[dusankovacevicc]

Component and requirement IDs

Team 6 — AUT-04 (J), AUT-07 (П). Related: AUD-03, LAB-04.

Changes

• New module backend/Platform.LabVisibility (added to SecurityLab.slnx, referenced from Platform.Api).
• Domain: LabPublicContent and EvaluatorKey are separate types; the client-facing StudentLabView has only public fields.
• Contracts: ILabPublicContentReader, IEvaluatorKeyStore, ICourseMembership, ILabVisibilityAudit, LabVisibilityActions.
• In-memory implementations for development and tests (replaced later by EF Core and the real audit adapter).
• AddLabVisibility() and RegisterLabVisibilityAccess() registered in Program.cs; Development-only demo course membership with fictional accounts.

Verification

dotnet build backend/SecurityLab.slnx and dotnet test backend/SecurityLab.slnx: 52/52 passed locally.

Architecture and data flow

Skeleton only. Component diagrams and DFD follow in the team component document.

Security checks and negative tests

• All three actions (lab.student.view, lab.preview, lab.key.read) are registered in the Access catalog without a policy and are denied with NoPolicy (fail-closed).
• An unregistered lab action is denied with UnknownAction.
• Registering the actions twice fails at startup.
• The audit event has no content field, so answers cannot reach the audit log (AUD-03).

Dependencies

Uses IAccessDecision from Platform.Access (Team 3). Course membership is a dev stub until the ACC teams publish their contract.

[owlCoder]

Ponovni pregled (03.11): AUT-04/AUT-07 pripadaju timu 6. CI za backend i frontend, uključujući solution testove, prolazi. PR ima merge konflikte sa aktuelnim main nakon novih integracija. Molimo rešiti konflikte i ponovo pokrenuti CI; tada može na merge.