learningequality
Signed-out user can access a resource URL containing class and lesson ids when users are allowed to explore resources without signing in
Observed behavior
With this device settings
I can access a lesson resource page as a signed-out user when I know its URL via pasting it to the address bar, e.g. /en/learn/#/topics/c/69b6ce4071fd54fd82fab705fc89797f?lessonId=ca87af39b5a025cd51d8b87ff2ce95db&classId=68fdf5eca4d9e18cc31b3fe9ef897e9f (note lessonId and classId query parameters that are used for resources in the class context)
Expected behavior
Even though users are allowed to explore resources without signing in, giving access to lesson resources still doesn't make sense for anonymous users. For signed-out users, it should rather redirect them to the same resource but outside of the class context (e.g. /en/learn/#/topics/c/69b6ce4071fd54fd82fab705fc89797f). If there are some technical limitations on the routing level for doing this, we should at least check that we account for this URL when deciding between lesson and topic contexts of a resource as @rtibbles noted:
I think the issue I can imagine is that we use the lesson id to contextualise the "more in" side panel and the completion modal too. So at the very least we should be adding extra checks for that as to whether the user is logged in.
User-facing consequences
I haven't noticed any user-facing problems related to this except that the URL might be confusing a bit and as described above, it has the potential for causing problems with lesson/topic contexts.
Steps to reproduce
- Select "Allow users to explore resources without signing in" in device settings as an admin
- Obtain a URL of a resource from a lesson as a learner
- Sign out
- Paste the URL to the browser address bar
Context
- Kolibri version: Kolibri 0.15.1.dev0+git.20220127215827
- Operating system: Ubuntu 20.04.3 LTS
- Browser: Version 97.0.4692.99 (Official Build) (64-bit)
When a lessonId and classId are specified, if the user is not logged in, we should call the redirectBrowser function.
Yes, please work from the develop branch and target any pull request there.
