education/classroom

GitHub Classroom automates repository creation and access control, making it easy for teachers to distribute starter code and collect assignments on GitHub.

GitHub Classroom

---

Moving forwards, GitHub Classroom will be developed internally alongside GitHub.com. As a result, we’re archiving the open source repository. This represents a significant “growing up” moment for GitHub Classroom as we strive to offer you the best education tools possible.

We’re making this decision for a few important reasons:

1. Quality. To provide the best services to our varied and global community, we need GitHub Classroom to meet the operational excellence of GitHub.com. Continuing development internally allows us to make better use of GitHub’s internal resources, tooling, and infrastructure.

2. Better support. Using GitHub Support as our primary feedback mechanism, instead of issues, allows us to assist our users in a more productive way. We can leverage the support infrastructure already in place for GitHub.com, and all user feedback can be kept in a single place. The Education team will continue to respond to all GitHub Classroom requests.

GitHub Classroom will continue to evolve and improve based on your feedback. We’re growing faster than ever, and can’t wait to launch some very exciting new features in the coming months.

If you have questions, concerns, or feedback, don’t hesitate to contact us at https://support.github.com/contact.

Thank you!

The GitHub Classroom Team

---

Table of Contents

• The workflow you use as a developer, scaled for the needs of students.
• Why try GitHub Classroom?
• Design principles
• GitHub Classroom and the edtech ecosystem
• The technical details
• Deployment
• Help wanted
• Contributors

The workflow you use as a developer, scaled for the needs of students.

Developers rarely work all by themselves, on a deadline, or ship something they’ll only use once (with no idea whether it actually works).

Wouldn’t students be better served by showing versions of their work, iterating, checking in on milestones and showing off the final product?

With GitHub Classroom you can set up the industry-standard workflow and free up your time to focus on teaching.

GitHub Classroom is a teacher-facing tool that uses the GitHub API to enable the GitHub workflow for education.

You create an Assignment with starter code and directions, send along one link, and students get their own “sandbox” copy of the repo to get started.

Set due dates, track assignments in your teacher dashboard, or integrate other tools like testing frameworks.

With GitHub Classroom, you can spin up your course on GitHub and move on to the good stuff.

@johndbritton, @mozzadrella, @d12, @benemdon, @srinjoym, and @tarebyte, are all maintainers.

Why try GitHub Classroom?

Spend more time with students, less on setup. Students accept an assignment with one link, so you can get straight to the material.

Bootstrap group assignments in a snap. Invite students to a shared repository, and cap the number of students per group. Use the same groups over and over again, or create new ones.

More insight into student work than ever before. See when students accept the assignment, and access their work from the moment they start. With version control, catch when they get stuck and help them rewind.

You are in control. Students can work individually or in groups, in public or in private. Invite teaching assistants or graders to view the assignments.

Scales for large courses with ease. If you have a small course, GitHub Classroom will make your life easier and save you time. If you have hundreds of students, we have you covered: as many repositories as you need, and webhooks to integrate automated testing tools.

Works with your Learning Management System (LMS). Students submit a link to their assignment repository to your learning management system. Give feedback through comments in GitHub, but keep grades in your LMS.

You’re not alone. The experts on the GitHub Education team are here to answer any of your questions, and we’ve got docs, best practices, and a strong community of educators to help you migrate to GitHub Classroom.

Are you super-advanced? Do you want to build your own tools? We 💖 contributions. Please check out contributing guidelines.

Design principles

GitHub Classroom is a teacher-facing tool to simplify the educational use of GitHub. Every student needs feedback and support as they learn to code, and using GitHub you can give them the right advice, in the right place, at the right time. GitHub Classroom makes it easier to use the workflow you love, with some automation and ease for student use.

Students use GitHub. They don’t use GitHub Classroom. Experience with real-world tools gives students a leg-up once they move on from school. Invest time in the tools students can grow with, not another third-party tool with its own learning curve.

GitHub Classroom is not an LMS (Learning Management System). If you need to use an LMS like Canvas, Moodle or Blackboard, we hear you. Students can post their repositories to your LMS. We’re going to stick with what we’re good at, which is helping people collaborate on code.

