quiz resetc

internal/server/server.go

@@ -725,17 +725,20 @@ func (s *Server) setupRouter() {
 		// Vāṇī of the Day — public daily content pick for the home page.
 		r.Get("/vani/today", s.vaniH.Today)
 
-		// Quizzes. Browsing is open to signed-out readers (they see that a
-		// quiz exists); taking one, and seeing results, needs an account.
+		// Quizzes are for signed-in users: listing, finding one on a page,
+		// taking it and reading results all need an account. The one open
+		// endpoint is a quiz's own card — title, description, what it's
+		// attached to, never its questions — so link previews (OpenGraph)
+		// can name the quiz when it's shared.
 		r.Route("/quizzes", func(r chi.Router) {
 			r.Group(func(r chi.Router) {
 				r.Use(middleware.OptionalAuth(s.authIssuer, s.userRepo))
-				r.Get("/", s.quizH.List)
-				r.Get("/for", s.quizH.ForPath)
 				r.Get("/{id}", s.quizH.Get)
 			})
 			r.Group(func(r chi.Router) {
 				r.Use(middleware.RequireAuth(s.authIssuer, s.userRepo))
+				r.Get("/", s.quizH.List)
+				r.Get("/for", s.quizH.ForPath)
 				r.Post("/{id}/start", s.quizH.Start)
 				r.Post("/{id}/answer", s.quizH.Answer)
 				r.Get("/{id}/result", s.quizH.Result)
@@ -1262,6 +1265,7 @@ func (s *Server) setupRouter() {
 			can("quizzes:results").Get("/quizzes/{id}/participants", s.quizH.Participants)
 			can("quizzes:results").Get("/quizzes/{id}/participants/{userID}", s.quizH.ParticipantResult)
 			can("quizzes:results").Get("/quizzes/{id}/responses", s.quizH.Responses)
+			can("quizzes:reset").Delete("/quizzes/{id}/participants/{userID}", s.quizH.ResetParticipant)
 
 			can("short_urls:read").Get("/short-urls", s.adminH.ListShortURLs)
 			can("short_urls:read").Get("/short-urls/stats", s.adminH.ShortURLStats)