Secure the api endpoints

[atulya2109]

Describe the bug
This is an umbrella issue for all the issues that could be related to securing endpoints. For example, when creating a test the class id is passed in the POST Request but it isn't verified on the back end whether the user is the admin of the class or not. Therefore, anyone can create tests in any class. Similarly, in delete test endpoint as well it should be checked whether the user has delete privileges or not.

To Reproduce
Steps to reproduce the behavior:

1. Open the network tab on chrome or firefox before creating a test to log the POST request sent to the server.
2. Import this request in Postman.
3. Change the class field in the body of the request.
4. Returns a 200 Status Code and creates entry in database.

Expected behavior
Test creation should fail instead of creating it in another class.

Desktop (please complete the following information):

• OS: Any
• Browser: Any
• Version: Any

Additional context
There are many other security issues in other end points as well.

[VenomFate-619]

Yes, we should create middlewares to check whether the user is created of that class

[aavishkarmishra]

@atulya2109 are you willing to work on this issue?

[atulya2109]

@aavishkarmishra Yeah, sure.

[atulya2109]

@aavishkarmishra The pull request was merged but my points weren't updated. Please look into it