GitHub Classroom is open source. Git and GitHub are versatile with many ways to meet your learning goals, and we want to model the open source process that makes our communities great.

We welcome contributions aligned with the roadmap below and through answering these questions:

• Does it enable the real-life experience of using GitHub as a developer?
• Does it replicate functionality that's best left to the expertise of content platforms, hardware or LMS?
• How many support tickets and questions will the feature address?

Who is GitHub Classroom for?

Anyone teaching computer science in a high school, university or informal environment. Folks who might also find GitHub Classroom useful:

• Higher ed statistics and data science teachers
• Higher ed biology and the hard sciences

GitHub Classroom and the edtech ecosystem

In case you’re wondering “How does GitHub Classroom interact with my favorite app/my notebook/my LMS” here’s the tl;dr on how those pieces fit together:

Apps and content platforms

Examples: Codecademy, Skillshare, Udemy, Udacity

Apps offer premium content and interactive exercises. GitHub Classroom offers real-world experience with code. GitHub Classroom, as a teacher-facing application will eventually surface best-in-class content for top courses (notes / lectures / problem sets) but not produce original content.

Learning Management system/LMS

Examples: Blackboard, Moodle, Canvas. Google Classroom

Teachers often use a learning management system in keeping with student privacy regulations. GitHub Classroom has a lightweight integration with LMS ecosystem--students can submit a link to their repositories. LTI compliance and Google Classroom integration will make the app more extensible.

Notebooks

Examples: BlueJ, Jupyter, RStudio

Most notebooks have a Git integration that students can push to. Future iterations may pre-populate repos with robust directions on set up.

Hardware

Examples: Chromebooks, Raspberry Pi, Lego

GitHub Classroom runs in Unix environments and Windows. Shared machines or lab environments are encouraged to use cloud-based environments, like Cloud 9. Integration looks like Git and GitHub pre-loaded + embedded in hardware.

Assessment

Examples: Pearson, Travis CI, Circle CI

For GitHub Classroom, assessment is directly related to the real-world experience of being a developer: your code passes tests. Configuring folders in student repositories is a priority on the roadmap.

The technical details

GitHub Classroom is a Ruby on Rails application.

New to Ruby? No worries! You can follow these instructions to install a local server.

macOS

If you're using macOS and running the Homebrew package manager you're all set to go! Head down to Setup GitHub Classroom

Linux

Installing Docker and Docker Compose

We use Docker and docker-compose so that we don't have to setup our external dependencies on our machines.

Here is the installation guide for Ubuntu: https://docs.docker.com/install/linux/docker-ce/ubuntu/

Installing Rbenv

First things first, you'll need to install Ruby. We recommend using the excellent rbenv, and ruby-build.

Install PostgreSQL

In order to install the pg gem you have to have PostgreSQL on your system, all you need to do is install it via your package manager of choice.

If you're running an Debian/Ubuntu based GNU/Linux for example run: apt-get install nodejs postgresql redis-server memcached.

Windows

We really don't have a good story for running this on Windows, but Pull Requests are welcome 😄

Setup GitHub Classroom

We follow the script to rule them all principle, so all you need to do is run:

script/setup

Once that's done the script will kindly remind you to fill out you .env file inside the repository, this is the breakdown.

Development environment variables

These values must be present in your .env file (created by script/setup).

ENV Variable	Description
CLASSROOM_WEBHOOK_URL_PREFIX	Ngrok url to receive webhooks (run ./script/ngrok).
GITHUB_CLIENT_ID	the GitHub Application Client ID.
GITHUB_CLIENT_SECRET	the GitHub Application Client Secret.
NON_STAFF_GITHUB_ADMIN_IDS	GitHub user_ids of users to be granted staff level access.
GOOGLE_CLIENT_ID	the Google Client ID
GOOGLE_CLIENT_SECRET	the Google Client Secret

To obtain your GitHub Client ID/Secret you need to register a new OAuth application.

After you register your OAuth application, you should fill in the homepage url with http://localhost:5000 and the authorization url with http://localhost:5000/auth/github/callback.

