From e8093447011601d1d1c62a250f7384ae16da1472 Mon Sep 17 00:00:00 2001
From: Jansen Kantor <jkantor@edx.org>
Date: Mon, 6 Mar 2023 15:16:22 -0500
Subject: [PATCH] fix: waffle flag gates public video (#31881)

* fix: waffle flag gates public video

* test: move test into existing file
---
 lms/djangoapps/courseware/tests/test_views.py | 42 +++++++------------
 lms/djangoapps/courseware/toggles.py          |  3 +-
 lms/djangoapps/courseware/views/views.py      |  4 ++
 3 files changed, 21 insertions(+), 28 deletions(-)

diff --git a/lms/djangoapps/courseware/tests/test_views.py b/lms/djangoapps/courseware/tests/test_views.py
index 66d34ad6ea..1adb52cf16 100644
--- a/lms/djangoapps/courseware/tests/test_views.py
+++ b/lms/djangoapps/courseware/tests/test_views.py
@@ -3066,35 +3066,23 @@ class TestRenderPublicVideoXBlock(ModuleStoreTestCase):
         response = self.get_response(usage_key=self.html_block.location, is_embed=is_embed)
         self.assertContains(response, 'Page not found', status_code=404)
 
-    @ddt.data(True, False)
-    def test_render_xblock_with_video_usage_key_with_public_access(self, is_embed):
-        """
-        Verify that endpoint returns expected response if usage key block type is `video`
-        and video doesn't have 'public access' set as True
-        """
-        self.setup_course()
-        response = self.get_response(usage_key=self.video_block_public.location, is_embed=is_embed)
-        self.assertContains(response, 'Play video', status_code=200)
+    @ddt.unpack
+    @ddt.data(
+        (True, True, 200),
+        (True, False, 404),
+        (False, True, 404),
+        (False, False, 404),
+    )
+    def test_access(self, is_waffle_enabled, is_public_video, expected_status_code):
+        """ Tests for access control """
+        self.setup_course(enable_waffle=is_waffle_enabled)
+        target_video = self.video_block_public if is_public_video else self.video_block_not_public
 
-    @ddt.data(True, False)
-    def test_render_xblock_with_video_usage_key_with_non_public_access(self, is_embed):
-        """
-        Verify that endpoint returns expected response if usage key block type is `video`
-        and video doesn't have 'public access' set as False
-        """
-        self.setup_course()
-        response = self.get_response(usage_key=self.video_block_not_public.location, is_embed=is_embed)
-        self.assertContains(response, 'Play video', status_code=200)
+        response = self.get_response(usage_key=target_video.location, is_embed=False)
+        embed_response = self.get_response(usage_key=target_video.location, is_embed=True)
 
-    @ddt.data(True, False)
-    def test_render_xblock_with_video_waffle_not_enabled(self, is_embed):
-        """
-        Verify that endpoint returns expected response if waffle is not enabled for course.
-        """
-        self.setup_course(enable_waffle=False)
-        for block in (self.video_block_public, self.video_block_not_public):
-            response = self.get_response(usage_key=block.location, is_embed=is_embed)
-            self.assertContains(response, 'Page not found', status_code=404)
+        self.assertEqual(expected_status_code, response.status_code)
+        self.assertEqual(expected_status_code, embed_response.status_code)
 
 
 class TestRenderXBlockSelfPaced(TestRenderXBlock):  # lint-amnesty, pylint: disable=test-inherits-tests
diff --git a/lms/djangoapps/courseware/toggles.py b/lms/djangoapps/courseware/toggles.py
index aa2977d414..b8e097d517 100644
--- a/lms/djangoapps/courseware/toggles.py
+++ b/lms/djangoapps/courseware/toggles.py
@@ -99,7 +99,8 @@ COURSES_INVITE_ONLY = SettingToggle('COURSES_INVITE_ONLY', default=False)
 # .. toggle_name: courseware.public_video_share
 # .. toggle_implementation: CourseWaffleFlag
 # .. toggle_default: False
-# .. toggle_description: Enables public viewing / sharing of all course videos.
+# .. toggle_description: Gates access to public videos. This flag must be enabled, and individual
+#                        videos must be marked as "public_access"
 # .. toggle_use_cases: temporary
 # .. toggle_creation_date: 2023-02-02
 # .. toggle_target_removal_date: None
diff --git a/lms/djangoapps/courseware/views/views.py b/lms/djangoapps/courseware/views/views.py
index ecafc1087e..c8a3c65b34 100644
--- a/lms/djangoapps/courseware/views/views.py
+++ b/lms/djangoapps/courseware/views/views.py
@@ -1683,6 +1683,10 @@ def _render_public_video_xblock(request, usage_key_string, is_embed=False):
             will_recheck_access=False
         )
 
+        # Block must be marked as public to be viewed
+        if not block.public_access:
+            raise Http404("Video not found.")
+
         fragment = block.render(view, context={
             'public_video_embed': is_embed,
         })