Lab editing and group grades

- academic-service: PUT /labs/{id} (title, deadline, defense, points, status,
  description), POST/PUT/DELETE variants endpoints
- progress-service: lab_grades table, POST/GET /api/v1/grades, GET /me/grades
- gateway: routes for /api/v1/assign and /api/v1/grades
- web: lab edit page (metadata + per-variant forms + add/delete variant)
- web: group page shows grades matrix per lab with editable score inputs
  and computed average column
- web: student dashboard renders statement via markdown, shows deadline

web/src/main/kotlin/ru/ysu/lms/web/admin/AdminController.kt

@@ -16,7 +16,10 @@ import org.springframework.web.servlet.mvc.support.RedirectAttributes
 import ru.ysu.lms.web.api.ApiClient
 import ru.ysu.lms.web.api.ApiException
 import ru.ysu.lms.web.api.AssignVariantPayload
+import ru.ysu.lms.web.api.GradeSetPayload
 import ru.ysu.lms.web.api.LabImportResultDto
+import ru.ysu.lms.web.api.LabUpdatePayload
+import ru.ysu.lms.web.api.VariantSavePayload
 import ru.ysu.lms.web.api.DistributeResultDto
 import ru.ysu.lms.web.api.LevelAssignPayload
 import ru.ysu.lms.web.api.LevelAssignmentResultDto
@@ -90,10 +93,45 @@ class AdminController(private val api: ApiClient) {
         session: HttpSession,
         model: Model,
     ): String {
-        model.addAttribute("group", api.groupDetail(token(session), id))
+        val t = token(session)
+        val group = api.groupDetail(t, id)
+        val labs = api.listLabs(t)
+        val grades = api.listGrades(t)
+        val gradeBy = grades.associate { "${it.studentId}|${it.labId}" to it.score }
+        val studentGrades = group.students.map { s ->
+            val scores = labs.map { lab -> gradeBy["${s.id}|${lab.id}"] }
+            val nums = scores.mapNotNull { it?.toBigDecimalOrNull() }
+            AdminStudentGrades(
+                studentId = s.id,
+                fullName = s.fullName,
+                studentNo = s.studentNo,
+                scores = scores,
+                average = if (nums.isEmpty()) null else nums.map { it.toDouble() }.average(),
+            )
+        }
+        model.addAttribute("group", group)
+        model.addAttribute("labs", labs)
+        model.addAttribute("studentGrades", studentGrades)
         return "admin/group"
     }
 
+    @PostMapping("/groups/{id}/grades")
+    fun setGrade(
+        @PathVariable id: String,
+        @RequestParam studentId: String,
+        @RequestParam labId: String,
+        @RequestParam score: String,
+        session: HttpSession,
+        redirect: RedirectAttributes,
+    ): String = try {
+        api.setGrade(token(session), GradeSetPayload(studentId, labId, score))
+        redirect.addFlashAttribute("notice", "Оценка сохранена")
+        "redirect:/admin/groups/$id"
+    } catch (ex: ApiException) {
+        redirect.addFlashAttribute("error", ex.message)
+        "redirect:/admin/groups/$id"
+    }
+
     @PostMapping("/groups/{id}/students/{studentId}/reset-password")
     fun resetPassword(
         @PathVariable id: String,
@@ -228,6 +266,77 @@ class AdminController(private val api: ApiClient) {
         "redirect:/admin/labs/$labId"
     }
 
