models.py

from __future__ import annotations


__copyright__ = "Copyright (C) 2014 Andreas Kloeckner"

__license__ = """
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
"""

from typing import (  # noqa
    TYPE_CHECKING, Any, Dict, FrozenSet, Iterable, List, Optional, Text, Tuple, cast,
)

from django.conf import settings
from django.core.exceptions import ObjectDoesNotExist, ValidationError
from django.core.validators import RegexValidator
from django.db import models
from django.db.models.signals import post_save
from django.dispatch import receiver
from django.urls import reverse
from django.utils.timezone import now
from django.utils.translation import gettext_lazy as _, pgettext_lazy

from course.constants import (  # noqa
    COURSE_ID_REGEX, EVENT_KIND_REGEX, EXAM_TICKET_STATE_CHOICES,
    FLOW_PERMISSION_CHOICES, FLOW_RULE_KIND_CHOICES,
    FLOW_SESSION_EXPIRATION_MODE_CHOICES, GRADE_AGGREGATION_STRATEGY_CHOICES,
    GRADE_STATE_CHANGE_CHOICES, GRADING_OPP_ID_REGEX,
    PARTICIPATION_PERMISSION_CHOICES, PARTICIPATION_STATUS_CHOICES,
    USER_STATUS_CHOICES, exam_ticket_states, flow_permission, flow_rule_kind,
    flow_session_expiration_mode, grade_aggregation_strategy,
    grade_state_change_types, participation_permission, participation_status,
    user_status,
)
from relate.utils import string_concat


# {{{ mypy

if TYPE_CHECKING:
    import datetime  # noqa

    from course.content import FlowDesc  # noqa
    from course.page.base import AnswerFeedback  # noqa: F401

# }}}


from jsonfield import JSONField
from yamlfield.fields import YAMLField


# {{{ course

def validate_course_specific_language(value: str) -> None:
    if not value.strip():
        # the default value is ""
        return
    if value not in (
                [lang_code for lang_code, lang_descr in settings.LANGUAGES]
                + [settings.LANGUAGE_CODE]):
        raise ValidationError(
            _("'%s' is currently not supported as a course specific "
              "language at this site.") % value)


class Course(models.Model):
    identifier = models.CharField(max_length=200, unique=True,
            help_text=_("A course identifier. Alphanumeric with dashes, "
            "no spaces. This is visible in URLs and determines the location "
            "on your file system where the course's git repository lives. "
            "This should <em>not</em> be changed after the course has been created "
            "without also moving the course's git on the server."),
            verbose_name=_("Course identifier"),
            db_index=True,
            validators=[
                RegexValidator(
                    "^"+COURSE_ID_REGEX+"$",
                    message=_(
                        "Identifier may only contain letters, "
                        "numbers, and hyphens ('-').")),
                    ]
            )
    name = models.CharField(
            null=True, blank=False,
            max_length=200,
            verbose_name=_("Course name"),
            help_text=_("A human-readable name for the course. "
                "(e.g. 'Numerical Methods')"))
    number = models.CharField(
            null=True, blank=False,
            max_length=200,
            verbose_name=_("Course number"),
            help_text=_("A human-readable course number/ID "
                "for the course (e.g. 'CS123')"))
    time_period = models.CharField(
            null=True, blank=False,
            max_length=200,
            verbose_name=_("Time Period"),
            help_text=_("A human-readable description of the "
                "time period for the course (e.g. 'Fall 2014')"))

    start_date = models.DateField(
            verbose_name=_("Start date"),
            null=True, blank=True)
    end_date = models.DateField(
            verbose_name=_("End date"),
            null=True, blank=True)

    hidden = models.BooleanField(
            default=True,
            help_text=_("Is the course only accessible to course staff?"),
            verbose_name=_("Only visible to course staff"))
    listed = models.BooleanField(
            default=True,
            help_text=_("Should the course be listed on the main page?"),
            verbose_name=_("Listed on main page"))
    accepts_enrollment = models.BooleanField(
            default=True,
            verbose_name=_("Accepts enrollment"))

