Dashboard for all teachers (own-data scoped) + fix report IDOR

chatkit/backend/app/admin.py

@@ -1,14 +1,22 @@
-"""Admin-only API: analytics dashboard, user/session management, schema info.
+"""Dashboard API.
 
-All routes require an admin teacher (see auth.get_current_admin).
+Two access levels share these routes:
+- Admins (is_admin) see ALL teachers' data and can manage users.
+- Regular teachers see ONLY their own data (their quizzes/students/results) and
+  cannot reach user-management or other teachers' records.
+
+Scoping is enforced server-side: list endpoints filter by the caller's teacher
+id, and detail endpoints verify ownership before returning anything.
 """
 
 from __future__ import annotations
 
+from typing import Optional
+
 from fastapi import APIRouter, Depends, HTTPException
 from pydantic import BaseModel
 
-from .auth import get_current_admin
+from .auth import get_current_admin, get_current_user
 from .database import (
     admin_list_sessions,
     admin_list_students,
@@ -30,13 +38,30 @@ from .storage import create_signed_url
 router = APIRouter(prefix="/api/admin", tags=["admin"])
 
 
+def _scope(user: dict) -> Optional[int]:
+    """None for admins (see everything), else the teacher id to scope to."""
+    return None if user.get("is_admin") else user["id"]
+
+
+def _owns_quiz(user: dict, quiz: dict) -> bool:
+    return user.get("is_admin") or quiz.get("teacher_id") == user["id"]
+
+
+def _owns_student(user: dict, student: dict) -> bool:
+    return user.get("is_admin") or student.get("teacher_id") == user["id"]
+
+
 @router.get("/stats")
-async def admin_stats(_admin=Depends(get_current_admin)):
-    stats = await get_stats()
-    stats["schema_version"] = await get_schema_version()
+async def dashboard_stats(user=Depends(get_current_user)):
+    stats = await get_stats(_scope(user))
+    stats["is_admin"] = bool(user.get("is_admin"))
+    if user.get("is_admin"):
+        stats["schema_version"] = await get_schema_version()
     return stats
 
 
+# ---- User management (admin only) ----
+
 @router.get("/users")
 async def admin_users(_admin=Depends(get_current_admin)):
     return {"users": await list_all_users()}
@@ -62,24 +87,24 @@ async def admin_delete_user(user_id: int, admin=Depends(get_current_admin)):
     return {"status": "deleted"}
 
 
+# ---- Sessions / quizzes (scoped) ----
+
 @router.get("/sessions")
-async def admin_sessions(_admin=Depends(get_current_admin)):
-    return {"sessions": await admin_list_sessions()}
+async def dashboard_sessions(user=Depends(get_current_user)):
+    return {"sessions": await admin_list_sessions(_scope(user))}
 
 
 @router.get("/sessions/{session_id}")
-async def admin_session_detail(session_id: int, _admin=Depends(get_current_admin)):
+async def dashboard_session_detail(session_id: int, user=Depends(get_current_user)):
     """Full quiz detail: raw files (signed URLs), structured parsed data, results."""
     quiz = await get_session(session_id)
-    if not quiz:
+    if not quiz or not _owns_quiz(user, quiz):
         raise HTTPException(status_code=404, detail="Session not found")
 
-    # Group structured parsed data by type (questions / student_answers / etc.)
     parsed = {}
     for item in await get_parsed_data(session_id):
         parsed[item["data_type"]] = item["structured_data"]
 
-    # Raw files with short-lived signed download URLs (None if Storage disabled/missing).
     raw_files = []
     for f in await get_raw_files(session_id):
         f["download_url"] = await create_signed_url(f.get("storage_path", ""))
@@ -94,21 +119,24 @@ async def admin_session_detail(session_id: int, _admin=Depends(get_current_admin
 
