Update Tahoe Nutmeg upgrade branch with changes from main

cms/static/js/certificates/models/certificate.js

@@ -43,7 +43,7 @@ define([
             initialize: function(attributes, options) {
                 // Set up the initial state of the attributes set for this model instance
                 this.canBeEmpty = options && options.canBeEmpty;
-                if (options.add) {
+                if (options.add && !attributes.signatories) {
                     // Ensure at least one child Signatory model is defined for any new Certificate model
                     attributes.signatories = new SignatoryModel({certificate: this});
                 }

openedx/core/djangoapps/appsembler/settings/settings/production_lms.py

@@ -45,6 +45,7 @@ def plugin_settings(settings):
         # from the redirect mechanics.
         settings.MAIN_SITE_REDIRECT_ALLOWLIST = [
             '/api/',
+            '/user_api/',  # still used by EdxRestAPIClient in integrations
             '/admin',
             'oauth',  # TODO: Add slashes during Nutmeg upgrade since this requires a lot of QA
             'status',  # TODO: Add slashes during Nutmeg upgrade since this requires a lot of QA

openedx/core/djangoapps/appsembler/tahoe_idp/course_roles.py

@@ -0,0 +1,56 @@
+"""
+Tahoe Authentication helpers for managing course related roles.
+"""
+
+from common.djangoapps.student.roles import (
+    CourseCreatorRole,
+    OrgRole,
+    OrgStaffRole,
+    register_access_role,
+)
+
+
+def update_organization_staff_roles(
+    user,
+    organization_short_name,
+    set_as_course_author=False,
+    set_as_organization_staff=False,
+):
+    """
+    Update the organization-wide OrgStaffRole/CourseCreatorRole for using Studio and instructor dashboards.
+    """
+    assert user, 'Parameter `user` is required.'
+    assert organization_short_name, 'Parameter `organization_short_name` is required.'
+
+    organization_role = OrgStaffRole(organization_short_name)
+    course_author_role = TahoeCourseAuthorRole(organization_short_name)
+    creator_role = CourseCreatorRole()
+
+    if set_as_organization_staff or set_as_course_author:
+        # Both org-wide staff and limited course author can create courses.
+        creator_role.add_users(user)
+    else:
+        creator_role.remove_users(user)
+
+    if set_as_organization_staff:
+        organization_role.add_users(user)
+    else:
+        organization_role.remove_users(user)
+
+    if set_as_course_author:
+        course_author_role.add_users(user)
+    else:
+        course_author_role.remove_users(user)
+
+
+@register_access_role
+class TahoeCourseAuthorRole(OrgRole):
+    """
+    A limited course access role to allow Studio access without having a course.
+
+    A user with this role needs to be explicitly invited to a course.
+    """
+    ROLE = 'tahoe_course_author'
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(self.ROLE, *args, **kwargs)

openedx/core/djangoapps/appsembler/tahoe_idp/helpers.py

@@ -15,12 +15,6 @@
 import third_party_auth
 from third_party_auth.pipeline import running as pipeline_running
 
-
-from .constants import (
-    TAHOE_IDP_BACKEND_NAME,
-    TAHOE_IDP_PROVIDER_NAME,
-)
-
 from student.roles import (
     CourseAccessRole,
     CourseCreatorRole,
@@ -33,6 +27,14 @@
 from tahoe_idp import api as tahoe_idp_api
 
 
+from .constants import (
+    TAHOE_IDP_BACKEND_NAME,
+    TAHOE_IDP_PROVIDER_NAME,
+)
+
+from .course_roles import TahoeCourseAuthorRole
+
+
 def is_tahoe_idp_enabled():
     """
     Tahoe: Check if tahoe-idp package is enabled for the current site (or cluster-wide).
@@ -148,7 +150,7 @@ def is_studio_allowed_for_user(user, organization=None):
     OR the user is staff user
     OR the user is an admin on the organization
     OR the user has deprecated_has_course_specific_role()
-    OR the user has (OrgStaffRole) or (OrgInstructorRole) role
+    OR the user has (OrgStaffRole) or (OrgInstructorRole) or (TahoeCourseAuthorRole) role
 
     :param user: the user in question
     :param organization: the user's organization. If the user is not super admin or staff, this value will be used
@@ -168,9 +170,12 @@ def is_studio_allowed_for_user(user, organization=None):
         return True
 
     short_name = organization.short_name
-    has_org_wide_role = OrgStaffRole(short_name).has_user(user) or OrgInstructorRole(short_name).has_user(user)
 
-    return has_org_wide_role
+    for org_wide_role in [OrgStaffRole, OrgInstructorRole, TahoeCourseAuthorRole]:
+        if org_wide_role(short_name).has_user(user):
+            return True
+
+    return False
 
 
 def is_studio_login_form_overridden():

openedx/core/djangoapps/appsembler/auth/tests/test_course_roles.py → openedx/core/djangoapps/appsembler/tahoe_idp/tests/test_course_roles.py

@@ -7,7 +7,7 @@
 
 from student.tests.factories import UserFactory
 
-from .. import course_roles
+from openedx.core.djangoapps.appsembler.tahoe_idp import course_roles
 
 
 @pytest.mark.django_db

openedx/core/djangoapps/appsembler/tahoe_idp/tests/test_tahoe_idp_pipeline_steps.py

@@ -8,6 +8,7 @@
 import tahoe_sites.api
 
 from common.djangoapps.student.roles import CourseCreatorRole, OrgStaffRole
+from ..course_roles import TahoeCourseAuthorRole
 from ..tpa_pipeline import tahoe_idp_user_updates
 
 from openedx.core.djangoapps.site_configuration.tests.factories import SiteFactory
@@ -37,40 +38,58 @@ def test_tahoe_idp_step_in_settings():
     assert idp_step_index == force_sync_step_index + 1, 'Tahoe IdP step should be right after `user_details_force_sync`'
 