    git_source = models.CharField(max_length=200, blank=False,
            help_text=_("A Git URL from which to pull course updates. "
            "If you're just starting out, enter "
            "<tt>https://github.com/inducer/relate-sample.git</tt> "
            "to get some sample content."),
            verbose_name=_("git source"))
    ssh_private_key = models.TextField(blank=True,
            help_text=_("An SSH private key to use for Git authentication. "
            "Not needed for the sample URL above."
            "You may use <a href='/generate-ssh-key'>this tool</a> to generate "
            "a key pair."),
            verbose_name=_("SSH private key"))
    course_root_path = models.CharField(max_length=200, blank=True,
            help_text=_(
                "Subdirectory <em>within</em> the git repository to use as "
                "course root directory. Not required, and usually blank. "
                "Use only if your course content lives in a subdirectory "
                "of your git repository. "
                "Should not include trailing slash."),
            verbose_name=_("Course root in repository"))

    course_file = models.CharField(max_length=200,
            default="course.yml",
            help_text=_("Name of a YAML file in the git repository that "
            "contains the root course descriptor."),
            verbose_name=_("Course file"))
    events_file = models.CharField(max_length=200,
            default="events.yml",
            help_text=_("Name of a YAML file in the git repository that "
            "contains calendar information."),
            verbose_name=_("Events file"))

    enrollment_approval_required = models.BooleanField(
            default=False,
            help_text=_("If set, each enrolling student must be "
            "individually approved."),
            verbose_name=_("Enrollment approval required"))
    preapproval_require_verified_inst_id = models.BooleanField(
            default=True,
            help_text=_("If set, students cannot get participation "
                        "preapproval using institutional ID if "
                        "the institutional ID they provided is not "
                        "verified."),
            verbose_name=_("Prevent preapproval by institutional ID if not "
                           "verified?"))
    enrollment_required_email_suffix = models.CharField(
            max_length=200, blank=True, null=True,
            help_text=_("Enrollee's email addresses must end in the "
            "specified suffix, such as '@illinois.edu'."),
            verbose_name=_("Enrollment required email suffix"))

    from_email = models.EmailField(
            # Translators: replace "RELATE" with the brand name of your
            # website if necessary.
            help_text=_("This email address will be used in the 'From' line "
            "of automated emails sent by RELATE."),
            verbose_name=_("From email"))

    notify_email = models.EmailField(
            help_text=_("This email address will receive "
            "notifications about the course."),
            verbose_name=_("Notify email"))

    force_lang = models.CharField(max_length=200, blank=True, null=True,
            default="",
            validators=[validate_course_specific_language],
            help_text=_(
                "Which language is forced to be used for this course."),
            verbose_name=_("Course language forcibly used"))

    # {{{ XMPP

    course_xmpp_id = models.CharField(max_length=200, blank=True, null=True,
            help_text=_("(Required only if the instant message feature is "
            "desired.) The Jabber/XMPP ID (JID) the course will use to sign "
            "in to an XMPP server."),
            verbose_name=_("Course xmpp ID"))
    course_xmpp_password = models.CharField(max_length=200, blank=True, null=True,
            help_text=_("(Required only if the instant message feature is "
            "desired.) The password to go with the JID above."),
            verbose_name=_("Course xmpp password"))

    recipient_xmpp_id = models.CharField(max_length=200, blank=True, null=True,
            help_text=_("(Required only if the instant message feature is "
            "desired.) The JID to which instant messages will be sent."),
            verbose_name=_("Recipient xmpp ID"))

    # }}}

    active_git_commit_sha = models.CharField(max_length=200, null=False,
            blank=False,
            verbose_name=_("Active git commit SHA"))

    participants = models.ManyToManyField(settings.AUTH_USER_MODEL,
            through="Participation")

    trusted_for_markup = models.BooleanField(
            default=False,
            verbose_name=_("May present arbitrary HTML to course participants"))

    class Meta:
        verbose_name = _("Course")
        verbose_name_plural = _("Courses")

    def __unicode__(self):
        return self.identifier

    __str__ = __unicode__

    def clean(self):
        if self.force_lang:
            self.force_lang = self.force_lang.strip()

    def get_absolute_url(self):
        return reverse("relate-course_page", args=(self.identifier,))

