[scottgrayson]

Summary

Gates GET lms/certificates/{course}/{user} behind auth and allows HTML only for the certificate owner or a user who can update the course, removing guest access via course completion or signed URLs.

Design decisions

HTML show requires session owner or course updater

Why

Guests who knew course and user IDs could open named certificates when completedByUserAt($userId) was true. PDF download was already behind auth; HTML needed the same privacy bar without signed URLs (PDF uses an HTML string, not a fetch of the show route).

High impact

Any guest or email link that relied on public or signed HTML certificate URLs will stop working; viewers must be logged in as the certificate user or as someone who can update the course.

Files

src/Http/Controllers/CertificateController.php
routes/web.php

Auth rules for certificate HTML

Why

Product rules: allow if Auth::id() == $userId, or if Auth::user()?->can('update', $course). Do not keep guest access via completion alone. Admin “Click to Preview” still works because it uses the logged-in admin’s user id (owner path) while the admin session is active.

Feature coverage for guest, owner, admin, stranger

Why

Locks the new gate: guests redirect to login; owner and updater get 200; another authenticated user gets 403. Signed-guest access is not required and is no longer honored.

Files

tests/Feature/CertificateControllerTest.php

Testing

Package Pest suite (no Portal deploy). From a clone with dependencies installed: vendor/bin/pest tests/Feature/CertificateControllerTest.php.

1. As a guest, open /lms/certificates/{course}/{user} for a completed learner → redirected to login (not 200).
2. Log in as that learner and open the same URL → certificate HTML loads.
3. Log in as an admin who can update the course and open another user’s certificate URL (or admin “Click to Preview”) → page loads.
4. Log in as a different non-admin user and open someone else’s certificate URL → 403.
5. Confirm PDF download still requires auth and completion or update ability.