+    @GetMapping("/labs/{id}/edit")
+    fun editLabForm(
+        @PathVariable id: String,
+        session: HttpSession,
+        model: Model,
+    ): String {
+        val lab = api.labDetail(token(session), id)
+        // datetime-local требует формат yyyy-MM-dd'T'HH:mm
+        model.addAttribute("lab", lab)
+        model.addAttribute("deadlineLocal", lab.deadlineAt?.take(16) ?: "")
+        model.addAttribute("defenseLocal", lab.defenseAt?.take(16) ?: "")
+        return "admin/lab-edit"
+    }
+
+    @PostMapping("/labs/{id}/edit")
+    fun editLab(
+        @PathVariable id: String,
+        @RequestParam title: String,
+        @RequestParam(required = false) deadlineAt: String?,
+        @RequestParam(required = false) defenseAt: String?,
+        @RequestParam pointsMax: String,
+        @RequestParam status: String,
+        @RequestParam descriptionMd: String,
+        session: HttpSession,
+        redirect: RedirectAttributes,
+    ): String = try {
+        api.updateLab(
+            token(session), id,
+            LabUpdatePayload(title, deadlineAt?.takeIf { it.isNotBlank() }, defenseAt?.takeIf { it.isNotBlank() }, pointsMax, status, descriptionMd),
+        )
+        redirect.addFlashAttribute("notice", "Лабораторная сохранена")
+        "redirect:/admin/labs/$id"
+    } catch (ex: ApiException) {
+        redirect.addFlashAttribute("error", ex.message)
+        "redirect:/admin/labs/$id/edit"
+    }
+
+    @PostMapping("/labs/{labId}/variants/save")
+    fun saveVariant(
+        @PathVariable labId: String,
+        @RequestParam(required = false) variantId: String?,
+        @RequestParam labLevelId: String,
+        @RequestParam number: String,
+        @RequestParam title: String,
+        @RequestParam statementMd: String,
+        session: HttpSession,
+        redirect: RedirectAttributes,
+    ): String = try {
+        api.saveVariant(token(session), labId, variantId, VariantSavePayload(labLevelId, number, title, statementMd))
+        redirect.addFlashAttribute("notice", "Вариант сохранён")
+        "redirect:/admin/labs/$labId/edit"
+    } catch (ex: ApiException) {
+        redirect.addFlashAttribute("error", ex.message)
+        "redirect:/admin/labs/$labId/edit"
+    }
+
+    @PostMapping("/labs/{labId}/variants/{variantId}/delete")
+    fun deleteVariant(
+        @PathVariable labId: String,
+        @PathVariable variantId: String,
+        session: HttpSession,
+        redirect: RedirectAttributes,
+    ): String = try {
+        api.deleteVariant(token(session), labId, variantId)
+        redirect.addFlashAttribute("notice", "Вариант удалён")
+        "redirect:/admin/labs/$labId/edit"
+    } catch (ex: ApiException) {
+        redirect.addFlashAttribute("error", ex.message)
+        "redirect:/admin/labs/$labId/edit"
+    }
+
     @PostMapping("/labs/{id}/distribute")
     fun distribute(
         @PathVariable id: String,

web/src/main/kotlin/ru/ysu/lms/web/admin/AdminLabView.kt

@@ -15,4 +15,12 @@ data class AdminLabStudent(
     val variantId: String?,
     val variantNumber: String?,
     val source: String,
+)
+
+data class AdminStudentGrades(
+    val studentId: String,
+    val fullName: String,
+    val studentNo: String,
+    val scores: List<String?>,
+    val average: Double?,
 )

