Update Saqel Platform: 2026-09-04 03:20:29

backend/app/Controllers/VideoController.php

@@ -441,6 +441,38 @@ class VideoController
 
         $lessonId = (int)$lesson['id'];
 
+        // Strict Academic Access Control & Institutional Free / CliQ Paid Validation
+        $course = Database::selectOne("SELECT * FROM courses WHERE id = ? LIMIT 1", [$lesson['course_id']]);
+        $targetGrade = $course['grade_level'] ?? 'grade_10';
+        $studentId = $request->user_id ? (int)$request->user_id : null;
+        $nationalId = $request->getHeader('x-national-id') ?: ($request->getQuery('national_id') ?? null);
+
+        $access = \App\Services\StudentAccessControlService::validateLessonAccess(
+            $studentId,
+            $nationalId,
+            $targetGrade,
+            (int)$lesson['course_id'],
+            $lessonId
+        );
+
+        if (!$access['allowed']) {
+            $response->status(403)->json([
+                'status'        => 'forbidden',
+                'access_denied' => true,
+                'reason'        => $access['reason'],
+                'message'       => $access['message'] ?? 'غير مصرح بمشاهدة هذا الدرس',
+                'student_grade' => $access['student_grade'] ?? null,
+                'target_grade'  => $access['target_grade'] ?? null,
+                'payment_info'  => (($access['reason'] ?? '') === 'payment_required') ? [
+                    'payment_method' => 'CliQ (نظام كليك الأردني للمدفوعات الفورية)',
+                    'cliq_alias'     => \App\Services\CliqPaymentService::DEFAULT_PLATFORM_CLIQ_ALIAS,
+                    'price_jod'      => (float)($course['price_jod'] ?? 35.0),
+                    'initiate_url'   => '/api/payment/cliq/initiate'
+                ] : null
+            ]);
+            return;
+        }
+
         // Self-Healing Curriculum Guard: Purge any obsolete/mismatched calculus questions
         // for non-calculus lessons (e.g. Grade 10 Systems of Equations)
         $isCalculusLesson = (str_contains($lesson['title'], 'اشتقاق') || str_contains($lesson['title'], 'تفاضل'));