To obtain your GitHub User ID for the NON_STAFF_GITHUB_ADMIN_IDS field, go to https://api.github.com/users/your_username

To obtain your Google Client ID/Secret you will need to create a new web application. When creating credentials choose OAuth Client ID, then fill in the Authorized JavaScript origins with http://localhost:5000 and the Authorized redirect URIs with http://localhost:5000/auth/github/callback.

After creating your Google credientials, add the Google Classroom scopes of:

• https://www.googleapis.com/auth/classroom.courses.readonly
• https://www.googleapis.com/auth/classroom.rosters.readonly

Testing environment variables

If you want to make a functionality change to the application you will need to write tests to accompany that change. In order to do this, the test values in the .env file must be filled in.

GitHub Classroom uses VCR for recording and playing back API fixtures during test runs. These cassettes (fixtures) are part of the Git project in the spec/support/cassettes folder. If you're not recording new cassettes you can run the specs with existing cassettes with:

script/test

GitHub Classroom uses environmental variables for storing credentials used in testing, these values are located in your .env file (created by script/setup). If you are recording new cassettes, you need to make sure all of these values are present.

ENV Variable	Description
TEST_CLASSROOM_OWNER_GITHUB_ID	GitHub user_id of an organization admin (classroom owner)
TEST_CLASSROOM_OWNER_GITHUB_TOKEN	OAuth Access Token for GitHub Classroom on behalf of the test classroom owner
TEST_CLASSROOM_STUDENT_GITHUB_ID	GitHub user_id of the student
TEST_CLASSROOM_STUDENT_GITHUB_TOKEN	OAuth Access Token for GitHub Classroom on behalf of the test student
TEST_CLASSROOM_OWNER_ORGANIZATION_GITHUB_ID	GitHub ID of classroom organization (preferably one created specifically for testing against)
TEST_CLASSROOM_OWNER_ORGANIZATION_GITHUB_LOGIN	GitHub login of classroom organization (preferably one created specifically for testing against)

To obtain these values you will need:

• A teacher (your primary GitHub account)
• A student (another Github account, created for this purpose)
• An organisation that the teacher is an owner of, but the student does not belong to.

It is best if you create your own organization for testing purposes, if you have done so:

To obtain the OWNER_GITHUB_ID value, you can go to https://api.github.com/users/organization_owner_username.

To obtain the OWNER_GITHUB_TOKEN value, you will need to log in to GitHub Classroom with the owner test account, pull up the Rails console, and copy the token field

To get the STUDENT_GITHUB_ID value you will need to create another user account on GitHub and get the ID by going to https://api.github.com/users/student_username

To get the STUDENT_GITHUB_TOKEN value, you will need to log in to GitHub Classroom with the student test account, pull up the Rails console, and copy the token field

To obtain the OWNER_ORGANIZATION_GITHUB_ID/LOGIN you can go to https://api.github.com/orgs/organization_name.

Now you should have all of the values filled in, great job!

Running the application

Optional

If you'd like to receive webhooks from GitHub you can run:

script/ngrok

And update the WEBHOOK_URL in your .env file.

And if you want to play with features that are still in development run:

./bin/rake enable_features

Necessary

After that, you may start the rails server in a separate terminal with:

script/server

Aaand that's it! You should have a working instance of GitHub Classroom located here

Debugging

We use pry-rails and byebug for debugging. But since we use overmind in the development environment, debugging via byebug or via binding.pry requires a few more steps:

• Once you start your server using script/server, overmind will start tmux processes depending on the Procfile.
• We have two such processes rails and sidekiq (See Procfile.dev for details) that you can control.
• Once you've added a debugging statement in the code and your request pauses, you can access console in a separate tab/window using the following command:
  • overmind connect rails for debugging in request-response cycle, typically controllers, models, services.
  • overmind connect sidekiq for debugging in background jobs.
• After you've finished debugging you can close the connection using Ctrl+b d.

For more details please visit overmind homepage: https://github.com/DarthSim/overmind

Deployment

We strongly encourage you to use https://classroom.github.com, but if you would like your own version GitHub Classroom can be easily deployed to Heroku.

There are a few environment variables you will need to know in order to get GitHub Classroom working on production.

