Introduce `CourseContextRoleListener` to dynamically assign contextual course roles#8491

Draft

AngelFQC wants to merge 30 commits into

chamilo:masterfrom

AngelFQC:8486-cidreq

Commits on May 29, 2026

Introduce `CourseContextRoleListener` to dynamically assign contextual course roles
AngelFQC
committed
Refactor `Voter` classes to remove dynamic role assignments from users and streamline access checks
AngelFQC
committed
Security: Restrict document access to course-specific roles (`ROLE_CURRENT_COURSE_STUDENT` and `ROLE_CURRENT_COURSE_SESSION_STUDENT`)
AngelFQC
committed
Security: Add regression tests for CDocument API to prevent unauthorized document access
AngelFQC
committed
Security: Enforce course-teacher validation for `resourceLinkList` in `CreateDocumentFileAction` to prevent IDOR vulnerabilities
AngelFQC
committed
Introduce `OptionalCourseLinkFilter` to allow optional `cid` handling in API requests
AngelFQC
committed
Replace manual `cid`, `sid`, and `gid` handling with `CidReqHelper` for cleaner context management in `DocumentCollectionStateProvider`
AngelFQC
committed

Commits on May 30, 2026