=== Step 4: Add an assignment to your lesson

With an assignment a user can practise within a lesson. A lesson can consist of multiple assignment, each assignment
needs to extend the class `AssignmentEndpoint`, let's look at an example:

[source,java]
----
@RestController // <1>
@AssignmentHints({"lesson-template.hints.1", "lesson-template.hints.2", "lesson-template.hints.3"}) // <2>
public class SampleAttack extends AssignmentEndpoint { // <3>

    private final String secretValue = "secr37Value";

    @Autowired
    private UserSessionData userSessionData; // <4>

    @PostMapping("/lesson-template/sample-attack") <5>
    @ResponseBody
    public AttackResult completed(@RequestParam("param1") String param1, @RequestParam("param2") String param2) { <6>
        if (userSessionData.getValue("some-value") != null) {
            // do any session updating you want here ... or not, just comment/example here
            //return failed(this).feedback("lesson-template.sample-attack.failure-2").build();
        }

        //overly simple example for success. See other existing lesssons for ways to detect 'success' or 'failure'
        if (secretValue.equals(param1)) {
            return success(this) // <7>
                    .output("Custom Output ...if you want, for success")
                    .feedback("lesson-template.sample-attack.success")
                    .build();
            //lesson-template.sample-attack.success is defined in src/main/resources/i18n/WebGoatLabels.properties
        }

        // else
        return failed(this) // <8>
                .feedback("lesson-template.sample-attack.failure-2")
                .output("Custom output for this failure scenario, usually html that will get rendered directly ... yes, you can self-xss if you want")
                .build();
    }
----
<1> Every assignment is just a Spring RestController
<2> Each assignment can have a list of hints, the actual text needs to be placed in `WebGoatLabels.properties`
<3> Each assignment needs to extend the class `AssignmentEndpoint` giving you some helpful methods you need when you want to mark an assignment as complete
<4> As the assignment is a Spring based class you can autowire every component managed by Spring necessary for the assignment
<5> Each assignment should at least have one mapping with the method signature (see 6)
<6> When the user tries to solve an assignment you need return an `AttackResult`
<7> Returning a successful attack result when user solved the lesson
<8> Returning a failed attack user did not solve the lesson

As you can see an assignment is a REST controller which need to at least have one method with the following signature:

[source]
----
@RequestMapping(method = "...", path = "/lesson-template/solution")
@ResponseBody
public AttackResult solve(String param) {
  ...
}
----

=== Extra endpoints

Other endpoints can be added in the assignment to support different cases for the assignment, for example:

[source]
----
@GetMapping("lesson-template/shop/{user}")
@ResponseBody
public List<Item> getItemsInBasket(@PathVariable("user") String user) {
  return List.of(new Item("WG-1", "WebGoat promo", 12.0), new Item("WG-2", "WebGoat sticker", 0.00));
}
----

=== Adding an assignment to the html page

We mentioned a lesson can consist of multiple assignments, WebGoat picks them up automatically and the UI displays
a navigation bar on top of every lesson. A page with an assignment will be red in the beginning and will become
green when the user solves the assignment. To make this work in the html we need to add:

[source]
----
<div class="lesson-page-wrapper">
  <div class="adoc-content" th:replace="doc:lesson-template-attack.adoc"></div>
  <div class="attack-container">
    <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
    <form class="attack-form" accept-charset="UNKNOWN"
          method="POST" name="form"
          action="/WebGoat/lesson-template/sample-attack">
      <table>
        <tr>
          <td>two random params</td>
          <td>parameter 1:<input name="param1" value="" type="TEXT" /></td>
          <td>parameter 2:<input name="param2" value="" type="TEXT" /></td>
          <td>
            <input name="submit" value="Submit" type="SUBMIT"/>
          </td>
        </tr>
      </table>
    </form>
    <div class="attack-feedback"></div>
    <div class="attack-output"></div>
  </div>
</div>
----

So the `action` of the form should match the method which defines the check if the lesson has been solved or not
see `public AttackResult solved()`

That's it you now successfully created your first WebGoat lesson including an assignment!