Remove access for inactive users

common/test/acceptance/pages/studio/auto_auth.py

@@ -12,19 +12,24 @@ class AutoAuthPage(PageObject):
     """
     The automatic authorization page.
     When allowed via the django settings file, visiting
-    this url will create a user and log them in.
+    this url will create/update a user and log them in.
     """
 
     def __init__(self, browser, username=None, email=None, password=None,
-                 staff=None, course_id=None, roles=None, no_login=None):
+                 staff=None, course_id=None, roles=None, no_login=None, is_active=None):
         """
         Auto-auth is an end-point for HTTP GET requests.
         By default, it will create accounts with random user credentials,
         but you can also specify credentials using querystring parameters.
 
+        Can be used to update an account, call to this end-point with already
+        made account's credentials along with values to update will result into
+        an account update.
+
         `username`, `email`, and `password` are the user's credentials (strings)
         `staff` is a boolean indicating whether the user is global staff.
         `course_id` is the ID of the course to enroll the student in.
+        `is_active` activation status of user
         Currently, this has the form "org/number/run"
 
         Note that "global staff" is NOT the same as course staff.
@@ -55,6 +60,9 @@ class AutoAuthPage(PageObject):
         if no_login:
             self._params['no_login'] = True
 
+        if is_active is not None:
+            self._params['is_active'] = 'true' if is_active else 'false'
+
     @property
     def url(self):
         """

common/test/acceptance/tests/studio/test_studio_course_team.py

@@ -26,6 +26,17 @@ class CourseTeamPageTest(StudioCourseTest):
         ).visit()
         return user
 
+    def _update_user(self, user_info):
+        """
+        Update user with provided `user_info`
+
+        Arguments:
+            `user_info`: dictionary containing values of attributes to be updated
+        """
+        AutoAuthPage(
+            self.browser, no_login=True, **user_info
+        ).visit()
+
     def setUp(self, is_staff=False):
         """
         Install a course with no content using a fixture.
@@ -174,6 +185,34 @@ class CourseTeamPageTest(StudioCourseTest):
         self.log_in(self.other_user)
         self._assert_current_course(visible=False)
 
+    def test_admins_can_delete_other_inactive_users(self):
+        """
+        Scenario: Admins can delete other inactive users
+        Given I have opened a new course in Studio
+        And I am viewing the course team settings.
+        When I add other user to the course team,
+        And then delete that other user from the course team.
+        And other user logs in
+        Then he/she does not see the course on page
+        """
+        self.page.add_user_to_course(self.other_user.get('email'))
+        self._assert_user_present(self.other_user, present=True)
+
+        # inactivate user
+        user_info = {
+            'username': self.other_user.get('username'),
+            'email': self.other_user.get('email'),
+            'password': self.other_user.get('password'),
+            'is_active': False
+        }
+        self._update_user(user_info)
+
+        # go to course team page to perform delete operation
+        self._go_to_course_team_page()
+        self.page.delete_user_from_course(self.other_user.get('email'))
+
+        self._assert_user_present(self.other_user, present=False)
+
     def test_admins_cannot_add_users_that_do_not_exist(self):
         """
         Scenario: Admins cannot add users that do not exist