web/src/main/kotlin/ru/ysu/lms/web/api/ApiClient.kt

@@ -235,6 +235,62 @@ class ApiClient(
         } ?: emptyList()
     }
 
+    fun updateLab(token: String, labId: String, payload: LabUpdatePayload): LabDetailDto =
+        call {
+            client.put().uri("/api/v1/labs/{id}", labId)
+                .header(HttpHeaders.AUTHORIZATION, bearer(token))
+                .contentType(MediaType.APPLICATION_JSON)
+                .body(payload)
+                .retrieve().body(LabDetailDto::class.java)
+        }
+
+    fun saveVariant(token: String, labId: String, variantId: String?, payload: VariantSavePayload): LabDetailDto =
+        if (variantId.isNullOrBlank()) {
+            addVariant(token, labId, payload)
+        } else {
+            call {
+                client.put().uri("/api/v1/labs/{id}/variants/{vid}", labId, variantId)
+                    .header(HttpHeaders.AUTHORIZATION, bearer(token))
+                    .contentType(MediaType.APPLICATION_JSON)
+                    .body(payload)
+                    .retrieve().body(LabDetailDto::class.java)
+            }
+        }
+
+    fun addVariant(token: String, labId: String, payload: VariantSavePayload): LabDetailDto =
+        call {
+            client.post().uri("/api/v1/labs/{id}/variants", labId)
+                .header(HttpHeaders.AUTHORIZATION, bearer(token))
+                .contentType(MediaType.APPLICATION_JSON)
+                .body(payload)
+                .retrieve().body(LabDetailDto::class.java)
+        }
+
+    fun deleteVariant(token: String, labId: String, variantId: String): LabDetailDto =
+        call {
+            client.delete().uri("/api/v1/labs/{id}/variants/{vid}", labId, variantId)
+                .header(HttpHeaders.AUTHORIZATION, bearer(token))
+                .retrieve().body(LabDetailDto::class.java)
+        }
+
+    fun listGrades(token: String): List<GradeDto> {
+        val type = object : ParameterizedTypeReference<List<GradeDto>>() {}
+        return call {
+            client.get().uri("/api/v1/grades")
+                .header(HttpHeaders.AUTHORIZATION, bearer(token))
+                .retrieve().body(type)
+        } ?: emptyList()
+    }
+
+    fun setGrade(token: String, payload: GradeSetPayload): GradeDto =
+        call {
+            client.post().uri("/api/v1/grades")
+                .header(HttpHeaders.AUTHORIZATION, bearer(token))
+                .contentType(MediaType.APPLICATION_JSON)
+                .body(payload)
+                .retrieve().body(GradeDto::class.java)
+        }
+
     private companion object {
         val DETAIL_PATTERN = Regex("\"detail\"\\s*:\\s*\"((?:\\\\.|[^\"\\\\])*)\"")
     }

web/src/main/kotlin/ru/ysu/lms/web/api/ApiDtos.kt

@@ -162,6 +162,9 @@ data class LabDetailDto(
     val title: String = "",
     val status: String = "",
     val descriptionMd: String = "",
+    val deadlineAt: String? = null,
+    val defenseAt: String? = null,
+    val pointsMax: Any? = null,
     val levels: List<LabLevelDetailDto> = emptyList(),
 )
 
@@ -181,6 +184,35 @@ data class VariantDetailDto(
     val statementMd: String = "",
 )
 
+data class LabUpdatePayload(
+    val title: String,
+    val deadlineAt: String?,
+    val defenseAt: String?,
+    val pointsMax: String,
+    val status: String,
+    val descriptionMd: String,
+)
+
+data class VariantSavePayload(
+    val labLevelId: String,
+    val number: String,
+    val title: String,
+    val statementMd: String,
+)
+
+@JsonIgnoreProperties(ignoreUnknown = true)
+data class GradeDto(
+    val studentId: String = "",
+    val labId: String = "",
+    val score: String = "",
+)
+
+data class GradeSetPayload(
+    val studentId: String,
+    val labId: String,
+    val score: String,
+)
+
 class DownloadDto(
     val bytes: ByteArray,
     val filename: String,

web/src/main/resources/static/css/app.css

@@ -163,6 +163,7 @@ tr:last-child td { border-bottom: none; }
 .inline-form { display: inline-flex; align-items: center; gap: 0.375rem; margin: 0; }
 .inline-form .input-sm { width: auto; min-width: 10rem; }
 .input-sm { padding: 0.25rem 0.5rem; font-size: 0.8125rem; }
+.input-score { width: 4.5rem; }
 .filter-select { width: auto; }
 .hidden { display: none !important; }
 

