feat: replace enterprise_support import with AccountSettingsReadOnlyFields filter

Author: kiram15

lms/envs/common.py

@@ -3705,6 +3705,18 @@ def _should_send_certificate_events(settings):
 #     The project ID should be obtained from the Google Cloud Console when creating a reCAPTCHA
 RECAPTCHA_PROJECT_ID = None
 
+# .. setting_name: OPEN_EDX_FILTERS_CONFIG
+# .. setting_default: {"org.openedx.learning.account.settings.read_only_fields.requested.v1": {"fail_silently": true, "pipeline": ["enterprise.filters.accounts.AccountSettingsReadOnlyFieldsStep"]}}
+# .. setting_description: Configuration dict for openedx-filters pipeline steps.
+#    Keys are filter type strings; values are dicts with 'fail_silently' (bool) and
+#    'pipeline' (list of dotted-path strings to PipelineStep subclasses).
+OPEN_EDX_FILTERS_CONFIG = {
+    "org.openedx.learning.account.settings.read_only_fields.requested.v1": {
+        "fail_silently": True,
+        "pipeline": ["enterprise.filters.accounts.AccountSettingsReadOnlyFieldsStep"],
+    },
+}
+
 ############################## Miscellaneous ###############################
 
 # To limit the number of courses displayed on learner dashboard

lms/envs/production.py

@@ -84,6 +84,7 @@ def get_env_setting(setting):
             'EVENT_BUS_PRODUCER_CONFIG',
             'DEFAULT_FILE_STORAGE',
             'STATICFILES_STORAGE',
+            'OPEN_EDX_FILTERS_CONFIG',
         ]
     })
 
@@ -281,6 +282,19 @@ def get_env_setting(setting):
     EVENT_TRACKING_SEGMENTIO_EMIT_WHITELIST
 )
 
+# Merge OPEN_EDX_FILTERS_CONFIG from YAML into the default defined in common.py.
+# Pipeline steps from YAML are appended after steps defined in common.py.
+# The fail_silently value from YAML takes precedence over the one in common.py.
+for _filter_type, _filter_config in _YAML_TOKENS.get('OPEN_EDX_FILTERS_CONFIG', {}).items():
+    if _filter_type in OPEN_EDX_FILTERS_CONFIG:  # noqa: F405
+        OPEN_EDX_FILTERS_CONFIG[_filter_type]['pipeline'].extend(  # noqa: F405
+            _filter_config.get('pipeline', [])
+        )
+        if 'fail_silently' in _filter_config:
+            OPEN_EDX_FILTERS_CONFIG[_filter_type]['fail_silently'] = _filter_config['fail_silently']  # noqa: F405
+    else:
+        OPEN_EDX_FILTERS_CONFIG[_filter_type] = _filter_config  # noqa: F405
+
 if ENABLE_THIRD_PARTY_AUTH:
     AUTHENTICATION_BACKENDS = _YAML_TOKENS.get('THIRD_PARTY_AUTH_BACKENDS', [
         'social_core.backends.google.GoogleOAuth2',

openedx/core/djangoapps/user_api/accounts/api.py

@@ -12,6 +12,7 @@
 from django.utils.translation import gettext as _
 from django.utils.translation import override as override_language
 from eventtracking import tracker
+from openedx_filters.learning.filters import AccountSettingsReadOnlyFieldsRequested
 from pytz import UTC
 
 from common.djangoapps.student import views as student_views
@@ -39,7 +40,6 @@
 from openedx.core.djangoapps.user_authn.views.registration_form import validate_name, validate_username
 from openedx.core.lib.api.view_utils import add_serializer_errors
 from common.djangoapps.third_party_auth.utils import get_saml_provider_for_user
-from openedx.features.enterprise_support.utils import get_enterprise_readonly_account_fields
 from openedx.features.name_affirmation_api.utils import is_name_affirmation_installed
 
 from .serializers import AccountLegacyProfileSerializer, AccountUserSerializer, UserReadOnlySerializer, _visible_fields
@@ -194,11 +194,19 @@ def update_account_settings(requesting_user, update, username=None):
 
 def _validate_read_only_fields(user, data, field_errors):
     # Check for fields that are not editable. Marking them read-only causes them to be ignored, but we wish to 400.
+    # .. filter_implemented_name: AccountSettingsReadOnlyFieldsRequested
+    # .. filter_type: org.openedx.learning.account.settings.read_only_fields.requested.v1
+    plugin_readonly_fields, __ = AccountSettingsReadOnlyFieldsRequested.run_filter(
+        readonly_fields=set(),
+        user=user,
+    )
+    plugin_readonly_fields = plugin_readonly_fields or set()
+
     read_only_fields = set(data.keys()).intersection(
         # Remove email since it is handled separately below when checking for changing_email.
         (set(AccountUserSerializer.get_read_only_fields()) - {"email"}) |
         set(AccountLegacyProfileSerializer.get_read_only_fields() or set()) |
-        get_enterprise_readonly_account_fields(user)
+        plugin_readonly_fields
     )
 
     for read_only_field in read_only_fields:

openedx/core/djangoapps/user_api/accounts/tests/test_api.py

@@ -4,7 +4,6 @@
 """
 
 import datetime
-import itertools
 import unicodedata
 from unittest.mock import Mock, patch
 
