the loop avoids per-course membership queries, while preserving the
existing access-category assignments.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/main/java/de/tum/cit/aet/artemis/iris/web/IrisGlobalSearchResource.java`:
- Line 68: Update the user lookup calls in IrisGlobalSearchResource.search() and
ask() to use an existing UserRepository method that accepts the principal login
and eagerly loads the required groups and authorities; alternatively, add the
missing getUserWithGroupsAndAuthorities method to UserRepository with matching
behavior.

---

Duplicate comments:
In
`@src/main/java/de/tum/cit/aet/artemis/iris/service/IrisAccessContextService.java`:
- Around line 45-70: Update resolveAccessContext in IrisAccessContextService to
call CourseRepository.findAllAccessibleCoursesForUser with the user identifier
required by its actual method signature, rather than user.getGroups(). Then
reuse preloaded user course-role data for the editor and teaching-assistant
checks so the loop avoids per-course membership queries, while preserving the
existing access-category assignments.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 6597f0a7-1857-4ce9-81cf-6c9a82e4c2b2

📥 Commits

Reviewing files that changed from the base of the PR and between c674710 and 740e466.

📒 Files selected for processing (10)

• src/main/java/de/tum/cit/aet/artemis/iris/api/IrisLectureSearchApi.java
• src/main/java/de/tum/cit/aet/artemis/iris/service/IrisAccessContextService.java
• src/main/java/de/tum/cit/aet/artemis/iris/service/pyris/PyrisConnectorService.java
• src/main/java/de/tum/cit/aet/artemis/iris/service/pyris/dto/search/GlobalSearchLectureRequestDTO.java
• src/main/java/de/tum/cit/aet/artemis/iris/service/pyris/dto/search/PyrisAccessContextDTO.java
• src/main/java/de/tum/cit/aet/artemis/iris/service/pyris/dto/search/PyrisGlobalSearchAnswerRequestDTO.java
• src/main/java/de/tum/cit/aet/artemis/iris/service/pyris/dto/search/PyrisLectureSearchRequestDTO.java
• src/main/java/de/tum/cit/aet/artemis/iris/web/IrisGlobalSearchResource.java
• src/test/java/de/tum/cit/aet/artemis/core/connector/IrisRequestMockProvider.java
• src/test/java/de/tum/cit/aet/artemis/iris/IrisGlobalSearchIntegrationTest.java

🚧 Files skipped from review as they are similar to previous changes (8)

• src/main/java/de/tum/cit/aet/artemis/iris/service/pyris/dto/search/GlobalSearchLectureRequestDTO.java
• src/main/java/de/tum/cit/aet/artemis/iris/service/pyris/dto/search/PyrisAccessContextDTO.java
• src/main/java/de/tum/cit/aet/artemis/iris/api/IrisLectureSearchApi.java
• src/test/java/de/tum/cit/aet/artemis/core/connector/IrisRequestMockProvider.java
• src/main/java/de/tum/cit/aet/artemis/iris/service/pyris/dto/search/PyrisGlobalSearchAnswerRequestDTO.java
• src/main/java/de/tum/cit/aet/artemis/iris/service/pyris/PyrisConnectorService.java
• src/main/java/de/tum/cit/aet/artemis/iris/service/pyris/dto/search/PyrisLectureSearchRequestDTO.java
• src/test/java/de/tum/cit/aet/artemis/iris/IrisGlobalSearchIntegrationTest.java

[coderabbitai]

🧹 Nitpick comments (1)

src/test/java/de/tum/cit/aet/artemis/iris/IrisGlobalSearchIntegrationTest.java (1)

202-203: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Assert the editor and teaching-assistant role scopes.

The test creates teaching-assistant, editor, and instructor assignments. It only verifies courseIds, staffCourseIds, and studentCourseIds.

Add direct assertions for the editor and teaching-assistant course-ID lists. This will detect a removed, swapped, or merged role scope.

Based on PR objectives, the access context contains role-grouped course IDs.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@src/test/java/de/tum/cit/aet/artemis/iris/IrisGlobalSearchIntegrationTest.java`
around lines 202 - 203, Extend the assertions in IrisGlobalSearchIntegrationTest
to directly verify the editor and teaching-assistant course-ID lists after the
role assignments are created. Assert each role-specific list contains exactly
the corresponding course IDs, preserving the existing assertions for courseIds,
staffCourseIds, and studentCourseIds.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In
`@src/test/java/de/tum/cit/aet/artemis/iris/IrisGlobalSearchIntegrationTest.java`:
- Around line 202-203: Extend the assertions in IrisGlobalSearchIntegrationTest
to directly verify the editor and teaching-assistant course-ID lists after the
role assignments are created. Assert each role-specific list contains exactly
the corresponding course IDs, preserving the existing assertions for courseIds,
staffCourseIds, and studentCourseIds.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 963072c3-76ac-42cb-ba25-6255f50ab671

📥 Commits

Reviewing files that changed from the base of the PR and between 740e466 and 4a7c7fc.

📒 Files selected for processing (3)

• src/main/java/de/tum/cit/aet/artemis/iris/service/IrisAccessContextService.java
• src/main/java/de/tum/cit/aet/artemis/iris/web/IrisGlobalSearchResource.java
• src/test/java/de/tum/cit/aet/artemis/iris/IrisGlobalSearchIntegrationTest.java

🚧 Files skipped from review as they are similar to previous changes (1)

• src/main/java/de/tum/cit/aet/artemis/iris/service/IrisAccessContextService.java

[Claudia-Anthropica]

@Nayer-kotry The two prior compilation blockers are fixed at this head. However, the prior course-role-loading concern remains unresolved: both endpoints load only authorities, causing access-context resolution to execute up to two role-existence queries per accessible course.

[marlonnienaber]

Thx for incorporating my CRs

[Pomodorka3]

--- TESTED on TS3 ---
All prerequisites have been fulfilled.

✅ As the student, search for the content of the unreleased unit: it must not appear. (user: artemis_test_user_1240)

---

✅ As the instructor (staff of course X), run the same search: the unreleased unit must appear. (user: artemis_test_user_1241)

---

✅ As the admin, run the same search: the unreleased unit must appear. (user: ge43fis)