feat: private materials with per-user shares

A material may be private: only its author and the users it is shared
with see it. Every student read (list, detail, course detail and
counters, the checklist linked material, the token twins) goes through
one visibility fragment. Existing materials stay public with no author.

GET/PUT /_bm/api/v1/materials/{id}/access let the author, a material
manager, toggle the flag and pick the users; the first change of an
author-less material makes the caller its author.
This commit is contained in:
Jakub Zych
2026-11-08 11:52:47 +01:00
parent 5ed02ed9f7
commit 418f8240a4
14 changed files with 688 additions and 65 deletions

View File

@@ -76,11 +76,11 @@ func TestPluginActivates(t *testing.T) {
if p.ID() != "jz.bm" || !slices.Equal(p.Requires(), []string{"golem15.user"}) {
t.Errorf("ID %q Requires %v", p.ID(), p.Requires())
}
if n := len(p.Models()); n != 13 {
t.Errorf("Models = %d, want 13", n)
if n := len(p.Models()); n != 14 {
t.Errorf("Models = %d, want 14", n)
}
if n := len(p.Migrations()); n != 18 {
t.Errorf("Migrations = %d, want 18", n)
if n := len(p.Migrations()); n != 19 {
t.Errorf("Migrations = %d, want 19", n)
}
if !slices.ContainsFunc(p.Commands(), func(c bonfire.Command) bool { return c.Name == "bm:seed" }) {
t.Error("bm:seed is not registered")
@@ -131,6 +131,8 @@ func TestRoutes(t *testing.T) {
"PUT /_bm/api/v1/calendar-feed",
"POST /_bm/api/v1/calendar-feed/rotate",
"DELETE /_bm/api/v1/calendar-feed",
"GET /_bm/api/v1/materials/{id}/access",
"PUT /_bm/api/v1/materials/{id}/access",
"GET /_bm/api/v1/token/dashboard",
"GET /_bm/api/v1/token/courses",
"GET /_bm/api/v1/token/courses/{id}",