feat: перелопатил синхронизацию преподавателей

backend/UniVerse.Infrastructure/Services/LectureService.cs

@@ -82,13 +82,14 @@ public class LectureService : ILectureService
         return full.ToDto();
     }
 
-    public async Task<LectureDto> UpdateAsync(int id, UpdateLectureRequest req)
+    public async Task<LectureDto> UpdateAsync(int id, UpdateLectureRequest req, int currentUserId, bool isAdmin = false)
     {
         var lecture = await _db.Lectures
             .Include(l => l.Location)
             .Include(l => l.Enrollments)
             .ThenInclude(e => e.User)
             .FirstOrDefaultAsync(l => l.Id == id) ?? throw new NotFoundException("Lecture", id);
+        EnsureTeacherOwnsLecture(lecture, currentUserId, isAdmin);
         lecture.TeacherId = req.TeacherId; lecture.LocationId = req.LocationId;
         lecture.Title = req.Title; lecture.Description = req.Description;
         lecture.Format = req.Format; lecture.StartsAt = req.StartsAt; lecture.EndsAt = req.EndsAt;
@@ -150,8 +151,9 @@ public class LectureService : ILectureService
         await _db.SaveChangesAsync();
     }
 
-    public async Task MarkAttendanceAsync(int lectureId, int userId, bool attended)
+    public async Task MarkAttendanceAsync(int lectureId, int userId, bool attended, int currentUserId, bool isAdmin = false)
     {
+        await EnsureTeacherOwnsLectureAsync(lectureId, currentUserId, isAdmin);
         var enrollment = await _db.LectureEnrollments
             .FirstOrDefaultAsync(e => e.LectureId == lectureId && e.UserId == userId)
             ?? throw new NotFoundException("Enrollment not found.");
@@ -161,8 +163,9 @@ public class LectureService : ILectureService
             await _gamification.CheckAndAwardAchievementsAsync(userId);
     }
 
-    public async Task<PagedResult<EnrollmentDto>> GetEnrollmentsAsync(int lectureId, PaginationRequest pagination)
+    public async Task<PagedResult<EnrollmentDto>> GetEnrollmentsAsync(int lectureId, PaginationRequest pagination, int currentUserId, bool isAdmin = false)
     {
+        await EnsureTeacherOwnsLectureAsync(lectureId, currentUserId, isAdmin);
         var query = _db.LectureEnrollments.Include(e => e.User)
             .Where(e => e.LectureId == lectureId);
         var total = await query.CountAsync();
@@ -171,6 +174,22 @@ public class LectureService : ILectureService
         return PagedResult<EnrollmentDto>.Create(items.Select(e => e.ToDto()).ToList(), total, pagination.Page, pagination.PageSize);
     }
 
+    private async Task EnsureTeacherOwnsLectureAsync(int lectureId, int currentUserId, bool isAdmin)
+    {
+        if (isAdmin)
+            return;
+
+        var lecture = await _db.Lectures.FirstOrDefaultAsync(l => l.Id == lectureId)
+            ?? throw new NotFoundException("Lecture", lectureId);
+        EnsureTeacherOwnsLecture(lecture, currentUserId, isAdmin: false);
+    }
+
+    private static void EnsureTeacherOwnsLecture(Lecture lecture, int currentUserId, bool isAdmin)
+    {
+        if (!isAdmin && lecture.TeacherId != currentUserId)
+            throw new ForbiddenException("Teacher can access only their own lectures.");
+    }
+
     private async Task RescheduleLectureRemindersAsync(Lecture lecture)
     {
         foreach (var enrollment in lecture.Enrollments)