web/src/main/resources/templates/admin/group.html

@@ -3,36 +3,101 @@
 <head><title th:text="${group.name} + ' — LMS'">Группа</title></head>
 <body>
 <div id="content">
-    <a th:href="@{/admin/groups}" class="text-sm">← Все группы</a>
+    <a th:href="@{/admin/groups}" class="nav-link">← Все группы</a>
     <div class="mt-4 mb-6 flex flex-wrap items-center justify-between gap-4">
-        <div><h1 class="page-title" th:text="${group.name}">Группа</h1><p class="text-sm text-muted mt-1">Студентов: <span th:text="${#lists.size(group.students)}">0</span></p></div>
-        <div class="flex gap-2"><a class="btn btn-secondary" th:href="@{/admin/groups/{id}/credentials(id=${group.id}, format='xlsx')}">Выгрузить XLSX</a><a class="btn btn-secondary" th:href="@{/admin/groups/{id}/credentials(id=${group.id}, format='csv')}">CSV</a></div>
+        <div>
+            <h1 class="page-title" th:text="${group.name}">Группа</h1>
+            <p class="text-sm text-muted mt-1">Студентов: <span th:text="${#lists.size(group.students)}">0</span></p>
+        </div>
+        <div class="flex gap-2">
+            <a class="btn btn-secondary" th:href="@{/admin/groups/{id}/credentials(id=${group.id}, format='xlsx')}">Выгрузить XLSX</a>
+            <a class="btn btn-secondary" th:href="@{/admin/groups/{id}/credentials(id=${group.id}, format='csv')}">CSV</a>
+        </div>
     </div>
+
     <div th:if="${notice}" class="alert alert-success" th:text="${notice}"></div>
     <div th:if="${error}" class="alert alert-error" th:text="${error}"></div>
-    <div th:if="${resetPassword}" class="alert alert-warning">Новый пароль: <code class="code" th:text="${resetPassword}">password</code></div>
+    <div th:if="${resetPassword}" class="alert alert-warning">
+        Новый пароль: <code class="code" th:text="${resetPassword}">password</code>
+    </div>
+
     <div th:if="${importResult}" class="card import-card mb-4">
         <div class="card-body">
             <h2 class="section-title">Импорт: <span th:text="${importResult.groupName}">группа</span></h2>
-            <p class="text-sm text-muted">Новых студентов: <span th:text="${#lists.size(importResult.added)}">0</span>, обновлено: <span th:text="${#lists.size(importResult.updated)}">0</span>.</p>
+            <p class="text-sm text-muted">
+                Новых студентов: <span th:text="${#lists.size(importResult.added)}">0</span>,
+                обновлено: <span th:text="${#lists.size(importResult.updated)}">0</span>.
+            </p>
             <div th:if="${not #lists.isEmpty(importResult.added)}" class="mt-4 overflow-x-auto">
                 <p class="text-sm alert-warning mini-alert">Сохраните пароли — они показываются для выдачи студентам.</p>
-                <table><thead><tr><th>ФИО</th><th>Логин</th><th>Пароль</th></tr></thead>
-                    <tbody><tr th:each="credential : ${importResult.added}"><td th:text="${credential.fullName}">—</td><td class="font-mono" th:text="${credential.studentNo}">—</td><td class="font-mono font-semibold" th:text="${credential.password}">—</td></tr></tbody>
+                <table>
+                    <thead><tr><th>ФИО</th><th>Логин</th><th>Пароль</th></tr></thead>
+                    <tbody>
+                    <tr th:each="credential : ${importResult.added}">
+                        <td th:text="${credential.fullName}">—</td>
+                        <td class="font-mono" th:text="${credential.studentNo}">—</td>
+                        <td class="font-mono font-semibold" th:text="${credential.password}">—</td>
+                    </tr>
+                    </tbody>
                 </table>
             </div>
         </div>
     </div>
+
+    <h2 class="section-title">Баллы за лабораторные</h2>