    def get_from_email(self):
        if settings.RELATE_EMAIL_SMTP_ALLOW_NONAUTHORIZED_SENDER:
            return self.from_email
        else:
            return getattr(
                settings, "NOTIFICATION_EMAIL_FROM",
                settings.ROBOT_EMAIL_FROM)

    def get_reply_to_email(self):
        # this functionality need more fields in Course model,
        # about the preference of the course.
        if settings.RELATE_EMAIL_SMTP_ALLOW_NONAUTHORIZED_SENDER:
            return self.from_email
        else:
            return self.notify_email

    def save(self, *args, **kwargs):
        self.full_clean()  # performs regular validation then clean()
        super().save(*args, **kwargs)

# }}}


# {{{ event

class Event(models.Model):
    """An event is an identifier that can be used to specify dates in
    course content.
    """

    course = models.ForeignKey(Course,
            verbose_name=_("Course"), on_delete=models.CASCADE)
    kind = models.CharField(max_length=50,
            # Translators: format of event kind in Event model
            help_text=_("Should be lower_case_with_underscores, no spaces "
            "allowed."),
            verbose_name=_("Kind of event"),
            validators=[
                RegexValidator(
                    "^" + EVENT_KIND_REGEX + "$",
                    message=_("Should be lower_case_with_underscores, no spaces "
                              "allowed.")),
                ]
            )
    ordinal = models.IntegerField(blank=True, null=True,
            # Translators: ordinal of event of the same kind
            verbose_name=_("Ordinal of event"))

    time = models.DateTimeField(verbose_name=_("Start time"))
    end_time = models.DateTimeField(null=True, blank=True,
            verbose_name=_("End time"))
    all_day = models.BooleanField(default=False,
            # Translators: for when the due time is "All day", how the webpage
            # of a event is displayed.
            help_text=_("Only affects the rendering in the class calendar, "
            "in that a start time is not shown"),
            verbose_name=_("All day"))

    shown_in_calendar = models.BooleanField(default=True,
            verbose_name=_("Shown in calendar"))

    class Meta:
        verbose_name = _("Event")
        verbose_name_plural = _("Events")
        ordering = ("course", "time")
        unique_together = (("course", "kind", "ordinal"))

    def __unicode__(self):
        if self.ordinal is not None:
            return f"{self.kind} {self.ordinal}"
        else:
            return self.kind

    def clean(self):
        super().clean()

        try:
            self.course
        except ObjectDoesNotExist:
            raise ValidationError(
                {"course":
                     _("Course must be given.")})

        if self.end_time:
            if self.end_time < self.time:
                raise ValidationError(
                    {"end_time":
                         _("End time must not be ahead of start time.")})

        if self.ordinal is None:
            null_ordinal_qset = Event.objects.filter(
                    course=self.course,
                    kind=self.kind,
                    ordinal__isnull=True)

            if self.pk:
                null_ordinal_qset = null_ordinal_qset.exclude(id=self.pk)

            if null_ordinal_qset.exists():
                raise ValidationError(
                        _("May not create multiple ordinal-less events "
                            "of kind '{evt_kind}' in course '{course}'")
                        .format(evt_kind=self.kind, course=self.course))

    def save(self, *args, **kwargs):
        self.full_clean()
        return super().save(*args, **kwargs)

    __str__ = __unicode__

# }}}


# {{{ participation

class ParticipationTag(models.Model):
    course = models.ForeignKey(Course,
            verbose_name=_("Course"), on_delete=models.CASCADE)
    name = models.CharField(max_length=100,
            blank=False, null=False,
            # Translators: name format of ParticipationTag
            help_text=_("Should be a valid identifier (as defined by Python)."),
            verbose_name=_("Name of participation tag"))
    shown_to_participant = models.BooleanField(default=False,
            verbose_name=_("Shown to participant"))

    def clean(self):
        super().clean()

        if not self.name.isidentifier():
            field_name = "name"
            raise ValidationError(
                {field_name:
                     _("'%s' contains invalid characters.") % field_name})

    def __unicode__(self):
        return f"{self.name} ({self.course})"

