feat: implement automation feature

apps/api/src/routes/course/exercise.ts

@@ -21,24 +21,43 @@ import { getGroupMemberIdByCourseAndProfile, isCourseTeamMemberOrOrgAdmin } from
 
 import { Hono } from '@api/utils/hono';
 import { authMiddleware } from '@api/middlewares/auth';
+import { authOrAutomationKeyMiddleware } from '@api/middlewares/auth-or-automation-key';
 import { courseMemberMiddleware } from '@api/middlewares/course-member';
+import { courseMemberOrAutomationKeyMiddleware } from '@api/middlewares/course-member-or-automation-key';
+import { assertMcpAutomationUsageAllowed, recordMcpAutomationUsage } from '@api/services/organization/automation-usage';
 import { createSubmissionService, listExerciseSubmissionsOverview } from '@api/services/submission';
 import { zValidator } from '@hono/zod-validator';
 
 export const exerciseRouter = new Hono()
   // Exercise CRUD routes
-  .get('/', authMiddleware, courseMemberMiddleware, zValidator('query', ZExerciseListQuery), async (c) => {
-    try {
-      const courseId = c.req.param('courseId')!;
-      const user = c.get('user')!;
-      const { lessonId, sectionId } = c.req.valid('query');
-      const exercises = await listExercises(courseId, { lessonId, sectionId }, user.id);
+  .get(
+    '/',
+    authOrAutomationKeyMiddleware,
+    courseMemberOrAutomationKeyMiddleware(['course:exercise:read']),
+    zValidator('query', ZExerciseListQuery),
+    async (c) => {
+      try {
+        const courseId = c.req.param('courseId')!;
+        const user = c.get('user');
+        const automationKey = c.get('automationKey');
+        const { lessonId, sectionId } = c.req.valid('query');
 
-      return c.json({ success: true, data: exercises }, 200);
-    } catch (error) {
-      return handleError(c, error, 'Failed to list exercises');
+        if (automationKey?.type === 'mcp') {
+          await assertMcpAutomationUsageAllowed(automationKey, 'list_course_exercises');
+        }
+
+        const exercises = await listExercises(courseId, { lessonId, sectionId }, user?.id);
+
+        if (automationKey?.type === 'mcp') {
+          await recordMcpAutomationUsage(automationKey, 'list_course_exercises', { courseId, lessonId, sectionId });
+        }
+
+        return c.json({ success: true, data: exercises }, 200);
+      } catch (error) {
+        return handleError(c, error, 'Failed to list exercises');
+      }
     }
-  })
+  )
   .get('/:exerciseId/submissions', authMiddleware, courseMemberMiddleware, async (c) => {
     try {
       const courseId = c.req.param('courseId')!;
@@ -51,28 +70,65 @@ export const exerciseRouter = new Hono()
       return handleError(c, error, 'Failed to fetch exercise submissions overview');
     }
   })
-  .get('/:exerciseId', authMiddleware, courseMemberMiddleware, zValidator('param', ZExerciseGetParam), async (c) => {
-    try {
-      const { exerciseId } = c.req.valid('param');
-      const user = c.get('user')!;
-      const exercise = await getExercise(exerciseId, undefined, user.id);
+  .get(
+    '/:exerciseId',
+    authOrAutomationKeyMiddleware,
+    courseMemberOrAutomationKeyMiddleware(['course:exercise:read']),
+    zValidator('param', ZExerciseGetParam),
+    async (c) => {
+      try {
+        const { exerciseId } = c.req.valid('param');
+        const user = c.get('user');
+        const automationKey = c.get('automationKey');
 
-      return c.json({ success: true, data: exercise }, 200);
-    } catch (error) {
-      return handleError(c, error, 'Failed to fetch exercise');
+        if (automationKey?.type === 'mcp') {
+          await assertMcpAutomationUsageAllowed(automationKey, 'get_course_exercise');
+        }
+
+        const exercise = await getExercise(exerciseId, undefined, user?.id);
+
+        if (automationKey?.type === 'mcp') {
+          await recordMcpAutomationUsage(automationKey, 'get_course_exercise', {
+            courseId: c.req.param('courseId')!,
+            exerciseId
+          });
+        }
+
+        return c.json({ success: true, data: exercise }, 200);
+      } catch (error) {
+        return handleError(c, error, 'Failed to fetch exercise');
+      }
     }
-  })
-  .post('/', authMiddleware, courseMemberMiddleware, zValidator('json', ZExerciseCreate), async (c) => {
-    try {
-      const data = c.req.valid('json');
+  )
+  .post(
+    '/',
+    authOrAutomationKeyMiddleware,
+    courseMemberOrAutomationKeyMiddleware(['course:exercise:write']),
+    zValidator('json', ZExerciseCreate),
+    async (c) => {
+      try {
+        const data = c.req.valid('json');
+        const automationKey = c.get('automationKey');
 
