feat: add course rating and review endpoint

[onyemaechiezekiel9]

feat: add course rating and review endpoint

Closes #211

---

Summary

Adds a full course rating and review API allowing learners to submit, update, list, and delete ratings. Includes aggregate stats with star distribution. Upsert logic prevents duplicate ratings per user per course.

---

Changes

course-rating.service.ts — created

• submitRating() — upsert: creates on first submission, updates on subsequent
• listRatings() — paginated list (default: page 1, per_page 20, max 100)
• getRatingStats() — average rating (2 decimal places), total count, 1–5 star distribution
• deleteRating() — removes own rating only; returns 404 without leaking existence of other users' ratings
• hasUserRated(), getUserRating() helper methods

course.controller.ts — updated with 4 new endpoints

Method	Path	Auth	Description
POST	/:id/ratings	Required	Submit or update rating
GET	/:id/ratings	Public	List ratings with pagination
GET	/:id/ratings/stats	Public	Aggregate stats
DELETE	/:id/ratings	Required	Delete own rating (204)

course.module.ts — updated

• CourseRatingEntity registered in TypeOrmModule
• CourseRatingService added as provider and exported

Existing files used (already present):

• course-rating.entity.ts — entity with unique constraint on (courseId, userId) and indices
• create-rating.dto.ts — validation: rating 1–5, review max 2000 chars
• rating-stats.dto.ts — response DTO for stats

---

Test Coverage (22 tests, all passing)

Category	Tests
Submit rating	Create new, upsert update, no review, course not found
List ratings	Pagination, defaults, param clamping, empty list
Stats	Average calculation, distribution, rounding, no ratings edge case
Delete	Own rating, not found, cannot delete other user's rating
Helpers & edge cases	Multi-user, text preservation, hasUserRated, getUserRating

---

Security Notes

• POST and DELETE require auth guard — unauthenticated requests return 401
• DELETE returns 404 (not 403) when rating belongs to another user — avoids leaking rating existence
• Upsert prevents duplicate ratings per user per course at both service and DB constraint level
• review field capped at 2000 characters via DTO validation — rejects before hitting the DB
• Pagination clamped server-side — clients cannot request unbounded result sets

[drips-wave]

@onyemaechiezekiel9 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[onyemaechiezekiel9]

Please @Hub-of-Evolution is there any update on this