 
-@pytest.mark.parametrize('user_details,should_be_admin,should_be_staff,message', [
-    (
-        {
+@pytest.mark.parametrize('test_case', [
+    {
+        'user_details': {
             'tahoe_idp_is_organization_admin': False,
             'tahoe_idp_is_organization_staff': False,
+            'tahoe_idp_is_course_author': False,
             'tahoe_idp_metadata': {'field': 'some value'},
         },
-        False,
-        False,
-        'Check for learner',
-    ),
-    (
-        {
+        'should_be_admin': False,
+        'should_be_staff': False,
+        'should_be_author': False,
+        'message': 'Check for learner',
+    },
+    {
+        'user_details': {
             'tahoe_idp_is_organization_admin': False,
             'tahoe_idp_is_organization_staff': True,
+            'tahoe_idp_is_course_author': False,
             'tahoe_idp_metadata': {'field': 'some value'},
         },
-        False,
-        True,
-        'Check for Studio',
-    ),
-    (
-        {
+        'should_be_admin': False,
+        'should_be_staff': True,
+        'should_be_author': False,
+        'message': 'Check for Studio',
+    },
+    {
+        'user_details': {
             'tahoe_idp_is_organization_admin': True,
             'tahoe_idp_is_organization_staff': True,
+            'tahoe_idp_is_course_author': False,
             'tahoe_idp_metadata': {'field': 'some value'},
         },
-        True,
-        True,
-        'Check for Admins',
-    ),
+        'should_be_admin': True,
+        'should_be_staff': True,
+        'should_be_author': False,
+        'message': 'Check for Admins',
+    },
+    {
+        'user_details': {
+            'tahoe_idp_is_organization_admin': False,
+            'tahoe_idp_is_organization_staff': False,
+            'tahoe_idp_is_course_author': True,
+            'tahoe_idp_metadata': {'field': 'some value'},
+        },
+        'should_be_admin': False,
+        'should_be_staff': False,
+        'should_be_author': True,
+        'message': 'Check for Course Authors',
+    },
 ])
 @pytest.mark.django_db
-def test_tahoe_idp_roles_step_roles(user_details, should_be_admin, should_be_staff, message):
+def test_tahoe_idp_roles_step_roles(test_case):
     """
     Tests for happy scenarios of the `tahoe_idp_user_updates` step.
     """
@@ -88,15 +107,18 @@ def test_tahoe_idp_roles_step_roles(user_details, should_be_admin, should_be_sta
         tahoe_idp_user_updates(
             auth_entry=None,
             strategy=strategy,
-            details=user_details,
+            details=test_case['user_details'],
             user=user,
         )
-
     org_role = OrgStaffRole(organization.short_name)
+    tahoe_author_role = TahoeCourseAuthorRole(organization.short_name)
     creator_role = CourseCreatorRole()
-    assert org_role.has_user(user) == should_be_staff, message
-    assert creator_role.has_user(user) == should_be_staff, message
-    assert tahoe_sites.api.is_active_admin_on_organization(user, organization) == should_be_admin, message
+    message = test_case['message']
+    should_be_course_creator = test_case['should_be_staff'] or test_case['should_be_author']
+    assert org_role.has_user(user) == test_case['should_be_staff'], message
+    assert creator_role.has_user(user) == should_be_course_creator, message
+    assert tahoe_author_role.has_user(user) == test_case['should_be_author'], message
+    assert tahoe_sites.api.is_active_admin_on_organization(user, organization) == test_case['should_be_admin'], message
     assert user.profile.get_meta() == {'tahoe_idp_metadata': {'field': 'some value'}}
     mock_update_tahoe_user_id.assert_called_once_with(user)
 

openedx/core/djangoapps/appsembler/tahoe_idp/tpa_pipeline.py

@@ -6,12 +6,11 @@
 import beeline
 import tahoe_sites.api
 
-from openedx.core.djangoapps.appsembler.auth import course_roles
 
 from tahoe_idp import api as tahoe_idp_api
 
+from . import course_roles
 from .helpers import store_idp_metadata_in_user_profile
-
 from .constants import TAHOE_IDP_BACKEND_NAME
 
 log = logging.getLogger(__name__)
@@ -38,6 +37,7 @@ def tahoe_idp_user_updates(auth_entry, strategy, details, user=None, *args, **kw
     if user and backend_name == TAHOE_IDP_BACKEND_NAME:
         set_as_admin = details['tahoe_idp_is_organization_admin']
         set_as_organization_staff = details['tahoe_idp_is_organization_staff']
+        set_as_course_author = details['tahoe_idp_is_course_author']
 
         organization = tahoe_sites.api.get_current_organization(strategy.request)
 
@@ -53,6 +53,7 @@ def tahoe_idp_user_updates(auth_entry, strategy, details, user=None, *args, **kw
         course_roles.update_organization_staff_roles(
             user=user,
             organization_short_name=organization_short_name,
+            set_as_course_author=set_as_course_author,
             set_as_organization_staff=set_as_organization_staff,
         )
 

requirements/edx/appsembler.txt

@@ -23,7 +23,7 @@ https://github.com/appsembler/edx-proctoring/archive/v2.4.0-appsembler1.tar.gz
 django-tiers==0.2.7
 fusionauth-client==1.36.0
 google-cloud-storage==1.32.0
-tahoe-idp==2.0.0
+tahoe-idp==2.1.0
 tahoe-sites==1.3.2
 tahoe-lti==0.3.0
 site-configuration-client==0.2.3