Production environment variables

ENV Variable	Description
CANONICAL_HOST	the preferred hostname for the application, if set requests served on other hostnames will be redirected
GOOGLE_ANALYTICS_TRACKING_ID	identifier for Google Analytics in the format UA-.*
PINGLISH_ENABLED	Enable the /_ping endpoint with relevant health checks
MOTD	Show the message of the day banner at the top of the site

Help wanted

If you're interested in helping out with GitHub Classroom development and looking for a place to get started, check out the issues labeled help-wanted and feel free to ask any questions you have before diving into the code.

Contributors

GitHub Classroom is developed by these contributors.

Shout out to GitHub Summer of Code student, Mark Tareshawty, from The Ohio State University for his work on GitHub Classroom.

classroom's Issues

Creating a Group Assignment

This has all of the same options as the Individual Assignment (#86) but the user has to either create a new group of teams, currently known as a grouping, or choose an existing one.

The grouping aspect isn't really super clear at this point, and I'm not really sure what's the best way to show that to the user.

Landing Page

When the user hits Classroom for the first time, this is what they currently see. I'm not entirely sure what to do with this, but it could possibly be a page to show off the highlights of the app.

Most common use cases for GitHub by educators?

According to http://education.github.com there are two common ways for handling assignments.

• Forks
• Sandboxing

I know personally the classes that I graded for practiced sandboxing, but that may not be the most common use case.

Is there any research or data that could give us an insight as to what method(s) would be most useful to have? My goal would be to eventually handle the most common use cases, but I'd like to at least get the one that helps the most people to fit into current summer timeline.

Individual and Group Assignments Settings

So there isn't a setting page yet for either Individual Assignments or Group Assignments.

What we can currently do is the following.

• Rename the assignment
• Destroy the assignment
• Regenerate the Invitation URL

If you destroy either type of assignment it WILL delete all of the github repositories that were created with it. Probably a good idea to warn them.

CSRF in AssignmentInvitationsController#accept_invitation

AssignmentInvitationsController#accept_invitation uses a GET requests. This should be a POST. Otherwise, an attacker could post an image like

<img src="https://myclassroomapp.com/assignment_invitations/f772b522f9622307106fb91b7afe745d/accept_invitation">

on another site, forcing every Classroom user visiting the page to accept the invitation.

AssignmentInvitationsController#show should require confirmation

Browsing to AssignmentInvitationsController#show fires JavaScript that accepts the invitation. It would be good to require some user interaction. Otherwise, any use can be sent to the URL and will be added to the org, added to the team, etc...

Creating a new Individual Assignment

When a user creates a new Individual Assignment they can give it a name, choose whether the assignment repos will be public or private and choose a repository for starter code if they want to.

Assignment Relationships

@johndbritton This is just an overview of the relationships as I view them for individual and group assignments.

Let me know what you think. (interaction diagram coming soon)

                               +----------------------------------+
+-------------------------+    | Organization                     |
| User                    |    |                                  |
|                         |    | has_many: individual_assignments |
| has_many :repo_accesses |    | has_many: group_assignments      |
| github_user_id          |    | has_many: repo_accesses          |
+-------------------------+    +----------------------------------+

                    +--------------------------+                   
                    | RepoAccess               |                   
                    |                          |                   
                    | belongs_to :organization |                   
                    | belongs_to :user         |                   
                    | github_team_id           |                   
                    +--------------------------+                   

+----------------------+                +-------------------------+
| AssignmentRepo       |                | GroupAssignmentRepo     |
|                      |                |                         |
| has_one :repo_access |                | has_many :repo_accesses |
| github_repo_id       |                | github_repo_id          |
+----------------------+                +-------------------------+

                               +----------------------------------+
+----------------------------+ | Grouping                         |
| IndividualAssignment       | |                                  |
|                            | | has_many :group_assignment_repos |
| has_many :assignment_repos | | title                            |
+----------------------------+ +----------------------------------+

                                              +-------------------+
                                              | GroupAssignment   |
                                              |                   |
                                              | has_one :grouping |
                                              +-------------------+

User has too many organizations

As discussed in chat, there may be a case where the user has more than one page of organizations. The new page for Organizations should be able to take care of that.

