QUIZ_AUTHORIZATION.md

Quiz Authorization - Implementation Summary

✅ Fitur yang Telah Diimplementasikan

Authorization Rules

Admin & Instructor:

• ✅ Create Quiz
• ✅ Edit Quiz Settings
• ✅ Delete Quiz
• ✅ Manage Questions (CRUD)
• ✅ View All Quizzes
• ✅ View Quiz Details & Statistics
• ✅ Reorder Questions

Student:

• ✅ View Quiz Details (read-only)
• ✅ Start Quiz
• ✅ Take Quiz
• ✅ Save Answers
• ✅ Submit Quiz
• ✅ View Results
• ✅ View Attempt History
• ✅ View Best Score

Restricted for Students:

• ❌ Create Quiz
• ❌ Edit Quiz
• ❌ Delete Quiz
• ❌ Manage Questions

🔒 Security Implementation

Routes Protection

1. Public Routes (All Auth Users):

   • View quiz list
   • View quiz details
   • Quiz taking flow

2. Admin/Instructor Only:

   • Quiz CRUD operations
   • Question management

Controller Middleware

1. QuizController:

   • Constructor middleware checks user role
   • Allows public access to show() and quiz taking routes
   • Restricts management routes to admin/instructor

2. QuizQuestionController:

   • Full protection - only admin/instructor can access
   • All question management operations protected

View-Level Protection

1. Quiz Show Page:

   • Admin/Instructor: Edit, Manage Questions, Delete buttons
   • Student: Start Quiz button, Attempt History

2. Quiz Index Page:

   • Admin/Instructor: Full CRUD actions
   • Student: View + Start Quiz button

3. Conditional Rendering:

   • All management buttons hidden from students
   • Student-specific UI (attempts, best score) for students only

📋 View Updates

Quiz Show Page

• Header: Role-based buttons
• Sidebar Actions: Separate cards for Admin vs Student
• Student Card includes:
  • Start Quiz button
  • Progress tracking
  • Attempt history
  • Best score display
  • Availability checks

Quiz Index Page

• Actions column: Role-based buttons
• Admin: Edit, Manage, Delete
• Student: Start Quiz (if available)

🎯 Student Experience

Viewing Quiz:

1. Student can see quiz details
2. Cannot see edit/delete buttons
3. Sees "Start Quiz" if available
4. Sees attempt history if attempted
5. Sees best score if completed

Taking Quiz:

1. Click "Start Quiz" button
2. Quiz taking interface (separate views)
3. Auto-save answers
4. Submit quiz
5. View results (if enabled)

Restrictions:

• Cannot access quiz management routes
• Cannot edit questions
• Cannot change quiz settings
• Cannot delete quiz

🔐 Security Features

• ✅ Route-level protection
• ✅ Controller-level authorization
• ✅ View-level conditional rendering
• ✅ 403 error for unauthorized access
• ✅ Attempt limit enforcement
• ✅ Quiz availability checks

📝 API Endpoints

Public (All Auth):

• GET /quizzes - List all quizzes
• GET /quizzes/{quiz} - View quiz details
• GET /quizzes/{quiz}/start - Start quiz attempt
• All quiz taking routes

Admin/Instructor Only:

• POST /lessons/{lesson}/quizzes - Create quiz
• PUT /quizzes/{quiz} - Update quiz
• DELETE /quizzes/{quiz} - Delete quiz
• All /quizzes/{quiz}/questions/* routes

🎨 UI Differences

Admin View:

• Blue/Primary buttons for management
• Full CRUD operations visible
• Statistics and analytics
• Question management tools

Student View:

• Green/Success buttons for taking quiz
• Attempt tracking
• Progress visualization
• Best score display
• Clean, focused interface

✅ Testing Checklist

• Admin can create quiz
• Admin can edit quiz
• Admin can delete quiz
• Admin can manage questions
• Student cannot access management routes
• Student can view quiz
• Student can start quiz
• Student can see attempt history
• 403 error for unauthorized access