Added CCX REST APIs

CCX REST APIs
OAUTH2 authorization for CCX APIs
- oauth2 authorization required for ccx list.
- Course-instructor permission for ccx api endpoint
- Protection for detail view too.

Tests for CCX REST APIs and OAUTH2 authorization

openedx/core/lib/api/permissions.py

@@ -6,7 +6,7 @@ from django.conf import settings
 from django.http import Http404
 from rest_framework import permissions
 
-from student.roles import CourseStaffRole
+from student.roles import CourseStaffRole, CourseInstructorRole
 
 
 class ApiKeyHeaderPermission(permissions.BasePermission):
@@ -64,6 +64,15 @@ class IsUserInUrl(permissions.BasePermission):
         return True
 
 
+class IsCourseInstructor(permissions.BasePermission):
+    """
+    Permission to check that user is a course instructor.
+    """
+
+    def has_object_permission(self, request, view, obj):
+        return hasattr(request, 'user') and CourseInstructorRole(obj.course_id).has_user(request.user)
+
+
 class IsUserInUrlOrStaff(IsUserInUrl):
     """
     Permission that checks to see if the request user matches the user in the URL or has is_staff access.

openedx/core/lib/api/tests/test_permissions.py

@@ -3,13 +3,48 @@
 import ddt
 from django.test import TestCase, RequestFactory
 
-from openedx.core.lib.api.permissions import IsStaffOrOwner
+from student.roles import CourseStaffRole, CourseInstructorRole
+from openedx.core.lib.api.permissions import IsStaffOrOwner, IsCourseInstructor
 from student.tests.factories import UserFactory
+from opaque_keys.edx.keys import CourseKey
 
 
 class TestObject(object):
     """ Fake class for object permission tests. """
-    user = None
+    def __init__(self, user=None, course_id=None):
+        self.user = user
+        self.course_id = course_id
+
+
+class IsCourseInstructorTests(TestCase):
+    """ Test for IsCourseInstructor permission class. """
+
+    def setUp(self):
+        super(IsCourseInstructorTests, self).setUp()
+        self.permission = IsCourseInstructor()
+        self.request = RequestFactory().get('/')
+        self.course_key = CourseKey.from_string('edx/test123/run')
+        self.obj = TestObject(course_id=self.course_key)
+
+    def test_course_staff_has_no_access(self):
+        user = UserFactory.create()
+        self.request.user = user
+        CourseStaffRole(course_key=self.course_key).add_users(user)
+
+        self.assertFalse(
+            self.permission.has_object_permission(self.request, None, self.obj))
+
+    def test_course_instructor_has_access(self):
+        user = UserFactory.create()
+        self.request.user = user
+        CourseInstructorRole(course_key=self.course_key).add_users(user)
+
+        self.assertTrue(
+            self.permission.has_object_permission(self.request, None, self.obj))
+
+    def test_anonymous_has_no_access(self):
+        self.assertFalse(
+            self.permission.has_object_permission(self.request, None, self.obj))
 
 
 @ddt.ddt