ls1intum · ekayandan · Sep 4, 2025 · Sep 4, 2025 · Sep 5, 2025 · Sep 5, 2025
@@ -263,17 +263,14 @@ private void validateAthenaEnabled(long exerciseId) {
     }
 
     /**
-     * GET public/programming-exercises/:exerciseId/submissions/:submissionId/repository : Get the repository as a zip file download
+     * GET public/programming-exercises/:exerciseId/submissions/:submissionId/repository : Deprecated, forwards to internal endpoint
      *
      * @param exerciseId   the id of the exercise the submission belongs to
      * @param submissionId the id of the submission to get the repository for
      * @param auth         the auth header value to check
-     * @param request      the HTTP request
-     * @param response     the HTTP response
-     * @throws ServletException if the forward fails
-     * @deprecated Use {@code api/athena/internal/programming-exercises/{exerciseId}/submissions/{submissionId}/repository} instead
+     * @param request      the HTTP servlet request used for forwarding
+     * @param response     the HTTP servlet response used for forwarding
      */
-    @Deprecated
     @GetMapping("public/programming-exercises/{exerciseId}/submissions/{submissionId}/repository")
     @EnforceNothing // We check the Athena secret and validation here
     @ManualConfig
@@ -285,27 +282,7 @@ public void getRepository(@PathVariable long exerciseId, @PathVariable long subm
         request.getRequestDispatcher("/api/athena/internal/programming-exercises/" + exerciseId + "/submissions/" + submissionId + "/repository").forward(request, response);
     }
 
-    /**
-     * GET public/programming-exercises/:exerciseId/repository/template : Get the template repository as a zip file download
-     *
-     * @param exerciseId the id of the exercise
-     * @param auth       the auth header value to check
-     * @param request    the HTTP request
-     * @param response   the HTTP response
-     * @throws ServletException if the forward fails
-     * @deprecated Use {@code api/athena/internal/programming-exercises/{exerciseId}/repository/template} instead
-     */
-    @Deprecated
-    @GetMapping("public/programming-exercises/{exerciseId}/repository/template")
-    @EnforceNothing // We check the Athena secret and validation here
-    @ManualConfig
-    public void getTemplateRepository(@PathVariable long exerciseId, @RequestHeader(HttpHeaders.AUTHORIZATION) String auth, HttpServletRequest request,
-            HttpServletResponse response) throws ServletException, IOException {
-        log.debug("REST call to deprecated endpoint, forwarding to internal endpoint for exercise {}", exerciseId);
-        checkAthenaSecret(auth);
-        validateAthenaEnabled(exerciseId);
-        request.getRequestDispatcher("/api/athena/internal/programming-exercises/" + exerciseId + "/repository/template").forward(request, response);
-    }
+    // Removed legacy generic instructor repository endpoint in favor of specific endpoints below
 
     /**
      * GET public/programming-exercises/:exerciseId/repository/solution : Get the solution repository as a zip file download

@@ -1239,6 +1239,10 @@ public Map<File, FileType> listFilesAndFolders(Repository repo, boolean omitBina
         Iterator<java.io.File> itr = FileUtils.iterateFilesAndDirs(repo.getLocalPath().toFile(), filter, filter);
         Map<File, FileType> files = new HashMap<>();
 
+        if (itr == null) {
+            return files;
+        }
+
         while (itr.hasNext()) {
             File nextFile = new File(itr.next(), repo);
             Path nextPath = nextFile.toPath();

@@ -526,7 +526,7 @@ public void renameFile(Repository repository, FileMove fileMove) throws FileNotF
         if (!repository.isValidFile(newFile)) {
             throw new IllegalArgumentException("Existing path is not valid");
         }
-        if (gitService.getFileByName(repository, newFile.getPath()).isPresent()) {
+        if (gitService.getFileByName(repository, newFile.toString()).isPresent()) {
             throw new FileAlreadyExistsException("New path is not valid");
         }
         boolean isRenamed = existingFile.get().renameTo(newFile);

@@ -155,6 +155,11 @@
 
         Path remoteDirPath = localVCRepositoryUri.getLocalRepositoryPath(localVCBasePath);
 