 
 @router.delete("/sessions/{session_id}")
-async def admin_delete_session(session_id: int, _admin=Depends(get_current_admin)):
-    if not await get_session(session_id):
+async def dashboard_delete_session(session_id: int, user=Depends(get_current_user)):
+    quiz = await get_session(session_id)
+    if not quiz or not _owns_quiz(user, quiz):
         raise HTTPException(status_code=404, detail="Session not found")
     await delete_session(session_id)
     return {"status": "deleted"}
 
 
+# ---- Students (scoped) ----
+
 @router.get("/students")
-async def admin_students(_admin=Depends(get_current_admin)):
-    return {"students": await admin_list_students()}
+async def dashboard_students(user=Depends(get_current_user)):
+    return {"students": await admin_list_students(_scope(user))}
 
 
 @router.get("/students/{student_id}")
-async def admin_student_detail(student_id: int, _admin=Depends(get_current_admin)):
+async def dashboard_student_detail(student_id: int, user=Depends(get_current_user)):
     student = await get_student(student_id)
-    if not student:
+    if not student or not _owns_student(user, student):
         raise HTTPException(status_code=404, detail="Student not found")
     return {"student": student, "timeline": await get_student_timeline(student_id)}

chatkit/backend/app/database.py

@@ -403,7 +403,10 @@ async def get_student_timeline(student_id: int) -> list[dict]:
         res = await db.execute(
             select(StudentResult, Quiz.title, Quiz.subject, Quiz.created_at)
             .join(Quiz, StudentResult.quiz_id == Quiz.id)
+            .join(Student, StudentResult.student_id == Student.id)
             .where(StudentResult.student_id == student_id)
+            # defense-in-depth: only the student's own teacher's quizzes
+            .where(Quiz.teacher_id == Student.teacher_id)
             .order_by(Quiz.created_at)
         )
         out = []
@@ -523,27 +526,57 @@ async def get_report(report_id: int) -> Optional[dict]:
 # Analytics (admin dashboard)
 # =============================================================================
 
-async def get_stats() -> dict:
-    async with get_sessionmaker()() as db:
-        async def count(model):
-            return (await db.execute(select(func.count(model.id)))).scalar_one()
-
+async def get_stats(teacher_id: Optional[int] = None) -> dict:
+    """Global stats (admin) or stats scoped to one teacher's own data."""
+    async with get_sessionmaker()() as db:
+        async def count(stmt):
+            return (await db.execute(stmt)).scalar_one()
+
+        if teacher_id is None:
+            return {
+                "teachers": await count(select(func.count(Teacher.id))),
+                "students": await count(select(func.count(Student.id))),
+                "quizzes": await count(select(func.count(Quiz.id))),
+                "reports": await count(select(func.count(Report.id))),
+                "student_results": await count(select(func.count(StudentResult.id))),
+                "prompts": await count(select(func.count(Prompt.id))),
+            }
+
+        # Scoped to one teacher: own students/quizzes/prompts directly; reports and
+        # results are owned transitively through the teacher's own quizzes.
+        own_quiz = select(Quiz.id).where(Quiz.teacher_id == teacher_id).scalar_subquery()
         return {
-            "teachers": await count(Teacher),
-            "students": await count(Student),
-            "quizzes": await count(Quiz),
-            "reports": await count(Report),
-            "student_results": await count(StudentResult),
-            "prompts": await count(Prompt),
+            "teachers": 1,
+            "students": await count(
+                select(func.count(Student.id)).where(Student.teacher_id == teacher_id)
+            ),
+            "quizzes": await count(
+                select(func.count(Quiz.id)).where(Quiz.teacher_id == teacher_id)
+            ),
+            "reports": await count(
+                select(func.count(Report.id)).where(Report.quiz_id.in_(own_quiz))
+            ),
+            "student_results": await count(
+                select(func.count(StudentResult.id)).where(StudentResult.quiz_id.in_(own_quiz))
+            ),
+            "prompts": await count(
+                select(func.count(Prompt.id)).where(Prompt.teacher_id == teacher_id)
+            ),
         }
 
