- import document, manage routes and MCP question tools take rubric and
max_length; open questions refuse answers, max_length is 1..20000 and
both apply to open questions only
- quizzes take a grader; the manage routes refuse a code the registry
does not know, the import accepts any well-formed code
- quiz stats report unreviewed open answers and their average points
- import_quiz warns that replace deletes the grades and reviews
- SetScore (0..points in 0.5 steps, comment shown to the student),
ConfirmBulk per quiz or attempt and Regrade through the quiz's grader
- close() announces an attempt reviewed while it was open
- quizzes_review_set_score, quizzes_review_confirm_bulk,
quizzes_review_regrade; 409 already_reviewed and grader_manual
- classes/review.go: review queue, detail and Confirm, shared by MCP and
the admin screen; AnswerReviewed and AttemptReviewed after commit
- /api/v1/quiz-reviews routes behind the quizzes permission
- quizzes_review_list, quizzes_review_show, quizzes_review_confirm
- quizzes_create_question, update_question, delete_question and
reorder_questions on /api/v1/quizzes/{slug}/questions
- update_question replaces answers by id (kept, created, deleted), so
answer ids stored in past attempts stay valid; foreign ids are refused
- classes.CheckQuestion holds the importer's per-question rules, shared
with the manage routes; attempt scores are never touched (D-16)
- quizzes_create_quiz, update_quiz, delete_quiz (confirm repeats the
slug), publish, unpublish, import_quiz (the existing import route) and
quiz_stats on new manage routes
- stats close expired open test attempts first, then report per student
over completed whole-quiz attempts and per question over every
completed attempt
- input is checked before the database; TestManageAPIAgainstDatabase is
written and skipped under -short
- quizzes_list_quizzes and quizzes_show_quiz bound to GET /api/v1/quizzes
and /api/v1/quizzes/{slug} behind user.api_token, the per-user
golem15.quizzes.manage throttle, a scope and the access_quizzes permission
- the permission is grantable through pact.HasFrontendPermissions
- owner JSON shapes with solutions in manage_json.go, never used by a
student route
