Tutorial groups: migrate tutorial group REST responses to DTOs

[WoH]

Summary

Migrate tutorial group list and free period REST responses away from entities to dedicated DTOs and enforce zero DTO architecture violations in the tutorial group module.

Checklist

General

• I tested all changes and their related features with all corresponding user types on a test server.
• This is a small issue that I tested locally and was confirmed by another developer on a test server.
• Language: I followed the guidelines for inclusive, diversity-sensitive, and appreciative language.
• I chose a title conforming to the naming conventions for pull requests.

Server

• Important: I implemented the changes with a very good performance and prevented too many (unnecessary) and too complex database calls.
• I strictly followed the principle of data economy for all database calls.
• I strictly followed the server coding and design guidelines and the REST API guidelines.
• I added multiple integration tests (Spring) related to the features (with a high test coverage).
• I added pre-authorization annotations according to the guidelines and checked the course groups for all new REST Calls (security).
• I documented the Java code using JavaDoc style.

Motivation and Context

The tutorial group module still returned JPA entities directly from several REST endpoints and still allowed remaining entity-usage architecture violations. This PR completes the tutorial group backend migration for the affected list and free period responses and updates the architecture test to enforce zero remaining violations.

Description

• add TutorialGroupSummaryDTO for GET /api/tutorialgroup/courses/{courseId}/tutorial-groups
• add TutorialGroupFreePeriodDTO for tutorial group free period read/create/update responses
• remove the unused Java-side TutorialGroupUpdateDTO
• change the session resource helper to return only a ZoneId, which removes the last remaining entity return violation inside the tutorial group REST controllers
• update tutorial group integration tests to deserialize and assert DTO responses
• restore privacy assertions for hidden tutorial group information and clear the corresponding flattened transient fields when privacy-sensitive information is hidden
• set tutorial group architecture allowances to zero
• manually verified that current Angular consumers of GET /courses/{id}/tutorial-groups use the flat fields and do not depend on nested teachingAssistant, course, or registrations from that response

Steps for Testing

Prerequisites:

• 1 course with tutorial groups enabled
• 1 tutorial groups configuration with at least 1 free period
• at least 2 tutorial groups in the same course
• 1 tutor assigned to exactly one of those tutorial groups
• 1 student registered in a tutorial group
• 1 student user, 1 editor user, 1 tutor user, 1 instructor user

1. Log in as an instructor and navigate to Course Administration -> Tutorial groups for the prepared course.
2. Verify that the tutorial groups table loads without errors.
3. Verify that existing values still render correctly in the table, especially tutor name, registration count, schedule, next session, and channel information.
4. In the same management view, open the free periods area.
5. Create a new tutorial group free period and verify it is created successfully and shown in the UI with the expected start, end, and reason.
6. Edit that free period and verify the updated values are shown correctly afterwards.
7. Delete the free period again and verify it disappears from the UI.
8. While still logged in as the instructor, open the browser network tab and inspect the response body of GET /api/tutorialgroup/courses/{courseId}/tutorial-groups.
9. Verify that the response objects use the flat DTO shape and do not contain nested entity objects such as teachingAssistant, course, or registrations.
10. Verify that the instructor still receives the expected flat private-information fields such as numberOfRegisteredUsers, teachingAssistantName, teachingAssistantId, and courseTitle.
11. Log in as the tutor who is assigned to exactly one tutorial group in the course and inspect the same GET /api/tutorialgroup/courses/{courseId}/tutorial-groups response.
12. Verify that the tutor's own group still contains the expected flat private-information fields.
13. Verify that another group in the same course still hides those private-information fields.
14. Log in as an editor in the same course and inspect the same response.
15. Verify that the response still uses the flat DTO shape and that the private-information fields are hidden for all groups.
16. Log in as a student in the same course, open the tutorial groups overview, and verify the page still loads without errors.
17. Inspect the same GET /api/tutorialgroup/courses/{courseId}/tutorial-groups response as the student and verify that the response still uses the flat DTO shape and that the private-information fields are hidden for all groups.

Testserver States

• Not tested on a test server in this session.

Review Progress

Performance Review

• I (as a reviewer) confirm that the client changes (in particular related to REST calls and UI responsiveness) are implemented with a very good performance even for very large courses with more than 2000 students.
• I (as a reviewer) confirm that the server changes (in particular related to database calls) are implemented with a very good performance even for very large courses with more than 2000 students.

Code Review

• Code Review 1
• Code Review 2

Manual Tests

• Test 1
• Test 2

Exam Mode Test

• Test 1
• Test 2

Performance Tests

• Test 1
• Test 2

Test Coverage