HTML
"}, (False, True)), + + # Mixed fields + ( + {"title": "New Title", "start_date": "2023-01-01"}, + (True, True) + ), + + # Non-updatable / irrelevant fields + ({"random_field": "value"}, (False, False)), + ) + @ddt.unpack + def test_classify_update(self, payload, expected): + result = _classify_update(payload, self.course.id) + self.assertEqual(result, expected) + + def test_classyfy_update_with_get_request(self): + """ + GET request with no changes should not be classified as schedule or details update. + """ + # Get the current status of the course details to use + # as the basis for the update request + self.add_user_to_role_in_course( + self.authorized_user, + COURSE_EDITOR.external_key, + self.course.id + ) + response = self.authorized_client.get(self.url) + self.assertEqual(response.status_code, status.HTTP_200_OK) + current_course_details = response.json() + # This field is flagged as a details update because of a type mismatch: + # the GET response returns an invalid string, while the stored value has a different type. + # As a result, the equality check fails even though the values are logically the same. + current_course_details["certificates_display_behavior"] = "end" + + expected = (False, False) + result = _classify_update(current_course_details, self.course.id) + self.assertEqual(result, expected) + + def test_course_editor_can_edit_course_details(self): + """ + User with COURSE_EDITOR role can update course details. + COURSE_EDITOR does not have permission to edit schedule fields. + """ + + self.add_user_to_role_in_course( + self.authorized_user, + COURSE_EDITOR.external_key, + self.course.id + ) + + # Get the current status of the course details to use + # as the basis for the update request + response = self.authorized_client.get(self.url) + self.assertEqual(response.status_code, status.HTTP_200_OK) + current_course_details = response.json() + # This field is flagged as a details update because of a type mismatch: + # the GET response returns an invalid string, while the stored value has a different type. + # As a result, the equality check fails even though the values are logically the same. + current_course_details["certificates_display_behavior"] = "end" + + # Update the course details with new values, + # keeping schedule fields the same to ensure we are only + # testing edit details permission + current_course_details["title"] = "Updated Title" + + response = self.authorized_client.put( + path=self.url, + data=json.dumps(current_course_details), + content_type="application/json", + ) + + self.assertEqual(response.status_code, status.HTTP_200_OK) + + def test_course_staff_can_edit_course_schedule(self): + """ + User with COURSE_STAFF role can update course schedule. + Only COURSE_STAFF and COURSE_ADMIN can edit schedule related fields. + """ + self.add_user_to_role_in_course( + self.authorized_user, + COURSE_STAFF.external_key, + self.course.id + ) + + # Get the current status of the course details to use + # as the basis for the update request + response = self.authorized_client.get(self.url) + self.assertEqual(response.status_code, status.HTTP_200_OK) + current_course_details = response.json() + # This field is flagged as a details update because of a type mismatch: + # the GET response returns an invalid string, while the stored value has a different type. + # As a result, the equality check fails even though the values are logically the same. + current_course_details["certificates_display_behavior"] = "end" + + # Update the course details with new values, + # changing schedule fields to ensure we are only + # testing edit schedule permission + current_course_details["end_date"] = "2023-08-01T01:30:00Z" + + response = self.authorized_client.put( + path=self.url, + data=json.dumps(current_course_details), + content_type="application/json", + ) + + self.assertEqual(response.status_code, status.HTTP_200_OK) + + def test_course_editor_cannot_edit_course_schedule(self): + """ + User with COURSE_EDITOR role cannot update course schedule. + Only COURSE_STAFF and COURSE_ADMIN can edit schedule-related fields. + """ + self.add_user_to_role_in_course( + self.authorized_user, + COURSE_EDITOR.external_key, + self.course.id + ) + + # Get the current status of the course details to use + # as the basis for the update request + response = self.authorized_client.get(self.url) + self.assertEqual(response.status_code, status.HTTP_200_OK) + current_course_details = response.json() + # This field is flagged as a details update because of a type mismatch: + # the GET response returns an invalid string, while the stored value has a different type. + # As a result, the equality check fails even though the values are logically the same. + current_course_details["certificates_display_behavior"] = "end" + + # Update the course details with new values, + # changing schedule fields to ensure we are only + # testing edit schedule permission + current_course_details["end_date"] = "2023-08-01T01:30:00Z" + + response = self.authorized_client.put( + path=self.url, + data=json.dumps(current_course_details), + content_type="application/json", + ) + + self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN) + + def