Country Access: block enrollment

Block users from enrolling in a course if the user
is blocked by country access rules.

1) Enrollment via the login/registration page.
2) Enrollment from the marketing iframe (via student.views.change_enrollment)
3) Enrollment using 100% redeem codes.
4) Enrollment via upgrade.

This does NOT cover enrollment through third party authentication,
which is sufficiently complex to deserve its own commit.

common/djangoapps/student/tests/test_enrollment.py

@@ -5,18 +5,19 @@ import ddt
 import unittest
 from mock import patch
 
-from django.test.utils import override_settings
 from django.conf import settings
 from django.core.urlresolvers import reverse
 from xmodule.modulestore.tests.django_utils import ModuleStoreTestCase
 from xmodule.modulestore.tests.factories import CourseFactory
+from util.testing import UrlResetMixin
+from embargo.test_utils import restrict_course
 from student.tests.factories import UserFactory, CourseModeFactory
 from student.models import CourseEnrollment
 
 
 @ddt.ddt
 @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
-class EnrollmentTest(ModuleStoreTestCase):
+class EnrollmentTest(UrlResetMixin, ModuleStoreTestCase):
     """
     Test student enrollment, especially with different course modes.
     """
@@ -25,9 +26,10 @@ class EnrollmentTest(ModuleStoreTestCase):
     EMAIL = "bob@example.com"
     PASSWORD = "edx"
 
+    @patch.dict(settings.FEATURES, {'ENABLE_COUNTRY_ACCESS': True})
     def setUp(self):
         """ Create a course and user, then log in. """
-        super(EnrollmentTest, self).setUp()
+        super(EnrollmentTest, self).setUp('embargo')
         self.course = CourseFactory.create()
         self.user = UserFactory.create(username=self.USERNAME, email=self.EMAIL, password=self.PASSWORD)
         self.client.login(username=self.USERNAME, password=self.PASSWORD)
@@ -132,6 +134,29 @@ class EnrollmentTest(ModuleStoreTestCase):
         else:
             self.assertFalse(mock_update_email_opt_in.called)
 
+    @patch.dict(settings.FEATURES, {'ENABLE_COUNTRY_ACCESS': True})
+    def test_embargo_restrict(self):
+        # When accessing the course from an embargoed country,
+        # we should be blocked.
+        with restrict_course(self.course.id) as redirect_url:
+            response = self._change_enrollment('enroll')
+            self.assertEqual(response.status_code, 200)
+            self.assertEqual(response.content, redirect_url)
+
+        # Verify that we weren't enrolled
+        is_enrolled = CourseEnrollment.is_enrolled(self.user, self.course.id)
+        self.assertFalse(is_enrolled)
+
+    @patch.dict(settings.FEATURES, {'ENABLE_COUNTRY_ACCESS': True})
+    def test_embargo_allow(self):
+        response = self._change_enrollment('enroll')
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.content, '')
+
+        # Verify that we were enrolled
+        is_enrolled = CourseEnrollment.is_enrolled(self.user, self.course.id)
+        self.assertTrue(is_enrolled)
+
     def test_user_not_authenticated(self):
         # Log out, so we're no longer authenticated
         self.client.logout()

common/djangoapps/student/views.py

@@ -9,6 +9,7 @@ import time
 import json
 from collections import defaultdict
 from pytz import UTC
+from ipware.ip import get_ip
 
 from django.conf import settings
 from django.contrib.auth import logout, authenticate, login
@@ -113,6 +114,8 @@ from xmodule.error_module import ErrorDescriptor
 from shoppingcart.models import DonationConfiguration, CourseRegistrationCode
 from openedx.core.djangoapps.user_api.api import profile as profile_api
 
+from embargo import api as embargo_api
+
 import analytics
 from eventtracking import tracker
 
@@ -876,6 +879,17 @@ def change_enrollment(request, check_access=True):
 
         available_modes = CourseMode.modes_for_course_dict(course_id)
 
+        # Check whether the user is blocked from enrolling in this course
+        # This can occur if the user's IP is on a global blacklist
+        # or if the user is enrolling in a country in which the course
+        # is not available.
+        redirect_url = embargo_api.redirect_if_blocked(
+            course_id, user=user, ip_address=get_ip(request),
+            url=request.path
+        )
+        if redirect_url:
+            return HttpResponse(redirect_url)
+
         # Check that auto enrollment is allowed for this course
         # (= the course is NOT behind a paywall)
         if CourseMode.can_auto_enroll(course_id):