lucasw89/STCourses
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ai): lessonUrl builder in one place; authoring follows core canView

Browse Source 
- Learner links go through lessonUrl/courseUrl (src/web/urls.ts).
- Generation, the studio course list and file listing require an authoring
  right and core canView, so a global author needs a grant for a restricted
  course. Contract requests 8 (global author in canView) and 9
  (STC_AI_ALLOWED_BASE_URLS in AppConfig).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
Lucas Winther
2026-10-30 04:49:48 +01:00
co-authored by Claude Opus 5.5
parent ead7327bb1
commit f3ce2e34bf
7 changed files with 87 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/feature-ai/test/feature.test.ts
+26
View File
@@ -218,3 +218,29 @@ forEachDb("provider errors on a user's own key show the status and a fixed messa
const t2 = await (await call("POST", "/api/ai/courses/sample/chat", "owner", { message: "hello" })).text();
expect(t2).toContain("502: INTERNAL-SECRET-BODY");
});
forEachDb("authoring uses core canView: a global author needs a grant for a restricted course", async (db) => {
const { call } = await setup(db);
await call("PUT", "/api/ai/admin/config", "owner", { provider: { kind: "anthropic", apiKey: "k" }, mcpServers: [] });
const body = { courseId: "secret", kind: "questions", style: "pure-snake", topic: "Adding", sources: [{ kind: "lesson", lessonId: "m2-text" }] };
const courses = async (u: string) => ((await (await call("GET", "/api/ai/studio/courses", u)).json()) as { id: string }[]).map((c) => c.id).sort();
// Public course: the author role is enough. Restricted course: not without a grant.
expect(await courses("auth")).toEqual(["sample"]);
expect((await call("GET", "/api/ai/studio/sources?courseId=secret", "auth")).status).toBe(403);
expect((await call("POST", "/api/ai/studio/generate", "auth", body)).status).toBe(403);
// The owner sees everything.
expect(await courses("owner")).toEqual(["sample", "secret"]);
expect((await call("POST", "/api/ai/studio/generate", "owner", body)).status).toBe(202);
// An ACL grant (core canView) lets the global author in.
await db.sql`INSERT INTO course_acl (course_id, principal_type, principal_id) VALUES ('secret', 'user', 'auth')`;
expect(await courses("auth")).toEqual(["sample", "secret"]);
expect((await call("POST", "/api/ai/studio/generate", "auth", body)).status).toBe(202);
// A course_authors row makes a learner an author of that course only.
expect((await call("POST", "/api/ai/studio/generate", "bob", body)).status).toBe(403);
await db.sql`INSERT INTO course_authors (course_id, user_id) VALUES ('secret', 'bob')`;
expect(await courses("bob")).toEqual(["secret"]);
expect((await call("POST", "/api/ai/studio/generate", "bob", body)).status).toBe(202);
// A grant to view alone does not make a learner an author.
await db.sql`INSERT INTO course_acl (course_id, principal_type, principal_id) VALUES ('secret', 'user', 'ann')`;
expect((await call("POST", "/api/ai/studio/generate", "ann", body)).status).toBe(403);
});