test_course_staff_can_edit_course_schedule_and_details(self): + """ + User with COURSE_STAFF role can update course + schedule and details. + """ + self.add_user_to_role_in_course( + self.authorized_user, + COURSE_STAFF.external_key, + self.course.id + ) + + # Get the current status of the course details to use + # as the basis for the update request + response = self.authorized_client.get(self.url) + self.assertEqual(response.status_code, status.HTTP_200_OK) + current_course_details = response.json() + # This field is flagged as a details update because of a type mismatch: + # the GET response returns an invalid string, while the stored value has a different type. + # As a result, the equality check fails even though the values are logically the same. + current_course_details["certificates_display_behavior"] = "end" + + # Update the course details with new values, + # changing schedule and details fields to ensure user + # has permission to edit both + current_course_details["end_date"] = "2023-08-01T01:30:00Z" + current_course_details["title"] = "Updated Title" + + response = self.authorized_client.put( + path=self.url, + data=json.dumps(current_course_details), + content_type="application/json", + ) + + self.assertEqual(response.status_code, status.HTTP_200_OK) + + def test_course_editor_cannot_edit_course_schedule_and_details(self): + """ + User with COURSE_EDITOR role cannot update course + schedule or course details. + """ + self.add_user_to_role_in_course( + self.authorized_user, + COURSE_EDITOR.external_key, + self.course.id + ) + + # Get the current status of the course details to use + # as the basis for the update request + response = self.authorized_client.get(self.url) + self.assertEqual(response.status_code, status.HTTP_200_OK) + current_course_details = response.json() + # This field is flagged as a details update because of a type mismatch: + # the GET response returns an invalid string, while the stored value has a different type. + # As a result, the equality check fails even though the values are logically the same. + current_course_details["certificates_display_behavior"] = "end" + + # Update the course details with new values, + # changing schedule and details fields to ensure user + # has permission to edit both + current_course_details["end_date"] = "2023-08-01T01:30:00Z" + current_course_details["title"] = "Updated Title" + + response = self.authorized_client.put( + path=self.url, + data=json.dumps(current_course_details), + content_type="application/json", + ) + + self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN) + + def test_unauthorized_user_cannot_edit_with_any_change_on_the_payload(self): + """ + An unauthorized user should receive 403 even if the payload contains + no changes that do not require edit permissions. + """ + self.add_user_to_role_in_course( + self.authorized_user, + COURSE_EDITOR.external_key, + self.course.id + ) + + # Get the current status of the course details to use + # as the basis for the update request + response = self.authorized_client.get(self.url) + self.assertEqual(response.status_code, status.HTTP_200_OK) + current_course_details = response.json() + # This field is flagged as a details update because of a type mismatch: + # the GET response returns an invalid string, while the stored value has a different type. + # As a result, the equality check fails even though the values are logically the same. + current_course_details["certificates_display_behavior"] = "end" + + # Update the course details with the same values. + response = self.unauthorized_client.put( + path=self.url, + data=json.dumps(current_course_details), + content_type="application/json", + ) + self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN) + + def test_put_user_without_role_then_added_can_update(self): + """ + Validate dynamic role assignment works for PUT. + """ + # Initially unauthorized + response = self.unauthorized_client.put( + path=self.url, + data=json.dumps(self.request_data), + content_type="application/json", + ) + self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN) + + # Assign role dynamically + self.add_user_to_role_in_course( + self.unauthorized_user, + COURSE_STAFF.external_key, + self.course.id + ) + + response = self.unauthorized_client.put( + path=self.url, + data=json.dumps(self.request_data), + content_type="application/json", + ) + self.assertEqual(response.status_code, status.HTTP_200_OK) + + @patch.dict("django.conf.settings.FEATURES", {"ENABLE_PREREQUISITE_COURSES": True}) + def test_put_invalid_pre_requisite_course_with_authz(self): + """ + Ensure validation still applies under AuthZ. + """ + self.add_user_to_role_in_course( + self.authorized_user, + COURSE_EDITOR.external_key, + self.course.id + ) + + pre_requisite_course_keys = [str(self.course.id), "invalid_key"] + request_data = {"pre_requisite_courses": pre_requisite_course_keys} + + response = self.authorized_client.put( + path=self.url, + data=json.dumps(request_data), + content_type="application/json", + ) + + self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST) + self.assertEqual(response.json()["error"], "Invalid prerequisite course key") + + def test_staff_user_can_update_without_authz_role(self): + """ + Django staff user should bypass AuthZ. + """ + response = self.staff_client.put( + path=self.url, + data=json.dumps(self.request_data), + content_type="application/json", + ) + + self.assertEqual(response.status_code, status.HTTP_200_OK) + + def test_superuser_can_update_without_authz_role(self): + """ + Superuser should bypass AuthZ. + """ + response = self.super_client.put( + path=self.url, + data=json.dumps(self.request_data), + content_type="application/json", + ) + + self.assertEqual(response.status_code, status.HTTP_200_OK) diff --git a/cms/djangoapps/contentstore/rest_api/v1/views/tests/test_settings.py b/cms/djangoapps/contentstore/rest_api/v1/views/tests/test_settings.py index 15b0992fdf1a..50bceaa16377 100644 --- a/cms/djangoapps/contentstore/rest_api/v1/views/tests/test_settings.py +++ b/cms/djangoapps/contentstore/rest_api/v1/views/tests/test_settings.py @@ -6,11 +6,13 @@ import ddt from django.conf import settings from django.urls import reverse +from openedx_authz.constants.roles import COURSE_EDITOR from rest_framework import status from cms.djangoapps.contentstore.tests.utils import CourseTestCase from cms.djangoapps.contentstore.utils import get_proctored_exam_settings_url from common.djangoapps.util.course import get_link_for_about_page +from openedx.core.djangoapps.authz.tests.mixins import CourseAuthoringAuthzTestMixin from openedx.core.djangoapps.credit.tests.factories import CreditCourseFactory from ...mixins import PermissionAccessMixin @@ -85,3 +87,78 @@ def test_prerequisite_courses_enabled_setting(self): response = self.client.get(self.url) self.assertIn("possible_pre_requisite_courses", response.data) self.assertEqual(response.status_code, status.HTTP_200_OK) + + +@ddt.ddt +class CourseSettingsAuthzViewTest(CourseAuthoringAuthzTestMixin, CourseTestCase): + """ + Tests for CourseSettingsView using AuthZ permissions. + """ + + def setUp(self): + super().setUp() + self.url = reverse( + "cms.djangoapps.contentstore:v1:course_settings", + kwargs={"course_id": self.course.id}, + ) + + def test_authorized_user_can_access_course_settings(self): + """Authorized user with COURSE_EDITOR role can access course settings.""" + self.add_user_to_role_in_course(self.authorized_user, COURSE_EDITOR.external_key, self.course.id) + response = self.authorized_client.get(self.url) + + self.assertEqual(response.status_code, status.HTTP_200_OK) + self.assertIn("course_display_name", response.data) + + def test_unauthorized_user_cannot_access_course_settings(self): + """Unauthorized user should receive 403.""" + response = self.unauthorized_client.get(self.url) + + self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN) + + def test_user_without_role_then_added_can_access(self): + """ + Validate dynamic role assignment works as expected. + """ + # Initially unauthorized + response = self.unauthorized_client.get(self.url) + self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN) + + # Assign role dynamically + self.add_user_to_role_in_course( + self.unauthorized_user, + COURSE_EDITOR.external_key, + self.course.id + ) + + response = self.unauthorized_client.get(self.url) + self.assertEqual(response.status_code, status.HTTP_200_OK) + + @patch.dict("django.conf.settings.FEATURES", {"ENABLE_CREDIT_ELIGIBILITY": True}) + def test_credit_eligibility_setting_with_authz(self): + """ + Ensure feature flags still affect response under AuthZ. + """ + _ = CreditCourseFactory(course_key=self.course.id, enabled=True) + + self.add_user_to_role_in_course(self.authorized_user, COURSE_EDITOR.external_key, self.course.id) + response = self.authorized_client.get(self.url) + + self.assertEqual(response.status_code, status.HTTP_200_OK) + self.assertIn("credit_requirements", response.data) + self.assertTrue(response.data["is_credit_course"]) + + def test_staff_user_can_access_without_authz_role(self): + """Django staff user should access course settings without AuthZ role.""" + + response = self.staff_client.get(self.url) + + self.assertEqual(response.status_code, status.HTTP_200_OK) + self.assertIn("course_display_name", response.data) + + def test_superuser_can_access_without_authz_role(self): + """Superuser should access course settings without AuthZ role.""" + response = self.super_client.get(self.url) + + self.assertEqual(response.status_code, status.HTTP_200_OK) + self.assertIn("course_display_name", response.data) diff --git a/openedx/core/djangoapps/authz/tests/mixins.py b/openedx/core/djangoapps/authz/tests/mixins.py index 39360c49fb29..c6385115693f 100644 --- a/openedx/core/djangoapps/authz/tests/mixins.py +++ b/openedx/core/djangoapps/authz/tests/mixins.py @@ -55,6 +55,14 @@ def setUp(self): self.unauthorized_client = APIClient() self.unauthorized_client.force_authenticate(user=self.unauthorized_user) + self.super_user = UserFactory(is_superuser=True, password=self.password) + self.super_client = APIClient() + self.super_client.force_authenticate(user=self.super_user) + + self.staff_user = UserFactory(is_staff=True, password=self.password) + self.staff_client = APIClient() + self.staff_client.force_authenticate(user=self.staff_user) + def tearDown(self): super().tearDown() AuthzEnforcer.get_enforcer().clear_policy()