prevent proctoring provider changes after course start (#24146)

* prevent proctoring provider changes after course start

* better comment wording

* add support email to error msg

cms/djangoapps/contentstore/tests/test_course_settings.py

@@ -1200,6 +1200,48 @@ class CourseMetadataEditingTest(CourseTestCase):
         test_model = CourseMetadata.fetch(self.fullcourse)
         self.assertIn('proctoring_provider', test_model)
 
+    @ddt.data(True, False)
+    @override_settings(
+        PROCTORING_BACKENDS={
+            'DEFAULT': 'test_proctoring_provider',
+            'valid_provider': {}
+        },
+        PARTNER_SUPPORT_EMAIL='support@foobar.com'
+    )
+    @override_waffle_flag(ENABLE_PROCTORING_PROVIDER_OVERRIDES, True)
+    def test_validate_update_does_not_allow_proctoring_provider_changes_after_course_start(self, staff_user):
+        """
+        Course staff cannot modify proctoring provder after the course start date.
+        Only admin users may update the provider if the course has started.
+        """
+        field_name = "proctoring_provider"
+        course = CourseFactory.create(start=datetime.datetime.now(UTC) - datetime.timedelta(days=1))
+        user = UserFactory.create(is_staff=staff_user)
+
+        did_validate, errors, test_model = CourseMetadata.validate_and_update_from_json(
+            course,
+            {
+                field_name: {"value": 'valid_provider'},
+            },
+            user=user
+        )
+
+        if staff_user:
+            self.assertTrue(did_validate)
+            self.assertEqual(len(errors), 0)
+            self.assertIn(field_name, test_model)
+        else:
+            self.assertFalse(did_validate)
+            self.assertEqual(len(errors), 1)
+            self.assertEqual(
+                errors[0].get('message'),
+                (
+                    'The proctoring provider cannot be modified after a course has started.'
+                    ' Contact support@foobar.com for assistance'
+                )
+            )
+            self.assertIsNone(test_model)
+
     @override_settings(
         PROCTORING_BACKENDS={
             'DEFAULT': 'test_proctoring_provider',

cms/djangoapps/models/settings/course_metadata.py

@@ -3,10 +3,12 @@ Django module for Course Metadata class -- manages advanced settings and related
 """
 
 
+from datetime import datetime
 import six
 from crum import get_current_user
 from django.conf import settings
 from django.utils.translation import ugettext as _
+import pytz
 from six import text_type
 from xblock.fields import Scope
 
@@ -246,6 +248,20 @@ class CourseMetadata(object):
                 did_validate = False
                 errors.append({'message': text_type(err), 'model': model})
 
+        # Disallow updates to the proctoring provider after course start
+        proctoring_provider_model = filtered_dict.get('proctoring_provider')
+        if (
+            not user.is_staff and
+            proctoring_provider_model != descriptor.proctoring_provider and
+            datetime.now(pytz.UTC) > descriptor.start
+        ):
+            did_validate = False
+            message = (
+                'The proctoring provider cannot be modified after a course has started.'
+                ' Contact {support_email} for assistance'
+            ).format(support_email=settings.PARTNER_SUPPORT_EMAIL or 'support')
+            errors.append({'message': message, 'model': filtered_dict.get('proctoring_provider')})
+
         # If did validate, go ahead and update the metadata
         if did_validate:
             updated_data = cls.update_from_dict(key_values, descriptor, user, save=False)