List submissions on assignment page

There should be a list of links to all the repositories that represent assignment submissions on the assignment page:

Accept Organization invitation on behalf of the student

According to https://developer.github.com/v3/orgs/members/#edit-your-organization-membership you can update your membership state from pending to active.

This should happen so that the student doesn't have to check their email

What I'm working on

This is just a running issue list of what I'm working on / what I will be working on.

Classroom

Done

• Add GitHub organization (classroom), with proper user relationships
• Give users the ability to add their classroom only if they are an owner
• Allow students to join the classroom through an invitation url, which adds them to a students team which consists of all students
• Allow teachers to create an assignment
• Make sure a teacher cannot create an assignment without adding a designated students team first
• Move invitations to assignments
• When a student accesses Classroom for the first time, add them to the students team, and add them to their own personal team. Then create the assignment, then naming convention TBD.

  ---

What I'm working on...

• Group Assignments
• Caching and error handling

---

Next Up

• Everything else that goes with Assignments
• ... TBD

Individual Assignment or Group Assignments Page

Currently on an assignment page, the user can only see the invitation url for their assignment.

I still need to include the settings page see #84

There isn't a whole bunch here, but there is some information that may be useful to the teacher that we have access too. Such as how many student/teams have created their assignment and when they created their assignments.

We also have the ability to delete individual assignments on a per team/per student basis. I'm not sure if that should be another page off the assignments page or it should be on this page.

Group Assignment Invitation Page

When the student goes to a Group Assignment Invitation Page, they currently see this.

Or if there already existing teams, then they see this

This allows them to create a new team or join an already existing team after they create their team and it all goes well, they see this.

Assignment invitation success page

When a student successfully accepts an assignment, we should provide some useful information and a link for them to go to their repository.

Right now, they just get a message that says "Success."

Would be better to say something like: "Your repository for #{assignment.name} has been created at https://github.com/#{org}/#{repo}."

License?

Wasn't entirely sure what license should be used for this project. I would assume MIT copyright to GitHub but I didn't want to make assumptions.

Update invitation template if there isn't anyone to invite

Explain individual vs group assignments

On the new assignment page we should explain a bit more:

Maybe something like this:

Individual assignment - Each student works independently
Group assignment - Students work in self-selecting groups

Copy invitation doesn't work

The clipboard link on the invitation link doesn't copy the url to the clipboard.

Design Halp

❤️ 💚 💜

• Logo/Branding #42
• Landing Page #77
• Dashboard Layout #61
• Organizations #78
  • Invite Admins #79
  • Settings #85
• New Assignment #80
• Assignments
  • Creation #86
  • Main Page #81
  • Invitation Page #82
  • Settings #84
• Group Assignments
  • Creation #87
  • Main Page #81
  • Invitations Page #83
  • Settings #84

Can add any user to an organization

OrganizationsController#invite_users doesn't check that the id of the user being invited is actually part or the organization. This can be used to add arbitrary users to your organization. This could be an abuse vector since the new organization will show up on the user's dashboard and they will have no way to leave the organization. For example, when they go to their dashboard they might see:

The controller should check that the user being invited is actually a member of the GitHub organization.

Organization Page

Each user can have many Organization that are apart of Classroom. When a user chooses their organization on Classroom, this is what it looks like right now.

From this page a user should be able click on creating a new assignment (Individual or Group) see assignments that exist, or invite other Org admins to join classroom. See (issue about invitations)

Logout should be a POST request

The /logout endpoint should require a POST request. Currently, someone could CSRF this endpoint by including an image like <img src="https://classroomdomain.com/logout"> on another domain to log users out. This is quite low risk, but is an easy fix.

Dashboard Layout

This is the first page of the application, currently the user only has the ability to click on their already added Organizations, or add one to Classroom.

It currently looks like this when there aren't any organizations added.

This is what it looks like with one or more organizations.

Landing Page

The current state of the front page.

It would be awesome if it looked like an extension of GitHub Education.

