feat: add lesson resources feature for teachers to photograph and manage unit resources

- Implemented frontend components in math.js and math.css for resource management.
- Created backend API in unit_resources.py to handle resource storage and retrieval.
- Added database migration for math_unit_resources table to store resource metadata.
- Developed tests for resource management functionality, including adding, listing, and deleting resources.
- Enabled teachers to photograph exercises and explanations, with appropriate permissions and validations.

README.md

@@ -65,6 +65,10 @@ Checks and feedback are stored privately against the original attempt and photo,
 
 For rollback, turn `MATHLY_ANSWER_SCANS_ENABLED` off and restart; preserve the new tables and private bucket. The skills API serves the original multiple-choice geometry sample while scanning is disabled, including for guest practice and older frontends. Enabling scanning again restores open-ended presentation and access to saved answers. Keep stored answer records for recovery. No destructive down migration is needed.
 
+### Lesson resources (teachers)
+
+A teacher taps a unit's title on the path (for example **טכניקה אלגברית 1**), photographs an exercise or an explanation, and saves it to that lesson's resources. Each photo is marked as **תרגיל חדש**, **הסבר תיאורטי**, or **אחר** (with a short free-text description), and can optionally name the topic it belongs to (for example **פילוג מורחב**). Apply [the additive resources migration](supabase/migrations/20261101090000_math_unit_resources.sql); it adds the `math_unit_resources` table and the private `mathly-resources` bucket. Only accounts with the teacher role see, add, or open resources, and only the teacher who added a photo (or a manager) can delete it. Students do not see resources yet.
+
 Integration tests use bundled disposable PostgreSQL and local private test blobs, without project credentials or Docker:
 
 ```bash

app/main.py

@@ -23,6 +23,7 @@ from .math_photo import (DAILY_PHOTOS, MAX_PHOTO, MEDIA_TYPES as PHOTO_TYPES,
                          PhotoSolver, PhotoUnavailable, math_model, photo_client)
 from .math_skills import algebra9, practice_graph
 from .monitoring import ActionLog, RETURN_GAP, install_monitoring_routes
+from .unit_resources import install_resource_routes
 
 logging.basicConfig(level=logging.INFO)
 log = logging.getLogger("mathly")
@@ -306,6 +307,7 @@ self.addEventListener("activate", event => event.waitUntil((async () => {
         return {"ok": True, "readable": result.get("readable", False)}
 
     install_answer_routes(app, signed_in)
+    install_resource_routes(app, signed_in)
     install_monitoring_routes(app, manager)
     return app
 

app/unit_resources.py

@@ -0,0 +1,189 @@
+"""Lesson resources: photos a teacher adds to a unit (an exercise, a theory explanation, or a free note).
+
+Rows live in `math_unit_resources`, images in the private `mathly-resources` bucket. Only the backend, with the
+service key, reads or writes either; teachers reach them through `/api/math/units/.../resources`.
+"""
+from __future__ import annotations
+
+import json
+import logging
+import urllib.error
+import urllib.parse
+import urllib.request
+import uuid
+
+from fastapi import Depends, File, Form, HTTPException, UploadFile
+from fastapi.responses import JSONResponse, Response
+from starlette.concurrency import run_in_threadpool
+
+from .access import has_permission
+from .answer_scans import MAX_IMAGE, ScanError, clean_image
+from .math_skills import algebra9
+
+log = logging.getLogger("mathly.unit_resources")
+BUCKET = "mathly-resources"
+KINDS = {"exercise": "תרגיל חדש", "theory": "הסבר תיאורטי", "other": "אחר"}
+MAX_NOTE = 200
+
+
+class ResourceUnavailable(RuntimeError):
+    pass
+
+
+class UnitResources:
+    """Supabase storage for lesson resources, through the service key."""
+
+    def __init__(self, auth):
+        self.auth = auth
+
+    @property
+    def configured(self) -> bool:
+        return bool(self.auth and self.auth.secret)
+
+    def _request(self, path, method="GET", data=None, content_type=None, prefer=None) -> bytes:
+        headers = {"Authorization": "Bearer " + self.auth.secret, "apikey": self.auth.secret,
+                   "User-Agent": "mathly/1.0"}
+        if content_type:
+            headers["Content-Type"] = content_type
+        if prefer:
+            headers["Prefer"] = prefer
+        req = urllib.request.Request(self.auth.url + path, data=data, method=method, headers=headers)
+        try:
+            with urllib.request.urlopen(req, timeout=30) as response:
+                return response.read()
+        except (urllib.error.URLError, TimeoutError, OSError) as exc:
+            # Never pass SQL, keys or storage paths on to the browser.
+            log.warning("resource storage failed: %s", getattr(exc, "code", type(exc).__name__))
+            raise ResourceUnavailable("resource storage unavailable") from exc
+
+    def _rows(self, path, method="GET", body=None):
+        raw = self._request(path, method, json.dumps(body).encode() if body is not None else None,
+                            "application/json", "return=representation")
+        return json.loads(raw or b"null") or []
+
+    def list(self, unit_id: str) -> list[dict]:
+        query = urllib.parse.urlencode({"unit_id": f"eq.{unit_id}", "select": "*", "order": "created_at.desc"})
+        return self._rows(f"/rest/v1/math_unit_resources?{query}")
+
+    def get(self, resource_id: str) -> dict | None:
+        rows = self._rows(f"/rest/v1/math_unit_resources?id=eq.{resource_id}&select=*")
+        return rows[0] if rows else None
+
+    def add(self, row: dict) -> dict:
+        return self._rows("/rest/v1/math_unit_resources", "POST", row)[0]
+
+    def remove(self, resource_id: str) -> None:
+        self._rows(f"/rest/v1/math_unit_resources?id=eq.{resource_id}", "DELETE")
+
+    def put(self, object_key: str, data: bytes) -> None:
+        self._request(f"/storage/v1/object/{BUCKET}/{urllib.parse.quote(object_key, safe='/')}",
+                      "POST", data, "image/jpeg")
+
+    def read(self, object_key: str) -> bytes:
+        return self._request(f"/storage/v1/object/authenticated/{BUCKET}/{urllib.parse.quote(object_key, safe='/')}")
+
+    def delete(self, object_key: str) -> None:
+        self._request(f"/storage/v1/object/{BUCKET}", "DELETE",
+                      json.dumps({"prefixes": [object_key]}).encode(), "application/json")
+
+
+def public(row: dict) -> dict:
+    """A resource as the browser sees it: no storage path."""
+    return {key: row.get(key) for key in ("id", "unit_id", "kind", "note", "skill_id", "created_email", "created_at",
+                                          "created_by")}
+
+
+def resource_id(value: str) -> str:
+    try:
+        return str(uuid.UUID(value))
+    except ValueError as exc:
+        raise HTTPException(404, "resource not found") from exc
+
+
+def install_resource_routes(app, signed_in):
+    if not hasattr(app.state, "resources"):
+        app.state.resources = UnitResources(app.state.auth)
+
+    def teacher(user=Depends(signed_in)) -> dict:
+        if not user or not user.get("id"):
+            raise HTTPException(401, "sign in required")
+        if not has_permission(user, "students.view"):
+            raise HTTPException(403, "teacher permission required")
+        if not app.state.resources.configured:
+            raise HTTPException(503, "resource storage is not configured")
+        return user
+
+    def unit_of(unit_id: str) -> dict:
+        unit = next((u for u in algebra9()["units"] if u["id"] == unit_id), None)
+        if unit is None:
+            raise HTTPException(404, "unit not found")
+        return unit
+
+    async def storage(call, *args):
+        try:
+            return await run_in_threadpool(call, *args)
+        except ResourceUnavailable as exc:
+            raise HTTPException(503, "resource storage unavailable") from exc
+
+    @app.get("/api/math/units/{unit_id}/resources")
+    async def list_resources(unit_id: str, _user: dict = Depends(teacher)):
+        unit_of(unit_id)
+        rows = await storage(app.state.resources.list, unit_id)
+        return JSONResponse({"resources": [public(row) for row in rows]}, headers={"Cache-Control": "no-store"})
+
+    @app.post("/api/math/units/{unit_id}/resources")
+    async def add_resource(unit_id: str, photo: UploadFile = File(...), kind: str = Form(...),
+                           note: str = Form(""), skill: str = Form(""), user: dict = Depends(teacher)):
+        unit = unit_of(unit_id)
+        if kind not in KINDS:
+            raise HTTPException(400, "choose what the photo shows")
+        note = " ".join(note.split())
+        if len(note) > MAX_NOTE:
+            raise HTTPException(400, f"the description is longer than {MAX_NOTE} characters")
+        if kind == "other" and not note:
+            raise HTTPException(400, "describe the photo")
+        skills = {s["id"]: s for s in algebra9()["skills"] if s["unit"] == unit_id}
+        if skill and skill not in skills:
+            raise HTTPException(400, "the topic is not part of this lesson")
+        data = await photo.read(MAX_IMAGE + 1)
+        try:
+            image = clean_image(data, photo.content_type or "")
+        except ScanError as exc:
+            raise HTTPException(exc.status, exc.code) from exc
+        key = f"{unit_id}/{uuid.uuid4()}.jpg"
+        await storage(app.state.resources.put, key, image)
+        try:
+            row = await storage(app.state.resources.add, {
+                "unit_id": unit_id, "kind": kind, "note": note, "skill_id": skill or None, "object_key": key,
+                "byte_size": len(image), "created_by": user["id"], "created_email": user.get("email", "")})
+        except HTTPException:
+            try:
+                await run_in_threadpool(app.state.resources.delete, key)
+            except ResourceUnavailable:
+                pass   # an orphaned image holds no row and is never shown
+            raise
+        label = " · ".join(filter(None, [unit["name"], KINDS[kind], skills[skill]["short"] if skill else ""]))
+        app.state.actions.record(user, "resource_added", label)
+        return JSONResponse(public(row), status_code=201, headers={"Cache-Control": "no-store"})
+
+    @app.get("/api/math/resources/{rid}/image")
+    async def resource_image(rid: str, _user: dict = Depends(teacher)):
+        row = await storage(app.state.resources.get, resource_id(rid))
+        if not row:
+            raise HTTPException(404, "resource not found")
+        return Response(await storage(app.state.resources.read, row["object_key"]), media_type="image/jpeg",
+                        headers={"Cache-Control": "private, max-age=3600", "X-Content-Type-Options": "nosniff"})
+
+    @app.delete("/api/math/resources/{rid}")
+    async def delete_resource(rid: str, user: dict = Depends(teacher)):
+        row = await storage(app.state.resources.get, resource_id(rid))
+        if not row:
+            raise HTTPException(404, "resource not found")
+        if row.get("created_by") != user["id"] and not has_permission(user, "management.access"):
+            raise HTTPException(403, "only the teacher who added it can delete it")
+        await storage(app.state.resources.remove, row["id"])
+        try:
+            await run_in_threadpool(app.state.resources.delete, row["object_key"])
+        except ResourceUnavailable:
+            log.warning("a deleted resource's image stayed in storage")
+        return {"ok": True}

static/math.css

@@ -411,6 +411,29 @@ button.sky-chip.flame{padding:6px 11px;color:var(--ink)}
 .mx-uhead{display:flex;align-items:center;gap:4px 10px;flex-wrap:wrap}
 .mx-uhead h2{font-size:20px;color:var(--uc);flex:1;min-width:0}
 .mx-unit.full .mx-uhead h2::after{content:" ✦";color:var(--gold)}
+/* lesson resources: a teacher opens them from a unit's title (static/math.js, openResources) */
+.mx-uhead.is-teach{cursor:pointer}
+.mx-res-open{border:1px solid color-mix(in srgb,var(--uc) 55%,var(--line));background:var(--bg);color:var(--ink);border-radius:999px;padding:6px 12px;font:600 13px/1 var(--f-body);cursor:pointer;min-height:32px}
+.mx-res-take{align-self:stretch;min-height:52px;font-size:17px}
+.mx-res-msg{min-height:1.3em;color:var(--muted);font-size:14px}
+.mx-res-form{display:flex;flex-direction:column;gap:14px}
+.mx-res-form .mx-thumb{max-height:260px}
+.mx-res-form fieldset{margin:0;padding:0;border:0;display:flex;flex-direction:column;gap:10px}
+.mx-res-form legend,.mx-res-form>label{font-weight:700;margin-bottom:6px}
+.mx-res-form>label{display:flex;flex-direction:column;gap:6px}.mx-res-form>label small{color:var(--muted);font-weight:500}
+.mx-res-kinds{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:8px}
+.mx-res-kinds label{display:flex;align-items:center;justify-content:center;gap:6px;min-height:48px;border:1px solid var(--line);border-radius:12px;padding:8px;text-align:center;cursor:pointer;font-weight:600}
+.mx-res-kinds label:has(input:checked){border-color:var(--mx-accent);background:var(--mx-accent-soft)}
+.mx-res-kinds input{position:absolute;opacity:0;pointer-events:none}
+.mx-res-kinds label:has(input:focus-visible){outline:2px solid var(--mx-accent);outline-offset:2px}
+.mx-res-form input[name="note"],.mx-res-form select{box-sizing:border-box;width:100%;border:1px solid var(--line);border-radius:10px;background:var(--bg);color:var(--ink);padding:11px 12px;font:inherit}
+.mx-res-list{display:flex;flex-direction:column;gap:10px}
+.mx-res-item{display:grid;grid-template-columns:88px 1fr auto;gap:12px;align-items:start;border:1px solid var(--line);border-radius:12px;background:var(--bg);padding:10px}
+.mx-res-img{display:block;width:88px;height:88px;border-radius:8px;overflow:hidden;background:var(--surface-2)}
+.mx-res-img img{width:100%;height:100%;object-fit:cover;display:block}
+.mx-res-item>div{display:flex;flex-direction:column;gap:4px;min-width:0}
+.mx-res-item p{margin:0;overflow-wrap:anywhere}.mx-res-item small{color:var(--muted);overflow-wrap:anywhere}
+@media (max-width:380px){.mx-res-kinds{grid-template-columns:1fr}}
 .mx-pill{padding:3px 10px;border-radius:999px;font:700 12px/1.4 var(--f-body);background:color-mix(in srgb,var(--uc) 18%,transparent);color:var(--uc);font-variant-numeric:tabular-nums}
 .mx-usub{width:100%;color:var(--muted);font-size:13px}
 .mx-step{position:relative;display:flex;flex-direction:column;align-items:center;gap:6px;width:150px;transform:translateX(calc(var(--x) * var(--amp)))}

static/math.js

@@ -26,7 +26,7 @@ const save=()=>{ try{ localStorage.setItem(key(),JSON.stringify(P)); }catch{} };
 
 let G=null, BY={}, POST={}, ORDER=[], P={done:{},tries:{},solved:{},at:{}}, root=null, curQ=0, path=null, sheet=null, cur=null, back=null, ACTIVE_SUBJECT="";
 let nav=null, FIRST=true, COMBO=0;   // the tab bar; whether the shown question is still at its first try; first-try answers in a row
-let picker=null, PH=null;   // the photo file picker, and the photographed problem on the sheet (see photo())
+let picker=null, PH=null, resPicker=null, RES=null;   // RES: the open lesson-resources sheet (see openResources())   // the photo file picker, and the photographed problem on the sheet (see photo())
 let advanceTimer=null;
 let phonePair=null;
 function stopPhone(){
@@ -74,8 +74,11 @@ async function show(){
     // no capture attribute: the phone offers the camera and the gallery both
     picker=document.createElement("input"); picker.type="file"; picker.accept="image/*"; picker.hidden=true;
     picker.onchange=()=>{ const f=picker.files[0]; picker.value=""; if(f) photo(f); };
+    resPicker=document.createElement("input"); resPicker.type="file"; resPicker.accept="image/*"; resPicker.hidden=true;
+    resPicker.setAttribute("capture","environment");   // a lesson resource is photographed: the phone opens its camera
+    resPicker.onchange=()=>{ const f=resPicker.files[0]; resPicker.value=""; if(f) resourcePhoto(f); };
     nav=document.createElement("nav"); nav.className="mx-nav"; nav.setAttribute("aria-label","ניווט"); nav.hidden=true;
-    root.append(path,sheet,picker,nav); document.body.append(root); window.MathlySky.mount(root);
+    root.append(path,sheet,picker,resPicker,nav); document.body.append(root); window.MathlySky.mount(root);
     root.addEventListener("click",onClick);
     document.addEventListener("keydown",e=>{ if(e.key==="Escape"&&cur) closeSheet(); });
   }
@@ -238,7 +241,7 @@ function examSoon(){
    The nodes sway left and right; trail() then draws the line through their centres, lit up to the last skill done. */
 const SWAY=[0,.55,.9,.55,0,-.55,-.9,-.55];
 function pathView(){
-  const nxt=next(), cls=MY_CLASS?` · כיתת ${esc(MY_CLASS.name)}`:"";
+  const nxt=next(), cls=MY_CLASS?` · כיתת ${esc(MY_CLASS.name)}`:"", teach=can("students.view");
   let k=0;
   const units=mineUnits().map(u=>{
     const ids=unitIds(u), act=ids.filter(live), lit=act.filter(id=>P.done[id]).length;
@@ -246,8 +249,10 @@ function pathView(){
       return `<div class="mx-step u-${u.id}" style="--x:${SWAY[k++%SWAY.length]}">
         <button class="mx-node mx-star st-${st}" data-id="${id}" aria-label="${esc(plain(BY[id].name))}: ${STATE_NAME[st]}">${Sky.spark()}${st==="next"?`<span class="mx-perch">${Sky.owl(34)}</span>`:""}</button>
         <span class="mx-lbl l-${st}">${fmt(BY[id].short)}${tag?`<em>${tag}</em>`:""}</span></div>`; }).join("");
-    return `<section class="mx-unit u-${u.id}${unitDone(u)?" full":""}" id="mx-unit-${u.id}"><div class="mx-uhead">
-      <h2>${esc(u.name)}</h2><span class="mx-pill">${lit}/${act.length}</span>${u.when?`<span class="mx-usub">${esc(u.when)}</span>`:""}</div></section>${steps}`;
+    const res=teach?` data-act="resources" data-unit="${u.id}"`:"";   // a teacher opens the lesson's resources from its title
+    return `<section class="mx-unit u-${u.id}${unitDone(u)?" full":""}" id="mx-unit-${u.id}"><div class="mx-uhead${teach?" is-teach":""}"${res}>
+      <h2>${esc(u.name)}</h2><span class="mx-pill">${lit}/${act.length}</span>${u.when?`<span class="mx-usub">${esc(u.when)}</span>`:""}
+      ${teach?`<button class="mx-res-open"${res} aria-label="משאבי השיעור ${esc(u.name)}">📷 משאבים</button>`:""}</div></section>${steps}`;
   }).join("");
   return `${topBar()}${daily()}${examSoon()}<div class="mx-pghead"><h2>המסלול שלי</h2><p class="mx-sub">אלגברה וגאומטריה כיתה ט׳ · 5 יח״ל${cls}</p></div>
     <div class="mx-trail"><svg class="mx-line" aria-hidden="true"></svg>
@@ -357,7 +362,7 @@ function open(id){
   sheet.querySelector(".mx-x").focus({preventScroll:true});
   if(openEnded&&st!=="off")window.MathlyAnswers?.mountQuestion(sheet.querySelector(".mx-answer"),id,s.question_version);
 }
-function closeSheet(){ stopPhone(); cancelAdvance(); if(sheet)sheet.hidden=true; cur=null; back?.focus?.({preventScroll:true}); back=null; }
+function closeSheet(){ stopPhone(); dropResources(); cancelAdvance(); if(sheet)sheet.hidden=true; cur=null; back?.focus?.({preventScroll:true}); back=null; }
 
 // counts down, then opens `target` (a skill id); stops if the student moved on in the meantime
 function autoAdvance(id,target){
@@ -435,6 +440,10 @@ function onClick(e){
     case "cal-next": return showStreak(1);
     case "sound": Sky.setSound(!Sky.soundOn()); Sky.sound.tap(); return draw();
     case "phone": return pairPhone();
+    case "resources": return openResources(t.dataset.unit);
+    case "res-take": case "res-retake": return resPicker.click();
+    case "res-cancel": RES.photo=null; RES.msg=""; return drawResources();
+    case "res-delete": return deleteResource(t.dataset.res);
     case "copy-phone": return copyPhone(t);
     case "photo": case "retake": return picker.click();
     case "hint": PH.shown++; return drawPhoto();
@@ -543,7 +552,7 @@ function showManageMode(mode){
 /* Monitoring (ניטור): a snapshot of the system, open-answer activity, and the server's latest warnings.
    Each source loads and fails on its own, so a slow Supabase does not hold up the rest. */
 const MON_RANGES={day:["יום","24 השעות האחרונות","15 דקות"],week:["שבוע","7 הימים האחרונים","שעה"],month:["חודש","30 הימים האחרונים","יום"]};
-const MON_ACTIONS={visit:["👋","נכנס/ה לאפליקציה"],photo:["📷","צילם/ה תרגיל לעזרה"],answer_upload:["📝","שלח/ה תשובה פתוחה"],answer_graded:["✔️","תשובה נבדקה"],class_saved:["🏫","שמר/ה כיתה"],class_deleted:["🗑️","מחק/ה כיתה"]};
+const MON_ACTIONS={visit:["👋","נכנס/ה לאפליקציה"],photo:["📷","צילם/ה תרגיל לעזרה"],answer_upload:["📝","שלח/ה תשובה פתוחה"],answer_graded:["✔️","תשובה נבדקה"],class_saved:["🏫","שמר/ה כיתה"],class_deleted:["🗑️","מחק/ה כיתה"],resource_added:["🖼️","הוסיף/ה תמונה למשאבי שיעור"]};
 const VERDICTS={correct:"נכונות",partial:"נכונות חלקית",incorrect:"שגויות",unreadable:"לא קריאות",needs_review:"דורשות בדיקה",grading:"בבדיקה",failed:"הבדיקה נכשלה"};
 let MON={}, MON_RANGE=(()=>{try{return localStorage.getItem("mathly.monRange")}catch{return null}})();
 if(!MON_RANGES[MON_RANGE]) MON_RANGE="week";
@@ -876,6 +885,143 @@ async function pairPhone(){
   }catch(error){if(phonePair===pair)message.textContent=error.message;}
 }
 
+/* Lesson resources (app/unit_resources.py). A teacher taps a unit's title on the path, photographs an exercise or an
+   explanation, says what it shows (a new exercise, a theory explanation, or other words) and, if they like, which of
+   the unit's topics it belongs to. Images come through the API with the teacher's sign-in, so each is a blob URL. */
+const RES_KINDS={exercise:"תרגיל חדש",theory:"הסבר תיאורטי",other:"אחר"};
+const resError=(status,fallback)=>({401:"צריך להיכנס מחדש.",403:"רק מורים יכולים לראות ולהוסיף משאבים.",404:"השיעור או התמונה לא נמצאו.",
+  413:"התמונה גדולה מדי. נסו לצלם שוב.",415:"לא הצלחנו לקרוא את התמונה. צלמו שוב או בחרו JPEG, PNG או WebP.",
+  503:"שמירת משאבים עדיין לא זמינה בשרת. נסו שוב מאוחר יותר."}[status]||fallback);
+function dropResources(){
+  if(!RES) return;
+  Object.values(RES.urls).forEach(url=>URL.revokeObjectURL(url));
+  if(RES.preview) URL.revokeObjectURL(RES.preview);
+  RES=null;
+}
+function openResources(unitId){
+  const unit=G.units.find(u=>u.id===unitId);
+  if(!unit||!can("students.view")) return;
+  stopPhone(); cancelAdvance(); dropResources();
+  if(!cur) back=document.activeElement;
+  cur="resources";
+  RES={unit,items:null,error:"",urls:{},photo:null,preview:null,busy:false,msg:"",fresh:true};
+  drawResources();
+  loadResources(RES);
+}
+async function loadResources(mine){
+  try{
+    const res=await api(`/api/math/units/${encodeURIComponent(mine.unit.id)}/resources`,{cache:"no-store"}), data=await res.json().catch(()=>({}));
+    if(!res.ok) throw new Error(resError(res.status,"לא הצלחנו לטעון את המשאבים."));
+    mine.items=data.resources||[]; mine.error="";
+  }catch(e){ mine.items=mine.items||[]; mine.error=e.message; }
+  if(RES===mine&&cur==="resources") drawResources();
+}
+function resourceForm(){
+  const skills=unitSkills(RES.unit.id);
+  return `<form class="mx-res-form" novalidate>
+    <img class="mx-thumb" src="${RES.preview}" alt="התמונה שצילמתם">
+    <fieldset><legend>מה בתמונה?</legend><div class="mx-res-kinds">
+      ${Object.entries(RES_KINDS).map(([k,label])=>`<label><input type="radio" name="kind" value="${k}"><span>${label}</span></label>`).join("")}</div>
+      <input name="note" maxlength="200" autocomplete="off" placeholder="כתבו מה יש בתמונה" aria-label="תיאור חופשי של התמונה" hidden></fieldset>
+    <label>נושא <small>(לא חובה)</small><select name="skill"><option value="">ללא נושא מסוים</option>
+      ${skills.map(s=>`<option value="${esc(s.id)}">${esc(plain(s.name))}</option>`).join("")}</select></label>
+    <div class="mx-row"><button type="submit" class="mx-btn solid"${RES.busy?" disabled":""}>${RES.busy?"שומרים…":"שמירה במשאבים"}</button>
+      <button type="button" class="mx-btn" data-act="res-retake"${RES.busy?" disabled":""}>צילום מחדש</button>
+      <button type="button" class="mx-btn" data-act="res-cancel"${RES.busy?" disabled":""}>ביטול</button></div></form>`;
+}
+function resourceItem(r){
+  const skill=r.skill_id&&BY[r.skill_id], mine=r.created_by===CFG.userId||can("management.access");
+  const when=new Date(r.created_at), date=Number.isNaN(when.getTime())?"":when.toLocaleDateString("he-IL",{day:"numeric",month:"short",year:"numeric"});
+  return `<article class="mx-res-item"><a class="mx-res-img" data-res-link="${esc(r.id)}" target="_blank" rel="noopener" aria-label="פתיחת התמונה בגודל מלא">
+      <img data-res-img="${esc(r.id)}" alt="${esc(r.kind==="other"?r.note:RES_KINDS[r.kind]||"")}"${RES.urls[r.id]?` src="${RES.urls[r.id]}"`:""}></a>
+    <div><b>${esc(RES_KINDS[r.kind]||r.kind)}</b>${r.kind==="other"&&r.note?`<p>${esc(r.note)}</p>`:""}
+      <small>${skill?`${fmt(skill.short||skill.name)} · `:""}${esc(date)}${r.created_email?` · <span dir="ltr">${esc(r.created_email)}</span>`:""}</small></div>
+    ${mine?`<button class="mx-link" data-act="res-delete" data-res="${esc(r.id)}">מחיקה</button>`:""}</article>`;
+}
+function drawResources(){
+  const items=RES.items, was=sheet.querySelector(".mx-res-form");   // a redraw keeps what was filled in
+  const filled=was&&{kind:was.elements.kind.value,note:was.elements.note.value,skill:was.elements.skill.value};
+  const list=items===null?'<p class="mx-note">טוענים את המשאבים…</p>':items.length?`<div class="mx-res-list">${items.map(resourceItem).join("")}</div>`
+    :'<p class="mx-note">עוד אין משאבים לשיעור הזה. צלמו תרגיל או הסבר כדי להוסיף.</p>';
+  sheet.innerHTML=`<div class="mx-scrim" data-act="close"></div>
+    <div class="mx-sheet mx-res u-${RES.unit.id}" role="dialog" aria-modal="true" aria-labelledby="mxTitle">
+      <div class="mx-shtop"><div><span class="mx-uchip">${esc(RES.unit.name)}</span><h3 id="mxTitle">משאבי השיעור</h3>
+        <small class="mx-src">תמונות של תרגילים והסברים לשיעור הזה</small></div>
+        <button class="mx-x" data-act="close" aria-label="סגירה">✕</button></div>
+      ${RES.photo?resourceForm():'<button class="mx-btn solid mx-res-take" data-act="res-take">📷 צילום תמונה</button>'}
+      <p class="mx-res-msg" role="status" aria-live="polite">${esc(RES.msg)}</p>
+      ${RES.error?`<p class="mx-bad">${esc(RES.error)}</p>`:""}
+      <div class="mx-sec"><h4>משאבים${items?.length?` (${items.length})`:""}</h4>${list}</div></div>`;
+  sheet.hidden=false;
+  if(RES.fresh){ RES.fresh=false; sheet.querySelector(".mx-x").focus({preventScroll:true}); }
+  const form=sheet.querySelector(".mx-res-form");
+  if(form){
+    const note=form.elements.note;
+    if(filled){ form.querySelectorAll('[name="kind"]').forEach(r=>r.checked=r.value===filled.kind); note.value=filled.note; form.elements.skill.value=filled.skill; note.hidden=filled.kind!=="other"; }
+    form.addEventListener("change",()=>{ note.hidden=form.elements.kind.value!=="other"; if(!note.hidden) note.focus(); });
+    form.onsubmit=event=>{ event.preventDefault(); saveResource(form); };
+  }
+  (items||[]).forEach(r=>{ if(r.id in RES.urls) showResourceImage(r.id); else loadResourceImage(RES,r.id); });
+}
+function showResourceImage(id){
+  const url=RES.urls[id], img=sheet.querySelector(`[data-res-img="${CSS.escape(id)}"]`), link=sheet.querySelector(`[data-res-link="${CSS.escape(id)}"]`);
+  if(!url) return;
+  if(img) img.src=url;
+  if(link) link.href=url;
+}
+async function loadResourceImage(mine,id){
+  mine.urls[id]=null;   // asked for once
+  try{
+    const res=await api(`/api/math/resources/${encodeURIComponent(id)}/image`);
+    if(!res.ok) return;
+    const url=URL.createObjectURL(await res.blob());
+    if(RES!==mine){ URL.revokeObjectURL(url); return; }
+    mine.urls[id]=url; showResourceImage(id);
+  }catch{}
+}
+async function resourcePhoto(file){
+  if(!RES||cur!=="resources") return;
+  const mine=RES;
+  mine.msg="מכינים את התמונה…"; drawResources();
+  let blob=null;
+  try{ blob=await window.MathlyPhoto.prepare(file); }catch{}
+  if(!blob&&["image/jpeg","image/png","image/webp"].includes(file.type)) blob=file;
+  if(RES!==mine) return;
+  if(!blob||blob.size>5000000){ mine.msg="לא הצלחנו להכין את התמונה. צלמו שוב."; return drawResources(); }
+  if(mine.preview) URL.revokeObjectURL(mine.preview);
+  mine.photo=blob; mine.preview=URL.createObjectURL(blob); mine.msg="בחרו מה יש בתמונה, ואם תרצו גם את הנושא.";
+  drawResources();
+  sheet.querySelector(".mx-res-form")?.scrollIntoView({block:"start"});
+}
+async function saveResource(form){
+  const mine=RES, kind=form.elements.kind.value, note=form.elements.note.value.trim(), skill=form.elements.skill.value;
+  const status=sheet.querySelector(".mx-res-msg");
+  if(!kind){ status.textContent="בחרו מה יש בתמונה: תרגיל חדש, הסבר תיאורטי או אחר."; return; }
+  if(kind==="other"&&!note){ status.textContent="כתבו בכמה מילים מה יש בתמונה."; form.elements.note.focus(); return; }
+  mine.busy=true; form.querySelectorAll("button").forEach(b=>b.disabled=true); status.textContent="שומרים…";
+  try{
+    const body=new FormData(); body.append("photo",mine.photo,"resource.jpg"); body.append("kind",kind); body.append("note",kind==="other"?note:""); body.append("skill",skill);
+    const res=await api(`/api/math/units/${encodeURIComponent(mine.unit.id)}/resources`,{method:"POST",body}), data=await res.json().catch(()=>({}));
+    if(!res.ok) throw new Error(resError(res.status,"לא הצלחנו לשמור. נסו שוב."));
+    mine.urls[data.id]=URL.createObjectURL(mine.photo);   // the saved photo, without downloading it again
+    mine.items=[data,...(mine.items||[])];
+    URL.revokeObjectURL(mine.preview); mine.photo=mine.preview=null; mine.msg="התמונה נשמרה במשאבי השיעור.";
+  }catch(e){ mine.msg=e.message; }
+  mine.busy=false;
+  if(RES===mine&&cur==="resources") drawResources();
+}
+async function deleteResource(id){
+  const mine=RES; if(!mine||!confirm("למחוק את התמונה ממשאבי השיעור?")) return;
+  try{
+    const res=await api(`/api/math/resources/${encodeURIComponent(id)}`,{method:"DELETE"});
+    if(!res.ok) throw new Error(resError(res.status,"לא הצלחנו למחוק. נסו שוב."));
+    mine.items=mine.items.filter(r=>r.id!==id);
+    if(mine.urls[id]) URL.revokeObjectURL(mine.urls[id]);
+    delete mine.urls[id]; mine.msg="התמונה נמחקה.";
+  }catch(e){ mine.msg=e.message; }
+  if(RES===mine&&cur==="resources") drawResources();
+}
+
 function geometryDiagram(diagram){
   const triangle=diagram.type==="triangle";
   return `<div class="mx-geometry"><svg viewBox="0 0 320 210" role="img" aria-label="${esc(diagram.alt)}">

supabase/migrations/20261101090000_math_unit_resources.sql

@@ -0,0 +1,27 @@
+-- Lesson resources: photos teachers add to a unit. Additive; existing tables are untouched.
+begin;
+create table public.math_unit_resources (
+  id uuid primary key default gen_random_uuid(),
+  unit_id text not null,
+  kind text not null check (kind in ('exercise','theory','other')),
+  note text not null default '' check (char_length(note) <= 200),
+  skill_id text,
+  object_key text not null unique,
+  byte_size integer not null check (byte_size > 0 and byte_size <= 5000000),
+  created_by uuid references auth.users(id) on delete set null,
+  created_email text not null default '',
+  created_at timestamptz not null default now(),
+  check (kind <> 'other' or note <> '')
+);
+create index math_unit_resources_unit on public.math_unit_resources(unit_id, created_at desc);
+alter table public.math_unit_resources enable row level security;
+-- Only the backend (service role) reads or writes; it checks the teacher first.
+revoke all on public.math_unit_resources from anon, authenticated;
+grant all on public.math_unit_resources to service_role;
+
+insert into storage.buckets(id, name, public, file_size_limit, allowed_mime_types)
+  values ('mathly-resources', 'mathly-resources', false, 5000000, array['image/jpeg']);
+-- Restrictive, so a permissive "all buckets" policy cannot open it.
+create policy math_resource_private on storage.objects as restrictive for all to anon, authenticated
+  using (bucket_id <> 'mathly-resources') with check (bucket_id <> 'mathly-resources');
+commit;

tests/test_unit_resources.py

@@ -0,0 +1,291 @@
+"""Lesson resources: teachers photograph exercises and explanations for a unit."""
+import asyncio
+import io
+import re
+import socket
+import threading
+import time
+import uuid
+from pathlib import Path
+
+import httpx
+import pytest
+import uvicorn
+from PIL import Image
+
+from app.main import create_app
+from app.unit_resources import UnitResources
+from scan_support import BOOTSTRAP, postgres_server
+
+TEACHER = 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa'
+COLLEAGUE = 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb'
+STUDENT = 'cccccccc-cccc-4ccc-8ccc-cccccccccccc'
+ADMIN = 'dddddddd-dddd-4ddd-8ddd-dddddddddddd'
+ROLES = {TEACHER: ['teacher'], COLLEAGUE: ['teacher'], STUDENT: ['student'], ADMIN: ['admin']}
+
+
+class Auth:
+    url = 'https://test.invalid'
+    key = 'public-test'
+    secret = 'server-test'
+    teachers = frozenset()
+    developers = frozenset()
+
+    def user(self, token):
+        return {'id': token, 'email': token[:4] + '@test.invalid'} if token in ROLES else None
+
+    def classes(self):
+        return []
+
+    def access_for(self, user_id, **_kwargs):
+        return {'roles': ROLES[user_id]}
+
+
+class MemoryResources(UnitResources):
+    """The storage calls, kept in memory."""
+
+    def __init__(self):
+        super().__init__(Auth())
+        self.rows, self.files = {}, {}
+
+    def list(self, unit_id):
+        return sorted((r for r in self.rows.values() if r['unit_id'] == unit_id), key=lambda r: r['created_at'], reverse=True)
+
+    def get(self, resource_id):
+        return self.rows.get(resource_id)
+
+    def add(self, row):
+        row = {**row, 'id': str(uuid.uuid4()), 'created_at': f'2026-11-01T10:{len(self.rows):02d}:00Z'}
+        self.rows[row['id']] = row
+        return row
+
+    def remove(self, resource_id):
+        self.rows.pop(resource_id, None)
+
+    def put(self, key, data):
+        self.files[key] = data
+
+    def read(self, key):
+        return self.files[key]
+
+    def delete(self, key):
+        self.files.pop(key, None)
+
+
+def png(color='white'):
+    out = io.BytesIO()
+    Image.new('RGB', (200, 120), color).save(out, 'PNG')
+    return out.getvalue()
+
+
+def app_with(store):
+    app = create_app(auth=Auth())
+    app.state.resources = store
+    return app
+
+
+def client(app, token):
+    return httpx.AsyncClient(transport=httpx.ASGITransport(app=app), base_url='http://test',
+                             headers={'Authorization': f'Bearer {token}'})
+
+
+def add(c, unit='t', kind='exercise', note='', skill=''):
+    return c.post(f'/api/math/units/{unit}/resources', data={'kind': kind, 'note': note, 'skill': skill},
+                  files={'photo': ('p.png', png(), 'image/png')})
+
+
+def test_teacher_adds_lists_opens_and_deletes_lesson_photos():
+    store = MemoryResources()
+    app = app_with(store)
+
+    async def check():
+        async with client(app, TEACHER) as teacher, client(app, COLLEAGUE) as colleague, \
+                client(app, STUDENT) as student, client(app, ADMIN) as admin:
+            # an exercise on a topic of the lesson
+            saved = await add(teacher, skill='t_ext')
+            assert saved.status_code == 201
+            first = saved.json()
+            assert first['kind'] == 'exercise' and first['skill_id'] == 't_ext' and first['note'] == ''
+            assert 'object_key' not in first
+            # a theory explanation with no topic, and free text
+            assert (await add(teacher, kind='theory')).json()['skill_id'] is None
+            other = (await add(teacher, kind='other', note='  סיכום   השיעור  ')).json()
+            assert other['note'] == 'סיכום השיעור'
+            # what the form refuses
+            assert (await add(teacher, kind='photo')).status_code == 400
+            assert (await add(teacher, kind='other', note='   ')).status_code == 400
+            assert (await add(teacher, kind='other', note='x' * 201)).status_code == 400
+            assert (await add(teacher, skill='q_vertex')).status_code == 400   # a topic of another lesson
+            assert (await add(teacher, unit='nope')).status_code == 404
+            bad = await teacher.post('/api/math/units/t/resources', data={'kind': 'exercise'},
+                                     files={'photo': ('p.txt', b'not an image', 'text/plain')})
+            assert bad.status_code == 415
+            assert len(store.rows) == len(store.files) == 3
+
+            listed = (await colleague.get('/api/math/units/t/resources')).json()['resources']
+            assert [r['kind'] for r in listed] == ['other', 'theory', 'exercise']
+            assert all('object_key' not in r for r in listed)
+            assert (await teacher.get('/api/math/units/t2/resources')).json() == {'resources': []}
+
+            image = await colleague.get(f"/api/math/resources/{first['id']}/image")
+            assert image.status_code == 200 and image.headers['content-type'] == 'image/jpeg'
+            assert Image.open(io.BytesIO(image.content)).format == 'JPEG'   # re-encoded, metadata dropped
+            assert (await teacher.get('/api/math/resources/not-a-uuid/image')).status_code == 404
+
+            # students neither see nor add resources
+            assert (await student.get('/api/math/units/t/resources')).status_code == 403
+            assert (await add(student)).status_code == 403
+            assert (await student.get(f"/api/math/resources/{first['id']}/image")).status_code == 403
+
+            # only the teacher who added a photo, or a manager, deletes it
+            assert (await colleague.delete(f"/api/math/resources/{first['id']}")).status_code == 403
+            assert (await teacher.delete(f"/api/math/resources/{first['id']}")).json() == {'ok': True}
+            assert (await admin.delete(f"/api/math/resources/{other['id']}")).json() == {'ok': True}
+            assert (await teacher.delete(f"/api/math/resources/{other['id']}")).status_code == 404
+            assert len(store.rows) == len(store.files) == 1
+
+        async with httpx.AsyncClient(transport=httpx.ASGITransport(app=app), base_url='http://test') as guest:
+            assert (await guest.get('/api/math/units/t/resources')).status_code == 401
+
+    asyncio.run(check())
+    assert [a['kind'] for a in app.state.actions.recent()].count('resource_added') == 3
+
+
+def test_resources_fail_closed_without_storage_key():
+    store = MemoryResources()
+    store.auth = type('NoSecret', (Auth,), {'secret': ''})()
+    app = app_with(store)
+
+    async def check():
+        async with client(app, TEACHER) as teacher:
+            assert (await teacher.get('/api/math/units/t/resources')).status_code == 503
+    asyncio.run(check())
+
+
+def test_migration_keeps_resources_private(postgres_server):
+    psycopg = pytest.importorskip('psycopg')
+    database = 'res_' + uuid.uuid4().hex
+    with psycopg.connect(postgres_server.get_uri(), autocommit=True) as c:
+        c.execute('create database ' + database)
+    try:
+        with psycopg.connect(postgres_server.get_uri(database=database), autocommit=True) as c:
+            c.execute(BOOTSTRAP)
+            c.execute(Path('supabase/migrations/20261101090000_math_unit_resources.sql').read_text())
+            c.execute('insert into auth.users values(%s)', (TEACHER,))
+            assert c.execute("select public from storage.buckets where id='mathly-resources'").fetchone()[0] is False
+            c.execute("set role service_role")
+            c.execute("insert into math_unit_resources(unit_id,kind,skill_id,object_key,byte_size,created_by) "
+                      "values('t','exercise','t_ext','t/a.jpg',10,%s)", (TEACHER,))
+            for bad in ("('t','other','','t/b.jpg',10)", "('t','photo','','t/c.jpg',10)", "('t','theory','','t/a.jpg',10)"):
+                with pytest.raises(psycopg.errors.IntegrityError):
+                    c.execute(f"insert into math_unit_resources(unit_id,kind,note,object_key,byte_size) values{bad}")
+            c.execute("insert into storage.objects(bucket_id,name) values('mathly-resources','t/a.jpg')")
+            c.execute('reset role')
+            c.execute('set role authenticated')
+            with pytest.raises(psycopg.errors.InsufficientPrivilege):
+                c.execute('select * from math_unit_resources')
+            assert c.execute("select count(*) from storage.objects where bucket_id='mathly-resources'").fetchone()[0] == 0
+    finally:
+        with psycopg.connect(postgres_server.get_uri(), autocommit=True) as c:
+            c.execute('drop database ' + database + ' with (force)')
+
+
+@pytest.fixture
+def resource_server():
+    store = MemoryResources()
+    app = app_with(store)
+    with socket.socket() as sock:
+        sock.bind(('127.0.0.1', 0))
+        server = uvicorn.Server(uvicorn.Config(app, log_level='error'))
+        thread = threading.Thread(target=server.run, kwargs={'sockets': [sock]}, daemon=True)
+        thread.start()
+        try:
+            deadline = time.monotonic() + 5
+            while not server.started:
+                assert thread.is_alive() and time.monotonic() < deadline
+                time.sleep(.01)
+            yield f'http://127.0.0.1:{sock.getsockname()[1]}', store
+        finally:
+            server.should_exit = True
+            thread.join(timeout=5)
+
+
+def phone(browser, account):
+    ctx = browser.new_context(viewport={'width': 390, 'height': 844}, is_mobile=True, has_touch=True)
+    ctx.route('https://cdn.jsdelivr.net/**', lambda route: route.abort())
+    ctx.add_init_script('''window.supabase={createClient:()=>({auth:{
+      getSession:async()=>({data:{session:{access_token:'%s',user:{id:'%s'}}}}),
+      onAuthStateChange:()=>({data:{subscription:{unsubscribe(){}}}}),signOut:async()=>{}}})};''' % (account, account))
+    return ctx.new_page()
+
+
+def test_teacher_photographs_a_lesson_resource_on_a_phone(resource_server, tmp_path):
+    playwright = pytest.importorskip('playwright.sync_api')
+    url, store = resource_server
+    photo = tmp_path / 'board.png'
+    photo.write_bytes(png('lightyellow'))
+    expect = playwright.expect
+    with playwright.sync_playwright() as p:
+        browser = p.chromium.launch()
+        try:
+            page = phone(browser, TEACHER)
+            errors = []
+            page.on('pageerror', lambda error: errors.append(str(error)))
+            page.goto(url)
+            page.locator('.mx-nav [data-view="path"]').click()
+            page.locator('#mx-unit-t .mx-uhead h2').click()   # tapping the lesson's title
+            sheet = page.locator('.mx-res')
+            expect(sheet.locator('h3')).to_have_text('משאבי השיעור')
+            expect(sheet.locator('.mx-uchip')).to_have_text('טכניקה אלגברית 1')
+            expect(sheet).to_contain_text('עוד אין משאבים')
+            assert page.locator('input[capture="environment"]').count() == 1   # the camera opens directly
+
+            with page.expect_file_chooser() as chooser:
+                sheet.locator('[data-act="res-take"]').click()
+            chooser.value.set_files(str(photo))
+            form = sheet.locator('.mx-res-form')
+            expect(form.locator('img.mx-thumb')).to_be_visible()
+            form.locator('button[type=submit]').click()
+            expect(sheet.locator('.mx-res-msg')).to_contain_text('בחרו מה יש בתמונה')
+            assert not store.rows
+
+            form.locator('label', has_text='אחר').click()
+            expect(form.locator('input[name=note]')).to_be_visible()
+            form.locator('label', has_text='תרגיל חדש').click()
+            expect(form.locator('input[name=note]')).to_be_hidden()
+            form.locator('select[name=skill]').select_option('t_ext')
+            form.locator('button[type=submit]').click()
+            expect(sheet.locator('.mx-res-msg')).to_have_text('התמונה נשמרה במשאבי השיעור.')
+            item = sheet.locator('.mx-res-item')
+            expect(item).to_have_count(1)
+            expect(item).to_contain_text('תרגיל חדש')
+            expect(item).to_contain_text('פילוג מורחב')
+            (row,) = store.rows.values()
+            assert (row['unit_id'], row['kind'], row['skill_id']) == ('t', 'exercise', 't_ext')
+
+            # free text, with no topic
+            with page.expect_file_chooser() as chooser:
+                sheet.locator('[data-act="res-take"]').click()
+            chooser.value.set_files(str(photo))
+            form.locator('label', has_text='אחר').click()
+            form.locator('input[name=note]').fill('דף עבודה לשיעור בית')
+            form.locator('button[type=submit]').click()
+            expect(item).to_have_count(2)
+            expect(item.first).to_contain_text('דף עבודה לשיעור בית')
+
+            # reopening loads the saved photos from the server
+            sheet.locator('.mx-x').click()
+            page.locator('#mx-unit-t .mx-res-open').click()
+            expect(item).to_have_count(2)
+            expect(item.last.locator('img')).to_have_attribute('src', re.compile('^blob:'))
+            assert errors == []
+
+            student = phone(browser, STUDENT)
+            student.goto(url)
+            student.locator('.mx-nav [data-view="path"]').click()
+            expect(student.locator('#mx-unit-t')).to_be_visible()
+            expect(student.locator('.mx-res-open')).to_have_count(0)
+            student.locator('#mx-unit-t .mx-uhead h2').click()
+            expect(student.locator('.mx-res')).to_have_count(0)
+        finally:
+            browser.close()