+        if (Files.exists(remoteDirPath)) {
@@ -131,6 +131,7 @@
    @Override
    public void createProjectForExercise(ProgrammingExercise programmingExercise) {
        String projectKey = programmingExercise.getProjectKey();
+        validatePathComponent(projectKey, "projectKey");
        try {
            // Create a directory that will contain all repositories.
            Path projectPath = localVCBasePath.resolve(projectKey);
@@ -143,6 +144,18 @@
    }
    /**
+     * Validate that a string is a safe path component.
+     * Rejects null, empty, "..", path separators, and restricts to a safe pattern.
+     * Throws IllegalArgumentException if invalid.
+     */
+    private static void validatePathComponent(String input, String fieldName) {
+        if (input == null || input.isEmpty() || input.contains("..") || input.contains("/") || input.contains("\\") ||
+                !input.matches("^[a-zA-Z0-9_-]+$")) {
+            throw new IllegalArgumentException("Invalid " + fieldName + " for repository/project: " + input);
+        }
+    }
+
+    /**
     * Create a new repository for the given project key and repository slug
     *
     * @param projectKey     The project key of the parent project
@@ -151,6 +164,8 @@
     */
    @Override
    public void createRepository(String projectKey, String repositorySlug) {
+        validatePathComponent(projectKey, "projectKey");
+        validatePathComponent(repositorySlug, "repositorySlug");
        LocalVCRepositoryUri localVCRepositoryUri = new LocalVCRepositoryUri(localVCBaseUri, projectKey, repositorySlug);
        Path remoteDirPath = localVCRepositoryUri.getLocalRepositoryPath(localVCBasePath);
@@ -39,6 +39,9 @@
     * @throws LocalVCInternalException If the project key or repository slug results in an invalid URI, encapsulating the {@link URISyntaxException}.
     */
    public LocalVCRepositoryUri(URI localVCBaseUri, String projectKey, String repositorySlug) {
+        if (!isSafePathComponent(projectKey) || !isSafePathComponent(repositorySlug)) {
+            throw new IllegalArgumentException("Invalid projectKey or repositorySlug.");
+        }
        this.uri = buildUri(localVCBaseUri, projectKey, repositorySlug);
        this.projectKey = projectKey;
        this.repositorySlug = repositorySlug;
@@ -46,6 +49,12 @@
        this.isPracticeRepository = isPracticeRepository(repositorySlug, projectKey);
    }
+    private static boolean isSafePathComponent(String input) {
+        return input != null && !input.isEmpty()
+                && !input.contains("..") && !input.contains("/") && !input.contains("\\")
+                && input.matches("^[a-zA-Z0-9_-]+$");
+    }
+
    private static URI buildUri(URI localVCBaseUri, String projectKey, String repositorySlug) {
        return UriComponentsBuilder.fromUri(localVCBaseUri).pathSegment("git", projectKey, repositorySlug + ".git").build().toUri();
    }
@@ -131,6 +131,7 @@
    @Override
    public void createProjectForExercise(ProgrammingExercise programmingExercise) {
        String projectKey = programmingExercise.getProjectKey();
+        validatePathComponent(projectKey, "projectKey");
        try {
            // Create a directory that will contain all repositories.
            Path projectPath = localVCBasePath.resolve(projectKey);
@@ -143,6 +144,18 @@
    }

    /**
+     * Validate that a string is a safe path component.
+     * Rejects null, empty, "..", path separators, and restricts to a safe pattern.
+     * Throws IllegalArgumentException if invalid.
+     */
+    private static void validatePathComponent(String input, String fieldName) {
+        if (input == null || input.isEmpty() || input.contains("..") || input.contains("/") || input.contains("\\") ||
+                !input.matches("^[a-zA-Z0-9_-]+$")) {
+            throw new IllegalArgumentException("Invalid " + fieldName + " for repository/project: " + input);
+        }
+    }
+
+    /**
     * Create a new repository for the given project key and repository slug
     *
     * @param projectKey     The project key of the parent project
@@ -151,6 +164,8 @@
     */
    @Override
    public void createRepository(String projectKey, String repositorySlug) {
+        validatePathComponent(projectKey, "projectKey");
+        validatePathComponent(repositorySlug, "repositorySlug");
        LocalVCRepositoryUri localVCRepositoryUri = new LocalVCRepositoryUri(localVCBaseUri, projectKey, repositorySlug);

