update usage of SessionAuthenticationAllowInactiveUser

LEARNER-6469

openedx/core/djangoapps/profile_images/views.py

@@ -8,6 +8,7 @@ from contextlib import closing
 
 from pytz import UTC
 from django.utils.translation import ugettext as _
+from edx_rest_framework_extensions.authentication import SessionAuthenticationAllowInactiveUser
 from rest_framework import permissions, status
 from rest_framework.parsers import FormParser, MultiPartParser
 from rest_framework.response import Response
@@ -16,10 +17,7 @@ from six import text_type
 
 from openedx.core.djangoapps.user_api.accounts.image_helpers import get_profile_image_names, set_has_profile_image
 from openedx.core.djangoapps.user_api.errors import UserNotFound
-from openedx.core.lib.api.authentication import (
-    OAuth2AuthenticationAllowInactiveUser,
-    SessionAuthenticationAllowInactiveUser
-)
+from openedx.core.lib.api.authentication import OAuth2AuthenticationAllowInactiveUser
 from openedx.core.lib.api.parsers import TypedFileUploadParser
 from openedx.core.lib.api.permissions import IsUserInUrl
 from openedx.core.lib.api.view_utils import DeveloperErrorViewMixin

openedx/core/djangoapps/user_api/accounts/views.py

@@ -17,7 +17,7 @@ from django.db import transaction
 from django.utils.translation import ugettext as _
 from edx_ace import ace
 from edx_ace.recipient import Recipient
-from edx_rest_framework_extensions.authentication import JwtAuthentication
+from edx_rest_framework_extensions.authentication import JwtAuthentication, SessionAuthenticationAllowInactiveUser
 from enterprise.models import EnterpriseCourseEnrollment, EnterpriseCustomerUser, PendingEnterpriseCustomerUser
 from integrated_channels.degreed.models import DegreedLearnerDataTransmissionAudit
 from integrated_channels.sap_success_factors.models import SapSuccessFactorsLearnerDataTransmissionAudit
@@ -41,10 +41,7 @@ from openedx.core.djangoapps.course_groups.models import UnregisteredLearnerCoho
 from openedx.core.djangoapps.profile_images.images import remove_profile_images
 from openedx.core.djangoapps.user_api.accounts.image_helpers import get_profile_image_names, set_has_profile_image
 from openedx.core.djangolib.oauth2_retirement_utils import retire_dot_oauth2_models, retire_dop_oauth2_models
-from openedx.core.lib.api.authentication import (
-    OAuth2AuthenticationAllowInactiveUser,
-    SessionAuthenticationAllowInactiveUser
-)
+from openedx.core.lib.api.authentication import OAuth2AuthenticationAllowInactiveUser
 from openedx.core.lib.api.parsers import MergePatchParser
 from student.models import (
     CourseEnrollment,

openedx/core/djangoapps/user_api/preferences/views.py

@@ -11,11 +11,9 @@ from rest_framework import permissions
 
 from django.db import transaction
 from django.utils.translation import ugettext as _
+from edx_rest_framework_extensions.authentication import SessionAuthenticationAllowInactiveUser
 
-from openedx.core.lib.api.authentication import (
-    SessionAuthenticationAllowInactiveUser,
-    OAuth2AuthenticationAllowInactiveUser,
-)
+from openedx.core.lib.api.authentication import OAuth2AuthenticationAllowInactiveUser
 from openedx.core.lib.api.parsers import MergePatchParser
 from openedx.core.lib.api.permissions import IsUserInUrlOrStaff
 from ..errors import UserNotFound, UserNotAuthorized, PreferenceValidationError, PreferenceUpdateError

openedx/core/djangoapps/user_api/views.py

@@ -17,6 +17,7 @@ from six import text_type
 
 import accounts
 from django_comment_common.models import Role
+from edx_rest_framework_extensions.authentication import SessionAuthenticationAllowInactiveUser
 from opaque_keys import InvalidKeyError
 from opaque_keys.edx import locator
 from opaque_keys.edx.keys import CourseKey
@@ -32,7 +33,6 @@ from openedx.core.djangoapps.user_api.preferences.api import get_country_time_zo
 from openedx.core.djangoapps.user_api.serializers import CountryTimeZoneSerializer, UserPreferenceSerializer, UserSerializer
 from openedx.core.djangoapps.user_authn.cookies import set_logged_in_cookies
 from openedx.core.djangoapps.user_authn.views.register import create_account_with_params
-from openedx.core.lib.api.authentication import SessionAuthenticationAllowInactiveUser
 from openedx.core.lib.api.permissions import ApiKeyHeaderPermission
 from student.helpers import AccountValidationError
 from util.json_request import JsonResponse

openedx/core/lib/api/authentication.py

@@ -20,53 +20,6 @@ OAUTH2_TOKEN_ERROR_NOT_PROVIDED = u'token_not_provided'
 log = logging.getLogger(__name__)
 
 
-class SessionAuthenticationAllowInactiveUser(SessionAuthentication):
-    """Ensure that the user is logged in, but do not require the account to be active.
-
-    We use this in the special case that a user has created an account,
-    but has not yet activated it.  We still want to allow the user to
-    enroll in courses, so we remove the usual restriction
-    on session authentication that requires an active account.
-
-    You should use this authentication class ONLY for end-points that
-    it's safe for an un-activated user to access.  For example,
-    we can allow a user to update his/her own enrollments without
-    activating an account.
-
-    """
-    def authenticate(self, request):
-        """Authenticate the user, requiring a logged-in account and CSRF.
-
-        This is exactly the same as the `SessionAuthentication` implementation,
-        with the `user.is_active` check removed.
-
-        Args:
-            request (HttpRequest)
-
-        Returns:
-            Tuple of `(user, token)`
-
-        Raises:
-            PermissionDenied: The CSRF token check failed.
-
-        """
-        # Get the underlying HttpRequest object
-        request = request._request  # pylint: disable=protected-access
-        user = getattr(request, 'user', None)
-
-        # Unauthenticated, CSRF validation not required
-        # This is where regular `SessionAuthentication` checks that the user is active.
-        # We have removed that check in this implementation.
-        # But we added a check to prevent anonymous users since we require a logged-in account.
-        if not user or user.is_anonymous:
-            return None
-
-        self.enforce_csrf(request)
-
-        # CSRF passed with authenticated user
-        return (user, None)
-
-
 class OAuth2AuthenticationAllowInactiveUser(OAuth2Authentication):
     """
     This is a temporary workaround while the is_active field on the user is coupled

openedx/core/lib/api/view_utils.py

@@ -4,7 +4,7 @@ Utilities related to API views
 from django.core.exceptions import NON_FIELD_ERRORS, ObjectDoesNotExist, ValidationError
 from django.http import Http404
 from django.utils.translation import ugettext as _
-from edx_rest_framework_extensions.authentication import JwtAuthentication
+from edx_rest_framework_extensions.authentication import JwtAuthentication, SessionAuthenticationAllowInactiveUser
 from rest_framework import status
 from rest_framework.exceptions import APIException
 from rest_framework.generics import GenericAPIView
@@ -14,10 +14,7 @@ from rest_framework.request import clone_request
 from rest_framework.response import Response
 from six import text_type
 
-from openedx.core.lib.api.authentication import (
-    OAuth2AuthenticationAllowInactiveUser,
-    SessionAuthenticationAllowInactiveUser
-)
+from openedx.core.lib.api.authentication import OAuth2AuthenticationAllowInactiveUser
 from openedx.core.lib.api.permissions import IsUserInUrl