Determine how content visibility is handled related to content groups

mentioned in merge request !88 (merged)

I think it's ok if the frontend handles visibility of content. If we let the backend filter out content that is not visible, we have to distinguish get requests for rooms and content based on whether the creator or a participant requests the data since the creator needs to see the content. We may need to block answers for content in the backend that is not visible to avoid manipulation.

Proposal:

• Move list of contents out of room. Use a simple array with the group names.
• New API endpoint:
  • /room/{roomId}/contentgroup/{groupname}
  • Query param: filter=visible:true/false

Moved to bigger issue #45

closed