Update all edx-platform REST endpoints to support JWT Auth (#34152)

* chore: update API endpoints to support default JWT auth

The default DRF Auth classes were recently updated to allow for both JWT and Session auth by default. Any endpoint that overrides the AUTHENTICATION_CLASSES but has just session, just JWT or just both of those should be updated to remove the override.

Details in https://github.com/openedx/edx-platform/issues/33662

lms/djangoapps/bulk_user_retirement/views.py

@@ -3,7 +3,6 @@ An API for retiring user accounts.
 """
 import logging
 
-from edx_rest_framework_extensions.auth.jwt.authentication import JwtAuthentication
 from django.contrib.auth import get_user_model
 from django.db import transaction
 from rest_framework import permissions, status
@@ -34,7 +33,6 @@ class BulkUsersRetirementView(APIView):
 
           * usernames: Comma separated strings of usernames that should be retired.
     """
-    authentication_classes = (JwtAuthentication, )
     permission_classes = (permissions.IsAuthenticated, CanRetireUser)
 
     def post(self, request, **kwargs):  # pylint: disable=unused-argument

lms/djangoapps/commerce/api/v1/views.py

@@ -72,7 +72,6 @@ class CourseRetrieveUpdateView(PutAsCreateMixin, RetrieveUpdateAPIView):
 class OrderView(APIView):
     """ Retrieve order details. """
 
-    authentication_classes = (JwtAuthentication, SessionAuthentication,)
     permission_classes = (IsAuthenticatedOrActivationOverridden,)
 
     def get(self, request, number):

lms/djangoapps/course_home_api/outline/views.py

@@ -376,7 +376,6 @@ class OutlineTabView(RetrieveAPIView):
 
 
 @api_view(['POST'])
-@authentication_classes((JwtAuthentication,))
 @permission_classes((IsAuthenticated,))
 def dismiss_welcome_message(request):  # pylint: disable=missing-function-docstring
     course_id = request.data.get('course_id', None)

lms/djangoapps/discussion/rest_api/tests/test_views.py

@@ -675,7 +675,7 @@ class ReplaceUsernamesViewTest(DiscussionAPIViewTestMixin, ModuleStoreTestCase):
 
         # Test unauthenticated
         response = self.client.post(self.url, data)
-        assert response.status_code == 401
+        assert response.status_code == 403
 
         # Test non-service worker
         random_user = UserFactory()

lms/djangoapps/discussion/rest_api/views.py

@@ -1099,7 +1099,6 @@ class RetireUserView(APIView):
         Empty string
     """
 
-    authentication_classes = (JwtAuthentication,)
     permission_classes = (permissions.IsAuthenticated, CanRetireUser)
 
     def post(self, request):
@@ -1147,7 +1146,6 @@ class ReplaceUsernamesView(APIView):
 
     """
 
-    authentication_classes = (JwtAuthentication,)
     permission_classes = (permissions.IsAuthenticated, CanReplaceUsername)
 
     def post(self, request):

lms/djangoapps/edxnotes/views.py

@@ -11,7 +11,6 @@ from django.contrib.auth.decorators import login_required
 from django.http import Http404, HttpResponse
 from django.urls import reverse
 from django.views.decorators.http import require_GET
-from edx_rest_framework_extensions.auth.jwt.authentication import JwtAuthentication
 from opaque_keys.edx.keys import CourseKey
 from rest_framework import permissions, status
 from rest_framework.response import Response
@@ -244,7 +243,6 @@ class RetireUserView(APIView):
           - EdxNotesServiceUnavailable is thrown: the edx-notes-api IDA is not available.
     """
 
-    authentication_classes = (JwtAuthentication,)
     permission_classes = (permissions.IsAuthenticated, CanRetireUser)
 
     def post(self, request):

lms/djangoapps/instructor_task/rest_api/v1/views.py

@@ -9,8 +9,6 @@ import pytz
 import dateutil
 from celery.states import REVOKED
 from django.db import transaction
-from edx_rest_framework_extensions.auth.jwt.authentication import JwtAuthentication
-from rest_framework.authentication import SessionAuthentication
 from rest_framework.response import Response
 from rest_framework import generics, status
 