Organization page blankslate

After connecting my organization to Classroom, I end up on a page with a "create assignment" button. We should probably add a blankslate explaining that no assignments have been created.

Org invitations are a spam vector

Organization invitations can be sent to any email address. The content of the invitation can be hijacked by modifying the Organization title, which can be quite long and even contain newlines:

Creating an org with newlines in the title:

POST /orgs/free-viagra HTTP/1.1

utf8=%E2%9C%93&_method=patch&authenticity_token=[redacted]&organization%5Btitle%5D=Free+Viagra%21%21%21%21+https%3A%2F%2Fsketchy.site%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d&commit=Update+Organization

Sending spam to any email address:

POST /orgs/free-viagra/invite-users HTTP/1.1

utf8=%E2%9C%93&_method=patch&authenticity_token=[redacted]&github_owners%5Bmastahyeti%5D=1144197&github_owner_emails%5Bmastahyeti%5D=[redacted]@gmail.com&commit=Invite

Spam!!!

This one is kind of hard to solve. Some options are:

1. Only send emails to addresses listed on the invited user's GitHub profile.
2. Implement some kind of rate limiting and spam detection.

Project Timeline

This is the original timeline from my GSoC proposal. Just throwing it in here for feedback and my own edits.

Timeline

April 27th through May 25th
Getting to my mentors and flesh out the projects requirements, security concerns, and goals. I will also take this time to work on the application's design so that I have preliminary mockups to work from when I start building on week 0.

Week(s)	What I'll be working on
0-1	Configure the application for development and deployment (CI, database, etc) Setup any other needed systems (AWS etc) Create a basic styles and templating globally for the application Setup GitHub Authentication for the app and permissions for security Adapt teachers_pet to work on the web application
2-3	Give users the ability to: Upload CSV files Add students to organization and create teams I will also work on validation for the CSV file and present errors if need be Style sections as needed
4-5	Give users the ability to: Select project repos to push to students Create assignments repos for students/teams Style sections as needed
6-7	Give users ability to: Push template files from previously chosen repository Create easy to copy git clone command to pull down students projects Style sections as needed
8-9	Give users the ability to: Open an issue across all projects Give feedback to teams. See who has forks of a particular project Merge multiple pull requests for one project Style sections as needed
10-11	Testing, bug fixes, and changes as necessary Finalize documentation and README Verify deployment works and users can contribute easily

Add pagination to listing pages

It looks like the listing pages don't have any pagination right now. It's probably fine at the moment, but once we see some larger classes or teachers using it semester after semester, it will become necessary.

eval() is a code smell

While it isn't a vulnerability in this case, eval() gives security people heart palpitations. Instead of

invitation_path = eval("#{invitation.class.name.underscore}_path('#{invitation.key}')")

you could do

invitation_path = send("#{invitation.class.name.underscore}_path", invitation.key)

or better yet

invitation_path = case invitation
  when Assignment
    assignment_path invitation.key
  when GroupAssignment
    group_assignment_path invitation.key
end

Private assignment with no private repositories available

Creating a private assignment if there are no private repositories available results in a poor experience:

Application Design

I'd like to get feedback as to where in the process this application should be designed. I'm a fan of at least doing some general template design work done near the beginning.

Also since this is a GitHub sponsored open source project what about using Primer as a starting point for styling?

App layout

I'd love some help and feedback on the general layout of these pages. Here are some of the app flows and the pages that go along with them.

Current User Dashboard

For Classroom, teachers can add their organization so that they can manage their assignments and invite students. Currently the dashboard allows them to add and organization and then choose from the list of orgs after they have been created.

Adding an organization flow

Choose your organization

It takes you to the organization page (you then have to click the Classroom link or the dashboard link to get back the dashboard)

You could also click the edit link and it will take you to the edit page

Consider rack-canonical-host

https://github.com/tylerhunt/rack-canonical-host

Require SSL and redirect all domains to one official domain.

Syncing users with their organizations

Currently the only way that a user can see the classroom is if they add the organization themselves.

Add ensure_logged_in before filter to ApplicationController

For an app in which most endpoints require authentication, it's a good idea to check authentication in the ApplicationController and have unauthenticated actions opt-out via skip_before_filter. This makes it harder to forget to add the authentication check when adding a new controller.

