fix: don't use token param for assessments in prod

frontend/app/src/app/modules/assessments/page/assessments-page.component.ts

@@ -23,6 +23,7 @@ import {DataProvider, DataScope} from '../../data/data.provider';
 import {DataRoutingService} from '../../data/data-routing.service';
 import {groupBy, mapValues} from '@openstapps/collection-utils';
 import {takeUntilDestroyed} from '@angular/core/rxjs-interop';
+import {environment} from '../../../../environments/environment';
 
 @Component({
   selector: 'app-assessments-page',
@@ -62,6 +63,26 @@ export class AssessmentsPageComponent implements OnInit, AfterViewInit {
 
   destroy$ = inject(DestroyRef);
 
+  /**
+   * ?token=... (e.g. ?token=mock) is a development aid only.
+   * In production, no token is read from or passed on in URLs.
+   */
+  private readonly urlTokenAllowed = !environment.production;
+
+  /**
+   * Token from the URL (?token=...), development only.
+   * Always undefined in production, so no token is read from or passed on in URLs.
+   */
+  get urlToken(): string | undefined {
+    if (!this.urlTokenAllowed) {
+      return;
+    }
+
+    const token = this.activatedRoute.snapshot.queryParamMap.get('token');
+
+    return token === null ? undefined : token;
+  }
+
   ngAfterViewInit() {
     this.segmentView.value = this.sharedAxisChoreographer.currentValue;
   }
@@ -73,7 +94,7 @@ export class AssessmentsPageComponent implements OnInit, AfterViewInit {
       .subscribe(thing => {
         void this.router.navigate(['assessments', 'detail', thing.uid], {
           queryParams: {
-            token: this.activatedRoute.snapshot.queryParamMap.get('token'),
+            token: this.urlToken,
           },
           state: {item: thing},
         });
@@ -82,7 +103,7 @@ export class AssessmentsPageComponent implements OnInit, AfterViewInit {
     this.activatedRoute.queryParams.subscribe(parameters => {
       try {
         this.assessments = this.assessmentsProvider
-          .getAssessments(parameters.token)
+          .getAssessments(this.urlTokenAllowed ? parameters.token : undefined)
           .then(assessments => groupBy(assessments, it => it.courseOfStudy?.uid ?? 'unknown'))
           .then(it => {
             this.assessmentKeys = Object.keys(it);