added

Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>

controllers/client/courses.controller.js

@@ -40,7 +40,7 @@ const { onCourseCompleted }      = require('../../services/achievements.service'
 const PendingCertificate         = require('../../models/courses/pending_certificate.mdl');
 const Certificate                = require('../../models/courses/certificate.mdl');
 const UserNotification           = require('../../models/notifications/user_notification.mdl');
-const { renderNotification } = require('../../services/notificationTemplate.service');
+const { NOTIFICATION_REGISTRY } = require('../../data/notifications.data');
 
 const notDeleted = { deletedAt: null };
 
@@ -468,6 +468,10 @@ exports.getUnit = async (req, res) => {
     const link = await CourseUnit.findOne({ where: { course_id: courseId, unit_id: unitId } });
     if (!link) return R.error(res, "Unit not found.", 404);
 
+    if (!await canAccessUnit(req.user.user_id, unitId)) {
+      return R.error(res, "You do not have access to this unit.", 403);
+    }
+
     const unit = await Unit.findOne({
       where: { unit_id: unitId, ...notDeleted },
       attributes: [
@@ -519,6 +523,10 @@ exports.getLesson = async (req, res) => {
     ]);
     if (!courseLink || !lessonLink) return R.error(res, "Lesson not found.", 404);
 
+    if (!await canAccessLesson(req.user.user_id, lessonId)) {
+      return R.error(res, "You do not have access to this lesson.", 403);
+    }
+
     const lesson = await Lesson.findOne({
       where: { lesson_id: lessonId, ...notDeleted },
       attributes: [
@@ -557,6 +565,10 @@ exports.getUnitQuiz = async (req, res) => {
     const link = await CourseUnit.findOne({ where: { course_id: courseId, unit_id: unitId } });
     if (!link) return R.error(res, "Unit not found.", 404);
 
+    if (!await canAccessUnit(req.user.user_id, unitId)) {
+      return R.error(res, "You do not have access to this unit.", 403);
+    }
+
     const quiz = await UnitQuiz.findOne({
       where: { unit_id: unitId, ...notDeleted },
       attributes: [
@@ -615,6 +627,10 @@ exports.getCourseAssessment = async (req, res) => {
   try {
     const { courseId } = req.params;
 
+    if (!await canAccessCourse(req.user.user_id, courseId)) {
+      return R.error(res, "You do not have access to this course.", 403);
+    }
+
     const assessment = await CourseAssessment.findOne({
       where: { course_id: courseId, ...notDeleted },
       attributes: [
@@ -698,6 +714,10 @@ exports.startCourseAssessment = async (req, res) => {
     const { courseId, assessmentId } = req.params;
     const user_id = req.user.user_id;
 
+    if (!await canAccessCourse(user_id, courseId)) {
+      return R.error(res, "You do not have access to this course.", 403);
+    }
+
     const assessment = await CourseAssessment.findOne({
       where: { assessment_id: assessmentId, course_id: courseId, ...notDeleted },
       attributes: ["assessment_id", "time_limit_minutes", "passing_score", "max_attempts", "cooldown_hours"],
@@ -857,6 +877,10 @@ exports.submitUnitQuiz = async (req, res) => {
     const link = await CourseUnit.findOne({ where: { course_id: courseId, unit_id: unitId } });
     if (!link) return R.error(res, "Unit not found.", 404);
 
+    if (!await canAccessUnit(user_id, unitId)) {
+      return R.error(res, "You do not have access to this unit.", 403);
+    }
+
     const quiz = await UnitQuiz.findOne({
       where: { quiz_id: quizId, unit_id: unitId, ...notDeleted },
       include: [{
@@ -949,6 +973,10 @@ exports.submitCourseAssessment = async (req, res) => {
     const { answers = {}, session_id } = req.body;
     const user_id = req.user.user_id;
 
+    if (!await canAccessCourse(user_id, courseId)) {
+      return R.error(res, "You do not have access to this course.", 403);
+    }
+
     const assessment = await CourseAssessment.findOne({
       where: { assessment_id: assessmentId, course_id: courseId, ...notDeleted },
       include: [{
@@ -1038,9 +1066,10 @@ exports.submitCourseAssessment = async (req, res) => {
       }
 
       // Immediate notification: course completed, certificate incoming
-      renderNotification({ type: 'course_completed', data: { courseTitle: course?.title ?? '', courseUuid: course?.uuid ?? null } })
-        .then(notify => UserNotification.create({ user_id, ...notify }))
-        .catch(err => console.error('[ASSESSMENT] Failed to emit course_completed notification:', err));
+      UserNotification.create({
+        user_id,
+        ...NOTIFICATION_REGISTRY.course_completed.build({ courseTitle: course?.title ?? '', courseUuid: course?.uuid ?? null }),
+      }).catch(err => console.error('[ASSESSMENT] Failed to emit course_completed notification:', err));
     }
 
     return R.success(res, "Assessment submitted.", {