    __str__ = __unicode__

    class Meta:
        verbose_name = _("Participation tag")
        verbose_name_plural = _("Participation tags")
        unique_together = (("course", "name"),)
        ordering = ("course", "name")


class ParticipationRole(models.Model):
    course = models.ForeignKey(Course,
            verbose_name=_("Course"), on_delete=models.CASCADE)
    identifier = models.CharField(
            max_length=100, blank=False, null=False,
            help_text=_("A symbolic name for this role, used in course code. "
            "Should be a valid identifier (as defined by Python). The "
            "name 'unenrolled' is special and refers to anyone not enrolled "
            "in the course."),
            verbose_name=_("Role identifier"))
    name = models.CharField(max_length=200, blank=False, null=False,
            help_text=_("A human-readable description of this role."),
            verbose_name=_("Role name"))

    is_default_for_new_participants = models.BooleanField(default=False,
            verbose_name=_("Is default role for new participants"))
    is_default_for_unenrolled = models.BooleanField(default=False,
            verbose_name=_("Is default role for unenrolled users"))

    def clean(self):
        super().clean()

        if not self.identifier.isidentifier():
            field_name = "identifier"
            raise ValidationError(
                {field_name:
                     _("'%s' contains invalid characters.") % field_name})

    def __unicode__(self):
        return _("%(identifier)s in %(course)s") % {
            "identifier": self.identifier,
            "course": self.course}

    # {{{ permissions handling

    _permissions_cache: frozenset[tuple[str, str | None]] | None = None

    def permission_tuples(self) -> frozenset[tuple[str, str | None]]:

        if self._permissions_cache is not None:
            return self._permissions_cache

        perm = list(
                    ParticipationRolePermission.objects.filter(role=self)
                    .values_list("permission", "argument"))

        fset_perm = frozenset(
                (permission, argument) if argument else (permission, None)
                for permission, argument in perm)

        self._permissions_cache = fset_perm
        return fset_perm

    def has_permission(self, perm: str, argument: str | None = None) -> bool:
        return (perm, argument) in self.permission_tuples()

    # }}}
    __str__ = __unicode__

    class Meta:
        verbose_name = _("Participation role")
        verbose_name_plural = _("Participation roles")
        unique_together = (("course", "identifier"),)
        ordering = ("course", "identifier")


class ParticipationPermissionBase(models.Model):
    permission = models.CharField(max_length=200, blank=False, null=False,
            choices=PARTICIPATION_PERMISSION_CHOICES,
            verbose_name=_("Permission"),
            db_index=True)
    argument = models.CharField(max_length=200, blank=True, null=True,
            verbose_name=_("Argument"))

    class Meta:
        abstract = True

    def __unicode__(self):
        if self.argument:
            return f"{self.permission} {self.argument}"
        else:
            return self.permission

    __str__ = __unicode__


class ParticipationRolePermission(ParticipationPermissionBase):
    role = models.ForeignKey(ParticipationRole,
            verbose_name=_("Role"), on_delete=models.CASCADE,
            related_name="permissions")

    def __unicode__(self):
        # Translators: permissions for roles
        return _("%(permission)s for %(role)s") % {
            "permission": super().__unicode__(),
            "role": self.role}

    __str__ = __unicode__

    class Meta:
        verbose_name = _("Participation role permission")
        verbose_name_plural = _("Participation role permissions")
        unique_together = (("role", "permission", "argument"),)


class Participation(models.Model):
    user = models.ForeignKey(settings.AUTH_USER_MODEL,
            verbose_name=_("User ID"), on_delete=models.CASCADE,
            related_name="participations")
    course = models.ForeignKey(Course, related_name="participations",
            verbose_name=_("Course"), on_delete=models.CASCADE)

    enroll_time = models.DateTimeField(default=now,
            verbose_name=_("Enroll time"))
    role = models.CharField(max_length=50,
            verbose_name=_("Role (unused)"),)
    roles = models.ManyToManyField(ParticipationRole, blank=True,
            verbose_name=_("Roles"), related_name="participation")

    status = models.CharField(max_length=50,
            choices=PARTICIPATION_STATUS_CHOICES,
            verbose_name=_("Participation status"))

