fix: added access for data researcher in courseware (#27935)

fix: fixed data researcher permissions on instructor dashboard

lms/djangoapps/course_api/blocks/forms.py

@@ -139,6 +139,8 @@ class BlockListGetForm(Form):
             return self._verify_anonymous_user(requested_username, course_key, all_blocks)
 
         if all_blocks:
+            if requesting_user.has_perm('instructor.research', course_key):
+                return requesting_user
             return self._verify_all_blocks(requesting_user, course_key)
         elif requesting_user.username.lower() == requested_username.lower():
             return self._verify_requesting_user(requesting_user, course_key)

lms/djangoapps/course_api/blocks/tests/test_views.py

@@ -14,6 +14,7 @@ from django.urls import reverse
 from opaque_keys.edx.locator import CourseLocator
 
 from common.djangoapps.student.models import CourseEnrollment
+from common.djangoapps.student.roles import CourseDataResearcherRole
 from common.djangoapps.student.tests.factories import AdminFactory, CourseEnrollmentFactory, UserFactory
 from xmodule.modulestore.tests.django_utils import SharedModuleStoreTestCase
 from xmodule.modulestore.tests.factories import ToyCourseFactory
@@ -53,6 +54,8 @@ class TestBlocksView(SharedModuleStoreTestCase):
         # create and enroll user in the toy course
         self.user = UserFactory.create()
         self.admin_user = AdminFactory.create()
+        self.data_researcher = UserFactory.create()
+        CourseDataResearcherRole(self.course_key).add_users(self.data_researcher)
         self.client.login(username=self.user.username, password='test')
         CourseEnrollmentFactory.create(user=self.user, course_id=self.course_key)
 
@@ -359,6 +362,17 @@ class TestBlocksView(SharedModuleStoreTestCase):
                 block_data['type'] == 'course'
             )
 
+    def test_data_researcher_access(self):
+        """
+        Test if data researcher has access to the api endpoint
+        """
+        self.client.login(username=self.data_researcher.username, password='test')
+
+        self.verify_response(params={
+            'all_blocks': True,
+            'course_id': str(self.course_key)
+        })
+
     def test_navigation_param(self):
         response = self.verify_response(params={'nav_depth': 10})
         self.verify_response_block_dict(response)