Censor unittests on GET /forms/$id

2 files changed, 16 insertions, 0 deletions

diff --git a/backend/routes/forms/form.py b/backend/routes/forms/form.py
index e5f7ec6..deb03ae 100644
--- a/backend/routes/forms/form.py
+++ b/backend/routes/forms/form.py
@@ -10,6 +10,7 @@ from starlette.responses import JSONResponse
 
 from backend.models import Form
 from backend.route import Route
+from backend.routes.forms.unittesting import filter_unittests
 from backend.validation import ErrorMessage, OkayResponse, api
 
 
@@ -37,6 +38,8 @@ class SingleForm(Route):
 
         if raw_form := await request.state.db.forms.find_one(filters):
             form = Form(**raw_form)
+            form = filter_unittests(form)
+
             return JSONResponse(form.dict(admin=admin))
 
         return JSONResponse({"error": "not_found"}, status_code=404)
diff --git a/backend/routes/forms/unittesting.py b/backend/routes/forms/unittesting.py
index ddf0843..0cb7d8d 100644
--- a/backend/routes/forms/unittesting.py
+++ b/backend/routes/forms/unittesting.py
@@ -16,6 +16,19 @@ with open("resources/unittest_template.py") as file:
 UnittestResult = namedtuple("UnittestResult", "question_id return_code passed result")
 
 
+def filter_unittests(form: Form) -> Form:
+    """
+    Replace the unittest data section of code questions with the number of test cases.
+
+    This is used to redact the exact tests when sending the form back to the frontend.
+    """
+    for question in form.questions:
+        if question.type == "code" and "unittests" in question.data:
+            question.data["unittests"] = len(question.data["unittests"])
+
+    return form
+
+
 def _make_unit_code(units: dict[str, str]) -> str:
     result = ""