Resource: Student Enrollments about lifterlms-rest HOT 4 CLOSED

From the PR:

Can you please review this with particular attention to the LLMS_REST_Enrollments_Controller::handle_creation_date()
I'm not sure whether that's the kind of creation date update you wanted (with direct alteration of the updated_date db table column for that enrollment meta whose value is _start_date), with NO effects on the "enrollment's update date".

This looks good enough. It's not ideal but I think that's more because of the way the existing db is structured. It works. We can improve later. Nice work.

Also please take a look at the permissions, I thought that enrollments can only be listed to those who can 'view_others_lifterlms_reports', mimicking the lllms core.

I think we want to do something more like this (using new caps I added last week to the core): https://github.com/gocodebox/lifterlms-rest/blob/master/includes/server/class-llms-rest-students-controller.php#L163-L183 and https://github.com/gocodebox/lifterlms-rest/blob/master/includes/server/class-llms-rest-students-controller.php#L42-L58

The view_students cap will check to see if the current can view the student in question.

An admin/manager will get to see everyone. An instructor/assistant can see only students enrolled in their courses/memberships and everyone else can only see themselves.

Here's the logic in the core: https://github.com/gocodebox/lifterlms/blob/master/includes/class.llms.user.permissions.php#L166

While the current reporting in the core does rely on the view_lifterlms_reports the api can use these new permissions.

For today this is fine though.

from lifterlms-rest.

I think we can close this.

from lifterlms-rest.

Status of this resource:

• List
• Create
• Retrieve
• Update
• Delete
• List Content
• Test Coverage 90% or greater

Test Coverage at the moment is at 87%.
Also not sure if it what I wrote here has been looked into.

from lifterlms-rest.

I'm on this.
So... I leave the update/create/delete permissions as they are right now: current_user_can('enroll') && || current_user_can('unenroll')
The single enrollment read permission will become as you suggested:
current_user_can( 'view_students', $enrollment->student_id )
While, listing the enrollments will be allowed to anyone as we do for llms posts:
https://github.com/gocodebox/lifterlms-rest/blob/1.0.0-beta.3/includes/abstracts/class-llms-rest-posts-controller.php#L99

keeping in mind that, when processing the collection, the single enrollment read permissions will be check as above.
[Edit] I might make this a little more complex actually, as when we're listing a single student enrollment I can already check if the current user can view this student and forbid the access.

from lifterlms-rest.