 
-async def admin_list_students(limit: int = 500) -> list[dict]:
-    """All students across teachers, with quiz count + average score (admin)."""
+async def admin_list_students(teacher_id: Optional[int] = None, limit: int = 500) -> list[dict]:
+    """Students with quiz count + avg score; all teachers (admin) or one teacher's own."""
     async with get_sessionmaker()() as db:
-        res = await db.execute(
-            select(Student, Teacher.email).join(Teacher, Student.teacher_id == Teacher.id).order_by(Student.name).limit(limit)
+        stmt = (
+            select(Student, Teacher.email)
+            .join(Teacher, Student.teacher_id == Teacher.id)
+            .order_by(Student.name)
+            .limit(limit)
         )
+        if teacher_id is not None:
+            stmt = stmt.where(Student.teacher_id == teacher_id)
+        res = await db.execute(stmt)
         out = []
         for s, email in res.all():
             d = _row(s)
@@ -567,7 +600,10 @@ async def get_quiz_results(quiz_id: int) -> list[dict]:
         res = await db.execute(
             select(StudentResult, Student.name, Student.id)
             .join(Student, StudentResult.student_id == Student.id)
+            .join(Quiz, StudentResult.quiz_id == Quiz.id)
             .where(StudentResult.quiz_id == quiz_id)
+            # defense-in-depth: only students belonging to this quiz's teacher
+            .where(Student.teacher_id == Quiz.teacher_id)
             .order_by(Student.name)
         )
         out = []
@@ -596,15 +632,18 @@ async def get_schema_version() -> Optional[str]:
             return None
 
 
-async def admin_list_sessions(limit: int = 200) -> list[dict]:
-    """All quizzes across teachers, with author email + counts (admin)."""
+async def admin_list_sessions(teacher_id: Optional[int] = None, limit: int = 200) -> list[dict]:
+    """Quizzes with author email + counts; all teachers (admin) or one teacher's own."""
     async with get_sessionmaker()() as db:
-        res = await db.execute(
+        stmt = (
             select(Quiz, Teacher.email)
             .join(Teacher, Quiz.teacher_id == Teacher.id)
             .order_by(Quiz.created_at.desc())
             .limit(limit)
         )
+        if teacher_id is not None:
+            stmt = stmt.where(Quiz.teacher_id == teacher_id)
+        res = await db.execute(stmt)
         out = []
         for q, email in res.all():
             d = _row(q)

chatkit/backend/app/main.py

@@ -503,6 +503,11 @@ async def api_get_report(report_id: int, user=Depends(get_current_user)):
     report = await get_report(report_id)
     if not report:
         raise HTTPException(status_code=404, detail="Report not found")
+    # Reports have no teacher_id; enforce ownership via the parent quiz so one
+    # teacher cannot read another teacher's report by enumerating ids.
+    quiz = await get_session(report["quiz_id"])
+    if not quiz or (not user.get("is_admin") and quiz["user_id"] != user["id"]):
+        raise HTTPException(status_code=404, detail="Report not found")
     return report
 
 

chatkit/backend/tests/test_database.py

@@ -90,6 +90,32 @@ async def test_stats_counts(fresh_db):
     assert stats["student_results"] == 1
 
