feat: refactor the entire learnhouse project

apps/api/src/services/courses/activities/activities.py

@@ -0,0 +1,250 @@
+from typing import Literal
+from pydantic import BaseModel
+from src.security.rbac.rbac import (
+    authorization_verify_based_on_roles,
+    authorization_verify_if_element_is_public,
+    authorization_verify_if_user_is_anon,
+)
+from src.services.users.schemas.users import AnonymousUser, PublicUser
+from fastapi import HTTPException, status, Request
+from uuid import uuid4
+from datetime import datetime
+
+#### Classes ####################################################
+
+
+class Activity(BaseModel):
+    name: str
+    type: str
+    content: object
+
+
+class ActivityInDB(Activity):
+    activity_id: str
+    course_id: str
+    coursechapter_id: str
+    org_id: str
+    creationDate: str
+    updateDate: str
+
+
+#### Classes ####################################################
+
+
+####################################################
+# CRUD
+####################################################
+
+
+async def create_activity(
+    request: Request,
+    activity_object: Activity,
+    org_id: str,
+    coursechapter_id: str,
+    current_user: PublicUser,
+):
+    activities = request.app.db["activities"]
+    courses = request.app.db["courses"]
+    users = request.app.db["users"]
+
+    # get user
+    user = await users.find_one({"user_id": current_user.user_id})
+
+    # generate activity_id
+    activity_id = str(f"activity_{uuid4()}")
+
+    # verify activity rights
+    await authorization_verify_based_on_roles(
+        request,
+        current_user.user_id,
+        "create",
+        user["roles"],
+        activity_id,
+    )
+
+    # get course_id from activity
+    course = await courses.find_one({"chapters": coursechapter_id})
+
+    # create activity
+    activity = ActivityInDB(
+        **activity_object.dict(),
+        creationDate=str(datetime.now()),
+        coursechapter_id=coursechapter_id,
+        updateDate=str(datetime.now()),
+        activity_id=activity_id,
+        org_id=org_id,
+        course_id=course["course_id"],
+    )
+    await activities.insert_one(activity.dict())
+
+    # update chapter
+    await courses.update_one(
+        {"chapters_content.coursechapter_id": coursechapter_id},
+        {"$addToSet": {"chapters_content.$.activities": activity_id}},
+    )
+
+    return activity
+
+
+async def get_activity(request: Request, activity_id: str, current_user: PublicUser):
+    activities = request.app.db["activities"]
+    courses = request.app.db["courses"]
+
+    activity = await activities.find_one({"activity_id": activity_id})
+
+    # get course_id from activity
+    coursechapter_id = activity["coursechapter_id"]
+    await courses.find_one({"chapters": coursechapter_id})
+
+    # verify course rights
+    await verify_rights(request, activity["course_id"], current_user, "read")
+
+    if not activity:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Course does not exist"
+        )
+
+    activity = ActivityInDB(**activity)
+    return activity
+
+
+async def update_activity(
+    request: Request,
+    activity_object: Activity,
+    activity_id: str,
+    current_user: PublicUser,
+):
+    activities = request.app.db["activities"]
+
+    activity = await activities.find_one({"activity_id": activity_id})
+
+    # verify course rights
+    await verify_rights(request, activity_id, current_user, "update")
+
+    if activity:
+        creationDate = activity["creationDate"]
+
+        # get today's date
+        datetime_object = datetime.now()
+
+        updated_course = ActivityInDB(
+            activity_id=activity_id,
+            coursechapter_id=activity["coursechapter_id"],
+            creationDate=creationDate,
+            updateDate=str(datetime_object),
+            course_id=activity["course_id"],
+            org_id=activity["org_id"],
+            **activity_object.dict(),
+        )
+
+        await activities.update_one(
+            {"activity_id": activity_id}, {"$set": updated_course.dict()}
+        )
+
+        return ActivityInDB(**updated_course.dict())
+
+    else:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="activity does not exist"
+        )
+
+
+async def delete_activity(request: Request, activity_id: str, current_user: PublicUser):
+    activities = request.app.db["activities"]
+
+    activity = await activities.find_one({"activity_id": activity_id})
+
+    # verify course rights
+    await verify_rights(request, activity_id, current_user, "delete")
+
+    if not activity:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="activity does not exist"
+        )
+
+    # Remove Activity
+    isDeleted = await activities.delete_one({"activity_id": activity_id})
+
+    # Remove Activity from chapter
+    courses = request.app.db["courses"]
+    isDeletedFromChapter = await courses.update_one(
+        {"chapters_content.activities": activity_id},
+        {"$pull": {"chapters_content.$.activities": activity_id}},
+    )
+
+    if isDeleted and isDeletedFromChapter:
+        return {"detail": "Activity deleted"}
+    else:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="Unavailable database",
+        )
+
+
+####################################################
+# Misc
+####################################################
+
+
+async def get_activities(
+    request: Request, coursechapter_id: str, current_user: PublicUser
+):
+    activities = request.app.db["activities"]
+
+    activities = activities.find({"coursechapter_id": coursechapter_id})
+
+    if not activities:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Course does not exist"
+        )
+
+    activities = [
+        ActivityInDB(**activity) for activity in await activities.to_list(length=100)
+    ]
+
+    return activities
+
+
+#### Security ####################################################
+
+
+async def verify_rights(
+    request: Request,
+    activity_id: str,  # course_id in case of read
+    current_user: PublicUser | AnonymousUser,
+    action: Literal["create", "read", "update", "delete"],
+):
+    if action == "read":
+        if current_user.user_id == "anonymous":
+            await authorization_verify_if_element_is_public(
+                request, activity_id, current_user.user_id, action
+            )
+        else:
+            users = request.app.db["users"]
+            user = await users.find_one({"user_id": current_user.user_id})
+
+            await authorization_verify_if_user_is_anon(current_user.user_id)
+
+            await authorization_verify_based_on_roles(
+                request,
+                current_user.user_id,
+                action,
+                user["roles"],
+                activity_id,
+            )
+    else:
+        users = request.app.db["users"]
+        user = await users.find_one({"user_id": current_user.user_id})
+
+        await authorization_verify_if_user_is_anon(current_user.user_id)
+
+        await authorization_verify_based_on_roles(
+            request,
+            current_user.user_id,
+            action,
+            user["roles"],
+            activity_id,
+        )
+
+
+#### Security ####################################################

