feat: unpublished activities are now hidden by default

apps/api/src/routers/courses/courses.py

@@ -126,6 +126,7 @@ async def api_get_course_by_id(
 async def api_get_course_meta(
     request: Request,
     course_uuid: str,
+    with_unpublished_activities: bool = False,
     db_session: Session = Depends(get_db_session),
     current_user: PublicUser = Depends(get_current_user),
 ) -> FullCourseReadWithTrail:
@@ -133,7 +134,7 @@ async def api_get_course_meta(
     Get single Course Metadata (chapters, activities) by course_uuid
     """
     return await get_course_meta(
-        request, course_uuid, current_user=current_user, db_session=db_session
+        request, course_uuid, with_unpublished_activities, current_user=current_user, db_session=db_session
     )
 
 

apps/api/src/services/courses/activities/activities.py

@@ -260,15 +260,21 @@ async def get_activities(
     current_user: PublicUser | AnonymousUser,
     db_session: Session,
 ) -> list[ActivityRead]:
-    statement = select(ChapterActivity).where(
-        ChapterActivity.chapter_id == coursechapter_id
+    # Get activities that are published and belong to the chapter
+    statement = (
+        select(Activity)
+        .join(ChapterActivity)
+        .where(
+            ChapterActivity.chapter_id == coursechapter_id,
+            Activity.published == True
+        )
     )
     activities = db_session.exec(statement).all()
 
     if not activities:
         raise HTTPException(
             status_code=404,
-            detail="No activities found",
+            detail="No published activities found",
         )
 
     # RBAC check

apps/api/src/services/courses/chapters.py

@@ -214,6 +214,7 @@ async def get_course_chapters(
     course_id: int,
     db_session: Session,
     current_user: PublicUser | AnonymousUser,
+    with_unpublished_activities: bool,
     page: int = 1,
     limit: int = 10,
 ) -> List[ChapterRead]:
@@ -249,7 +250,7 @@ async def get_course_chapters(
         for chapter_activity in chapter_activities:
             statement = (
                 select(Activity)
-                .where(Activity.id == chapter_activity.activity_id)
+                .where(Activity.id == chapter_activity.activity_id, with_unpublished_activities or Activity.published == True)
                 .distinct(Activity.id)
             )
             activity = db_session.exec(statement).first()

apps/api/src/services/courses/courses.py

@@ -126,6 +126,7 @@ async def get_course_by_id(
 async def get_course_meta(
     request: Request,
     course_uuid: str,
+    with_unpublished_activities: bool,
     current_user: PublicUser | AnonymousUser,
     db_session: Session,
 ) -> FullCourseReadWithTrail:
@@ -165,7 +166,7 @@ async def get_course_meta(
         # Ensure course.id is not None
         if course.id is None:
             return []
-        return await get_course_chapters(request, course.id, db_session, current_user)
+        return await get_course_chapters(request, course.id, db_session, current_user, with_unpublished_activities)
     
     # Task 3: Get user trail (only for authenticated users)
     async def get_trail():