 
+@pytest.mark.unit
+async def test_stats_and_lists_scope_to_teacher(fresh_db):
+    # Two teachers, each with their own quiz + student + result.
+    t1 = await database.create_user("t1@example.com", "h")
+    t2 = await database.create_user("t2@example.com", "h")
+    s1 = await database.match_or_create_student(t1, "Alice")
+    s2 = await database.match_or_create_student(t2, "Bob")
+    q1 = await database.create_session(t1, "T1 Quiz")
+    q2 = await database.create_session(t2, "T2 Quiz")
+    await database.save_student_result(q1, s1, {"answers": []}, 3, 3, 100.0)
+    await database.save_student_result(q2, s2, {"answers": []}, 3, 1, 33.3)
+
+    # Global (admin) sees everything.
+    g = await database.get_stats()
+    assert g["teachers"] == 2 and g["students"] == 2 and g["quizzes"] == 2 and g["student_results"] == 2
+
+    # Scoped to t1 sees only t1's data.
+    sc = await database.get_stats(t1)
+    assert sc["students"] == 1 and sc["quizzes"] == 1 and sc["student_results"] == 1
+
+    # Scoped list endpoints filter by teacher.
+    assert {x["title"] for x in await database.admin_list_sessions(t1)} == {"T1 Quiz"}
+    assert {x["name"] for x in await database.admin_list_students(t1)} == {"Alice"}
+    assert len(await database.admin_list_sessions()) == 2  # admin sees both
+
+
 @pytest.mark.unit
 def test_score_student_grades_only_concrete_keys():
     grid = grid_from_dict(

chatkit/frontend/src/App.tsx

@@ -202,7 +202,7 @@ ${doneReports
     return <LoginForm onLogin={setUser} />;
   }
 
-  if (showAdmin && user.is_admin) {
+  if (showAdmin) {
     return (
       <div className="min-h-screen">
         <Header
@@ -213,7 +213,7 @@ ${doneReports
           onLogout={handleLogout}
         />
         <div className="pt-20">
-          <AdminDashboard />
+          <AdminDashboard isAdmin={!!user.is_admin} />
         </div>
       </div>
     );

chatkit/frontend/src/components/Header.tsx

@@ -32,7 +32,7 @@ export function Header({ userEmail, onLogout, isAdmin, showAdmin, onToggleAdmin
         </div>
 
         <div className="flex items-center gap-4">
-          {isAdmin && onToggleAdmin && (
+          {onToggleAdmin && (
             <button
               onClick={onToggleAdmin}
               className={`text-sm font-medium px-4 py-2 rounded-full border transition-colors ${
@@ -41,7 +41,7 @@ export function Header({ userEmail, onLogout, isAdmin, showAdmin, onToggleAdmin
                   : "text-[var(--color-text-muted)] border-[var(--color-border)] hover:text-[var(--color-text)]"
               }`}
             >
-              {showAdmin ? "← 返回應用" : "管理後台"}
+              {showAdmin ? "← 返回應用" : isAdmin ? "管理後台" : "我的資料"}
             </button>
           )}
           <div className="flex items-center gap-2 px-4 py-2 rounded-full bg-[var(--color-success)]/10 border border-[var(--color-success)]/20">

chatkit/frontend/src/components/admin/AdminDashboard.tsx

@@ -97,18 +97,24 @@ const TABS: { key: Tab; label: string }[] = [
   { key: "students", label: "學生" },
 ];
 
-export function AdminDashboard() {
+export function AdminDashboard({ isAdmin }: { isAdmin: boolean }) {
   const [tab, setTab] = useState<Tab>("overview");
+  // The teachers tab + user management is admin-only; teachers see only their own data.
+  const tabs = isAdmin ? TABS : TABS.filter((t) => t.key !== "teachers");
 
   return (
     <main className="max-w-6xl mx-auto px-4 pb-12">
       <div className="text-center mb-6">
-        <h2 className="font-display text-2xl font-bold text-[var(--color-text)]">管理後台</h2>
-        <p className="text-[var(--color-text-muted)] mt-1">資料庫管理與使用分析</p>
+        <h2 className="font-display text-2xl font-bold text-[var(--color-text)]">
+          {isAdmin ? "管理後台" : "我的資料中心"}
+        </h2>
+        <p className="text-[var(--color-text-muted)] mt-1">
+          {isAdmin ? "資料庫管理與使用分析" : "您自己儲存的測驗、學生與成績"}
+        </p>
       </div>
 