apps/api/src/services/courses/activities/pdf.py

@@ -0,0 +1,95 @@
+from src.security.rbac.rbac import authorization_verify_based_on_roles
+from src.services.courses.activities.uploads.pdfs import upload_pdf
+from src.services.users.users import PublicUser
+from src.services.courses.activities.activities import ActivityInDB
+from fastapi import HTTPException, status, UploadFile, Request
+from uuid import uuid4
+from datetime import datetime
+
+
+async def create_documentpdf_activity(
+    request: Request,
+    name: str,
+    coursechapter_id: str,
+    current_user: PublicUser,
+    pdf_file: UploadFile | None = None,
+):
+    activities = request.app.db["activities"]
+    courses = request.app.db["courses"]
+    users = request.app.db["users"]
+
+    # get user
+    user = await users.find_one({"user_id": current_user.user_id})
+
+    # generate activity_id
+    activity_id = str(f"activity_{uuid4()}")
+
+    # get org_id from course
+    coursechapter = await courses.find_one(
+        {"chapters_content.coursechapter_id": coursechapter_id}
+    )
+
+    org_id = coursechapter["org_id"]
+
+    # check if pdf_file is not None
+    if not pdf_file:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Pdf : No pdf file provided"
+        )
+
+    if pdf_file.content_type not in ["application/pdf"]:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Pdf : Wrong pdf format"
+        )
+
+    # get pdf format
+    if pdf_file.filename:
+        pdf_format = pdf_file.filename.split(".")[-1]
+
+    else:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Pdf : No pdf file provided"
+        )
+
+    activity_object = ActivityInDB(
+        org_id=org_id,
+        activity_id=activity_id,
+        coursechapter_id=coursechapter_id,
+        name=name,
+        type="documentpdf",
+        course_id=coursechapter["course_id"],
+        content={
+            "documentpdf": {
+                "filename": "documentpdf." + pdf_format,
+                "activity_id": activity_id,
+            }
+        },
+        creationDate=str(datetime.now()),
+        updateDate=str(datetime.now()),
+    )
+
+    await authorization_verify_based_on_roles(
+        request,
+        current_user.user_id,
+        "create",
+        user["roles"],
+        activity_id,
+    )
+
+    # create activity
+    activity = ActivityInDB(**activity_object.dict())
+    await activities.insert_one(activity.dict())
+
+    # upload pdf
+    if pdf_file:
+        # get pdffile format
+        await upload_pdf(pdf_file, activity_id, org_id, coursechapter["course_id"])
+
+    # todo : choose whether to update the chapter or not
+    # update chapter
+    await courses.update_one(
+        {"chapters_content.coursechapter_id": coursechapter_id},
+        {"$addToSet": {"chapters_content.$.activities": activity_id}},
+    )
+
+    return activity

apps/api/src/services/courses/activities/uploads/pdfs.py

@@ -0,0 +1,18 @@
+
+from src.services.utils.upload_content import upload_content
+
+
+async def upload_pdf(pdf_file, activity_id, org_id, course_id):
+    contents = pdf_file.file.read()
+    pdf_format = pdf_file.filename.split(".")[-1]
+
+    try:
+        await upload_content(
+            f"courses/{course_id}/activities/{activity_id}/documentpdf",
+            org_id,
+            contents,
+            f"documentpdf.{pdf_format}",
+        )
+
+    except Exception:
+        return {"message": "There was an error uploading the file"}

apps/api/src/services/courses/activities/uploads/videos.py

@@ -0,0 +1,18 @@
+
+from src.services.utils.upload_content import upload_content
+
+
+async def upload_video(video_file, activity_id, org_id, course_id):
+    contents = video_file.file.read()
+    video_format = video_file.filename.split(".")[-1]
+
+    try:
+        await upload_content(
+            f"courses/{course_id}/activities/{activity_id}/video",
+            org_id,
+            contents,
+            f"video.{video_format}",
+        )
+
+    except Exception:
+        return {"message": "There was an error uploading the file"}

