Allow show pending in /listAll when authenticated as admin

backend/blueprints/course/__init__.py

@@ -24,17 +24,22 @@ def list_all_courses():
     category_uuid: str = request.args.get('category_uuid')
     search_q: str = request.args.get('search_q', '').strip()
     sort_by: str = request.args.get('sort_by', '').strip()
+    show_pending: bool = bool(int(request.args.get('show_pending', 0)))
     available_sorts = ['date_asc', 'date_desc', 'name_asc', 'name_desc', 'students_desc', 'students_asc']
     if category_uuid is not None:
         category_uuid: uuid.UUID = uuid.UUID(request.args.get('category_uuid'))
     # Build the query as required
-    query: select = select(Course)
+    query: select = select(Course).where(in_)
     if search_q != '':
         query = query.where(or_(Course.name.like(f'%{search_q}%'), Course.description.like(f'%{search_q}%'),
                                 User.firstName.like(f'%{search_q}%')))
     if category_uuid is not None:
         query = query.where(Course.categoryID == category_uuid)
-
+    if g.get('is_authed'):
+        if show_pending and g.current_user.role == int(UserRole.ADMIN):
+            query = query.where(Course.publishedStatus == int(PublishedStatus.PENDING))
+    else:
+        query = query.where(Course.publishedStatus == int(PublishedStatus.APPROVED))
     #total_pages_for_offset: int = db.session.execute(func.count(Course.id).select_from(Course)).scalar()/limit
     total_pages_for_offset: int = db.session.execute(
             select(func.count()).select_from(query.subquery())