       <div className="flex justify-center gap-2 mb-6">
-        {TABS.map((t) => (
+        {tabs.map((t) => (
           <button
             key={t.key}
             onClick={() => setTab(t.key)}
@@ -123,9 +129,9 @@ export function AdminDashboard() {
         ))}
       </div>
 
-      {tab === "overview" && <Overview />}
-      {tab === "teachers" && <Teachers />}
-      {tab === "sessions" && <Sessions />}
+      {tab === "overview" && <Overview isAdmin={isAdmin} />}
+      {tab === "teachers" && isAdmin && <Teachers />}
+      {tab === "sessions" && <Sessions isAdmin={isAdmin} />}
       {tab === "students" && <Students />}
     </main>
   );
@@ -163,23 +169,25 @@ function StatCard({ label, value }: { label: string; value: number | string }) {
   );
 }
 
-function Overview() {
+function Overview({ isAdmin }: { isAdmin: boolean }) {
   const { data, loading, error } = useFetch<Stats>("/api/admin/stats");
   if (loading) return <Spinner />;
   if (error || !data) return <ErrorBox msg={error} />;
   return (
     <div>
       <div className="grid grid-cols-2 md:grid-cols-3 gap-4">
-        <StatCard label="教師" value={data.teachers} />
-        <StatCard label="學生" value={data.students} />
-        <StatCard label="測驗" value={data.quizzes} />
+        {isAdmin && <StatCard label="教師" value={data.teachers} />}
+        <StatCard label={isAdmin ? "學生" : "我的學生"} value={data.students} />
+        <StatCard label={isAdmin ? "測驗" : "我的測驗"} value={data.quizzes} />
         <StatCard label="已生成報告" value={data.reports} />
         <StatCard label="學生成績紀錄" value={data.student_results} />
         <StatCard label="提示詞" value={data.prompts} />
       </div>
-      <p className="text-center text-xs text-[var(--color-text-muted)] mt-6">
-        資料庫結構版本：{data.schema_version ?? "未知"}
-      </p>
+      {isAdmin && (
+        <p className="text-center text-xs text-[var(--color-text-muted)] mt-6">
+          資料庫結構版本：{data.schema_version ?? "未知"}
+        </p>
+      )}
     </div>
   );
 }
@@ -224,7 +232,7 @@ function Teachers() {
   );
 }
 
-function Sessions() {
+function Sessions({ isAdmin }: { isAdmin: boolean }) {
   const { data, loading, error, reload } = useFetch<{ sessions: SessionRow[] }>("/api/admin/sessions");
   const [detailId, setDetailId] = useState<number | null>(null);
 
@@ -240,13 +248,17 @@ function Sessions() {
     reload();
   };
 
+  const headers = isAdmin
+    ? ["標題", "科目", "教師", "狀態", "報告", "建立時間", ""]
+    : ["標題", "科目", "狀態", "報告", "建立時間", ""];
+
   return (
-    <Table headers={["標題", "科目", "教師", "狀態", "報告", "建立時間", ""]}>
+    <Table headers={headers}>
       {data.sessions.map((s) => (
         <tr key={s.id} className="border-t border-[var(--color-border)]">
           <Td>{s.title}</Td>
           <Td>{s.subject || "—"}</Td>
-          <Td>{s.teacher_email}</Td>
+          {isAdmin && <Td>{s.teacher_email}</Td>}
           <Td>{s.status}</Td>
           <Td>{s.report_count}</Td>
           <Td>{new Date(s.created_at).toLocaleDateString()}</Td>
@@ -255,9 +267,11 @@ function Sessions() {
               <button onClick={() => setDetailId(s.id)} className="text-sm underline text-[var(--color-primary)]">
                 查看詳情
               </button>
-              <button onClick={() => remove(s)} className="text-sm text-red-400 hover:underline">
-                刪除
-              </button>
+              {isAdmin && (
+                <button onClick={() => remove(s)} className="text-sm text-red-400 hover:underline">
+                  刪除
+                </button>
+              )}
             </div>
           </Td>
         </tr>