From 56fc15418ef241cc0e8ebd00ad1d364b2e4a4304 Mon Sep 17 00:00:00 2001
From: Maxim Dolgolyov <maxim.dolgolyov@gmail.com>
Date: Mon, 15 Jun 2026 14:19:38 +0300
Subject: [PATCH] =?UTF-8?q?feat(sidebar):=20=D1=81=D0=BA=D1=80=D1=8B=D0=B2?=
 =?UTF-8?q?=D0=B0=D1=82=D1=8C=20=D1=81=D1=81=D1=8B=D0=BB=D0=BA=D0=B8=20exa?=
 =?UTF-8?q?m-prep=20=D0=BF=D1=80=D0=B8=20=D0=B2=D1=8B=D0=BA=D0=BB=D1=8E?=
 =?UTF-8?q?=D1=87=D0=B5=D0=BD=D0=BD=D0=BE=D0=BC/=D0=BD=D0=B5=D0=B4=D0=BE?=
 =?UTF-8?q?=D1=81=D1=82=D1=83=D0=BF=D0=BD=D0=BE=D0=BC=20=D1=82=D1=80=D0=B5?=
 =?UTF-8?q?=D0=BA=D0=B5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 js/api.js | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/js/api.js b/js/api.js
index fc37a0d..dcd4534 100644
--- a/js/api.js
+++ b/js/api.js
@@ -885,6 +885,23 @@ async function hideDisabledFeatures() {
     }
   }
 
+  // Exam-prep track links (/exam-prep/<key>): показываем только включённые
+  // (exam_tracks.enabled) и доступные пользователю треки. /api/exam-prep/tracks
+  // уже отдаёт enabled-треки, отфильтрованные по правам доступа.
+  const examLinks = document.querySelectorAll('[href^="/exam-prep/"]');
+  if (examLinks.length) {
+    try {
+      const data = await apiFetch('/api/exam-prep/tracks');
+      const allowed = new Set((data.tracks || []).map(t => t.exam_key));
+      examLinks.forEach(el => {
+        const m = (el.getAttribute('href') || '').match(/^\/exam-prep\/([^/?#]+)/);
+        if (m && !allowed.has(m[1])) el.style.display = 'none';
+      });
+      const cur = window.location.pathname.match(/^\/exam-prep\/([^/?#]+)/);
+      if (cur && !allowed.has(cur[1])) window.location.href = '/dashboard.html';
+    } catch { /* сеть/доступ недоступны — ссылки оставляем как есть */ }
+  }
+
   // Student with no class — restrict to dashboard, homework, library, theory
   if (feats._no_class) {
     const classOnlyHrefs = [