apps/api/src/services/courses/activities/video.py

@@ -0,0 +1,187 @@
+from typing import Literal
+
+from pydantic import BaseModel
+from src.security.rbac.rbac import (
+    authorization_verify_based_on_roles,
+)
+from src.services.courses.activities.uploads.videos import upload_video
+from src.services.users.users import PublicUser
+from src.services.courses.activities.activities import ActivityInDB
+from fastapi import HTTPException, status, UploadFile, Request
+from uuid import uuid4
+from datetime import datetime
+
+
+async def create_video_activity(
+    request: Request,
+    name: str,
+    coursechapter_id: str,
+    current_user: PublicUser,
+    video_file: UploadFile | None = None,
+):
+    activities = request.app.db["activities"]
+    courses = request.app.db["courses"]
+    users = request.app.db["users"]
+
+    # get user
+    user = await users.find_one({"user_id": current_user.user_id})
+
+    # generate activity_id
+    activity_id = str(f"activity_{uuid4()}")
+
+    # get org_id from course
+    coursechapter = await courses.find_one(
+        {"chapters_content.coursechapter_id": coursechapter_id}
+    )
+
+    if not coursechapter:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="CourseChapter : No coursechapter found",
+        )
+
+    org_id = coursechapter["org_id"]
+
+    # check if video_file is not None
+    if not video_file:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="Video : No video file provided",
+        )
+
+    if video_file.content_type not in ["video/mp4", "video/webm"]:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Video : Wrong video format"
+        )
+
+    # get video format
+    if video_file.filename:
+        video_format = video_file.filename.split(".")[-1]
+
+    else:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="Video : No video file provided",
+        )
+
+    activity_object = ActivityInDB(
+        org_id=org_id,
+        activity_id=activity_id,
+        coursechapter_id=coursechapter_id,
+        course_id=coursechapter["course_id"],
+        name=name,
+        type="video",
+        content={
+            "video": {
+                "filename": "video." + video_format,
+                "activity_id": activity_id,
+            }
+        },
+        creationDate=str(datetime.now()),
+        updateDate=str(datetime.now()),
+    )
+
+    await authorization_verify_based_on_roles(
+        request,
+        current_user.user_id,
+        "create",
+        user["roles"],
+        activity_id,
+    )
+
+    # create activity
+    activity = ActivityInDB(**activity_object.dict())
+    await activities.insert_one(activity.dict())
+
+    # upload video
+    if video_file:
+        # get videofile format
+        await upload_video(video_file, activity_id, org_id, coursechapter["course_id"])
+
+    # todo : choose whether to update the chapter or not
+    # update chapter
+    await courses.update_one(
+        {"chapters_content.coursechapter_id": coursechapter_id},
+        {"$addToSet": {"chapters_content.$.activities": activity_id}},
+    )
+
+    return activity
+
+
+class ExternalVideo(BaseModel):
+    name: str
+    uri: str
+    type: Literal["youtube", "vimeo"]
+    coursechapter_id: str
+
+
+class ExternalVideoInDB(BaseModel):
+    activity_id: str
+
+
+async def create_external_video_activity(
+    request: Request,
+    current_user: PublicUser,
+    data: ExternalVideo,
+):
+    activities = request.app.db["activities"]
+    courses = request.app.db["courses"]
+    users = request.app.db["users"]
+
+    # get user
+    user = await users.find_one({"user_id": current_user.user_id})
+
+    # generate activity_id
+    activity_id = str(f"activity_{uuid4()}")
+
+    # get org_id from course
+    coursechapter = await courses.find_one(
+        {"chapters_content.coursechapter_id": data.coursechapter_id}
+    )
+
+    if not coursechapter:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="CourseChapter : No coursechapter found",
+        )
+
+    org_id = coursechapter["org_id"]
+
+    activity_object = ActivityInDB(
+        org_id=org_id,
+        activity_id=activity_id,
+        coursechapter_id=data.coursechapter_id,
+        name=data.name,
+        type="video",
+        content={
+            "external_video": {
+                "uri": data.uri,
+                "activity_id": activity_id,
+                "type": data.type,
+            }
+        },
+        course_id=coursechapter["course_id"],
+        creationDate=str(datetime.now()),
+        updateDate=str(datetime.now()),
+    )
+
+    await authorization_verify_based_on_roles(
+        request,
+        current_user.user_id,
+        "create",
+        user["roles"],
+        activity_id,
+    )
+
+    # create activity
+    activity = ActivityInDB(**activity_object.dict())
+    await activities.insert_one(activity.dict())
+
+    # todo : choose whether to update the chapter or not
+    # update chapter
+    await courses.update_one(
+        {"chapters_content.coursechapter_id": data.coursechapter_id},
+        {"$addToSet": {"chapters_content.$.activities": activity_id}},
+    )
+
+    return activity

