Commit just for you, Ralf :)

app/controllers/comments_controller.rb

@@ -0,0 +1,90 @@
+class CommentsController < ApplicationController
+  before_action :set_comment, only: [:show, :edit, :update, :destroy_by_id]
+
+  # disable authorization check. TODO: turn this on later.
+  skip_after_action :verify_authorized
+
+  # GET /comments
+  # GET /comments.json
+  def index
+    #@comments = Comment.all
+    @comments = Comment.where(file_id: params[:file_id])
+  end
+
+  # GET /comments/1
+  # GET /comments/1.json
+  def show
+  end
+
+  # GET /comments/new
+  def new
+    @comment = Comment.new
+  end
+
+  # GET /comments/1/edit
+  def edit
+  end
+
+  # POST /comments
+  # POST /comments.json
+  def create
+    @comment = Comment.new(comment_params.merge(user_type: 'InternalUser'))
+
+    respond_to do |format|
+      if @comment.save
+        format.html { redirect_to @comment, notice: 'Comment was successfully created.' }
+        format.json { render :show, status: :created, location: @comment }
+      else
+        format.html { render :new }
+        format.json { render json: @comment.errors, status: :unprocessable_entity }
+      end
+    end
+  end
+
+  # PATCH/PUT /comments/1
+  # PATCH/PUT /comments/1.json
+  def update
+    respond_to do |format|
+      if @comment.update(comment_params)
+        format.html { head :no_content, notice: 'Comment was successfully updated.' }
+        format.json { render :show, status: :ok, location: @comment }
+      else
+        format.html { render :edit }
+        format.json { render json: @comment.errors, status: :unprocessable_entity }
+      end
+    end
+  end
+
+  # DELETE /comments/1
+  # DELETE /comments/1.json
+  def destroy_by_id
+    @comment.destroy
+    respond_to do |format|
+      format.html { head :no_content, notice: 'Comment was successfully destroyed.' }
+      format.json { head :no_content }
+    end
+  end
+
+  def destroy
+    @comments = Comment.where(file_id: params[:file_id], row: params[:row])
+    @comments.delete_all
+    respond_to do |format|
+      #format.html { redirect_to comments_url, notice: 'Comments were successfully destroyed.' }
+      format.html { head :no_content, notice: 'Comments were successfully destroyed.' }
+      format.json { head :no_content }
+    end
+  end
+
+  private
+    # Use callbacks to share common setup or constraints between actions.
+    def set_comment
+      @comment = Comment.find(params[:id])
+    end
+
+    # Never trust parameters from the scary internet, only allow the white list through.
+    def comment_params
+      #params.require(:comment).permit(:user_id, :file_id, :row, :column, :text)
+      # fuer production mode, damit böse menschen keine falsche user_id uebergeben:
+      params.require(:comment).permit(:file_id, :row, :column, :text).merge(user_id: current_user.id)
+    end
+end

app/controllers/submissions_controller.rb

@@ -20,9 +20,31 @@ class SubmissionsController < ApplicationController
   def create
     @submission = Submission.new(submission_params)
     authorize!
+    copy_comments
     create_and_respond(object: @submission)
   end
 
+  def copy_comments
+    # copy each annotation and set the target_file.id
+    unless(params[:annotations_arr].nil?)
+      params[:annotations_arr].each do | annotation |
+        comment = Comment.new(:user_id => annotation[1][:user_id], :file_id => annotation[1][:file_id], :user_type => 'InternalUser', :row => annotation[1][:row], :column => annotation[1][:column], :text => annotation[1][:text])
+        source_file = CodeOcean::File.find(annotation[1][:file_id])
+
+        #comment = Comment.new(annotation[1].permit(:user_id, :file_id, :user_type, :row, :column, :text, :created_at, :updated_at))
+        target_file = @submission.files.detect do |file|
+          # file_id has to be that of a the former iteration OR of the initial file (if this is the first run)
+          file.file_id == source_file.file_id || file.file_id == source_file.id #seems to be needed here: (check this): || file.file_id == source_file.id
+        end
+
+        #save to assign an id
+        target_file.save!
+
+        comment.file_id = target_file.id
+        comment.save!
+      end
+    end
+
   def download_file
     if @file.native_file?
       send_file(@file.native_file.path)