Encrypt class and student IDs together in URLs

server.py

@@ -4,7 +4,7 @@ import json
 import asyncio
 import subprocess
 from fastapi import FastAPI, Request, WebSocket, WebSocketDisconnect
-from fastapi.responses import HTMLResponse, JSONResponse
+from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
 from fastapi.staticfiles import StaticFiles
 from fastapi.templating import Jinja2Templates
 
@@ -20,9 +20,6 @@ TEMPLATES_DIR = os.path.join(BASE_DIR, "templates")
 os.makedirs(TEMPLATES_DIR, exist_ok=True)
 templates = Jinja2Templates(directory=TEMPLATES_DIR)
 
-# Static projects mount
-app.mount("/static_projects", StaticFiles(directory=PROJECTS_DIR), name="static_projects")
-
 # ----------------- Scanning Projects -----------------
 def scan_projects():
     """
@@ -94,10 +91,39 @@ def get_id(name: str) -> str:
 def decode_class_student(class_name_or_id: str, student_name_or_id: str = None):
     """
     Decodes ID back to real folder names for class and student.
-    Supports transparent fallback if real names are passed.
+    Supports:
+    1. Single token representing student_id (get_id(class/student)) or "class/student"
+    2. Two arguments (class_name_or_id, student_name_or_id)
     """
     all_projects = scan_projects()
     
+    # Case A: We only have one argument (class_name_or_id)
+    if not student_name_or_id:
+        # Check if it matches a hashed student ID (get_id(class + "/" + student))
+        for c in all_projects:
+            for s in all_projects[c]:
+                if get_id(f"{c}/{s}") == class_name_or_id:
+                    return c, s
+                    
+        # Check if it is a raw path "class_name/student_name"
+        if "/" in class_name_or_id:
+            parts = class_name_or_id.split("/", 1)
+            c, s = parts[0], parts[1]
+            if c in all_projects and s in all_projects[c]:
+                return c, s
+                
+        # Otherwise, treat class_name_or_id as a class-only identifier
+        real_class = None
+        for c in all_projects:
+            if get_id(c) == class_name_or_id:
+                real_class = c
+                break
+        if not real_class:
+            if class_name_or_id in all_projects:
+                real_class = class_name_or_id
+        return real_class, None
+
+    # Case B: We have two arguments
     # 1. Decode Class
     real_class = None
     for c in all_projects:
@@ -108,10 +134,7 @@ def decode_class_student(class_name_or_id: str, student_name_or_id: str = None):
         if class_name_or_id in all_projects:
             real_class = class_name_or_id
             
-    if not student_name_or_id:
-        return real_class, None
-        
-    # 2. Decode Student (Student ID is hashed from class_name + "/" + student_name)
+    # 2. Decode Student
     real_student = None
     if real_class and real_class in all_projects:
         for s in all_projects[real_class]:
@@ -124,6 +147,33 @@ def decode_class_student(class_name_or_id: str, student_name_or_id: str = None):
                 
     return real_class, real_student
 
+# ----------------- Custom Static Files Routing wrapper -----------------
+@app.get("/static_projects/{student_token}/{project_name}/{path:path}")
+async def serve_static_project_file(student_token: str, project_name: str, path: str):
+    real_class, real_student = decode_class_student(student_token)
+    
+    # If not a valid student, check if it's actually the old format: class_name/student_name/project_name/path
+    if not real_class or not real_student:
+        parts = path.split("/", 1)
+        if len(parts) == 2:
+            actual_project_name = parts[0]
+            actual_path = parts[1]
+            real_class, real_student = decode_class_student(student_token, project_name)
+            if real_class and real_student:
+                file_path = os.path.join(PROJECTS_DIR, real_class, real_student, actual_project_name, actual_path)
+                if os.path.exists(file_path) and not os.path.isdir(file_path):
+                    return FileResponse(file_path)
+        return HTMLResponse("Not Found", status_code=404)
+        
+    file_path = os.path.join(PROJECTS_DIR, real_class, real_student, project_name, path)
+    if not os.path.exists(file_path) or os.path.isdir(file_path):
+        return HTMLResponse("File Not Found", status_code=404)
+        
+    return FileResponse(file_path)
+
+# Fallback direct mounting for direct access / other assets
+app.mount("/static_projects", StaticFiles(directory=PROJECTS_DIR), name="static_projects")
+
 # ----------------- HTTP Routes -----------------
 @app.get("/", response_class=HTMLResponse)
 async def read_index(request: Request):
@@ -146,10 +196,10 @@ async def read_class(request: Request, class_name: str):
         "restrict_student": ""
     })
 