-      const exercise = await createExercise(data);
+        if (automationKey?.type === 'mcp') {
+          await assertMcpAutomationUsageAllowed(automationKey, 'create_course_exercise');
+        }
 
-      return c.json({ success: true, data: exercise }, 201);
-    } catch (error) {
-      return handleError(c, error, 'Failed to create exercise');
+        const exercise = await createExercise(data);
+
+        if (automationKey?.type === 'mcp') {
+          await recordMcpAutomationUsage(automationKey, 'create_course_exercise', {
+            courseId: c.req.param('courseId')!,
+            exerciseId: exercise.id
+          });
+        }
+
+        return c.json({ success: true, data: exercise }, 201);
+      } catch (error) {
+        return handleError(c, error, 'Failed to create exercise');
+      }
     }
-  })
+  )
   /**
    * POST /course/:courseId/exercise/from-template
    * Creates an exercise from a template
@@ -80,14 +136,19 @@ export const exerciseRouter = new Hono()
    */
   .post(
     '/from-template',
-    authMiddleware,
-    courseMemberMiddleware,
+    authOrAutomationKeyMiddleware,
+    courseMemberOrAutomationKeyMiddleware(['course:exercise:write']),
     zValidator('json', ZExerciseFromTemplate),
     async (c) => {
       try {
         const courseId = c.req.param('courseId')!;
+        const automationKey = c.get('automationKey');
         const { lessonId, sectionId, order, templateId } = c.req.valid('json');
 
+        if (automationKey?.type === 'mcp') {
+          await assertMcpAutomationUsageAllowed(automationKey, 'create_course_exercise_from_template');
+        }
+
         // Fetch template from database
         const template = await fetchTemplateById(templateId);
         if (!template) {
@@ -100,6 +161,14 @@ export const exerciseRouter = new Hono()
 
         const exercise = await createExerciseFromTemplate(courseId, lessonId, sectionId, order, template);
 
+        if (automationKey?.type === 'mcp') {
+          await recordMcpAutomationUsage(automationKey, 'create_course_exercise_from_template', {
+            courseId,
+            exerciseId: exercise.id,
+            templateId
+          });
+        }
+
         return c.json({ success: true, data: exercise }, 201);
       } catch (error) {
         return handleError(c, error, 'Failed to create exercise from template');
@@ -108,8 +177,8 @@ export const exerciseRouter = new Hono()
   )
   .put(
     '/:exerciseId',
-    authMiddleware,
-    courseMemberMiddleware,
+    authOrAutomationKeyMiddleware,
+    courseMemberOrAutomationKeyMiddleware(['course:exercise:write']),
     zValidator('param', ZExerciseGetParam),
     zValidator('json', ZExerciseUpdate),
     async (c) => {
@@ -117,9 +186,14 @@ export const exerciseRouter = new Hono()
         const { exerciseId } = c.req.valid('param');
         const data = c.req.valid('json');
         const courseId = c.req.param('courseId')!;
-        const user = c.get('user')!;
+        const user = c.get('user');
+        const automationKey = c.get('automationKey');
 
-        if (data.isUnlocked !== undefined) {
+        if (automationKey?.type === 'mcp') {
+          await assertMcpAutomationUsageAllowed(automationKey, 'update_course_exercise');
+        }
+
+        if (!automationKey && user && data.isUnlocked !== undefined) {
           const isAuthorized = await isCourseTeamMemberOrOrgAdmin(courseId, user.id);
 
           if (!isAuthorized) {
@@ -136,6 +210,10 @@ export const exerciseRouter = new Hono()
 
         const exercise = await updateExerciseService(exerciseId, data);
 
+        if (automationKey?.type === 'mcp') {
+          await recordMcpAutomationUsage(automationKey, 'update_course_exercise', { courseId, exerciseId });
+        }
+
         return c.json({ success: true, data: exercise }, 200);
       } catch (error) {
         return handleError(c, error, 'Failed to update exercise');