fix: restrict mute privileges to discussion moderators only

[Alam-2U]

Description

Fixed discussion moderation permissions to restrict delete, ban, mute, and restore operations to discussion moderators only. Course staff and course instructors were incorrectly granted full moderation privileges when mute feature was added - they are authoring roles and should not have discussion moderation access.

Changes:

• Removed course staff/instructors from moderation privilege checks
• Preserved existing permissions (course staff can still pin threads and vote)
• Updated tests to reflect correct permission model

Who can moderate: Global Staff, Discussion Admins, Discussion Moderators, Community TAs
Who cannot: Course Staff, Course Instructors (authoring roles only)

Ticket

COSMO2-859

[Copilot]

Pull request overview

This PR tightens discussion moderation authorization by removing course staff/instructors from moderation privilege checks, ensuring only discussion moderation roles (and global staff) can perform high-impact actions like mute/restore/bulk moderation, while preserving authoring-role abilities like pinning and voting.

Changes:

• Updated privilege detection to exclude course staff/instructors from “moderation” checks across REST API utilities/permissions/serialization context.
• Adjusted editable-field exposure (e.g., removed muted) to align with the revised privilege model.
• Updated/restated unit tests to reflect the corrected permission expectations.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
lms/djangoapps/discussion/rest_api/utils.py	Restricts notify-all and “privileged user” checks to forum moderation/global staff rather than course team roles.
lms/djangoapps/discussion/rest_api/permissions.py	Removes muted as editable and tightens moderation permissions (bulk/spam/mute/restore).
lms/djangoapps/discussion/rest_api/serializers.py	Updates moderation context usage and privilege/label logic to exclude course staff; adds global-staff handling.
lms/djangoapps/discussion/rest_api/forum_mute_views.py	Aligns “privileged” detection used by mute views with revised moderation roles.
lms/djangoapps/discussion/rest_api/api.py	Adjusts course API payload admin flag logic (global staff vs staff).
lms/djangoapps/discussion/rest_api/tests/test_permissions.py	Updates expected editable/initializable fields and restore/mute tests for new role model.
lms/djangoapps/discussion/rest_api/tests/test_moderation_permissions.py	Updates spam/bulk-delete permission tests to deny course staff/instructors.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

lms/djangoapps/discussion/rest_api/tests/test_moderation_permissions.py:62

• This test file hard-codes forum role names like 'Moderator', 'Administrator', and 'Community TA'. Elsewhere in the discussion REST API tests, role name constants are used (e.g., FORUM_ROLE_MODERATOR in lms/djangoapps/discussion/rest_api/tests/test_permissions.py:27-32), which avoids typos and keeps tests aligned if role names change. Consider importing and using the FORUM_ROLE_* constants here as well.

    def test_forum_moderator_has_permission(self):
        """Forum moderators should have permission for their course."""
        user = UserFactory.create()
        role = Role.objects.create(name='Moderator', course_id=self.course_key)
        role.users.add(user)
        self.assertTrue(can_take_action_on_spam(user, self.course_key))

    def test_forum_administrator_has_permission(self):
        """Forum administrators should have permission for their course."""
        user = UserFactory.create()
        role = Role.objects.create(name='Administrator', course_id=self.course_key)
        role.users.add(user)
        self.assertTrue(can_take_action_on_spam(user, self.course_key))

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.