-@app.get("/student/{class_name}/{student_name}", response_class=HTMLResponse)
-async def read_student(request: Request, class_name: str, student_name: str):
-    """Renders the catalog restricted to a specific student (supports IDs or Names)."""
-    real_class, real_student = decode_class_student(class_name, student_name)
+@app.get("/student/{student_token}", response_class=HTMLResponse)
+async def read_student(request: Request, student_token: str):
+    """Renders the catalog restricted to a specific student (supports combined ID or "class_name/student_name")."""
+    real_class, real_student = decode_class_student(student_token)
     if not real_class or not real_student:
         return HTMLResponse("Student not found", status_code=404)
     return templates.TemplateResponse("index.html", {
@@ -158,6 +208,15 @@ async def read_student(request: Request, class_name: str, student_name: str):
         "restrict_student": real_student
     })
 
+@app.get("/student/{class_name}/{student_name}", response_class=HTMLResponse)
+async def read_student_old(request: Request, class_name: str, student_name: str):
+    """Redirects old student URLs to the new single-token URL."""
+    real_class, real_student = decode_class_student(class_name, student_name)
+    if not real_class or not real_student:
+        return HTMLResponse("Student not found", status_code=404)
+    student_token = get_id(f"{real_class}/{real_student}")
+    return RedirectResponse(url=f"/student/{student_token}", status_code=307)
+
 @app.get("/api/projects", response_class=JSONResponse)
 async def get_projects(class_name: str = None, student_name: str = None):
     """
@@ -191,10 +250,10 @@ async def get_projects(class_name: str = None, student_name: str = None):
         "student_ids": student_ids
     }
 
-@app.get("/run/{class_name}/{student_name}/{project_name}", response_class=HTMLResponse)
-async def run_project_page(request: Request, class_name: str, student_name: str, project_name: str):
-    """Renders the player viewport wrapper (supports IDs or Names for class/student)."""
-    real_class, real_student = decode_class_student(class_name, student_name)
+@app.get("/run/{student_token}/{project_name}", response_class=HTMLResponse)
+async def run_project_page(request: Request, student_token: str, project_name: str):
+    """Renders the player viewport wrapper (supports combined ID or "class_name/student_name")."""
+    real_class, real_student = decode_class_student(student_token)
     if not real_class or not real_student:
         return HTMLResponse("Project not found", status_code=404)
         
@@ -218,15 +277,23 @@ async def run_project_page(request: Request, class_name: str, student_name: str,
         "request": request,
         "class_name": real_class,
         "student_name": real_student,
+        "student_token": student_token,
         "project_name": project_name,
         "project_type": proj_type,
         "external_url": external_url
     })
 