    time_factor = models.DecimalField(
            max_digits=10, decimal_places=2,
            default=1,
            help_text=_("Multiplier for time available on time-limited "
            "flows"),
            verbose_name=_("Time factor"))

    preview_git_commit_sha = models.CharField(max_length=200, null=True,
            blank=True,
            verbose_name=_("Preview git commit SHA"))

    tags = models.ManyToManyField(ParticipationTag, blank=True,
            verbose_name=_("Tags"))
    notes = models.TextField(blank=True, null=True,
            verbose_name=_("Notes"))

    def __unicode__(self):
        # Translators: displayed format of Participation: some user in some
        # course as some role
        return _("%(user)s in %(course)s as %(role)s") % {
                "user": self.user, "course": self.course,
                "role": "/".join(
                    role.identifier
                    for role in self.roles.all())
                }

    __str__ = __unicode__

    class Meta:
        verbose_name = _("Participation")
        verbose_name_plural = _("Participations")
        unique_together = (("user", "course"),)
        ordering = ("course", "user")

    def get_role_desc(self):
        return ", ".join(role.name for role in self.roles.all())

    # {{{ permissions handling

    _permissions_cache: frozenset[tuple[str, str | None]] | None = None

    def permissions(self) -> frozenset[tuple[str, str | None]]:

        if self._permissions_cache is not None:
            return self._permissions_cache

        perm = (
                list(
                    ParticipationRolePermission.objects.filter(
                        role__course=self.course,
                        role__participation=self)
                    .values_list("permission", "argument"))
                + list(
                    ParticipationPermission.objects.filter(
                        participation=self)
                    .values_list("permission", "argument")))

        fset_perm = frozenset(
                (permission, argument) if argument else (permission, None)
                for permission, argument in perm)

        self._permissions_cache = fset_perm
        return fset_perm

    def has_permission(self, perm: str, argument: str | None = None) -> bool:
        return (perm, argument) in self.permissions()

    # }}}


class ParticipationPermission(ParticipationPermissionBase):
    participation = models.ForeignKey(Participation,
            verbose_name=_("Participation"), on_delete=models.CASCADE,
            related_name="individual_permissions")

    class Meta:
        verbose_name = _("Participation permission")
        verbose_name_plural = _("Participation permissionss")
        unique_together = (("participation", "permission", "argument"),)


class ParticipationPreapproval(models.Model):
    email = models.EmailField(max_length=254, null=True, blank=True,
            verbose_name=_("Email"))
    institutional_id = models.CharField(max_length=254, null=True, blank=True,
            verbose_name=_("Institutional ID"))
    course = models.ForeignKey(Course,
            verbose_name=_("Course"), on_delete=models.CASCADE)
    role = models.CharField(max_length=50,
            verbose_name=_("Role (unused)"),)
    roles = models.ManyToManyField(ParticipationRole, blank=True,
            verbose_name=_("Roles"), related_name="+")

    creator = models.ForeignKey(settings.AUTH_USER_MODEL, null=True,
            verbose_name=_("Creator"), on_delete=models.SET_NULL)
    creation_time = models.DateTimeField(default=now, db_index=True,
            verbose_name=_("Creation time"))

    def __unicode__(self):
        if self.email:
            # Translators: somebody's email in some course in Participation
            # Preapproval
            return _("Email %(email)s in %(course)s") % {
                "email": self.email, "course": self.course}
        elif self.institutional_id:
            # Translators: somebody's Institutional ID in some course in
            # Participation Preapproval
            return _("Institutional ID %(inst_id)s in %(course)s") % {
                    "inst_id": self.institutional_id, "course": self.course}
        else:
            return _("Preapproval with pk %(pk)s in %(course)s") % {
                    "pk": self.pk, "course": self.course}