apps/api/src/services/courses/chapters.py

@@ -0,0 +1,367 @@
+from datetime import datetime
+from typing import List, Literal
+from uuid import uuid4
+from pydantic import BaseModel
+from src.security.auth import non_public_endpoint
+from src.security.rbac.rbac import (
+    authorization_verify_based_on_roles,
+    authorization_verify_based_on_roles_and_authorship,
+    authorization_verify_if_element_is_public,
+    authorization_verify_if_user_is_anon,
+)
+from src.services.courses.courses import Course
+from src.services.courses.activities.activities import ActivityInDB
+from src.services.users.users import PublicUser
+from fastapi import HTTPException, status, Request
+
+
+class CourseChapter(BaseModel):
+    name: str
+    description: str
+    activities: list
+
+
+class CourseChapterInDB(CourseChapter):
+    coursechapter_id: str
+    course_id: str
+    creationDate: str
+    updateDate: str
+
+
+# Frontend
+class CourseChapterMetaData(BaseModel):
+    chapterOrder: List[str]
+    chapters: dict
+    activities: object
+
+
+#### Classes ####################################################
+
+####################################################
+# CRUD
+####################################################
+
+
+async def create_coursechapter(
+    request: Request,
+    coursechapter_object: CourseChapter,
+    course_id: str,
+    current_user: PublicUser,
+):
+    courses = request.app.db["courses"]
+    users = request.app.db["users"]
+    # get course org_id and verify rights
+    await courses.find_one({"course_id": course_id})
+    user = await users.find_one({"user_id": current_user.user_id})
+
+    # generate coursechapter_id with uuid4
+    coursechapter_id = str(f"coursechapter_{uuid4()}")
+
+    hasRoleRights = await authorization_verify_based_on_roles(
+        request, current_user.user_id, "create", user["roles"], course_id
+    )
+
+    if not hasRoleRights:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="Roles : Insufficient rights to perform this action",
+        )
+
+    coursechapter = CourseChapterInDB(
+        coursechapter_id=coursechapter_id,
+        creationDate=str(datetime.now()),
+        updateDate=str(datetime.now()),
+        course_id=course_id,
+        **coursechapter_object.dict(),
+    )
+
+    courses.update_one(
+        {"course_id": course_id},
+        {
+            "$addToSet": {
+                "chapters": coursechapter_id,
+                "chapters_content": coursechapter.dict(),
+            }
+        },
+    )
+
+    return coursechapter.dict()
+
+
+async def get_coursechapter(
+    request: Request, coursechapter_id: str, current_user: PublicUser
+):
+    courses = request.app.db["courses"]
+
+    coursechapter = await courses.find_one(
+        {"chapters_content.coursechapter_id": coursechapter_id}
+    )
+
+    if coursechapter:
+        # verify course rights
+        await verify_rights(request, coursechapter["course_id"], current_user, "read")
+        coursechapter = CourseChapter(**coursechapter)
+
+        return coursechapter
+
+    else:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="CourseChapter does not exist"
+        )
+
+
+async def update_coursechapter(
+    request: Request,
+    coursechapter_object: CourseChapter,
+    coursechapter_id: str,
+    current_user: PublicUser,
+):
+    courses = request.app.db["courses"]
+
+    coursechapter = await courses.find_one(
+        {"chapters_content.coursechapter_id": coursechapter_id}
+    )
+
+    if coursechapter:
+        # verify course rights
+        await verify_rights(request, coursechapter["course_id"], current_user, "update")
+
+        coursechapter = CourseChapterInDB(
+            coursechapter_id=coursechapter_id,
+            creationDate=str(datetime.now()),
+            updateDate=str(datetime.now()),
+            course_id=coursechapter["course_id"],
+            **coursechapter_object.dict(),
+        )
+
+        courses.update_one(
+            {"chapters_content.coursechapter_id": coursechapter_id},
+            {"$set": {"chapters_content.$": coursechapter.dict()}},
+        )
+
+        return coursechapter
+
+    else:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Coursechapter does not exist"
+        )
+
+
+async def delete_coursechapter(
+    request: Request, coursechapter_id: str, current_user: PublicUser
+):
+    courses = request.app.db["courses"]
+
+    course = await courses.find_one(
+        {"chapters_content.coursechapter_id": coursechapter_id}
+    )
+
+    if course:
+        # verify course rights
+        await verify_rights(request, course["course_id"], current_user, "delete")
+
+        # Remove coursechapter from course
+        await courses.update_one(
+            {"course_id": course["course_id"]},
+            {"$pull": {"chapters": coursechapter_id}},
+        )
+
+        await courses.update_one(
+            {"chapters_content.coursechapter_id": coursechapter_id},
+            {"$pull": {"chapters_content": {"coursechapter_id": coursechapter_id}}},
+        )
+
+        return {"message": "Coursechapter deleted"}
+
+    else:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Course does not exist"
+        )
+
+
+####################################################
+# Misc
+####################################################
+
+
+async def get_coursechapters(
+    request: Request, course_id: str, page: int = 1, limit: int = 10
+):
+    courses = request.app.db["courses"]
+
+    course = await courses.find_one({"course_id": course_id})
+
+    if course:
+        course = Course(**course)
+        coursechapters = course.chapters_content
+
+        return coursechapters
+
+
