Skip to content

Fix: REST API access control for course ratings, q&a and content visibility - #3111

Open
saadman30 wants to merge 6 commits into
4.2.0from
fix/rest-api-status-filter
Open

saadman30 wants to merge 6 commits into
4.2.0from
fix/rest-api-status-filter

Conversation

@saadman30

Copy link
Copy Markdown
Collaborator
  • Updated RestAPI to allow access to non-published posts based on enrollment status.
  • Improved REST_Rating to reflect UI access rules for course ratings, including handling guest users and their ratings.
  • Added a new method can_read_course_rating to encapsulate logic for determining if a user can read course ratings based on course status and user authentication.
  • Enhanced RestAuth to clarify access permissions for course content, ensuring that enrollment alone does not grant access to non-published content.

…lity

- Updated `RestAPI` to allow access to non-published posts based on enrollment status.
- Improved `REST_Rating` to reflect UI access rules for course ratings, including handling guest users and their ratings.
- Added a new method `can_read_course_rating` to encapsulate logic for determining if a user can read course ratings based on course status and user authentication.
- Enhanced `RestAuth` to clarify access permissions for course content, ensuring that enrollment alone does not grant access to non-published content.
@saadman30 saadman30 self-assigned this Oct 23, 2026
- Revised the description to specify that the endpoint retrieves ratings for a course, not just published courses.
- Clarified authentication requirements for public and private courses, including access conditions for enrolled users.
- Enhanced the response structure to include the user's own rating details when available, improving the API's usability.
- Improved the `has_qna_access` method in `Q_And_A` class to enforce course content rules, ensuring students can only access Q&A for published or private courses.
- Updated `RestAPI` to change permission callbacks from `__return_true` to `permission_optional_access_token`, enhancing security and access control for course-related endpoints.
- Revised API documentation to reflect the new permission handling and clarify authentication requirements for public and private courses.
@saadman30 saadman30 changed the title Fix: REST API access control for course ratings and content visibility Fix: REST API access control for course ratings, q&a and content visibility Oct 23, 2026
@saadman30
saadman30 requested a review from shewa12 October 23, 2026 09:14
@saadman30
saadman30 marked this pull request as ready for review October 23, 2026 09:14
- Introduced `showCopyFeedback` function to provide user feedback via toast notifications or tooltips when copying and pasting text.
- Updated clipboard copy and paste logic to utilize the new feedback mechanism, improving user experience.
- Enhanced error handling for clipboard operations, ensuring users receive appropriate messages for success or failure scenarios.
@saadman30
saadman30 marked this pull request as draft October 23, 2026 10:40
saadman30 and others added 2 commits October 23, 2026 16:49
- Removed redundant checks and streamlined the logic to determine user access to Q&A based on course visibility.
- Simplified the method by eliminating unnecessary variable assignments and conditions, enhancing code readability and maintainability.
- Updated comments to reflect the current functionality and clarify access rules for Q&A based on course status.
@saadman30
saadman30 marked this pull request as ready for review October 23, 2026 11:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant