Upload 8 files

databases.py

@@ -565,7 +565,10 @@ def get_audiodescription(sha1sum: str, version: str) -> Optional[sqlite3.Row]:
         return None
 
 
-def get_videos_from_audiodescriptions() -> List[Dict[str, Any]]:
+def get_videos_from_audiodescriptions(
+    session_id: str | None = None,
+    role: str | None = None,
+) -> List[Dict[str, Any]]:
     """Retorna vídeos disponibles segons audiodescriptions.db i videos.db.
 
     1) Llegeix demo/temp/db/audiodescriptions.db i obté els DISTINCT sha1sum.
@@ -587,7 +590,15 @@ def get_videos_from_audiodescriptions() -> List[Dict[str, Any]]:
     if not sha1_list:
         return []
 
-    # Map sha1sum -> video_name utilitzant videos.db
+    # Determinar telèfon associat a la sessió actual (si aplica)
+    session_phone: str = ""
+    if session_id:
+        try:
+            _, session_phone = get_latest_user_phone_for_session(session_id)
+        except sqlite3.OperationalError:
+            session_phone = ""
+
+    # Map sha1sum -> video_name utilitzant videos.db, amb filtres de visibility/rol/phone
     result: List[Dict[str, Any]] = []
     try:
         with _connect_videos_db() as vconn:
@@ -595,12 +606,18 @@ def get_videos_from_audiodescriptions() -> List[Dict[str, Any]]:
             for sha1 in sha1_list:
                 try:
                     row = vcur.execute(
-                        "SELECT video_name FROM videos WHERE sha1sum = ? LIMIT 1",
+                        "SELECT video_name, visibility, owner FROM videos WHERE sha1sum = ? LIMIT 1",
                         (sha1,),
                     ).fetchone()
-                    if row is not None and row["video_name"]:
-                        vname = str(row["video_name"])
-                    else:
+                    if row is None:
+                        # Sense registre a videos.db, ignorem aquest sha1
+                        continue
+
+                    vname = str(row["video_name"]) if row["video_name"] else ""
+                    visibility_val = str(row["visibility"] or "").strip().lower()
+                    owner_val = str(row["owner"] or "").strip()
+
+                    if not vname:
                         # Sense nom humà, ignorem aquest vídeo al desplegable
                         continue
                 except sqlite3.OperationalError:
@@ -611,6 +628,29 @@ def get_videos_from_audiodescriptions() -> List[Dict[str, Any]]:
                 if vname == sha1:
                     continue
 
+                # Regles d'accés segons visibility + rol + telèfon de sessió
+                is_public = visibility_val == "public"
+                is_private = visibility_val == "private" or not visibility_val
+
+                allowed = False
+                if is_public:
+                    allowed = True
+                else:
+                    # Vídeos privats
+                    if role in {"verd", "blau"}:
+                        # Administrador i revisor veuen tots els privats
+                        allowed = True
+                    elif role == "groc":
+                        # Col·laborador verificat només si el seu telèfon coincideix amb owner
+                        if session_phone and owner_val and session_phone == owner_val:
+                            allowed = True
+                    else:
+                        # Altres rols (taronja, vermell, o desconegut) no veuen privats
+                        allowed = False
+
+                if not allowed:
+                    continue
+
                 result.append({"sha1sum": sha1, "video_name": vname})
     except sqlite3.OperationalError:
         # Si videos.db no existeix o té un esquema incompatible, no retornem res

page_modules/analyze_audiodescriptions.py

@@ -182,7 +182,13 @@ def render_analyze_audiodescriptions_page(api, permissions: Dict[str, bool]) ->
     st.header("Analitzar audiodescripcions")
 
     # Llista de vídeos disponibles segons demo/temp/db/audiodescriptions.db
-    accessible_rows = get_videos_from_audiodescriptions()
+    # i els permisos de visibilitat/rol de l'usuari actual
+    session_id = st.session_state.get("session_id", "")
+    role = None
+    if st.session_state.get("user") and isinstance(st.session_state.get("user"), dict):
+        role = st.session_state["user"].get("role")
+
+    accessible_rows = get_videos_from_audiodescriptions(session_id=session_id or None, role=role)
 
     # Base de media: demo/temp/media/<sha1sum>
     base_dir = Path(__file__).resolve().parent.parent