+async def get_coursechapters_meta(
+    request: Request, course_id: str, current_user: PublicUser
+):
+    courses = request.app.db["courses"]
+    activities = request.app.db["activities"]
+
+    await non_public_endpoint(current_user)
+
+    await verify_rights(request, course_id, current_user, "read")
+
+    coursechapters = await courses.find_one(
+        {"course_id": course_id}, {"chapters": 1, "chapters_content": 1, "_id": 0}
+    )
+
+    coursechapters = coursechapters
+
+    if not coursechapters:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Course does not exist"
+        )
+
+    # activities
+    coursechapter_activityIds_global = []
+
+    # chapters
+    chapters = {}
+    if coursechapters["chapters_content"]:
+        for coursechapter in coursechapters["chapters_content"]:
+            coursechapter = CourseChapterInDB(**coursechapter)
+            coursechapter_activityIds = []
+
+            for activity in coursechapter.activities:
+                coursechapter_activityIds.append(activity)
+                coursechapter_activityIds_global.append(activity)
+
+            chapters[coursechapter.coursechapter_id] = {
+                "id": coursechapter.coursechapter_id,
+                "name": coursechapter.name,
+                "activityIds": coursechapter_activityIds,
+            }
+
+    # activities
+    activities_list = {}
+    for activity in await activities.find(
+        {"activity_id": {"$in": coursechapter_activityIds_global}}
+    ).to_list(length=100):
+        activity = ActivityInDB(**activity)
+        activities_list[activity.activity_id] = {
+            "id": activity.activity_id,
+            "name": activity.name,
+            "type": activity.type,
+            "content": activity.content,
+        }
+
+    final = {
+        "chapters": chapters,
+        "chapterOrder": coursechapters["chapters"],
+        "activities": activities_list,
+    }
+
+    return final
+
+
+async def update_coursechapters_meta(
+    request: Request,
+    course_id: str,
+    coursechapters_metadata: CourseChapterMetaData,
+    current_user: PublicUser,
+):
+    courses = request.app.db["courses"]
+
+    await verify_rights(request, course_id, current_user, "update")
+
+    # update chapters in course
+    await courses.update_one(
+        {"course_id": course_id},
+        {"$set": {"chapters": coursechapters_metadata.chapterOrder}},
+    )
+
+    if coursechapters_metadata.chapters is not None:
+        for (
+            coursechapter_id,
+            chapter_metadata,
+        ) in coursechapters_metadata.chapters.items():
+            filter_query = {"chapters_content.coursechapter_id": coursechapter_id}
+            update_query = {
+                "$set": {
+                    "chapters_content.$.activities": chapter_metadata["activityIds"]
+                }
+            }
+            result = await courses.update_one(filter_query, update_query)
+            if result.matched_count == 0:
+                # handle error when no documents are matched by the filter query
+                print(f"No documents found for course chapter ID {coursechapter_id}")
+
+    # update activities in coursechapters
+    activity = request.app.db["activities"]
+    if coursechapters_metadata.chapters is not None:
+        for (
+            coursechapter_id,
+            chapter_metadata,
+        ) in coursechapters_metadata.chapters.items():
+            # Update coursechapter_id in activities
+            filter_query = {"activity_id": {"$in": chapter_metadata["activityIds"]}}
+            update_query = {"$set": {"coursechapter_id": coursechapter_id}}
+
+            result = await activity.update_many(filter_query, update_query)
+            if result.matched_count == 0:
+                # handle error when no documents are matched by the filter query
+                print(f"No documents found for course chapter ID {coursechapter_id}")
+
+    return {"detail": "coursechapters metadata updated"}
+
+
+#### Security ####################################################
+
+
+async def verify_rights(
+    request: Request,
+    course_id: str,
+    current_user: PublicUser,
+    action: Literal["read", "update", "delete"],
+):
+    courses = request.app.db["courses"]
+    users = request.app.db["users"]
+    user = await users.find_one({"user_id": current_user.user_id})
+    course = await courses.find_one({"course_id": course_id})
+
+    if not course:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Course does not exist"
+        )
+
+    if action == "read":
+        if current_user.user_id == "anonymous":
+            await authorization_verify_if_element_is_public(
+                request, course_id, current_user.user_id, action
+            )
+        else:
+            users = request.app.db["users"]
+            user = await users.find_one({"user_id": current_user.user_id})
+
+            await authorization_verify_if_user_is_anon(current_user.user_id)
+
+            await authorization_verify_based_on_roles_and_authorship(
+                request,
+                current_user.user_id,
+                action,
+                user["roles"],
+                course_id,
+            )
+    else:
+        users = request.app.db["users"]
+        user = await users.find_one({"user_id": current_user.user_id})
+
+        await authorization_verify_if_user_is_anon(current_user.user_id)
+
+        await authorization_verify_based_on_roles_and_authorship(
+            request,
+            current_user.user_id,
+            action,
+            user["roles"],
+            course_id,
+        )
+
+
+#### Security ####################################################

