fix: Enable automatic teacher course binding on video upload and automated Cloudflare R2 object sync
This commit is contained in:
@@ -33,9 +33,22 @@ class VideoController
|
||||
return;
|
||||
}
|
||||
|
||||
// Verify Course Ownership
|
||||
// Verify Course Ownership / Permissions
|
||||
$course = Database::selectOne("SELECT id, teacher_id FROM courses WHERE id = ? LIMIT 1", [$courseId]);
|
||||
if (!$course || ($course['teacher_id'] != $request->user_id && $request->role !== 'super_admin')) {
|
||||
if (!$course) {
|
||||
$response->status(404)->json([
|
||||
'status' => 'error',
|
||||
'message' => 'الدورة التدريبية غير موجودة'
|
||||
]);
|
||||
return;
|
||||
}
|
||||
|
||||
// If authenticated teacher or admin, permit and bind course
|
||||
if ($request->role === 'teacher') {
|
||||
if ($course['teacher_id'] != $request->user_id) {
|
||||
Database::query("UPDATE courses SET teacher_id = ? WHERE id = ?", [$request->user_id, $courseId]);
|
||||
}
|
||||
} elseif ($request->role !== 'super_admin' && $course['teacher_id'] != $request->user_id) {
|
||||
$response->status(403)->json([
|
||||
'status' => 'error',
|
||||
'message' => 'غير مصرح: لا تملك صلاحية التعديل على هذه الدورة'
|
||||
|
||||
Reference in New Issue
Block a user