Fix CodeTailor security vulnerabilities

[aspadiyath]

• Add authentication (Depends(auth_manager)) to parsons_scaffolding endpoint
• Remove exec()-based Python test runner; replace with JOBE sandbox via evaluate_fixed_code.py
• Fetch test code from DB (question_json.suffix_code) instead of accepting it from request body
• Add clean_python_testcase() to transform Runestone unittest.gui format for JOBE compatibility

[Copilot]

Pull request overview

This PR addresses CodeTailor security hardening by restricting access to the Parsons scaffolding endpoint and removing server-side exec()-based Python test execution in favor of running tests inside a JOBE sandbox. It also stops accepting test code from the request body and instead loads instructor-authored test code (suffix_code) from the database, with a small normalization step for Runestone’s unittest.gui format.

Changes:

• Add authentication dependency (Depends(auth_manager)) to the /coach/parsons_scaffolding endpoint.
• Replace Python exec() test execution with JOBE-based execution in evaluate_fixed_code.py.
• Fetch suffix_code from Question.question_json (DB) and normalize Python tests via clean_python_testcase().

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
bases/rsptx/book_server_api/routers/personalized_parsons/evaluate_fixed_code.py	Switch Python test evaluation to JOBE and return a minimal wasSuccessful()-compatible result.
bases/rsptx/book_server_api/routers/coach.py	Require auth for parsons_scaffolding, fetch test code from DB, and normalize Runestone Python test format for JOBE.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bnmnetp]

Have you tested this locally so you know it works?

[aspadiyath]

Yup, I've tested locally and it works!

[bnmnetp]

Great, I'll look at it a little more and get it merged. Thanks for addressing this so quickly.