fix: misc permission issues

lms/lms/api.py

@@ -41,11 +41,10 @@ from lms.lms.utils import (
 	get_lms_route,
 	has_course_instructor_role,
 	has_evaluator_role,
+	has_lms_role,
 	has_moderator_role,
 )
 
-LMS_ROLES = ["Moderator", "Course Creator", "Batch Evaluator", "LMS Student"]
-
 
 @frappe.whitelist()
 def get_user_info():
@@ -1730,13 +1729,6 @@ def get_profile_details(username: str):
 	return details
 
 
-def has_lms_role():
-	roles = frappe.get_roles()
-	lms_roles = set(LMS_ROLES)
-	user_roles = set(roles)
-	return not lms_roles.isdisjoint(user_roles)
-
-
 @frappe.whitelist()
 def get_streak_info():
 	all_dates = fetch_activity_dates(frappe.session.user)

lms/lms/doctype/lms_enrollment/lms_enrollment.py

@@ -50,7 +50,10 @@ class LMSEnrollment(Document):
 			)
 
 		if self.enrollment_from_batch:
-			return
+			if frappe.db.exists(
+				"LMS Batch Enrollment", {"batch": self.enrollment_from_batch, "member": self.member}
+			):
+				return
 
 		if not course_details.published and not is_admin():
 			frappe.throw(_("You cannot enroll in an unpublished course."))

lms/lms/utils.py

@@ -31,6 +31,7 @@ from pypika import functions as fn
 from lms.lms.md import find_macros
 
 RE_SLUG_NOTALLOWED = re.compile("[^a-z0-9]+")
+LMS_ROLES = ["Moderator", "Course Creator", "Batch Evaluator", "LMS Student"]
 
 
 def get_lms_path():
@@ -1210,6 +1211,9 @@ def get_country_code():
 
 @frappe.whitelist()
 def get_question_details(question: str) -> dict:
+	if not has_lms_role():
+		frappe.throw(_("You are not authorized to view the question details."))
+
 	fields = ["question", "type", "multiple"]
 	for i in range(1, 5):
 		fields.append(f"option_{i}")
@@ -2302,3 +2306,10 @@ def can_modify_batch(batch: str) -> bool:
 	if not (has_moderator_role() or is_instructor):
 		return False
 	return True
+
+
+def has_lms_role():
+	roles = frappe.get_roles()
+	lms_roles = set(LMS_ROLES)
+	user_roles = set(roles)
+	return not lms_roles.isdisjoint(user_roles)