Bug: POST /submissions/{id}/feedback returns 500 - current_user is User object not dict

[nycomp]

Bug Description

The POST /api/v1/submissions/{id}/feedback endpoint tries to call .get('id') on current_user, but current_user is a User object, not a dict. This causes an AttributeError.

Location

• File: campus/api/routes/submissions.py:295
• Route: POST /submissions/{submission_id}/feedback

Error

AttributeError: 'User' object has no attribute 'get'

Root Cause

The route handler expects current_user to be a dict-like object:

if not current_user or not current_user.get('id'):

But the API blueprint's authenticate() function sets current_user to a User object:

flask.g.current_user = auth_result["user"]

Steps to Reproduce

# Via contract test
POST /api/v1/submissions/{submission_id}/feedback
{
  "question_id": "q1",
  "feedback_text": "Great work!"
}
Headers: Authorization: Bearer <valid_token>

Expected Behavior

The endpoint should access the user ID via attribute access (current_user.id) instead of dict access (current_user.get('id')).

This is the same pattern as the assignments bug mentioned in the integration test refactor plan.

Contract Tests Blocked

• tests/contract/test_api_submissions.py::TestApiSubmissionsContract::test_add_feedback_to_submission
• tests/contract/test_api_submissions.py::TestApiSubmissionsContract::test_add_feedback_updates_existing

Both tests are skipped due to this bug.

Related

• Found during Phase 5 of integration test refactor
• Similar to assignments API bug in campus/api/routes/assignments.py:85
• HTTP contract test coverage expansion