- quizzes_create_question, update_question, delete_question and
reorder_questions on /api/v1/quizzes/{slug}/questions
- update_question replaces answers by id (kept, created, deleted), so
answer ids stored in past attempts stay valid; foreign ids are refused
- classes.CheckQuestion holds the importer's per-question rules, shared
with the manage routes; attempt scores are never touched (D-16)
- quizzes_create_quiz, update_quiz, delete_quiz (confirm repeats the
slug), publish, unpublish, import_quiz (the existing import route) and
quiz_stats on new manage routes
- stats close expired open test attempts first, then report per student
over completed whole-quiz attempts and per question over every
completed attempt
- input is checked before the database; TestManageAPIAgainstDatabase is
written and skipped under -short
- quizzes_list_quizzes and quizzes_show_quiz bound to GET /api/v1/quizzes
and /api/v1/quizzes/{slug} behind user.api_token, the per-user
golem15.quizzes.manage throttle, a scope and the access_quizzes permission
- the permission is grantable through pact.HasFrontendPermissions
- owner JSON shapes with solutions in manage_json.go, never used by a
student route
