feat: Deny course staff visibility of legacy courseware. (#27469)

Currently, course staff can always view their courses
in the Legacy courseware experience.

With this change, course staff will *not* be able
to view their courses if the New (MFE) courseware
experience has been enabled for them.

This does not affect global staff, and it does not
affect courses that are still running in the Legacy
experience.

Adds a new parameter returned by the course metadata API
used by the courseware MFE to determine if the button to
show legacy experience should be displayed or not.

TNL-8203

lms/djangoapps/courseware/tests/test_views.py

@@ -3478,19 +3478,19 @@ class MFERedirectTests(BaseViewsTestCase):  # lint-amnesty, pylint: disable=miss
     def test_staff_no_redirect(self):
         lms_url, mfe_url = self._get_urls()  # lint-amnesty, pylint: disable=unused-variable
 
-        # course staff will not redirect
+        # course staff will redirect in an MFE-enabled course - and not redirect otherwise.
         course_staff = UserFactory.create(is_staff=False)
         CourseStaffRole(self.course_key).add_users(course_staff)
         self.client.login(username=course_staff.username, password='test')
 
         assert self.client.get(lms_url).status_code == 200
         with _set_mfe_flag(True):
-            assert self.client.get(lms_url).status_code == 200
+            assert self.client.get(lms_url).status_code == 302
 
         # global staff will never be redirected
         self._create_global_staff_user()
-        assert self.client.get(lms_url).status_code == 200
 
+        assert self.client.get(lms_url).status_code == 200
         with _set_mfe_flag(True):
             assert self.client.get(lms_url).status_code == 200
 

lms/djangoapps/courseware/toggles.py

@@ -176,7 +176,6 @@ def courseware_mfe_is_advertised(
 def courseware_legacy_is_visible(
         course_key: CourseKey,
         is_global_staff=False,
-        is_course_staff=False,
 ) -> bool:
     """
     Can we see a course run's content in the Legacy frontend?
@@ -187,9 +186,6 @@ def courseware_legacy_is_visible(
     # ALLOW: Global staff may always see the Legacy experience.
     if is_global_staff:
         return True
-    # ALLOW: The course team may always see their course in the Legacy experience.
-    if is_course_staff:
-        return True
     # OTHERWISE: Legacy is only visible if it's the active (ie canonical) experience.
     #            Note that Old Mongo courses are never the active experience,
     #            so we effectively always ALLOW them to be viewed in Legacy.

lms/djangoapps/courseware/views/index.py

@@ -178,7 +178,6 @@ class CoursewareIndex(View):
         if courseware_legacy_is_visible(
                 course_key=self.course_key,
                 is_global_staff=self.request.user.is_staff,
-                is_course_staff=self.is_staff,
         ):
             return
         # STAY: if we are in a special (ie proctored/timed) exam, which isn't yet