[BUG FIX] [MER-5610] Fix all pages duplication

[darrensiegel]

There were two different implementations for page duplication, one in the Curriculum view and one in the All Pages view. The latter was broken, badly. This was proven in a unit tests (now deleted) that shows it reversed activities and didn't duplicate them.

This PR refactors to allow the correct Curriculum impl to be used in both places.

The added unit test demonstrates that the Curriculum impl has the properties that we need: preserving order or and duplicating activities.

Tested locally and works as expected.

[github-actions]

Note: risk rules not loaded — micromatch is not a function

Generated by 🚫 dangerJS against 25c9df1

[github-actions]

AI Review — performance

No issues found

[github-actions]

AI Review — ui

Unhandled multiple parent containers can crash duplicate action

file: lib/oli_web/live/resources/pages_view.ex
line: 122
Description: PageBrowse.find_parent_container/2 returns a list, but this case only handles [] and a single-element list. If a page appears in more than one container, the duplicate UI action raises a CaseClauseError instead of showing the existing error flash.
Suggestion: Handle non-singleton results explicitly, for example [_ | _] = containers -> List.first(containers) if the first parent is valid, or return nil/{:error, :ambiguous_parent} and surface the existing duplicate failure flash.

Unhandled multiple parent containers can crash duplicate action

file: lib/oli_web/live/workspaces/course_author/pages_live.ex
line: 612
Description: PageBrowse.find_parent_container/2 returns a list, but this case only handles [] and a single-element list. If a page appears in more than one container, the duplicate UI action raises a CaseClauseError instead of showing the existing error flash.
Suggestion: Handle non-singleton results explicitly, for example [_ | _] = containers -> List.first(containers) if the first parent is valid, or return nil/{:error, :ambiguous_parent} and surface the existing duplicate failure flash.

[github-actions]

AI Review — security

Missing containment check allows duplicating pages without a parent

file: lib/oli/authoring/editing/container_editor.ex
line: 454
Description: duplicate_page now explicitly accepts nil for container, and both new callers pass nil when PageBrowse.find_parent_container/2 finds no parent. In this authoring flow, the parent container is the object-level boundary proving the page belongs in the project structure being edited. Allowing duplication to continue without that boundary weakens server-side authorization/tenancy assumptions and can permit copying orphaned or unexpected revisions instead of rejecting the request.
Suggestion: Keep duplicate_page constrained to a %Revision{} parent container, or return {:error, :parent_container_not_found} when container is nil. In the callers, treat a missing parent as a hard failure and show the existing flash error without invoking ContainerEditor.duplicate_page/4.

[github-actions]

AI Review — elixir

Duplicate action can crash on pages with multiple parents

file: lib/oli_web/live/resources/pages_view.ex
line: 124
Description: parent_container/2 only handles [] and [container]. If PageBrowse.find_parent_container/2 returns more than one container for a page referenced in multiple places, this raises a CaseClauseError before the caller can show the "Could not duplicate page" error.
Suggestion: Return a tagged result from parent_container/2 and explicitly handle the multi-parent case, for example {:error, :ambiguous_parent}, then flash an error instead of calling ContainerEditor.duplicate_page/4.

Duplicate action can crash on pages with multiple parents

file: lib/oli_web/live/workspaces/course_author/pages_live.ex
line: 613
Description: parent_container/2 only matches [] and [container]. A page with multiple parent containers will crash this LiveView action with a CaseClauseError, bypassing the duplicate error handling added above.
Suggestion: Handle the multi-container case explicitly, such as containers when length(containers) > 1 -> {:error, :ambiguous_parent}, and branch in the caller before invoking ContainerEditor.duplicate_page/4.