Individual Assignment invitation page

When a student goes to the individual assignment invitation url, they are greeted with this

This creates their assignment and sets up their team. Currently it will give them an error message or return their GitHub Repo URL for them to go to.

Logo / Branding

Right now this is the logo for Classroom

I know other GitHub open source projects like https://notifications.githubapp.com/ have a logo with the GitHub mark and the name of the app.

Can we do something similar? Or if not I'm totally open to suggestions.

Bit.ly discloses all assignment URLs

By taking one of the Bit.ly links generated by the application, I was able to use the Bit.ly link info API to find out whose account created the Bit.ly link. From there I was able to use the user link history API to find a listing of Bit.ly links generated by this user. This gives me the invitation URLs for all assignments.

Inviting new Org Admins to Classroom

When a user creates an Organization if there are other admins that they want to add, they have the option of doing so after they add their Organization or later on from the Organizations page.

The GitHub API doesn't allow us to see a users email if it isn't public so I had to give them optional text boxes.

Caching API Requests

Currently we aren't caching any of the requests, when I deployed the application to Heroku I didn't notice any performance lags.

However this is something that should be looked into more, as the application grows and we use more end points.

Selecting between an Individual Assignment or a Group Assignment

When you choose to create a new assignment from the Organization Page, you can choose to create one of the following

• Individual Assignment (each student gets their own repository)
• Group Assignment (students are in teams and those teams each get a repo)

Currently the selection looks like this:

Organizations Settings Page

The Organizations Settings page currently looks like this

The user can rename their Organization on Classroom, or they can remove it from Clasroom. This WILL delete all both types of assignments, delete all of the repos, and delete all of the teams created by Classroom for that org.

Definitely a dangerzone scenario.

Organization missing from add organization dropdown

I'm trying to add my organization, https://github.com/classroom. For some reason it's not showing in the dropdown. ❓

Creating new team causes application error

Visiting an assignment URL for a group assignment with starter code of rails/rails gives an application error after trying to join a new team.

URL: https://classroom-staging.herokuapp.com/group_assignment_invitations/5ba3f9f295292f846c56bcd72bc9ba56/accept_invitation

Don't really have any more insight into the issue.

Launch Check List

• Domain name classroom.github.com ⚡
• Google Analytics
• Blog Post
• Heroku app
• Documentation
• No blocking issues

/cc @johndbritton

Blankslate text confusing

I just connected my GitHub account to Classroom and landed on the blankslate page with this:

This classroom has no organizations. Add one now.

The statement makes me think that I'm in my classroom and I might have multiple organizations for my classroom. I think it would be better stated as something along the lines of:

You're not managing any GitHub organizations with Classroom. Add an organization to get started.

Show organization login on organization page

In this case my organization title is "August 2015" but there's no indication of the organization login on the page. I think it might be confusing to users to have a separate title from the actual organization login. Perhaps we should show @classroom next to the title?

Can create an Organization for any GitHub organization

The OrganizationsController#create endpoint doesn't check that the current user has access to the GitHub organization they are creating an Organization for. An attacker can create an Organization for any GitHub organization by modifying the organization[github_id] POST parameter.

This request creates an Organization for the @classroom GitHub organization:

POST /orgs HTTP/1.1

utf8=%E2%9C%93&authenticity_token=[redacted]&organization%5Btitle%5D=some+title&organization%5Bgithub_id%5D=13029875&commit=Add+Organization

The application should check that the current user is an admin of the GitHub organization.

OrganizationAuthorizedConstraint doesn't work

OrganizationAuthorizedConstraint searches the URL path for the first set of numeric characters and tries to look up an org with an id matching these digits. If no organization is found the check fails open. The OrganizationsController#set_organization method uses Organization.find(params[:id]) to lookup organizations. Because of FriendlyId, this can take a slug instead of a numeric id. The result is that authorization is not checked for URLs using the org slug instead of a numeric ID.

The authorization check should be moved to the controller level and the organization should be looked up in the same way as elsewhere in the controller. The check should also fail closed if the organization can't be found.