merged

Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>

controllers/client/courses.controller.js

@@ -112,8 +112,9 @@ async function buildUserContext(user_id) {
 // Returns true  → user may access the course.
 // Returns false → user's tier is too low AND no valid individual purchase.
 async function canAccessCourse(user_id, course_id) {
-  const course = await Course.findOne({ where: { course_id, ...notDeleted }, attributes: ['subscription'] });
+  const course = await Course.findOne({ where: { course_id, ...notDeleted }, attributes: ['subscription', 'status'] });
   if (!course) return false;
+  if (course.status !== 'published') return false;
 
   const userCtx = await buildUserContext(user_id);
 
@@ -156,7 +157,15 @@ async function canAccessUnit(user_id, unit_id) {
     if (allowed) return true;
   }
 
-  const links = await CourseUnit.findAll({ where: { unit_id }, attributes: ['course_id'] });
+  // Only links to PUBLISHED courses count as a real course dependency — a unit
+  // whose only link is to a draft/unpublished course behaves as if it had no
+  // course link at all (falls through to the free/standalone branch below),
+  // matching the client discovery-list's course_count computation.
+  const links = await CourseUnit.findAll({
+    where: { unit_id },
+    attributes: ['course_id'],
+    include: [{ model: Course, as: 'course', attributes: [], where: { status: 'published', ...notDeleted }, required: true }],
+  });
   if (!links.length) return !unit?.subscription;
   for (const link of links) {
     if (await canAccessCourse(user_id, link.course_id)) return true;
@@ -256,7 +265,7 @@ exports.getCourses = async (req, res) => {
     };
 
     const courses = await Course.findAll({
-      where:   { ...notDeleted },
+      where:   { ...notDeleted, status: 'published' },
       attributes: COURSE_LIST_ATTRS,
       include: [
         {