From e12916ce56131e6a06bd043824eeb2862997987d Mon Sep 17 00:00:00 2001
From: Ilyassbennanii <ilyass.bennani@beeznest.com>
Date: Mon, 27 Oct 2025 15:15:21 +0100
Subject: [PATCH 1/2] Catalogue: Fix showing the correct subscription status -
 refs #2805

---
 assets/vue/components/course/CatalogueCourseCard.vue | 10 ++++++++--
 src/CoreBundle/Controller/CatalogueController.php    |  6 ++++++
 src/CoreBundle/Entity/Course.php                     |  7 +++++++
 3 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/assets/vue/components/course/CatalogueCourseCard.vue b/assets/vue/components/course/CatalogueCourseCard.vue
index ef93c423052..8c637531bf9 100644
--- a/assets/vue/components/course/CatalogueCourseCard.vue
+++ b/assets/vue/components/course/CatalogueCourseCard.vue
@@ -140,7 +140,7 @@
         />
 
         <Button
-          v-else-if="course.subscribe && props.currentUserId"
+          v-else-if="course.subscribe && props.currentUserId && allowSelfSignup"
           :label="$t('Subscribe')"
           icon="pi pi-sign-in"
           class="w-full"
@@ -148,7 +148,7 @@
         />
 
         <Button
-          v-else-if="course.visibility === 2 && !course.subscribe && props.currentUserId"
+          v-else-if="props.currentUserId && !allowSelfSignup"
           :label="$t('Subscription not allowed')"
           icon="pi pi-ban"
           disabled
@@ -343,4 +343,10 @@ const { isLocked, hasRequirements, requirementList, graphImage, fetchStatus } =
 onMounted(() => {
   fetchStatus()
 })
+
+const allowSelfSignup = computed(() => {
+  if (props.course?.allow_self_signup !== undefined) return Boolean(props.course.allow_self_signup)
+  if (props.course?.allowSelfSignup !== undefined) return Boolean(props.course.allowSelfSignup)
+  return props.course?.visibility === 0
+})
 </script>
diff --git a/src/CoreBundle/Controller/CatalogueController.php b/src/CoreBundle/Controller/CatalogueController.php
index 10659c074e3..af97d38826f 100644
--- a/src/CoreBundle/Controller/CatalogueController.php
+++ b/src/CoreBundle/Controller/CatalogueController.php
@@ -534,6 +534,12 @@ public function autoSubscribeCourse(int $courseId, SettingsManager $settings): J
             return $this->json(['error' => 'Course or user not found'], 400);
         }
 
+        $isPrivileged = $this->isGranted('ROLE_ADMIN') || $this->isGranted('ROLE_TEACHER') || $this->isGranted('ROLE_SESSION_ADMIN');
+        if (!$course->getAllowSelfSignup() && !$isPrivileged) {
+            return $this->json(['error' => 'Self sign up not allowed for this course'], 403);
+        }
+
+
         $useAutoSession = 'true' === $settings->getSetting('catalog.course_subscription_in_user_s_session', true);
 
         if ($useAutoSession) {
diff --git a/src/CoreBundle/Entity/Course.php b/src/CoreBundle/Entity/Course.php
index 1a84c911d69..aa50fec60cc 100644
--- a/src/CoreBundle/Entity/Course.php
+++ b/src/CoreBundle/Entity/Course.php
@@ -377,6 +377,13 @@ class Course extends AbstractResource implements ResourceInterface, ResourceWith
     #[Groups(['course:read'])]
     public bool $subscribed = false;
 
+    #[SerializedName('allowSelfSignup')]
+    #[Groups(['course:read','session:read'])]
+    public function getAllowSelfSignup(): bool
+    {
+        return $this->visibility !== self::REGISTERED;
+    }
+
     public function __construct()
     {
         $this->visibility = self::OPEN_PLATFORM;

From a3dea2364c5fb0819bc20b70e0f68675f6562b83 Mon Sep 17 00:00:00 2001
From: Yannick Warnier <ywarnier@users.noreply.github.com>
Date: Wed, 29 Oct 2025 00:36:15 +0100
Subject: [PATCH 2/2] Catalogue: Remove ROLE_TEACHER from positive privilege
 check

---
 src/CoreBundle/Controller/CatalogueController.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/CoreBundle/Controller/CatalogueController.php b/src/CoreBundle/Controller/CatalogueController.php
index af97d38826f..aaa317496ff 100644
--- a/src/CoreBundle/Controller/CatalogueController.php
+++ b/src/CoreBundle/Controller/CatalogueController.php
@@ -534,7 +534,7 @@ public function autoSubscribeCourse(int $courseId, SettingsManager $settings): J
             return $this->json(['error' => 'Course or user not found'], 400);
         }
 
-        $isPrivileged = $this->isGranted('ROLE_ADMIN') || $this->isGranted('ROLE_TEACHER') || $this->isGranted('ROLE_SESSION_ADMIN');
+        $isPrivileged = $this->isGranted('ROLE_ADMIN') || $this->isGranted('ROLE_SESSION_ADMIN');
         if (!$course->getAllowSelfSignup() && !$isPrivileged) {
             return $this->json(['error' => 'Self sign up not allowed for this course'], 403);
         }