diff --git a/apps/course/views/participant.py b/apps/course/views/participant.py index d3129c6..58e3860 100644 --- a/apps/course/views/participant.py +++ b/apps/course/views/participant.py @@ -27,16 +27,22 @@ class CourseParticipantsView(generics.ListAPIView): return self.list(request, *args, **kwargs) def get_queryset(self): """ - Optimized queryset with select_related for course relationship + Optimized queryset with select_related for course relationship. + Filters out guest users (no email) and soft-deleted users (is_active=False). """ course_slug = self.kwargs.get('slug') try: course = Course.objects.get(slug=course_slug) except Course.DoesNotExist: - raise AppAPIException({'message': "Course not found"}) # Handle course not found + raise AppAPIException({'message': "Course not found"}) + # 👇 Apply the strict filters for Normal Users only return StudentUser.objects.select_related().filter( - participated_courses__course=course + participated_courses__course=course, + is_active=True, # Exclude soft-deleted users + email__isnull=False # Exclude guest users + ).exclude( + email__exact='' # Extra safety just in case an email is a blank string )