starr-philproperties/utils/courses/quiz_security.util.js

// Assessment cooldown policy is now stored per-assessment in the DB (max_attempts / cooldown_hours).
// These fallbacks are used only if values are missing (e.g. legacy rows before the migration).
const ASSESSMENT_FAILS_BEFORE_COOLDOWN = 3;
const ASSESSMENT_COOLDOWN_HOURS = 24;

// Fisher-Yates shuffle of each question's options. Pure — returns new
// arrays/objects, never mutates input. Grading is unaffected since
// submitUnitQuiz/submitCourseAssessment always re-fetch questions fresh
// from the DB and never trust shuffled client-facing order.
function shuffleOptions(questions) {
  return questions.map((q) => {
    const options = [...(q.options ?? [])];
    for (let i = options.length - 1; i > 0; i--) {
      const j = Math.floor(Math.random() * (i + 1));
      [options[i], options[j]] = [options[j], options[i]];
    }
    return { ...q, options };
  });
}

// Single source of truth for both the GET-time info fields and the
// submit-time enforcement check.
//
// type = 'quiz'       → unit quizzes: no cooldown, no attempt cap, always open
// type = 'assessment' → course assessments: maxFails failed attempts → cooldownHours cooldown (rolling cycles)
//                       maxFails / cooldownHours come from the assessment row; fallback to the constants above.
function getAttemptStatus(attempts, type = 'quiz', { maxFails, cooldownHours } = {}) {
  const attempt_count = attempts.length;
  const has_passed    = attempts.some((a) => a.passed);
  const best_attempt  = attempts.reduce(
    (best, a) => (!best || a.score > best.score ? a : best),
    null
  );

  if (type === 'quiz') {
    return {
      attempt_count,
      has_passed,
      best_attempt,
      attempts_remaining: null,
      cooldown_until:     null,
      window_reset_at:    null,
      can_attempt:        true,
    };
  }

  // Assessment: simulate rolling cycles — N failed attempts → cooldown (from the assessment's own config)
  const failLimit    = maxFails      ?? ASSESSMENT_FAILS_BEFORE_COOLDOWN;
  const lockHours    = cooldownHours ?? ASSESSMENT_COOLDOWN_HOURS;

  const sorted = [...attempts].sort((a, b) => new Date(a.createdAt) - new Date(b.createdAt));

  let cycle_end       = null; // when the current cooldown expires (null = no active or past cooldown)
  let failed_in_cycle = 0;

  for (const a of sorted) {
    // Skip attempts that fall inside a previous cooldown window (they shouldn't exist, but guard anyway)
    if (cycle_end && new Date(a.createdAt) < cycle_end) continue;
    if (!a.passed) {
      failed_in_cycle++;
      if (failed_in_cycle >= failLimit) {
        cycle_end = new Date(new Date(a.createdAt).getTime() + lockHours * 3600000);
        failed_in_cycle = 0;
      }
    }
  }

  const now = new Date();
  const cooldown_until = (cycle_end && cycle_end > now) ? cycle_end.toISOString() : null;

  return {
    attempt_count,
    has_passed,
    best_attempt,
    attempts_remaining: null,
    cooldown_until,
    window_reset_at:    null,
    can_attempt:        !cooldown_until,
  };
}

module.exports = { ASSESSMENT_FAILS_BEFORE_COOLDOWN, ASSESSMENT_COOLDOWN_HOURS, shuffleOptions, getAttemptStatus };