@@ -14,11 +13,10 @@
 from django.contrib.auth.hashers import make_password
 from django.contrib.auth.models import User  # lint-amnesty, pylint: disable=imported-auth-user
 from django.http import HttpResponse
-from django.test import TestCase
+from django.test import TestCase, override_settings
 from django.test.client import RequestFactory
 from django.urls import reverse
 from pytz import UTC
-from social_django.models import UserSocialAuth
 
 from common.djangoapps.student.models import (
     AccountRecovery,
@@ -51,6 +49,7 @@
 )
 from openedx.core.djangolib.testing.utils import skip_unless_lms
 from openedx.features.enterprise_support.tests.factories import EnterpriseCustomerUserFactory
+from openedx_filters import PipelineStep
 
 
 def mock_render_to_string(template_name, context):
@@ -67,6 +66,18 @@ def mock_render_to_response(template_name):
     return HttpResponse(template_name)
 
 
+class TestAccountSettingsReadOnlyFieldsPipelineStep(PipelineStep):
+    """
+    Test pipeline step for AccountSettingsReadOnlyFieldsRequested.
+    """
+
+    def run_filter(self, user, readonly_fields, **kwargs):  # pylint: disable=arguments-differ
+        return {
+            "readonly_fields": {"name"},
+            "updated_account_settings": None,
+        }
+
+
 class CreateAccountMixin:  # lint-amnesty, pylint: disable=missing-class-docstring
     def create_account(self, username, password, email):
         # pylint: disable=missing-docstring
@@ -104,11 +115,6 @@ def setUp(self):
         self.staff_user = UserFactory(is_staff=True, password=self.password)
         self.reset_tracker()
 
-        enterprise_patcher = patch('openedx.features.enterprise_support.api.enterprise_customer_for_request')
-        enterprise_learner_patcher = enterprise_patcher.start()
-        enterprise_learner_patcher.return_value = {}
-        self.addCleanup(enterprise_learner_patcher.stop)
-
     def test_get_username_provided(self):
         """Test the difference in behavior when a username is supplied to get_account_settings."""
         account_settings = get_account_settings(self.default_request)[0]
@@ -248,73 +254,26 @@ def test_update_success_for_enterprise(self):
         account_settings = get_account_settings(self.default_request)[0]
         assert level_of_education == account_settings['level_of_education']
 
-    @patch('openedx.features.enterprise_support.api.enterprise_customer_for_request')
-    @patch('openedx.features.enterprise_support.utils.third_party_auth.provider.Registry.get')
-    @ddt.data(
-        *itertools.product(
-            # field_name_value values
-            (("email", "new_email@example.com"), ("name", "new name"), ("country", "IN")),
-            # is_enterprise_user
-            (True, False),
-            # is_synch_learner_profile_data
-            (True, False),
-            # has `UserSocialAuth` record
-            (True, False),
-        )
-    )
-    @ddt.unpack
-    def test_update_validation_error_for_enterprise(
-        self,
-        field_name_value,
-        is_enterprise_user,
-        is_synch_learner_profile_data,
-        has_user_social_auth_record,
-        mock_auth_provider,
-        mock_customer,
-    ):
-        idp_backend_name = 'tpa-saml'
-        mock_customer.return_value = {}
-        if is_enterprise_user:
-            mock_customer.return_value.update({
-                'uuid': 'real-ent-uuid',
-                'name': 'Dummy Enterprise',
-                'identity_provider': 'saml-ubc',
-                'identity_providers': [
-                    {
-                        "provider_id": "saml-ubc",
-                    }
+    @override_settings(
+        OPEN_EDX_FILTERS_CONFIG={
+            "org.openedx.learning.account.settings.read_only_fields.requested.v1": {
+                "pipeline": [
+                    "openedx.core.djangoapps.user_api.accounts.tests.test_api.TestAccountSettingsReadOnlyFieldsPipelineStep",
                 ],
-            })
-        mock_auth_provider.return_value.sync_learner_profile_data = is_synch_learner_profile_data
-        mock_auth_provider.return_value.backend_name = idp_backend_name
-
-        update_data = {field_name_value[0]: field_name_value[1]}
+                "fail_silently": False,
+            },
+        },
+    )
+    def test_update_name_blocked_by_account_settings_read_only_fields_filter(self):
+        """
+        Test that update_account_settings honors the configured read-only-fields filter.
+        """
+        with pytest.raises(AccountValidationError) as context_manager:
+            update_account_settings(self.user, {"name": "Blocked Name"})
 
