feat(attachment): implement attachment workflow for user and admin by ZephyrNova47 · Pull Request #575 · VNOI-Admin/OJ

ZephyrNova47 · 2026-04-14T09:13:00Z

Description

This PR adds an admin-driven attachment workflow with secure file access control, and refactors file authorization using the Chain of Responsibility design pattern.

Known limitation: normal user file dashboard still needs follow-up work.

Type of change: new feature

What

Added CRUD flow for user files
Added a Shareable URL for public files that opens in view mode
Kept a separate Download action for file download behavior
Added permission revocation behavior so when a file is changed from public to private, old shared access is blocked (ex: http://localhost:8000/files/259d3c56-4e71-4593-9873-74c74abf6da6/view)
Added martor file to tracing

Limitations: My code haven't optimize yet. Need create checkbox for use delete multiple files

Why

Why this PR is needed?

Fixes # (567)

How Has This Been Tested?

Manual test (CRUD done)

Checklist

Put an x in the boxes that apply. You can also fill these out after creating the PR. If you're unsure about any of them, don't hesitate to ask. We're here to help! This is simply a reminder of what we are going to look for before merging your code.

I have explained the purpose of this PR.
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the README/documentation
Any dependent changes have been merged and published in downstream modules
Informed of breaking changes, testing and migrations (if applicable).
Attached screenshots (if applicable).

By submitting this pull request, I confirm that my contribution is made under the terms of the AGPL-3.0 License.

Copilot

Pull request overview

This PR introduces a new UserFile/FileUsage model and supporting UI/API endpoints to enable an attachment workflow (including shareable inline-view URLs and permission-aware access), and refactors markdown image uploads to store uploads as UserFile records with scoped authorization.

Changes:

Added UserFile + FileUsage models, migrations, access-authorization chain, and a backfill command for existing Martor uploads.
Added user-facing pages + API v2 endpoints for listing/uploading/editing/downloading user files.
Updated Martor image upload handling to create UserFile records and track usage context (problem/contest) for access control.

Reviewed changes

Copilot reviewed 22 out of 22 changed files in this pull request and generated 14 comments.

Show a summary per file

File	Description
templates/user/user-tabs.html	Adds a “My Files” tab gated by permission.
templates/user/files/file_upload.html	New upload form UI for user files.
templates/user/files/file_list.html	New list page UI (with pagination) for user files.
templates/user/files/file_edit.html	New edit-metadata UI for user files.
templates/user/files/file_detail.html	New detail page UI for user files (incl. usage display).
templates/user/files/file_delete.html	New delete-confirm UI for user files.
judge/views/widgets.py	Refactors Martor uploader to create `UserFile` + `FileUsage` and return access URL.
judge/views/user_files.py	Adds HTML views for CRUD + download/inline access with authorization.
judge/views/api/user_files.py	Adds API endpoints for listing/uploading/downloading/deleting user files.
judge/views/api/init.py	Exposes the new `user_files` API module.
judge/utils/user_file_access.py	Implements Chain-of-Responsibility authorization for file access.
judge/models/user_file.py	Defines `UserFile` storage behavior, access checks, and `FileUsage` model.
judge/models/tests/test_user_file.py	Adds unit tests for access rules and authorization chain.
judge/models/init.py	Exports `UserFile`, `FileUsage`, and storage router from the models package.
judge/migrations/0221_alter_contest_authors_alter_contest_curators_and_more.py	Introduces `UserFile`/`FileUsage` tables and related contest/profile field alterations.
judge/migrations/0222_fileusage_contest_id_userfile_storage_scope_and_more.py	Adds `storage_scope` and contest usage fields + indexes.
judge/migrations/0223_merge_20260426_1739.py	Merge migration for the new schema changes.
judge/management/commands/backfill_martor_user_files.py	Adds command to backfill `UserFile` entries for existing Martor-referenced uploads.
judge/forms.py	Adds upload/edit forms for `UserFile`.
judge/admin/init.py	Minor formatting-only change.
dmoj/urls.py	Wires up new HTML and API endpoints; serves media under `DEBUG`.
dmoj/settings.py	Adds `MEDIA_URL`/`MEDIA_ROOT` defaults for uploads.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-27T10:50:24Z

+        except Exception as e:
+            return self._error_response('unknown', str(e), 500)
+


The broad except Exception as e returns str(e) to clients with a 500. This can leak internal details (paths, settings, stack-relevant messages) and makes error handling inconsistent. Prefer catching expected exceptions and returning a generic message for unexpected failures (while logging the real exception server-side).

Copilot · 2026-04-27T10:50:26Z

+
+    base_url = url_map.get(scope)
+    if not base_url:
+        base_url = os.path.join(default_url.rstrip('/'), USER_FILE_STORAGE_PREFIX, scope) + '/'


os.path.join is used to build base_url. Because this is a URL (not a filesystem path), os.path.join can produce backslashes on Windows and can mangle leading slashes. Prefer URL-safe joining (e.g. manual '/' concatenation or urllib.parse.urljoin) when constructing base_url.