apps/api/src/services/courses/collections.py

@@ -0,0 +1,242 @@
+from typing import List, Literal
+from uuid import uuid4
+from pydantic import BaseModel
+from src.security.rbac.rbac import authorization_verify_based_on_roles_and_authorship, authorization_verify_if_user_is_anon
+from src.services.users.users import PublicUser
+from fastapi import HTTPException, status, Request
+
+#### Classes ####################################################
+
+
+class Collection(BaseModel):
+    name: str
+    description: str
+    courses: List[str]  # course_id
+    public: bool
+    org_id: str  # org_id
+
+
+class CollectionInDB(Collection):
+    collection_id: str
+    authors: List[str]  # user_id
+
+
+#### Classes ####################################################
+
+####################################################
+# CRUD
+####################################################
+
+
+async def get_collection(
+    request: Request, collection_id: str, current_user: PublicUser
+):
+    collections = request.app.db["collections"]
+
+    collection = await collections.find_one({"collection_id": collection_id})
+
+    # verify collection rights
+    await verify_collection_rights(
+        request, collection_id, current_user, "read", collection["org_id"]
+    )
+
+    if not collection:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Collection does not exist"
+        )
+
+    collection = Collection(**collection)
+
+    # add courses to collection
+    courses = request.app.db["courses"]
+    courseids = [course for course in collection.courses]
+
+    collection.courses = []
+    collection.courses = courses.find({"course_id": {"$in": courseids}}, {"_id": 0})
+
+    collection.courses = [
+        course for course in await collection.courses.to_list(length=100)
+    ]
+
+    return collection
+
+
+async def create_collection(
+    request: Request, collection_object: Collection, current_user: PublicUser
+):
+    collections = request.app.db["collections"]
+
+    # find if collection already exists using name
+    isCollectionNameAvailable = await collections.find_one(
+        {"name": collection_object.name}
+    )
+
+    # TODO
+    # await verify_collection_rights("*", current_user, "create")
+
+    if isCollectionNameAvailable:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="Collection name already exists",
+        )
+
+    # generate collection_id with uuid4
+    collection_id = str(f"collection_{uuid4()}")
+
+    collection = CollectionInDB(
+        collection_id=collection_id,
+        authors=[current_user.user_id],
+        **collection_object.dict(),
+    )
+
+    collection_in_db = await collections.insert_one(collection.dict())
+
+    if not collection_in_db:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="Unavailable database",
+        )
+
+    return collection.dict()
+
+
+async def update_collection(
+    request: Request,
+    collection_object: Collection,
+    collection_id: str,
+    current_user: PublicUser,
+):
+    # verify collection rights
+
+    collections = request.app.db["collections"]
+
+    collection = await collections.find_one({"collection_id": collection_id})
+
+    await verify_collection_rights(
+        request, collection_id, current_user, "update", collection["org_id"]
+    )
+
+    if not collection:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Collection does not exist"
+        )
+
+    updated_collection = CollectionInDB(
+        collection_id=collection_id, **collection_object.dict()
+    )
+
+    await collections.update_one(
+        {"collection_id": collection_id}, {"$set": updated_collection.dict()}
+    )
+
+    return Collection(**updated_collection.dict())
+
+
+async def delete_collection(
+    request: Request, collection_id: str, current_user: PublicUser
+):
+    collections = request.app.db["collections"]
+
+    collection = await collections.find_one({"collection_id": collection_id})
+
+    await verify_collection_rights(
+        request, collection_id, current_user, "delete", collection["org_id"]
+    )
+
+    if not collection:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Collection does not exist"
+        )
+
+    isDeleted = await collections.delete_one({"collection_id": collection_id})
+
+    if isDeleted:
+        return {"detail": "collection deleted"}
+    else:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="Unavailable database",
+        )
+
+
+####################################################
+# Misc
+####################################################
+
+
+async def get_collections(
+    request: Request,
+    org_id: str,
+    current_user: PublicUser,
+    page: int = 1,
+    limit: int = 10,
+):
+    collections = request.app.db["collections"]
+
+
+    if current_user.user_id == "anonymous":
+        all_collections = collections.find(
+            {"org_id": org_id, "public": True}, {"_id": 0}
+        )
+    else:
+        # get all collections from database without ObjectId
+        all_collections = (
+            collections.find({"org_id": org_id})
+            .sort("name", 1)
+            .skip(10 * (page - 1))
+            .limit(limit)
+        )
+
+    # create list of collections and include courses in each collection
+    collections_list = []
+    for collection in await all_collections.to_list(length=100):
+        collection = CollectionInDB(**collection)
+        collections_list.append(collection)
+
+        collection_courses = [course for course in collection.courses]
+        # add courses to collection
+        courses = request.app.db["courses"]
+        collection.courses = []
+        collection.courses = courses.find(
+            {"course_id": {"$in": collection_courses}}, {"_id": 0}
+        )
+
+        collection.courses = [
+            course for course in await collection.courses.to_list(length=100)
+        ]
+
+    return collections_list
+
+
+#### Security ####################################################
+
+
+async def verify_collection_rights(
+    request: Request,
+    collection_id: str,
+    current_user: PublicUser,
+    action: Literal["create", "read", "update", "delete"],
+    org_id: str,
+):
+    collections = request.app.db["collections"]
+    users = request.app.db["users"]
+    user = await users.find_one({"user_id": current_user.user_id})
+    collection = await collections.find_one({"collection_id": collection_id})
+
+    if not collection and action != "create" and collection_id != "*":
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Collection does not exist"
+        )
+
+    # Collections are public by default for now
+    if current_user.user_id == "anonymous" and action == "read":
+        return True
+
+    await authorization_verify_if_user_is_anon(current_user.user_id)
+
+    await authorization_verify_based_on_roles_and_authorship(
+        request, current_user.user_id, action, user["roles"], collection_id
+    )
+
+
+#### Security ####################################################