@@ -35,10 +33,6 @@ class ListScheduledBulkEmailInstructorTasks(generics.ListAPIView):
                data also includes information about the and course email instance associated with each task.
         * 403: User does not have the required role to view this data.
     """
-    authentication_classes = (
-        JwtAuthentication,
-        SessionAuthentication,
-    )
     permission_classes = (
         CanViewOrModifyScheduledBulkCourseEmailTasks,
     )
@@ -74,10 +68,6 @@ class ModifyScheduledBulkEmailInstructorTask(generics.DestroyAPIView, generics.U
         * 403: User does not have permission to modify the object specified.
         * 404: Requested schedule object could not be found and thus could not be modified or removed.
     """
-    authentication_classes = (
-        JwtAuthentication,
-        SessionAuthentication,
-    )
     permission_classes = (
         CanViewOrModifyScheduledBulkCourseEmailTasks,
     )

lms/djangoapps/learner_dashboard/api/v0/views.py

@@ -1,9 +1,7 @@
 """ API v0 views. """
 import logging
 
-from edx_rest_framework_extensions.auth.jwt.authentication import JwtAuthentication
 from enterprise.models import EnterpriseCourseEnrollment
-from rest_framework.authentication import SessionAuthentication
 from rest_framework.permissions import IsAuthenticated
 from rest_framework.response import Response
 from rest_framework.views import APIView
@@ -81,8 +79,6 @@ class Programs(APIView):
         ]
     """
 
-    authentication_classes = (JwtAuthentication, SessionAuthentication,)
-
     permission_classes = (IsAuthenticated,)
 
     def get(self, request, enterprise_uuid):
@@ -298,11 +294,6 @@ class ProgramProgressDetailView(APIView):
             }
     """
 
-    authentication_classes = (
-        JwtAuthentication,
-        SessionAuthentication,
-    )
-
     permission_classes = (IsAuthenticated,)
 
     def get(self, request, program_uuid):

lms/djangoapps/support/views/feature_based_enrollments.py

@@ -2,10 +2,8 @@
 Support tool for viewing course duration information
 """
 
-from edx_rest_framework_extensions.auth.jwt.authentication import JwtAuthentication
 from django.utils.decorators import method_decorator
 from django.views.generic import View
-from rest_framework.authentication import SessionAuthentication
 from rest_framework.permissions import IsAuthenticated
 from rest_framework.generics import GenericAPIView
 
@@ -43,9 +41,6 @@ class FeatureBasedEnrollmentSupportAPIView(GenericAPIView):
     Support-only API View for getting feature based enrollment configuration details
     for a course.
     """
-    authentication_classes = (
-        JwtAuthentication, SessionAuthentication
-    )
     permission_classes = (IsAuthenticated,)
 
     @method_decorator(require_support_permission)

lms/djangoapps/support/views/program_enrollments.py

@@ -6,9 +6,7 @@ from django.contrib.auth.models import User  # lint-amnesty, pylint: disable=imp
 from django.db.models import Q
 from django.utils.decorators import method_decorator
 from django.views.generic import View
-from edx_rest_framework_extensions.auth.jwt.authentication import JwtAuthentication
 from rest_framework.views import APIView
-from rest_framework.authentication import SessionAuthentication
 from rest_framework.response import Response
 from rest_framework.permissions import IsAuthenticated
 from social_django.models import UserSocialAuth
@@ -77,9 +75,6 @@ class LinkProgramEnrollmentSupportAPIView(APIView):
     """
     Support-only API View for linking learner enrollments by support staff.
     """
-    authentication_classes = (
-        JwtAuthentication, SessionAuthentication
-    )
     permission_classes = (
         IsAuthenticated,
     )
@@ -312,9 +307,6 @@ class ProgramEnrollmentsInspectorAPIView(ProgramEnrollmentInspector, APIView):
     information of a learner.
     """
 
-    authentication_classes = (
-        JwtAuthentication, SessionAuthentication
-    )
     permission_classes = (
         IsAuthenticated,
     )

lms/djangoapps/user_tours/v1/views.py

@@ -2,8 +2,6 @@
 from django.conf import settings
 from django.db import transaction, IntegrityError
 from django.shortcuts import get_object_or_404
-from edx_rest_framework_extensions.auth.jwt.authentication import JwtAuthentication
-from rest_framework.authentication import SessionAuthentication
 from rest_framework.generics import RetrieveUpdateAPIView
 from rest_framework.permissions import IsAuthenticated
 from rest_framework.response import Response
@@ -25,7 +23,6 @@ class UserTourView(RetrieveUpdateAPIView):
         GET /api/user_tours/v1/{username}
         PATCH /api/user_tours/v1/{username}
     """
-    authentication_classes = (JwtAuthentication,)
     permission_classes = (IsAuthenticated,)
     serializer_class = UserTourSerializer
 
@@ -111,7 +108,6 @@ class UserDiscussionsToursView(APIView):
     ]
     """
 
-    authentication_classes = (JwtAuthentication, SessionAuthentication)
     permission_classes = (IsAuthenticated,)
 
     def get(self, request, tour_id=None):