Merge pull request #17790 from edx/bmedx/user_retirement_utils

Add some common functionality for retiring users

openedx/core/djangoapps/user_api/accounts/permissions.py

@@ -3,6 +3,7 @@ Permissions classes for User accounts API views.
 """
 from __future__ import unicode_literals
 
+from django.conf import settings
 from rest_framework import permissions
 
 
@@ -13,3 +14,16 @@ class CanDeactivateUser(permissions.BasePermission):
     """
     def has_permission(self, request, view):
         return request.user.has_perm('student.can_deactivate_users')
+
+
+class CanRetireUser(permissions.BasePermission):
+    """
+    Grants access to the various retirement API endpoints if the requesting user is
+    a superuser, the RETIREMENT_SERVICE_USERNAME, or has the explicit permission to
+    retire a User account.
+    """
+    def has_permission(self, request, view):
+        return (
+            request.user.username == settings.RETIREMENT_SERVICE_WORKER_USERNAME or
+            request.user.is_superuser
+        )

openedx/core/djangoapps/user_api/accounts/tests/test_permissions.py

@@ -3,7 +3,7 @@ Tests for User deactivation API permissions
 """
 from django.test import TestCase, RequestFactory
 
-from openedx.core.djangoapps.user_api.accounts.permissions import CanDeactivateUser
+from openedx.core.djangoapps.user_api.accounts.permissions import CanDeactivateUser, CanRetireUser
 from student.tests.factories import ContentTypeFactory, PermissionFactory, SuperuserFactory, UserFactory
 
 
@@ -38,3 +38,30 @@ class CanDeactivateUserTest(TestCase):
         self.request.user = UserFactory()
         result = CanDeactivateUser().has_permission(self.request, None)
         self.assertFalse(result)
+
+
+class CanRetireUserTest(TestCase):
+    """ Tests for user retirement API permissions """
+
+    def setUp(self):
+        super(CanRetireUserTest, self).setUp()
+        self.request = RequestFactory().get('/test/url')
+
+    def test_api_permission_superuser(self):
+        self.request.user = SuperuserFactory()
+
+        result = CanRetireUser().has_permission(self.request, None)
+        self.assertTrue(result)
+
+    def test_api_permission_user_granted_permission(self):
+        user = UserFactory()
+        self.request.user = user
+
+        with self.settings(RETIREMENT_SERVICE_WORKER_USERNAME=user.username):
+            result = CanRetireUser().has_permission(self.request, None)
+            self.assertTrue(result)
+
+    def test_api_permission_user_without_permission(self):
+        self.request.user = UserFactory()
+        result = CanRetireUser().has_permission(self.request, None)
+        self.assertFalse(result)