apps/api/src/services/courses/courses.py

@@ -0,0 +1,413 @@
+import json
+from typing import List, Literal, Optional
+from uuid import uuid4
+from pydantic import BaseModel
+from src.security.rbac.rbac import (
+    authorization_verify_based_on_roles,
+    authorization_verify_based_on_roles_and_authorship,
+    authorization_verify_if_element_is_public,
+    authorization_verify_if_user_is_anon,
+)
+from src.services.courses.activities.activities import ActivityInDB
+from src.services.courses.thumbnails import upload_thumbnail
+from src.services.users.schemas.users import AnonymousUser
+from src.services.users.users import PublicUser
+from fastapi import HTTPException, Request, status, UploadFile
+from datetime import datetime
+
+#### Classes ####################################################
+
+
+class Course(BaseModel):
+    name: str
+    mini_description: str
+    description: str
+    learnings: List[str]
+    thumbnail: str
+    public: bool
+    chapters: List[str]
+    chapters_content: Optional[List]
+    org_id: str
+
+
+class CourseInDB(Course):
+    course_id: str
+    creationDate: str
+    updateDate: str
+    authors: List[str]
+
+
+# TODO : wow terrible, fix this
+# those models need to be available only in the chapters service
+class CourseChapter(BaseModel):
+    name: str
+    description: str
+    activities: list
+
+
+class CourseChapterInDB(CourseChapter):
+    coursechapter_id: str
+    course_id: str
+    creationDate: str
+    updateDate: str
+
+
+#### Classes ####################################################
+
+# TODO : Add courses photo & cover upload and delete
+
+
+####################################################
+# CRUD
+####################################################
+
+
+async def get_course(request: Request, course_id: str, current_user: PublicUser):
+    courses = request.app.db["courses"]
+
+    course = await courses.find_one({"course_id": course_id})
+
+    # verify course rights
+    await verify_rights(request, course_id, current_user, "read")
+
+    if not course:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Course does not exist"
+        )
+
+    course = Course(**course)
+    return course
+
+
+async def get_course_meta(request: Request, course_id: str, current_user: PublicUser):
+    courses = request.app.db["courses"]
+    trails = request.app.db["trails"]
+
+    course = await courses.find_one({"course_id": course_id})
+    activities = request.app.db["activities"]
+
+    # verify course rights
+    await verify_rights(request, course_id, current_user, "read")
+
+    if not course:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Course does not exist"
+        )
+
+    coursechapters = await courses.find_one(
+        {"course_id": course_id}, {"chapters_content": 1, "_id": 0}
+    )
+
+    # activities
+    coursechapter_activityIds_global = []
+
+    # chapters
+    chapters = {}
+    if coursechapters["chapters_content"]:
+        for coursechapter in coursechapters["chapters_content"]:
+            coursechapter = CourseChapterInDB(**coursechapter)
+            coursechapter_activityIds = []
+
+            for activity in coursechapter.activities:
+                coursechapter_activityIds.append(activity)
+                coursechapter_activityIds_global.append(activity)
+
+            chapters[coursechapter.coursechapter_id] = {
+                "id": coursechapter.coursechapter_id,
+                "name": coursechapter.name,
+                "activityIds": coursechapter_activityIds,
+            }
+
+    # activities
+    activities_list = {}
+    for activity in await activities.find(
+        {"activity_id": {"$in": coursechapter_activityIds_global}}
+    ).to_list(length=100):
+        activity = ActivityInDB(**activity)
+        activities_list[activity.activity_id] = {
+            "id": activity.activity_id,
+            "name": activity.name,
+            "type": activity.type,
+            "content": activity.content,
+        }
+
+    chapters_list_with_activities = []
+    for chapter in chapters:
+        chapters_list_with_activities.append(
+            {
+                "id": chapters[chapter]["id"],
+                "name": chapters[chapter]["name"],
+                "activities": [
+                    activities_list[activity]
+                    for activity in chapters[chapter]["activityIds"]
+                ],
+            }
+        )
+    course = CourseInDB(**course)
+
+    # Get activity by user
+    trail = await trails.find_one(
+        {"courses.course_id": course_id, "user_id": current_user.user_id}
+    )
+    if trail:
+        # get only the course where course_id == course_id
+        trail_course = next(
+            (course for course in trail["courses"] if course["course_id"] == course_id),
+            None,
+        )
+    else:
+        trail_course = ""
+
+    return {
+        "course": course,
+        "chapters": chapters_list_with_activities,
+        "trail": trail_course,
+    }
+
+
+async def create_course(
+    request: Request,
+    course_object: Course,
+    org_id: str,
+    current_user: PublicUser,
+    thumbnail_file: UploadFile | None = None,
+):
+    courses = request.app.db["courses"]
+    users = request.app.db["users"]
+    user = await users.find_one({"user_id": current_user.user_id})
+
+    # generate course_id with uuid4
+    course_id = str(f"course_{uuid4()}")
+
+    # TODO(fix) : the implementation here is clearly not the best one (this entire function)
+    course_object.org_id = org_id
+    course_object.chapters_content = []
+
+    await authorization_verify_based_on_roles(
+        request,
+        current_user.user_id,
+        "create",
+        user["roles"],
+        course_id,
+    )
+
+
+    if thumbnail_file and thumbnail_file.filename:
+        name_in_disk = (
+            f"{course_id}_thumbnail_{uuid4()}.{thumbnail_file.filename.split('.')[-1]}"
+        )
+        await upload_thumbnail(
+            thumbnail_file, name_in_disk, course_object.org_id, course_id
+        )
+        course_object.thumbnail = name_in_disk
+
+    course = CourseInDB(
+        course_id=course_id,
+        authors=[current_user.user_id],
+        creationDate=str(datetime.now()),
+        updateDate=str(datetime.now()),
+        **course_object.dict(),
+    )
+