    __str__ = __unicode__

    class Meta:
        verbose_name = _("Participation preapproval")
        verbose_name_plural = _("Participation preapprovals")
        unique_together = (("course", "email"),)
        ordering = ("course", "email")


def add_default_roles_and_permissions(course,
        role_model=ParticipationRole,
        role_permission_model=ParticipationRolePermission):
    from course.constants import participation_permission as pp

    rpm = role_permission_model

    def add_unenrolled_permissions(role):
        rpm(role=role, permission=pp.view_calendar).save()
        rpm(role=role, permission=pp.access_files_for,
                argument="unenrolled").save()
        rpm(role=role, permission=pp.access_files_for,
                argument="public").save()

    def add_student_permissions(role):
        rpm(role=role, permission=pp.send_instant_message).save()
        rpm(role=role, permission=pp.access_files_for,
                argument="student").save()

        add_unenrolled_permissions(role)

    def add_teaching_assistant_permissions(role):
        rpm(role=role, permission=pp.impersonate_role,
                argument="student").save()
        rpm(role=role, permission=pp.set_fake_time).save()
        rpm(role=role, permission=pp.set_pretend_facility).save()
        rpm(role=role, permission=pp.view_hidden_course_page).save()
        rpm(role=role, permission=pp.access_files_for,
                argument="ta").save()
        rpm(role=role, permission=pp.access_files_for,
                argument="in_exam").save()

        rpm(role=role, permission=pp.issue_exam_ticket).save()

        rpm(role=role, permission=pp.view_flow_sessions_from_role,
                argument="student").save()
        rpm(role=role, permission=pp.view_gradebook).save()
        rpm(role=role, permission=pp.assign_grade).save()
        rpm(role=role, permission=pp.skip_during_manual_grading).save()
        rpm(role=role, permission=pp.view_grader_stats).save()
        rpm(role=role, permission=pp.batch_download_submission).save()

        rpm(role=role, permission=pp.impose_flow_session_deadline).save()
        rpm(role=role, permission=pp.end_flow_session).save()
        rpm(role=role, permission=pp.regrade_flow_session).save()
        rpm(role=role, permission=pp.recalculate_flow_session_grade).save()

        rpm(role=role, permission=pp.reopen_flow_session).save()
        rpm(role=role, permission=pp.grant_exception).save()
        rpm(role=role, permission=pp.view_analytics).save()

        rpm(role=role, permission=pp.preview_content).save()
        rpm(role=role, permission=pp.use_markup_sandbox).save()
        rpm(role=role, permission=pp.use_page_sandbox).save()
        rpm(role=role, permission=pp.test_flow).save()
        rpm(role=role, permission=pp.query_participation).save()
        rpm(role=role, permission=pp.edit_participation).save()

        add_student_permissions(role)

    def add_instructor_permissions(role):
        rpm(role=role, permission=pp.use_admin_interface).save()
        rpm(role=role, permission=pp.impersonate_role,
                argument="ta").save()
        rpm(role=role, permission=pp.edit_course_permissions).save()
        rpm(role=role, permission=pp.edit_course).save()
        rpm(role=role, permission=pp.manage_authentication_tokens).save()
        rpm(role=role, permission=pp.access_files_for,
                argument="instructor").save()

        rpm(role=role, permission=pp.edit_exam).save()
        rpm(role=role, permission=pp.batch_issue_exam_ticket).save()

        rpm(role=role, permission=pp.view_flow_sessions_from_role,
                argument="ta").save()
        rpm(role=role, permission=pp.edit_grading_opportunity).save()
        rpm(role=role, permission=pp.batch_import_grade).save()
        rpm(role=role, permission=pp.batch_export_grade).save()

        rpm(role=role, permission=pp.batch_impose_flow_session_deadline).save()
        rpm(role=role, permission=pp.batch_end_flow_session).save()
        rpm(role=role, permission=pp.batch_regrade_flow_session).save()
        rpm(role=role, permission=pp.batch_recalculate_flow_session_grade).save()

        rpm(role=role, permission=pp.update_content).save()
        rpm(role=role, permission=pp.edit_events).save()
        rpm(role=role, permission=pp.manage_instant_flow_requests).save()
        rpm(role=role, permission=pp.preapprove_participation).save()

        add_teaching_assistant_permissions(role)

    instructor = role_model(
            course=course, identifier="instructor",
            name=_("Instructor"))
    instructor.save()
    teaching_assistant = role_model(
            course=course, identifier="ta",
            name=_("Teaching Assistant"))
    teaching_assistant.save()
    student = role_model(
            course=course, identifier="student",
            name=_("Student"),
            is_default_for_new_participants=True)
    student.save()
    unenrolled = role_model(
            course=course, identifier="unenrolled",
            name=_("Unenrolled"),
            is_default_for_unenrolled=True)
    unenrolled.save()

    rpm(role=student, permission=pp.included_in_grade_statistics).save()
    rpm(role=unenrolled, permission=pp.included_in_grade_statistics).save()

    add_unenrolled_permissions(unenrolled)
    add_student_permissions(student)
    add_teaching_assistant_permissions(teaching_assistant)
    add_instructor_permissions(instructor)


