diff --git a/lms/djangoapps/course_api/blocks/forms.py b/lms/djangoapps/course_api/blocks/forms.py index 94bc9fa38d..0d7006a005 100644 --- a/lms/djangoapps/course_api/blocks/forms.py +++ b/lms/djangoapps/course_api/blocks/forms.py @@ -139,6 +139,8 @@ class BlockListGetForm(Form): return self._verify_anonymous_user(requested_username, course_key, all_blocks) if all_blocks: + if requesting_user.has_perm('instructor.research', course_key): + return requesting_user return self._verify_all_blocks(requesting_user, course_key) elif requesting_user.username.lower() == requested_username.lower(): return self._verify_requesting_user(requesting_user, course_key) diff --git a/lms/djangoapps/course_api/blocks/tests/test_views.py b/lms/djangoapps/course_api/blocks/tests/test_views.py index 426e79c668..6e17e83dd4 100644 --- a/lms/djangoapps/course_api/blocks/tests/test_views.py +++ b/lms/djangoapps/course_api/blocks/tests/test_views.py @@ -14,6 +14,7 @@ from django.urls import reverse from opaque_keys.edx.locator import CourseLocator from common.djangoapps.student.models import CourseEnrollment +from common.djangoapps.student.roles import CourseDataResearcherRole from common.djangoapps.student.tests.factories import AdminFactory, CourseEnrollmentFactory, UserFactory from xmodule.modulestore.tests.django_utils import SharedModuleStoreTestCase from xmodule.modulestore.tests.factories import ToyCourseFactory @@ -53,6 +54,8 @@ class TestBlocksView(SharedModuleStoreTestCase): # create and enroll user in the toy course self.user = UserFactory.create() self.admin_user = AdminFactory.create() + self.data_researcher = UserFactory.create() + CourseDataResearcherRole(self.course_key).add_users(self.data_researcher) self.client.login(username=self.user.username, password='test') CourseEnrollmentFactory.create(user=self.user, course_id=self.course_key) @@ -359,6 +362,17 @@ class TestBlocksView(SharedModuleStoreTestCase): block_data['type'] == 'course' ) + def test_data_researcher_access(self): + """ + Test if data researcher has access to the api endpoint + """ + self.client.login(username=self.data_researcher.username, password='test') + + self.verify_response(params={ + 'all_blocks': True, + 'course_id': str(self.course_key) + }) + def test_navigation_param(self): response = self.verify_response(params={'nav_depth': 10}) self.verify_response_block_dict(response)