=== Step 4: Add an assignment to your lesson

With an assignment, a user can practice within a lesson. A lesson can consist of multiple assignments, each assignment
needs to extend the class `AssignmentEndpoint`, let's look at an example:

[source,java]
----
@RestController // <1>
@AssignmentHints({"lesson-template.hints.1", "lesson-template.hints.2", "lesson-template.hints.3"}) // <2>
public class SampleAttack extends AssignmentEndpoint { // <3>

    private final String secretValue = "secr37Value";

    @Autowired
    private UserSessionData userSessionData; // <4>

    @PostMapping("/lesson-template/sample-attack") <5>
    @ResponseBody
    public AttackResult completed(@RequestParam("param1") String param1, @RequestParam("param2") String param2) { <6>
        if (userSessionData.getValue("some-value") != null) {
            // do any session updating you want here ... or not, just comment/example here
            //return failed(this).feedback("lesson-template.sample-attack.failure-2").build();
        }

        //overly simple example for success. See other existing lessons for ways to detect 'success' or 'failure'
        if (secretValue.equals(param1)) {
            return success(this) // <7>
                    .output("Custom Output ...if you want, for success")
                    .feedback("lesson-template.sample-attack.success")
                    .build();
            //lesson-template.sample-attack.success is defined in src/main/resources/i18n/WebGoatLabels.properties
        }

        // else
        return failed(this) // <8>
                .feedback("lesson-template.sample-attack.failure-2")
                .output("Custom output for this failure scenario, usually html that will get rendered directly ... yes, you can self-xss if you want")
                .build();
    }
----
<1> Every assignment is just a Spring RestController
<2> Each assignment can have a list of hints. The actual text needs to be placed in `WebGoatLabels.properties` in the folder `src/main/resources/{lessonName}/i18n`
<3> Each assignment needs to extend the class `AssignmentEndpoint`, giving you some helpful methods you need when you want to mark an assignment as complete
<4> As the assignment is a Spring-based class, you can auto wire every component managed by Spring necessary for the assignment
<5> Each assignment should at least have one mapping with the method signature (see 6)
<6> When the user tries to solve an assignment, you need return an `AttackResult`
<7> Returning a successful attack result when user solved the lesson
<8> Returning a failed attack user did not solve the lesson

{nbsp} +

As you can see, an assignment is a REST controller which needs to at least have one method with the following signature:

[source]
----
@RequestMapping(method = "...", path = "/lesson-template/solution")
@ResponseBody
public AttackResult solve(String param) {
  ...
}
----

=== Extra endpoints

Other endpoints can be added in the assignment to support different cases for the assignment, for example:

[source]
----
@GetMapping("lesson-template/shop/{user}")
@ResponseBody
public List<Item> getItemsInBasket(@PathVariable("user") String user) {
  return List.of(new Item("WG-1", "WebGoat promo", 12.0), new Item("WG-2", "WebGoat sticker", 0.00));
}
----

=== Adding an assignment to the HTML page

We mentioned a lesson could consist of multiple assignments, WebGoat picks them up automatically, and the UI displays
a navigation bar on top of every lesson. A page with an assignment will be red initially and will become
green when the user solves the assignment. To make this work we need to add to the HTML file:

[source]
----
<div class="lesson-page-wrapper">
  <div class="adoc-content" th:replace="doc:lesson-template-attack.adoc"></div>
  <div class="attack-container">
    <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
    <form class="attack-form" accept-charset="UNKNOWN"
          method="POST" name="form"
          action="/WebGoat/lesson-template/sample-attack">
      <table>
        <tr>
          <td>two random params</td>
          <td>parameter 1:<input name="param1" value="" type="TEXT" /></td>
          <td>parameter 2:<input name="param2" value="" type="TEXT" /></td>
          <td>
            <input name="submit" value="Submit" type="SUBMIT"/>
          </td>
        </tr>
      </table>
    </form>
    <div class="attack-feedback"></div>
    <div class="attack-output"></div>
  </div>
</div>
----

So the `action` of the form should match the method which defines the check if the lesson has been solved or not
see `public AttackResult solved()`

That's it. You have now successfully created your first WebGoat lesson, including an assignment!