+    course_in_db = await courses.insert_one(course.dict())
+
+    if not course_in_db:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="Unavailable database",
+        )
+
+    return course.dict()
+
+
+async def update_course_thumbnail(
+    request: Request,
+    course_id: str,
+    current_user: PublicUser,
+    thumbnail_file: UploadFile | None = None,
+):
+    courses = request.app.db["courses"]
+
+    course = await courses.find_one({"course_id": course_id})
+
+    # verify course rights
+    await verify_rights(request, course_id, current_user, "update")
+
+    # TODO(fix) : the implementation here is clearly not the best one
+    if course:
+        creationDate = course["creationDate"]
+        authors = course["authors"]
+        if thumbnail_file and thumbnail_file.filename:
+            name_in_disk = f"{course_id}_thumbnail_{uuid4()}.{thumbnail_file.filename.split('.')[-1]}"
+            course = Course(**course).copy(update={"thumbnail": name_in_disk})
+            await upload_thumbnail(
+                thumbnail_file, name_in_disk, course.org_id, course_id
+            )
+
+            updated_course = CourseInDB(
+                course_id=course_id,
+                creationDate=creationDate,
+                authors=authors,
+                updateDate=str(datetime.now()),
+                **course.dict(),
+            )
+
+            await courses.update_one(
+                {"course_id": course_id}, {"$set": updated_course.dict()}
+            )
+
+            return CourseInDB(**updated_course.dict())
+
+    else:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Course does not exist"
+        )
+
+
+async def update_course(
+    request: Request, course_object: Course, course_id: str, current_user: PublicUser
+):
+    courses = request.app.db["courses"]
+
+    course = await courses.find_one({"course_id": course_id})
+
+    # verify course rights
+    await verify_rights(request, course_id, current_user, "update")
+
+    if course:
+        creationDate = course["creationDate"]
+        authors = course["authors"]
+
+        # get today's date
+        datetime_object = datetime.now()
+
+        updated_course = CourseInDB(
+            course_id=course_id,
+            creationDate=creationDate,
+            authors=authors,
+            updateDate=str(datetime_object),
+            **course_object.dict(),
+        )
+
+        await courses.update_one(
+            {"course_id": course_id}, {"$set": updated_course.dict()}
+        )
+
+        return CourseInDB(**updated_course.dict())
+
+    else:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Course does not exist"
+        )
+
+
+async def delete_course(request: Request, course_id: str, current_user: PublicUser):
+    courses = request.app.db["courses"]
+
+    course = await courses.find_one({"course_id": course_id})
+
+    # verify course rights
+    await verify_rights(request, course_id, current_user, "delete")
+
+    if not course:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Course does not exist"
+        )
+
+    isDeleted = await courses.delete_one({"course_id": course_id})
+
+    if isDeleted:
+        return {"detail": "Course deleted"}
+    else:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="Unavailable database",
+        )
+
+
+####################################################
+# Misc
+####################################################
+
+
+async def get_courses_orgslug(
+    request: Request,
+    current_user: PublicUser,
+    page: int = 1,
+    limit: int = 10,
+    org_slug: str | None = None,
+):
+    courses = request.app.db["courses"]
+    orgs = request.app.db["organizations"]
+
+    # get org_id from slug
+    org = await orgs.find_one({"slug": org_slug})
+
+    if not org:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT, detail="Organization does not exist"
+        )
+
+    # show only public courses if user is not logged in
+    if current_user.user_id == "anonymous":
+        all_courses = (
+            courses.find({"org_id": org["org_id"], "public": True})
+            .sort("name", 1)
+            .skip(10 * (page - 1))
+            .limit(limit)
+        )
+    else:
+        all_courses = (
+            courses.find({"org_id": org["org_id"]})
+            .sort("name", 1)
+            .skip(10 * (page - 1))
+            .limit(limit)
+        )
+
+    return [
+        json.loads(json.dumps(course, default=str))
+        for course in await all_courses.to_list(length=100)
+    ]
+
+
+#### Security ####################################################
+
+
+async def verify_rights(
+    request: Request,
+    course_id: str,
+    current_user: PublicUser | AnonymousUser,
+    action: Literal["create", "read", "update", "delete"],
+):
+    if action == "read":
+        if current_user.user_id == "anonymous":
+            await authorization_verify_if_element_is_public(
+                request, course_id, current_user.user_id, action
+            )
+        else:
+            users = request.app.db["users"]
+            user = await users.find_one({"user_id": current_user.user_id})
+
+            await authorization_verify_based_on_roles_and_authorship(
+                request,
+                current_user.user_id,
+                action,
+                user["roles"],
+                course_id,
+            )
+    else:
+        users = request.app.db["users"]
+        user = await users.find_one({"user_id": current_user.user_id})
+
+        await authorization_verify_if_user_is_anon(current_user.user_id)
+
+        await authorization_verify_based_on_roles_and_authorship(
+            request,
+            current_user.user_id,
+            action,
+            user["roles"],
+            course_id,
+        )
+
+
+#### Security ####################################################

apps/api/src/services/courses/thumbnails.py

@@ -0,0 +1,16 @@
+
+from src.services.utils.upload_content import upload_content
+
+
+async def upload_thumbnail(thumbnail_file, name_in_disk, org_id, course_id):
+    contents = thumbnail_file.file.read()
+    try:
+        await upload_content(
+            f"courses/{course_id}/thumbnails",
+            org_id,
+            contents,
+            f"{name_in_disk}",
+        )
+
+    except Exception:
+        return {"message": "There was an error uploading the file"}