        Path remoteDirPath = localVCRepositoryUri.getLocalRepositoryPath(localVCBasePath);
@@ -39,6 +39,9 @@
     * @throws LocalVCInternalException If the project key or repository slug results in an invalid URI, encapsulating the {@link URISyntaxException}.
     */
    public LocalVCRepositoryUri(URI localVCBaseUri, String projectKey, String repositorySlug) {
+        if (!isSafePathComponent(projectKey) || !isSafePathComponent(repositorySlug)) {
+            throw new IllegalArgumentException("Invalid projectKey or repositorySlug.");
+        }
        this.uri = buildUri(localVCBaseUri, projectKey, repositorySlug);
        this.projectKey = projectKey;
        this.repositorySlug = repositorySlug;
@@ -46,6 +49,12 @@
        this.isPracticeRepository = isPracticeRepository(repositorySlug, projectKey);
    }

+    private static boolean isSafePathComponent(String input) {
+        return input != null && !input.isEmpty()
+                && !input.contains("..") && !input.contains("/") && !input.contains("\\")
+                && input.matches("^[a-zA-Z0-9_-]+$");
+    }
+
    private static URI buildUri(URI localVCBaseUri, String projectKey, String repositorySlug) {
        return UriComponentsBuilder.fromUri(localVCBaseUri).pathSegment("git", projectKey, repositorySlug + ".git").build().toUri();
    }
+            log.debug("Local git repo {} at {} already exists – skipping creation", repositorySlug, remoteDirPath);
+            return;
+        }
+
         try {
             Files.createDirectories(remoteDirPath);
 

@@ -1,7 +1,6 @@
 package de.tum.cit.aet.artemis.assessment;
 
 import static org.assertj.core.api.Assertions.assertThat;
-import static org.mockito.Mockito.doReturn;
 
 import java.time.ZonedDateTime;
 import java.util.ArrayList;
@@ -12,14 +11,12 @@
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
-import org.eclipse.jgit.lib.ObjectId;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.Arguments;
 import org.junit.jupiter.params.provider.EnumSource;
 import org.junit.jupiter.params.provider.MethodSource;
-import org.mockito.ArgumentMatchers;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.HttpStatus;
 import org.springframework.security.test.context.support.WithMockUser;
@@ -186,8 +183,6 @@ void setupTest() {
         result2.setFeedbacks(feedbacks2);
         result2.setAssessmentType(AssessmentType.SEMI_AUTOMATIC);
 
-        String dummyHash = "9b3a9bd71a0d80e5bbc42204c319ed3d1d4f0d6d";
-        doReturn(ObjectId.fromString(dummyHash)).when(gitService).getLastCommitHash(ArgumentMatchers.any());
     }
 
     @Test

@@ -8,10 +8,14 @@
 import static de.tum.cit.aet.artemis.core.connector.AthenaRequestMockProvider.ATHENA_RESTRICTED_MODULE_TEXT_TEST;
 import static org.assertj.core.api.Assertions.assertThat;
 
+import java.nio.file.Files;
+import java.nio.file.Path;
 import java.time.ZonedDateTime;
 import java.util.List;
 import java.util.Map;
 
