Merge pull request #113 from edly-io/rehan/EDLY-1515

Updates permissions for updating Edly staff roles

common/djangoapps/student/auth.py

@@ -170,7 +170,7 @@ def _check_caller_authority(caller, role):
     if not (caller.is_authenticated and caller.is_active):
         raise PermissionDenied
     # superuser
-    if GlobalStaff().has_user(caller) or GlobalCourseCreatorRole().has_user(caller):
+    if GlobalStaff().has_user(caller) or caller.groups.filter(name=settings.EDLY_PANEL_ADMIN_USERS_GROUP).exists():
         return
 
     if isinstance(role, (GlobalStaff, CourseCreatorRole)):

openedx/features/edly/tests/test_utils.py

@@ -6,6 +6,8 @@
 from mock import MagicMock
 
 from django.conf import settings
+from django.contrib.auth.models import Group
+from django.core.exceptions import PermissionDenied
 from django.http import HttpResponse
 from django.test import TestCase
 from django.test.client import RequestFactory
@@ -176,14 +178,25 @@ def test_update_course_creator_status(self):
         assert self._get_course_creator_status(self.user) == 'unrequested'
         assert not auth.user_has_role(self.user, CourseCreatorRole())
 
+        self.admin_user.is_staff = False
+        self.admin_user.save()
+        with self.assertRaises(PermissionDenied):
+            update_course_creator_status(self.admin_user, self.user, True)
+
+        edly_panel_admin_user_group, __ = Group.objects.get_or_create(name=settings.EDLY_PANEL_ADMIN_USERS_GROUP)
+        self.admin_user.groups.add(edly_panel_admin_user_group)
+        update_course_creator_status(self.admin_user, self.user, False)
+        assert self._get_course_creator_status(self.user) == 'unrequested'
+        assert not auth.user_has_role(self.user, CourseCreatorRole())
+
     @skip_unless_cms
     @mock.patch('course_creators.admin.render_to_string', mock.Mock(side_effect=mock_render_to_string, autospec=True))
     def test_set_global_course_creator_status(self):
         """
         Test that "set_global_course_creator_status" method sets/removes a User as Global Course Creator correctly.
         """
         self._create_edly_sub_organization()
-        response = cookies_api.set_logged_in_edly_cookies(self.request, HttpResponse(), self.user)
+        response = cookies_api.set_logged_in_edly_cookies(self.request, HttpResponse(), self.user, cookie_settings(self.request))
         self._copy_cookies_to_request(response, self.request)
         edly_user_info_cookie = self.request.COOKIES.get(settings.EDLY_USER_INFO_COOKIE_NAME)
         edx_org = get_edx_org_from_cookie(edly_user_info_cookie)
@@ -196,3 +209,14 @@ def test_set_global_course_creator_status(self):
         set_global_course_creator_status(self.request, self.user, False)
         assert self._get_course_creator_status(self.user) == 'unrequested'
         assert not auth.user_has_role(self.user, GlobalCourseCreatorRole(edx_org))
+
+        self.admin_user.is_staff = False
+        self.admin_user.save()
+        with self.assertRaises(PermissionDenied):
+            set_global_course_creator_status(self.request, self.user, True)
+
+        edly_panel_admin_user_group, __ = Group.objects.get_or_create(name=settings.EDLY_PANEL_ADMIN_USERS_GROUP)
+        self.admin_user.groups.add(edly_panel_admin_user_group)
+        set_global_course_creator_status(self.request, self.user, True)
+        assert self._get_course_creator_status(self.user) == 'granted'
+        assert auth.user_has_role(self.user, CourseCreatorRole())

openedx/features/edly/utils.py

@@ -3,6 +3,7 @@
 import jwt
 import waffle
 from django.conf import settings
+from django.core.exceptions import PermissionDenied
 from django.db.models import Q
 from django.forms.models import model_to_dict
 
@@ -12,6 +13,7 @@
     CourseInstructorRole,
     CourseStaffRole,
     GlobalCourseCreatorRole,
+    GlobalStaff,
     UserBasedRole,
 )
 from util.organizations_helpers import get_organizations
@@ -188,6 +190,10 @@ def set_global_course_creator_status(request, user, set_global_creator):
     from course_creators.models import CourseCreator
 
     request_user = request.user
+    is_edly_panel_admin_user = request_user.groups.filter(name=settings.EDLY_PANEL_ADMIN_USERS_GROUP).exists()
+    if not GlobalStaff().has_user(request_user) and not is_edly_panel_admin_user:
+        raise PermissionDenied
+
     course_creator, __ = CourseCreator.objects.get_or_create(user=user)
     course_creator.state = CourseCreator.GRANTED if set_global_creator else CourseCreator.UNREQUESTED
     course_creator.note = 'Global course creator user was updated by panel admin {}'.format(request_user.email)