Suggested change

base_url = os.path.join(default_url.rstrip('/'), USER_FILE_STORAGE_PREFIX, scope) + '/'

base_url = '/'.join((default_url.rstrip('/'), USER_FILE_STORAGE_PREFIX, scope, ''))

leduythuccs · 2026-06-22T07:42:41Z

+# Media files (user uploads)
+MEDIA_URL = '/media/'
+MEDIA_ROOT = os.path.join(BASE_DIR, 'media')


we shouldn't set it here, it's belong to local_settings.py

…nly review)

add admin dashboard CRUD for user files add public URL for viewing files close/revoke public access when file permission is set to private known issue: normal user file dashboard view is still not working

… but super upload still has issues

… scope - Add can_list_by/can_upload_by permission helpers; default users only view files, admins grant judge.add_userfile to enable uploading at /files - Hide the upload button for users without upload permission - Store user files under per-scope subfolders (martor/problem/contest) so the source of each file is traceable on disk - Remove the dropped file_type kwarg that broke martor/problem/contest uploads - Make UserFileStorage deconstructible so migrations stay environment-stable and fix the migration storage drift - Trim redundant comments/docstrings across the feature

- IDOR: validate file ownership in FileAttachmentForm.clean() so users cannot attach files they don't own - File type: add USER_FILE_ATTACHMENT_SAFE_EXTS to settings and reject disallowed extensions (e.g. .html, .svg) in clean_new_file() - Empty form guard: raise ValidationError when neither file nor new_file is provided; clear empty attachment rows via JS on submit (matching the contest problem formset pattern) - Scope attachments context to ContestDetail only (was ContestMixin), filtered by can_view_attachment_by() so names aren't leaked - Admin: register UserFile and FileAttachment models - Tests: IDOR ownership check, dangerous file type rejection, formset IDOR via crafted POST, contest participant attachment access (issue 14)

ZephyrNova47 changed the title ~~feat(attachment): create simple api and interface (pls don't merge, o…~~ feat(attachment): implement attachment workflow for user and admin Apr 20, 2026

magnified103 requested a review from Copilot April 27, 2026 10:42

Copilot started reviewing on behalf of magnified103 April 27, 2026 10:42 View session

Copilot AI reviewed Apr 27, 2026

View reviewed changes

leduythuccs reviewed Jun 22, 2026

View reviewed changes

trucddx and others added 25 commits July 9, 2026 23:43

feat(attachment): create simple api and interface (pls don't merge, o…

25579c0

…nly review)

feat(admin-attachment): add partial user file admin workflow

e82e336

add admin dashboard CRUD for user files add public URL for viewing files close/revoke public access when file permission is set to private known issue: normal user file dashboard view is still not working

add file scope and auth handler

f4cf964

Move admin file management for user use, fix file UI and permissions,…

099b9e1

… but super upload still has issues

fix unit

4655ddb

feat(ui): fix ui and remove unneccessary code

981f7a0

clean code

4659f16

fix comment

fed4623

fix bug for tracing source type

c226db7

fix lint

c3db4a7

Update migration

b413318

revert setting

4e50f11

Remove api

5a7bacb

update storage

1826551

simplified user_file_directory

622e684

simplify serving files

a28012e

remove link_referenced_files and extract_referenced_file_uuids

abd7af1

revert widgets

15f1c99

remove usage file model

453ed68

simplified access

37a9dd1

migrate martor upload to user file

8103fed

WIP attachment for problems and contests

c08d916

remove old field

40f7029

Use only 1 view for download/view

8ca47fc

leduythuccs added 24 commits July 9, 2026 23:54

remove duplicated code in serve file

7abcdc3

Create enum for filescope

3705997

Remove create view for file

6c672b4

Reduce number of view for user files

cb8b934

allow user with permission to add attachment

6640b36

Fix placement of attachment

c0e3b2b

Fix lint

b58122e

Update access check for contest attachment

0ce2e20

Add test

807cf3b

change url order

b04bf95

validate file size

690050b

sanitize filename

d2007ad

avoid duplicate code for initAttachmentRow

de71bae

selecte related in detail view

ffda2df

merge model files

7aa4001

merge formset

e89457c

escape filename

d70ed3f

update test

c009b0f

remove empty formset

8587565

remove admin model

ea8f311

improve form, whitelist ext

0ccd65c

always validate display_name

7dd33c2

Improve inline form

1961df4

leduythuccs force-pushed the feat/attachment branch from 1381fe4 to 1961df4 Compare July 9, 2026 16:56

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(attachment): implement attachment workflow for user and admin #575

feat(attachment): implement attachment workflow for user and admin #575
ZephyrNova47 wants to merge 49 commits into
VNOI-Admin:masterfrom
ZephyrNova47:feat/attachment

ZephyrNova47 commented Apr 14, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Apr 27, 2026

Uh oh!

Uh oh!

Uh oh!

Copilot AI Apr 27, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

leduythuccs Jun 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		except Exception as e:
		return self._error_response('unknown', str(e), 500)

	base_url = os.path.join(default_url.rstrip('/'), USER_FILE_STORAGE_PREFIX, scope) + '/'
	base_url = '/'.join((default_url.rstrip('/'), USER_FILE_STORAGE_PREFIX, scope, ''))

Uh oh!

Conversation

ZephyrNova47 commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

What

Why

How Has This Been Tested?

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

leduythuccs Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ZephyrNova47 commented Apr 14, 2026 •

edited

Loading