+import org.apache.commons.io.FileUtils;
+import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.params.ParameterizedTest;
@@ -33,6 +37,7 @@
 import de.tum.cit.aet.artemis.exercise.domain.InitializationState;
 import de.tum.cit.aet.artemis.exercise.domain.participation.StudentParticipation;
 import de.tum.cit.aet.artemis.exercise.participation.util.ParticipationFactory;
+import de.tum.cit.aet.artemis.exercise.participation.util.ParticipationUtilService;
 import de.tum.cit.aet.artemis.exercise.test_repository.StudentParticipationTestRepository;
 import de.tum.cit.aet.artemis.exercise.util.ExerciseUtilService;
 import de.tum.cit.aet.artemis.modeling.domain.ModelingExercise;
@@ -42,12 +47,17 @@
 import de.tum.cit.aet.artemis.modeling.util.ModelingExerciseUtilService;
 import de.tum.cit.aet.artemis.programming.domain.ProgrammingExercise;
 import de.tum.cit.aet.artemis.programming.domain.ProgrammingSubmission;
+import de.tum.cit.aet.artemis.programming.domain.RepositoryType;
+import de.tum.cit.aet.artemis.programming.icl.LocalVCLocalCITestService;
+import de.tum.cit.aet.artemis.programming.service.GitService;
 import de.tum.cit.aet.artemis.programming.service.localvc.LocalVCRepositoryUri;
+import de.tum.cit.aet.artemis.programming.test_repository.ProgrammingExerciseStudentParticipationTestRepository;
 import de.tum.cit.aet.artemis.programming.test_repository.ProgrammingExerciseTestRepository;
 import de.tum.cit.aet.artemis.programming.test_repository.ProgrammingSubmissionTestRepository;
 import de.tum.cit.aet.artemis.programming.util.LocalRepository;
 import de.tum.cit.aet.artemis.programming.util.ProgrammingExerciseParticipationUtilService;
 import de.tum.cit.aet.artemis.programming.util.ProgrammingExerciseUtilService;
+import de.tum.cit.aet.artemis.programming.util.RepositoryExportTestUtil;
 import de.tum.cit.aet.artemis.text.domain.TextExercise;
 import de.tum.cit.aet.artemis.text.domain.TextSubmission;
 import de.tum.cit.aet.artemis.text.repository.TextExerciseRepository;
@@ -100,6 +110,15 @@ class AthenaResourceIntegrationTest extends AbstractAthenaTest {
     @Autowired
     private LearnerProfileUtilService learnerProfileUtilService;
 
+    @Autowired
+    private LocalVCLocalCITestService localVCLocalCITestService;
+
+    @Autowired
+    private ProgrammingExerciseStudentParticipationTestRepository programmingExerciseStudentParticipationTestRepository;
+
+    @Autowired
+    private ParticipationUtilService participationUtilService;
+
     private TextExercise textExercise;
 
     private TextSubmission textSubmission;
@@ -155,6 +174,11 @@ protected void initTestCase() {
         modelingSubmissionRepository.save(modelingSubmission);
     }
 
+    @AfterEach
+    void cleanupRepositories() {
+        RepositoryExportTestUtil.cleanupTrackedRepositories();
+    }
+
     @Test
     @WithMockUser(username = TEST_PREFIX + "editor1", roles = "EDITOR")
     void testGetAvailableProgrammingModulesSuccess_EmptyModules() throws Exception {
@@ -391,13 +415,12 @@ void testRepositoryExportEndpoint(String urlSuffix) throws Exception {
         programmingExerciseParticipationUtilService.addSolutionParticipationForProgrammingExercise(programmingExercise);
 
         // Seed a LocalVC bare repository with content
-        var sourceRepo = new LocalRepository(defaultBranch);
+        var sourceRepo = RepositoryExportTestUtil.trackRepository(new LocalRepository(defaultBranch));
         sourceRepo.configureRepos(localVCBasePath, "athenaSrcLocalRepo", "athenaSrcOriginRepo");
 
         // Ensure tests repository URI exists on the exercise
-        var testsSlug = programmingExercise.getProjectKey().toLowerCase() + "-tests";
-        var testsUri = new LocalVCRepositoryUri(localVCBaseUri, programmingExercise.getProjectKey(), testsSlug);
-        programmingExercise.setTestRepositoryUri(testsUri.toString());
+        var testsSlug = programmingExercise.getProjectKey().toLowerCase() + "-" + RepositoryType.TESTS.getName();
+        programmingExercise.setTestRepositoryUri(localVCLocalCITestService.buildLocalVCUri(null, null, programmingExercise.getProjectKey(), testsSlug));
         programmingExerciseRepository.save(programmingExercise);
 
         var sourceUri = new LocalVCRepositoryUri(localVCBaseUri, sourceRepo.remoteBareGitRepoFile.toPath());
@@ -422,6 +445,55 @@ void testRepositoryExportEndpoint(String urlSuffix) throws Exception {
         assertThat(repoFiles).as("export returns exactly one file: README.md").isNotNull().hasSize(1).containsOnlyKeys("README.md").containsEntry("README.md", "Initial commit");
     }
 