-        user_fullname_editable = False
-        if has_user_social_auth_record:
-            UserSocialAuth.objects.create(
-                provider=idp_backend_name,
-                user=self.user
-            )
-        else:
-            UserSocialAuth.objects.all().delete()
-            # user's fullname is editable if no `UserSocialAuth` record exists
-            user_fullname_editable = field_name_value[0] == 'name'
-
-        # prevent actual email change requests
-        with patch('openedx.core.djangoapps.user_api.accounts.api.student_views.do_email_change_request'):
-            # expect field un-editability only when all of the following conditions are met
-            if is_enterprise_user and is_synch_learner_profile_data and not user_fullname_editable:
-                with pytest.raises(AccountValidationError) as validation_error:
-                    update_account_settings(self.user, update_data)
-                    field_errors = validation_error.value.field_errors
-                    assert 'This field is not editable via this API' == \
-                           field_errors[field_name_value[0]]['developer_message']
-            else:
-                update_account_settings(self.user, update_data)
-                account_settings = get_account_settings(self.default_request)[0]
-                if field_name_value[0] != "email":
-                    assert field_name_value[1] == account_settings[field_name_value[0]]
+        field_errors = context_manager.value.field_errors
+        assert "name" in field_errors
+        assert field_errors["name"]["developer_message"] == "This field is not editable via this API"
 
     def test_update_error_validating(self):
         """Test that AccountValidationError is thrown if incorrect values are supplied."""
@@ -472,17 +431,12 @@ def test_email_changes_disabled(self):
         assert 'Email address changes have been disabled' in context_manager.value.developer_message
 
     @patch.dict(settings.FEATURES, dict(ALLOW_EMAIL_ADDRESS_CHANGE=True))
-    def test_email_changes_blocked_by_saml_provider(self):
+    @patch('openedx.core.djangoapps.user_api.accounts.api.get_saml_provider_for_user')
+    def test_email_changes_blocked_by_saml_provider(self, mock_get_saml_provider):
         """
         Test that email changes are rejected when the user's SAML provider has disable_email_editing=True.
         """
-        from common.djangoapps.third_party_auth.tests.factories import SAMLProviderConfigFactory
-        saml_config = SAMLProviderConfigFactory(disable_email_editing=True)
-        UserSocialAuth.objects.create(
-            user=self.user,
-            provider='tpa-saml',
-            uid=f'{saml_config.slug}:remote-user-id',
-        )
+        mock_get_saml_provider.return_value = Mock(disable_email_editing=True)
 
         with pytest.raises(AccountValidationError) as context_manager:
             update_account_settings(self.user, {"email": "new@example.com"})

requirements/edx/base.txt

@@ -831,7 +831,7 @@ openedx-events==10.5.0
     #   edx-name-affirmation
     #   event-tracking
     #   ora2
-openedx-filters==2.1.0
+openedx-filters==3.3.0
     # via
     #   -r requirements/edx/kernel.in
     #   edx-enterprise

requirements/edx/development.txt

@@ -1380,7 +1380,7 @@ openedx-events==10.5.0
     #   edx-name-affirmation
     #   event-tracking
     #   ora2
-openedx-filters==2.1.0
+openedx-filters==3.3.0
     # via
     #   -r requirements/edx/doc.txt
     #   -r requirements/edx/testing.txt

requirements/edx/doc.txt

@@ -1005,7 +1005,7 @@ openedx-events==10.5.0
     #   edx-name-affirmation
     #   event-tracking
     #   ora2
-openedx-filters==2.1.0
+openedx-filters==3.3.0
     # via
     #   -r requirements/edx/base.txt
     #   edx-enterprise

requirements/edx/kernel.in

@@ -118,7 +118,7 @@ openedx-atlas                       # CLI tool to manage translations
 openedx-calc                        # Library supporting mathematical calculations for Open edX
 openedx-django-require
 openedx-events                      # Open edX Events from Hooks Extension Framework (OEP-50)
-openedx-filters                     # Open edX Filters from Hooks Extension Framework (OEP-50)
+openedx-filters>=3.1.0              # Open edX Filters from Hooks Extension Framework (OEP-50)
 openedx-forum                       # Open edX forum v2 application
 openedx-learning                    # Open edX Learning core (experimental)
 openedx-django-wiki

requirements/edx/testing.txt

@@ -1050,7 +1050,7 @@ openedx-events==10.5.0
     #   edx-name-affirmation
     #   event-tracking
     #   ora2
-openedx-filters==2.1.0
+openedx-filters==3.3.0
     # via
     #   -r requirements/edx/base.txt
     #   edx-enterprise