+    <p class="text-sm text-muted mb-4">Введите балл (0–5) и нажмите «OK». Средний балл считается по оценённым лабам.</p>
+    <div class="card card-flush mb-6 overflow-x-auto">
+        <table>
+            <thead>
+            <tr>
+                <th>Студент</th>
+                <th class="text-center" th:each="lab : ${labs}">
+                    <a th:href="@{/admin/labs/{id}(id=${lab.id})}" th:text="|ЛР ${lab.number}|">ЛР</a>
+                </th>
+                <th class="text-center">Средний</th>
+            </tr>
+            </thead>
+            <tbody>
+            <tr th:each="row : ${studentGrades}">
+                <td th:text="${row.fullName}">—</td>
+                <td th:each="score, iter : ${row.scores}">
+                    <form class="inline-form" th:action="@{/admin/groups/{id}/grades(id=${group.id})}" method="post">
+                        <input type="hidden" name="studentId" th:value="${row.studentId}">
+                        <input type="hidden" name="labId" th:value="${labs[iter.index].id}">
+                        <input class="input input-sm input-score" name="score" type="number" step="0.1" min="0" max="5"
+                               th:value="${score}">
+                        <button class="btn btn-secondary btn-sm" type="submit">OK</button>
+                    </form>
+                </td>
+                <td class="text-center font-semibold">
+                    <span th:if="${row.average != null}" th:text="${#numbers.formatDecimal(row.average, 1, 2)}">—</span>
+                    <span th:if="${row.average == null}" class="text-muted">—</span>
+                </td>
+            </tr>
+            <tr th:if="${#lists.isEmpty(group.students)}">
+                <td class="empty" th:colspan="${#lists.size(labs) + 2}">В группе нет студентов.</td>
+            </tr>
+            </tbody>
+        </table>
+    </div>
+
+    <h2 class="section-title">Студенты</h2>
     <div class="card card-flush">
-        <table><thead><tr><th>№</th><th>ФИО</th><th>Логин</th><th>Основа</th><th>Пароль</th><th></th></tr></thead>
+        <table>
+            <thead><tr><th>№</th><th>ФИО</th><th>Логин</th><th>Основа</th><th>Пароль</th><th></th></tr></thead>
             <tbody>
             <tr th:each="student, iter : ${group.students}">
                 <td class="text-muted" th:text="${iter.count}">1</td>
                 <td th:text="${student.fullName}">—</td>
                 <td class="font-mono" th:text="${student.studentNo}">—</td>
                 <td class="text-muted" th:text="${student.basis}">—</td>
-                <td><span th:if="${student.mustChangePassword}" class="badge badge-warn">временный</span><span th:unless="${student.mustChangePassword}" class="badge badge-ok">изменён</span></td>
-                <td class="text-center"><form th:action="@{/admin/groups/{gid}/students/{sid}/reset-password(gid=${group.id}, sid=${student.id})}" method="post"><button type="submit" class="nav-link">Сбросить</button></form></td>
+                <td><span th:if="${student.mustChangePassword}" class="badge badge-warn">временный</span>
+                    <span th:unless="${student.mustChangePassword}" class="badge badge-ok">изменён</span></td>
+                <td class="text-center">
+                    <form th:action="@{/admin/groups/{gid}/students/{sid}/reset-password(gid=${group.id}, sid=${student.id})}" method="post">
+                        <button class="nav-link text-sm" type="submit">Сбросить</button>
+                    </form>
+                </td>
             </tr>
             <tr th:if="${#lists.isEmpty(group.students)}"><td colspan="6" class="empty">В группе пока нет студентов.</td></tr>
             </tbody>