+    @Test
+    void testStudentRepositoryExportEndpoint() throws Exception {
+        // Enable Athena for the exercise
+        programmingExercise.setFeedbackSuggestionModule(ATHENA_MODULE_PROGRAMMING_TEST);
+        programmingExerciseRepository.save(programmingExercise);
+
+        // Create a programming student participation with a submission and result
+        var studentLogin = TEST_PREFIX + "student1";
+        var result = participationUtilService.addProgrammingParticipationWithResultForExercise(programmingExercise, studentLogin);
+        programmingSubmission = (ProgrammingSubmission) result.getSubmission();
+
+        // Prepare a LocalVC student repository and wire it to the participation referenced by the submission.
+        var projectKey = programmingExercise.getProjectKey();
+        String srcSlug = projectKey.toLowerCase() + "-athena-src";
+        var sourceRepo = RepositoryExportTestUtil.trackRepository(localVCLocalCITestService.createAndConfigureLocalRepository(projectKey, srcSlug));
+        // Remove default seed file (test.txt) from the working copy and commit deletion
+        var defaultSeed = sourceRepo.workingCopyGitRepoFile.toPath().resolve("test.txt");
+        if (Files.exists(defaultSeed)) {
+            Files.delete(defaultSeed);
+            sourceRepo.workingCopyGitRepo.add().addFilepattern(".").call();
+            GitService.commit(sourceRepo.workingCopyGitRepo).setMessage("Remove default seed").call();
+            sourceRepo.workingCopyGitRepo.push().setRemote("origin").call();
+        }
+        // Seed a README.md so the export contains the expected file
+        Path readme = sourceRepo.workingCopyGitRepoFile.toPath().resolve("README.md");
+        FileUtils.writeStringToFile(readme.toFile(), "Initial commit", java.nio.charset.StandardCharsets.UTF_8);
+        sourceRepo.workingCopyGitRepo.add().addFilepattern(".").call();
+        GitService.commit(sourceRepo.workingCopyGitRepo).setMessage("Initial commit").call();
+        sourceRepo.workingCopyGitRepo.push().setRemote("origin").call();
+        var studentRepoSlug = localVCLocalCITestService.getRepositorySlug(projectKey, studentLogin);
+        var studentLocalVCRepo = RepositoryExportTestUtil.seedLocalVcBareFrom(localVCLocalCITestService, projectKey, studentRepoSlug, sourceRepo);
+
+        // Persist repository URI on the participation
+        var programmingStudentParticipation = programmingExerciseStudentParticipationTestRepository.findById(programmingSubmission.getParticipation().getId()).orElseThrow();
+        programmingStudentParticipation.setRepositoryUri(localVCLocalCITestService.buildLocalVCUri(null, null, projectKey, studentRepoSlug));
+        programmingExerciseStudentParticipationTestRepository.save(programmingStudentParticipation);
+
+        // Call the internal endpoint with valid Athena auth and verify file map
+        var authHeaders = new HttpHeaders();
+        authHeaders.add(HttpHeaders.AUTHORIZATION, athenaSecret);
+
+        String json = request.get("/api/athena/internal/programming-exercises/" + programmingExercise.getId() + "/submissions/" + programmingSubmission.getId() + "/repository",
+                HttpStatus.OK, String.class, authHeaders);
+        Map<String, String> repoFiles = request.getObjectMapper().readValue(json, new TypeReference<Map<String, String>>() {
+        });
+        assertThat(repoFiles).as("student export returns exactly one file: README.md").isNotNull().hasSize(1).containsOnlyKeys("README.md").containsEntry("README.md",
+                "Initial commit");
+    }
+
     @ParameterizedTest
     @ValueSource(strings = { "repository/template", "repository/solution", "repository/tests" })
     void testRepositoryExportEndpointsFailWhenAthenaNotEnabled(String urlSuffix) throws Exception {
@@ -458,4 +530,6 @@ void testRepositoryExportEndpointsFailWithInvalidRepositoryType(String urlSuffix
 
         request.get("/api/athena/internal/programming-exercises/" + programmingExercise.getId() + "/" + urlSuffix, HttpStatus.NOT_FOUND, Result.class, authHeaders);
     }
+
+    // Removed legacy public endpoint test that expected BAD_REQUEST for invalid repository type
 }