a

files/migrations/0017_mediapermission_source.py

@@ -0,0 +1,18 @@
+# Generated by Django 5.2.6 on 2026-04-21 15:54
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('files', '0016_category_lti_platform'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='mediapermission',
+            name='source',
+            field=models.CharField(choices=[('lti_embed', 'LTI Embed'), ('explicit', 'Explicit')], default='explicit', max_length=32),
+        ),
+    ]

files/models/media.py

@@ -981,10 +981,18 @@ class MediaPermission(models.Model):
         ("owner", "Owner"),
     )
 
+    SOURCE_LTI_EMBED = 'lti_embed'
+    SOURCE_EXPLICIT = 'explicit'
+    SOURCE_CHOICES = (
+        (SOURCE_LTI_EMBED, 'LTI Embed'),
+        (SOURCE_EXPLICIT, 'Explicit'),
+    )
+
     owner_user = models.ForeignKey('users.User', on_delete=models.CASCADE, related_name='granted_permissions')
     user = models.ForeignKey('users.User', on_delete=models.CASCADE)
     media = models.ForeignKey('Media', on_delete=models.CASCADE, related_name='permissions')
     permission = models.CharField(max_length=20, choices=PERMISSION_CHOICES)
+    source = models.CharField(max_length=32, choices=SOURCE_CHOICES, default=SOURCE_EXPLICIT)
     created_at = models.DateTimeField(auto_now_add=True)
 
     class Meta:

files/views/media.py

@@ -183,8 +183,11 @@ class MediaList(APIView):
             else:
                 base_queryset = Media.objects.prefetch_related("user", "tags")
 
-                # Build OR conditions similar to _get_media_queryset
-                conditions = Q(permissions__user=request.user)
+                exclude_lti_embed = request.GET.get('exclude_lti_embed') == '1'
+                if exclude_lti_embed:
+                    conditions = Q(permissions__user=request.user, permissions__source=MediaPermission.SOURCE_EXPLICIT)
+                else:
+                    conditions = Q(permissions__user=request.user)
 
                 if getattr(settings, 'USE_RBAC', False):
                     rbac_categories = request.user.get_rbac_categories_as_member()