web/src/main/resources/templates/admin/lab-edit.html

@@ -0,0 +1,81 @@
+<!DOCTYPE html>
+<html lang="ru" xmlns:th="http://www.thymeleaf.org" th:replace="~{fragments/base :: layout(~{::title}, ~{::#content})}">
+<head><title th:text="|Правка: ${lab.title} — LMS|">Правка лабы</title></head>
+<body>
+<div id="content">
+    <a th:href="@{/admin/labs/{id}(id=${lab.id})}" class="nav-link">← К лабораторной</a>
+    <h1 class="page-title mt-4">Правка лабораторной</h1>
+    <div th:if="${notice}" class="alert alert-success" th:text="${notice}"></div>
+    <div th:if="${error}" class="alert alert-error" th:text="${error}"></div>
+
+    <form class="card form-card form-stack" th:action="@{/admin/labs/{id}/edit(id=${lab.id})}" method="post">
+        <div><label class="label" for="title">Название</label>
+            <input class="input" id="title" name="title" th:value="${lab.title}" required></div>
+        <div class="grid grid-2">
+            <div><label class="label" for="deadlineAt">Срок сдачи</label>
+                <input class="input" id="deadlineAt" name="deadlineAt" type="datetime-local"
+                       th:value="${deadlineLocal}"></div>
+            <div><label class="label" for="defenseAt">Дата защиты</label>
+                <input class="input" id="defenseAt" name="defenseAt" type="datetime-local"
+                       th:value="${defenseLocal}"></div>
+        </div>
+        <div class="grid grid-2">
+            <div><label class="label" for="pointsMax">Максимум баллов</label>
+                <input class="input" id="pointsMax" name="pointsMax" type="number" step="0.1" min="0"
+                       th:value="${lab.pointsMax}" required></div>
+            <div><label class="label" for="status">Статус</label>
+                <select class="input" id="status" name="status">
+                    <option value="draft" th:selected="${lab.status == 'draft'}">draft</option>
+                    <option value="published" th:selected="${lab.status == 'published'}">published</option>
+                    <option value="archived" th:selected="${lab.status == 'archived'}">archived</option>
+                </select></div>
+        </div>
+        <div><label class="label" for="descriptionMd">Условие (markdown)</label>
+            <textarea class="input" id="descriptionMd" name="descriptionMd" rows="14"
+                      th:text="${lab.descriptionMd}"></textarea></div>
+        <button class="btn btn-primary" type="submit">Сохранить</button>
+    </form>
+
+    <h2 class="section-title mt-8">Варианты</h2>
+    <div th:each="level : ${lab.levels}" class="mb-6">
+        <h3 class="group-title" th:text="${level.title}">Уровень</h3>
+        <div th:each="v : ${level.variants}" class="card form-card form-stack mb-4">
+            <form th:action="@{/admin/labs/{labId}/variants/save(labId=${lab.id})}" method="post">
+                <input type="hidden" name="variantId" th:value="${v.id}">
+                <input type="hidden" name="labLevelId" th:value="${level.id}">
+                <div class="grid grid-2">
+                    <div><label class="label">Номер</label><input class="input" name="number" th:value="${v.number}" required></div>
+                    <div><label class="label">Название</label><input class="input" name="title" th:value="${v.title}"></div>
+                </div>
+                <div><label class="label">Условие (markdown)</label>
+                    <textarea class="input" name="statementMd" rows="6" th:text="${v.statementMd}"></textarea></div>
+                <div class="flex gap-2">
+                    <button class="btn btn-primary" type="submit">Сохранить</button>
+                </div>
+            </form>
+            <form th:action="@{/admin/labs/{labId}/variants/{vid}/delete(labId=${lab.id}, vid=${v.id})}" method="post"
+                  onsubmit="return confirm('Удалить вариант?')">
+                <button class="btn btn-secondary btn-sm" type="submit">Удалить вариант</button>
+            </form>
+        </div>
+    </div>
+
+    <h2 class="section-title mt-8">Добавить вариант</h2>
+    <form class="card form-card form-stack" th:action="@{/admin/labs/{labId}/variants/save(labId=${lab.id})}" method="post">
+        <div class="grid grid-2">
+            <div><label class="label" for="newLevel">Уровень</label>
+                <select class="input" id="newLevel" name="labLevelId">
+                    <option th:each="level : ${lab.levels}" th:value="${level.id}" th:text="${level.title}">—</option>
+                </select></div>
+            <div><label class="label" for="newNumber">Номер</label>
+                <input class="input" id="newNumber" name="number" required></div>
+        </div>
+        <div><label class="label" for="newTitle">Название</label>
+            <input class="input" id="newTitle" name="title"></div>
+        <div><label class="label" for="newStatement">Условие (markdown)</label>
+            <textarea class="input" id="newStatement" name="statementMd" rows="6"></textarea></div>
+        <button class="btn btn-primary" type="submit">Добавить</button>
+    </form>
+</div>
+</body>
+</html>

web/src/main/resources/templates/admin/lab.html

@@ -10,6 +10,7 @@
             <p class="text-sm text-muted">Статус: <span class="badge" th:classappend="${lab.status == 'published'} ? 'badge-ok' : 'badge-warn'" th:text="${lab.status}">—</span></p>
         </div>
         <div class="flex gap-2">
+            <a class="btn btn-secondary" th:href="@{/admin/labs/{id}/edit(id=${lab.id})}">Редактировать</a>
             <form th:action="@{/admin/labs/{id}/distribute(id=${lab.id})}" method="post">
                 <button class="btn btn-primary" type="submit" name="force" value="false">Распределить</button>
             </form>