-# ----------------- WebSocket Communication Proxy -----------------
-@app.websocket("/ws/play/{class_name}/{student_name}/{project_name}")
-async def play_project_ws(websocket: WebSocket, class_name: str, student_name: str, project_name: str):
+@app.get("/run/{class_name}/{student_name}/{project_name}", response_class=HTMLResponse)
+async def run_project_page_old(request: Request, class_name: str, student_name: str, project_name: str):
+    """Redirects old run URLs to the new single-token URL."""
     real_class, real_student = decode_class_student(class_name, student_name)
+    if not real_class or not real_student:
+        return HTMLResponse("Project not found", status_code=404)
+    student_token = get_id(f"{real_class}/{real_student}")
+    return RedirectResponse(url=f"/run/{student_token}/{project_name}", status_code=307)
+
+# ----------------- WebSocket Communication Proxy -----------------
+async def play_project_ws_internal(websocket: WebSocket, real_class: str, real_student: str, project_name: str):
     if not real_class or not real_student:
         await websocket.accept()
         await websocket.send_json({"type": "log", "data": "錯誤: 找不到該專案的執行路徑！\n"})
@@ -390,6 +457,16 @@ async def play_project_ws(websocket: WebSocket, class_name: str, student_name: s
         except Exception:
             pass
 
+@app.websocket("/ws/play/{student_token}/{project_name}")
+async def play_project_ws(websocket: WebSocket, student_token: str, project_name: str):
+    real_class, real_student = decode_class_student(student_token)
+    await play_project_ws_internal(websocket, real_class, real_student, project_name)
+
+@app.websocket("/ws/play/{class_name}/{student_name}/{project_name}")
+async def play_project_ws_old(websocket: WebSocket, class_name: str, student_name: str, project_name: str):
+    real_class, real_student = decode_class_student(class_name, student_name)
+    await play_project_ws_internal(websocket, real_class, real_student, project_name)
+
 # Main entry point to run server via python command directly if wanted
 if __name__ == "__main__":
     import uvicorn

templates/index.html

@@ -819,7 +819,7 @@
             if (selectedStudent) {
                 const studentKey = `${selectedClass}/${selectedStudent}`;
                 const studentId = studentIds[studentKey];
-                urlResult.value = `${baseUrl}/student/${classId}/${studentId}`;
+                urlResult.value = `${baseUrl}/student/${studentId}`;
             } else {
                 urlResult.value = `${baseUrl}/class/${classId}`;
             }
@@ -986,11 +986,10 @@
         }
 
         function launchProject(projectName) {
-            const classId = classIds[activeClass] || activeClass;
             const studentKey = `${activeClass}/${activeStudent}`;
             const studentId = studentIds[studentKey] || activeStudent;
             
-            const url = `/run/${encodeURIComponent(classId)}/${encodeURIComponent(studentId)}/${encodeURIComponent(projectName)}`;
+            const url = `/run/${encodeURIComponent(studentId)}/${encodeURIComponent(projectName)}`;
             window.open(url, '_blank');
         }
 

templates/player.html

@@ -543,6 +543,7 @@
     <script>
         const className = "{{ class_name }}";
         const studentName = "{{ student_name }}";
+        const studentToken = "{{ student_token }}";
         const projectName = "{{ project_name }}";
         const projectType = "{{ project_type }}";
         const externalUrl = "{{ external_url }}";
@@ -605,7 +606,7 @@
                 iframe.allow = "autoplay; fullscreen; microphone; camera";
                 
                 if (projectType === "html") {
-                    iframe.src = `/static_projects/${encodeURIComponent(className)}/${encodeURIComponent(studentName)}/${encodeURIComponent(projectName)}/index.html`;
+                    iframe.src = `/static_projects/${encodeURIComponent(studentToken)}/${encodeURIComponent(projectName)}/index.html`;
                 } else if (projectType === "external") {
                     iframe.src = formatEmbedUrl(externalUrl);
                 }
@@ -618,7 +619,7 @@
         function connectWebSocket() {
             const loc = window.location;
             const wsProto = loc.protocol === "https:" ? "wss:" : "ws:";
-            const wsUrl = `${wsProto}//${loc.host}/ws/play/${encodeURIComponent(className)}/${encodeURIComponent(studentName)}/${encodeURIComponent(projectName)}`;
+            const wsUrl = `${wsProto}//${loc.host}/ws/play/${encodeURIComponent(studentToken)}/${encodeURIComponent(projectName)}`;
             
             socket = new WebSocket(wsUrl);
             socket.binaryType = "blob";