@receiver(post_save, sender=Course, dispatch_uid="add_default_permissions")
def _set_up_course_permissions(sender, instance, created, raw, using, update_fields,
        **kwargs):
    if created:
        add_default_roles_and_permissions(instance)

# }}}


# {{{ auth token

class AuthenticationToken(models.Model):
    user = models.ForeignKey(settings.AUTH_USER_MODEL,
            verbose_name=_("User ID"), on_delete=models.CASCADE)

    participation = models.ForeignKey(Participation,
            verbose_name=_("Participation"), on_delete=models.CASCADE)

    restrict_to_participation_role = models.ForeignKey(ParticipationRole,
            verbose_name=_("Restrict to role"), on_delete=models.CASCADE,
            blank=True, null=True)

    description = models.CharField(max_length=200,
            verbose_name=_("Description"))

    creation_time = models.DateTimeField(
            default=now, verbose_name=_("Creation time"))
    last_use_time = models.DateTimeField(
            verbose_name=_("Last use time"),
            blank=True, null=True)
    valid_until = models.DateTimeField(
            default=None, verbose_name=_("Valid until"),
            blank=True, null=True)
    revocation_time = models.DateTimeField(
            default=None, verbose_name=_("Revocation time"),
            blank=True, null=True)

    token_hash = models.CharField(max_length=200,
            help_text=_("A hash of the authentication token to be "
                "used for direct git access."),
            null=True, blank=True, unique=True,
            verbose_name=_("Hash of git authentication token"))

    def __unicode__(self):
        return _("Token %(id)d for %(participation)s: %(description)s") % {
                "id": self.id,
                "participation": self.participation,
                "description": self.description}

    __str__ = __unicode__

    class Meta:
        verbose_name = _("Authentication token")
        verbose_name_plural = _("Authentication tokens")
        ordering = ("participation", "creation_time")

# }}}


# {{{ instant flow request

class InstantFlowRequest(models.Model):
    course = models.ForeignKey(Course,
            verbose_name=_("Course"), on_delete=models.CASCADE)
    flow_id = models.CharField(max_length=200,
            verbose_name=_("Flow ID"))
    start_time = models.DateTimeField(default=now,
            verbose_name=_("Start time"))
    end_time = models.DateTimeField(
            verbose_name=_("End time"))
    cancelled = models.BooleanField(default=False,
            verbose_name=_("Cancelled"))

    class Meta:
        verbose_name = _("Instant flow request")
        verbose_name_plural = _("Instant flow requests")

    def __unicode__(self):
        return _("Instant flow request for "
                "%(flow_id)s in %(course)s at %(start_time)s") \
                % {
                        "flow_id": self.flow_id,
                        "course": self.course,
                        "start_time": self.start_time,
                        }

    __str__ = __unicode__

# }}}


# {{{ flow session

class FlowSession(models.Model):
    # This looks like it's redundant with 'participation', below--but it's not.
    # 'participation' is nullable.
    course = models.ForeignKey(Course,
            verbose_name=_("Course"), on_delete=models.CASCADE)

    participation = models.ForeignKey(Participation, null=True, blank=True,
            db_index=True, related_name="flow_sessions",
            verbose_name=_("Participation"), on_delete=models.CASCADE)

