AI Activity Filter

activity_data.php imports core\test\handler_one, but that class does not exist anywhere in Moodle core (find /moodle -name 'handler_one*' returns nothing) and the symbol is not referenced in the file. It is a leftover from earlier development.

The use statement itself does not error because PHP only resolves the alias when something tries to reference handler_one — but it pollutes the symbol table, can confuse static analysers, and is misleading to readers.

version.php declares $plugin->requires = 2022112800; (Moodle 4.1) yet the implementation depends on APIs that did not exist before Moodle 4.5:

• core\di::get(...) (Moodle 4.5)
• The core\hook\di_configuration hook (Moodle 4.5)
• The core\hook\output\before_html_attributes hook (Moodle 4.5)
• core_ai\manager and core_ai\aiactions\generate_text (Moodle 4.5)

Installing the plugin onto a 4.1–4.4 site will fail at runtime because these classes do not exist.

Two helper classes contain multi-sentence German default descriptions for the booking and mootimeter activity plugins, hardcoded inline. These strings are user-visible (they are what the admin sees in the settings page and what gets shipped to the LLM as the plugin description), and they exist in only one language.

The duplicated text in both classes also means a translation fix would have to be made in two files.

classes/local/plugin_description.php and classes/local/overwritten_content_item_description.php are structurally identical and contain the same hardcoded German default text for booking and mootimeter. The two differ only in the name of the static method (get_default vs get_overwritten_default) and in the fallback (one returns get_string('modulename_help', ...), the other returns false).

Only overwritten_content_item_description is actually referenced from runtime code (activity_data.php, settings.php); plugin_description is unused outside of its own file.

stopword_remover.php bootstraps the bundled Composer autoload with a plain require, not require_once:

require(__DIR__ . '/../../vendor/autoload.php');

If stopword_remover.php is ever required twice in the same request (unlikely under Moodle's autoloader, but possible in test setups or future refactors), vendor/autoload.php will execute its top-level code twice. Composer's own autoload_real.php uses static caching, so this currently does not fatal, but the safe and idiomatic form is require_once.

Also note that doing this at file-include time (rather than inside the method that actually uses the library) means every class that triggers autoloading of stopword_remover pays the cost of Composer initialisation even if it never calls compress().

auto_resize_text_field.js registers a MutationObserver that listens to every DOM mutation under document.body (childList: true, subtree: true) and on every mutation runs document.querySelectorAll('.prompt-search') to find textareas to initialise.

Because the hook before_html_attributes injects this module on every page where the user passes the capability check, the observer is active site-wide for editing teachers — even on pages that will never contain a .prompt-search element. For complex pages (gradebook, reports, dashboards) the constant DOM activity will cause many irrelevant callback invocations.

The i_activity_searcher interface declares filter_activities(string $request): array with the docblock specifying activity_ranking[]. The real implementation, ai_searcher, returns an array of activity_ranking objects.

ai_dummy_searcher::filter_activities instead json_decodes dummydata.json with true (associative array mode) and returns the raw decoded structure — an array of plain associative arrays.

This works in practice because the only consumer is the external API, which only inspects array keys, and because PHP does not enforce the docblock type. But it is a contract violation and means any caller that uses activity_ranking's public properties (e.g. $ranking->pluginname) would crash in dummy mode. The fixture also contains entries like "pluginname": "Choice" (capitalised) that will never match a real content_item::get_name() (the AI searcher does a case-sensitive lookup).

get_max_content_item_occurrence performs a SELECT COUNT(*) ... GROUP BY m.name ORDER BY COUNT(*) DESC over the entire course_modules and modules tables and returns the largest count. The capability local/activityfilter:get_max_content_item_occurrence is defined at CONTEXT_COURSE, so authorisation is checked against a single course — but the data returned is a site-wide aggregate over every course on the platform.

In other words, any teacher in any course can learn the site-wide maximum count of any module type. The data is not particularly sensitive (it leaks only that, e.g., "the most-used activity type on this site has 4,213 instances"), but the scope mismatch between capability context and data scope is worth tightening.

get_max_content_item_occurrence uses get_record_sql(..., strictness: IGNORE_MULTIPLE) to fetch the largest count from a GROUP BY query. This pattern works but is wasteful — the database has to compute counts for every module type, sort the entire result set, and then PHP discards everything except the first row.

A single-row query is both clearer and cheaper:

ai_searcher::prepare_prompt builds the description payload by json_encode-ing the activity data and then mutating the resulting JSON string with three text-level transforms:

1. Strip every <...> substring with preg_replace('/<[^>]*>/', '', ...) to remove HTML tags from help text.
2. Drop the literal \/innen substring (a German gender-suffix) with str_replace.
3. Re-substitute \/ back to / (because json_encode was called without JSON_UNESCAPED_SLASHES).

Operating on the encoded JSON instead of the source data is fragile: a help string containing a < followed later by a > would collapse the intervening text (potentially across JSON structural characters), and the slash dance with str_replace makes the code hard to reason about. The current data sources are admin-controlled, so this is not an active security risk, but it is a clear correctness footgun.