    # This looks like it's redundant with participation, above--but it's not.
    # Again--'participation' is nullable, and it is useful to be able to
    # remember what user a session belongs to, even if they're not enrolled.
    user = models.ForeignKey(settings.AUTH_USER_MODEL, null=True, blank=True,
            verbose_name=_("User"), on_delete=models.SET_NULL)

    active_git_commit_sha = models.CharField(max_length=200,
            verbose_name=_("Active git commit SHA"))
    flow_id = models.CharField(max_length=200, db_index=True,
            verbose_name=_("Flow ID"))
    start_time = models.DateTimeField(default=now,
            verbose_name=_("Start time"))
    completion_time = models.DateTimeField(null=True, blank=True,
            verbose_name=_("Completion time"))
    page_count = models.IntegerField(null=True, blank=True,
            verbose_name=_("Page count"))

    # This field allows avoiding redundant checks for whether the
    # page data is in line with the course material and the current
    # version of RELATE.
    # See course.flow.adjust_flow_session_page_data.
    page_data_at_revision_key = models.CharField(
            max_length=200, null=True, blank=True,
            verbose_name=_("Page data at course revision"),
            help_text=_(
                "Page set-up data is up-to date for this revision of the "
                "course material"))

    in_progress = models.BooleanField(default=None,
            verbose_name=_("In progress"))
    access_rules_tag = models.CharField(max_length=200, null=True,
            blank=True,
            verbose_name=_("Access rules tag"))
    expiration_mode = models.CharField(max_length=20, null=True,
            default=flow_session_expiration_mode.end,
            choices=FLOW_SESSION_EXPIRATION_MODE_CHOICES,
            verbose_name=_("Expiration mode"))

    # Non-normal: These fields can be recomputed, albeit at great expense.
    #
    # Looking up the corresponding GradeChange is also invalid because
    # some flow sessions are not for credit and still have results.

    points = models.DecimalField(max_digits=10, decimal_places=2,
            blank=True, null=True,
            verbose_name=_("Points"))
    max_points = models.DecimalField(max_digits=10, decimal_places=2,
            blank=True, null=True,
            verbose_name=_("Max point"))
    result_comment = models.TextField(blank=True, null=True,
            verbose_name=_("Result comment"))

    class Meta:
        verbose_name = _("Flow session")
        verbose_name_plural = _("Flow sessions")
        ordering = ("course", "-start_time")

    def __unicode__(self):
        if self.participation is None:
            return _("anonymous session %(session_id)d on '%(flow_id)s'") % {
                    "session_id": self.id,
                    "flow_id": self.flow_id}
        else:
            return _("%(user)s's session %(session_id)d on '%(flow_id)s'") % {
                    "user": self.participation.user,
                    "session_id": self.id,
                    "flow_id": self.flow_id}

    __str__ = __unicode__

    def append_comment(self, s: str | None) -> None:
        if s is None:
            return

        if self.result_comment:
            self.result_comment += "\n" + s
        else:
            self.result_comment = s

    def points_percentage(self):
        if self.points is None:
            return None
        elif self.max_points:
            return 100*self.points/self.max_points
        else:
            return None

    def answer_visits(self):
        # only use this from templates
        from course.flow import assemble_answer_visits
        return assemble_answer_visits(self)

    def last_activity(self) -> datetime.datetime | None:
        for visit in (FlowPageVisit.objects
                .filter(
                    flow_session=self,
                    answer__isnull=False,
                    is_synthetic=False)
                .order_by("-visit_time")
                [:1]):
            return visit.visit_time

        return None

    def get_expiration_mode_desc(self):
        return dict(FLOW_SESSION_EXPIRATION_MODE_CHOICES).get(
                self.expiration_mode)

# }}}


# {{{ flow page data

class FlowPageData(models.Model):
    flow_session = models.ForeignKey(FlowSession, related_name="page_data",
            verbose_name=_("Flow session"), on_delete=models.CASCADE)
    page_ordinal = models.IntegerField(null=True, blank=True,
            verbose_name=_("Page ordinal"))

    # This exists to catch changing page types in course content,
    # which will generally lead to an inconsistency disaster.
    page_type = models.CharField(max_length=200,
            verbose_name=_("Page type as indicated in course content"),
            null=True, blank=True)

    group_id = models.CharField(max_length=200,
            verbose_name=_("Group ID"))
    page_id = models.CharField(max_length=200,
            verbose_name=_("Page ID"))

    data = JSONField(null=True, blank=True,
            # Show correct characters in admin for non ascii languages.
            dump_kwargs={"ensure_ascii": False},