Using shared secret for JWTs sent to Credentials API

This change brings the Credentials API calls in line with those of other services. The change also makes it easier for the future switch to an asymmetric signing key.

LEARNER-629

openedx/core/djangoapps/catalog/tests/test_utils.py

@@ -198,7 +198,7 @@ class TestGetCourseRuns(CatalogIntegrationMixin, TestCase):
         """
         args, kwargs = call_args
 
-        for arg in (self.catalog_integration, self.user, 'course_runs'):
+        for arg in (self.catalog_integration, 'course_runs'):
             self.assertIn(arg, args)
 
         self.assertEqual(kwargs['api']._store['base_url'], self.catalog_integration.internal_api_url)  # pylint: disable=protected-access

openedx/core/djangoapps/catalog/utils.py

@@ -2,7 +2,6 @@
 import copy
 import logging
 
-import waffle
 from django.conf import settings
 from django.contrib.auth import get_user_model
 from edx_rest_api_client.client import EdxRestApiClient
@@ -11,7 +10,6 @@ from openedx.core.djangoapps.catalog.models import CatalogIntegration
 from openedx.core.lib.edx_api_utils import get_edx_api_data
 from openedx.core.lib.token_utils import JwtBuilder
 
-
 log = logging.getLogger(__name__)
 
 User = get_user_model()  # pylint: disable=invalid-name
@@ -67,11 +65,10 @@ def get_programs(uuid=None, types=None):  # pylint: disable=redefined-builtin
 
         return get_edx_api_data(
             catalog_integration,
-            user,
             'programs',
+            api=api,
             resource_id=uuid,
             cache_key=cache_key if catalog_integration.is_cache_enabled else None,
-            api=api,
             querystring=querystring,
         )
     else:
@@ -98,13 +95,8 @@ def get_program_types(name=None):
         api = create_catalog_api_client(user, catalog_integration)
         cache_key = '{base}.program_types'.format(base=catalog_integration.CACHE_KEY)
 
-        data = get_edx_api_data(
-            catalog_integration,
-            user,
-            'program_types',
-            cache_key=cache_key if catalog_integration.is_cache_enabled else None,
-            api=api
-        )
+        data = get_edx_api_data(catalog_integration, 'program_types', api=api,
+                                cache_key=cache_key if catalog_integration.is_cache_enabled else None)
 
         # Filter by name if a name was provided
         if name:
@@ -169,12 +161,6 @@ def get_course_runs():
             'exclude_utm': 1,
         }
 
-        course_runs = get_edx_api_data(
-            catalog_integration,
-            user,
-            'course_runs',
-            api=api,
-            querystring=querystring,
-        )
+        course_runs = get_edx_api_data(catalog_integration, 'course_runs', api=api, querystring=querystring)
 
     return course_runs

openedx/core/djangoapps/credentials/utils.py

@@ -1,15 +1,28 @@
 """Helper functions for working with Credentials."""
 from __future__ import unicode_literals
+
 import logging
 
+from django.conf import settings
+from edx_rest_api_client.client import EdxRestApiClient
+
 from openedx.core.djangoapps.catalog.utils import get_programs
 from openedx.core.djangoapps.credentials.models import CredentialsApiConfig
 from openedx.core.lib.edx_api_utils import get_edx_api_data
-
+from openedx.core.lib.token_utils import JwtBuilder
 
 log = logging.getLogger(__name__)
 
 
+def get_credentials_api_client(user):
+    """ Returns an authenticated Credentials API client. """
+
+    scopes = ['email', 'profile']
+    expires_in = settings.OAUTH_ID_TOKEN_EXPIRATION
+    jwt = JwtBuilder(user).build_token(scopes, expires_in)
+    return EdxRestApiClient(CredentialsApiConfig.current().internal_api_url, jwt=jwt)
+
+
 def get_credentials(user, program_uuid=None):
     """
     Given a user, get credentials earned from the credentials service.
@@ -35,9 +48,10 @@ def get_credentials(user, program_uuid=None):
     # want to see them displayed immediately.
     use_cache = credential_configuration.is_cache_enabled and not user.is_staff
     cache_key = credential_configuration.CACHE_KEY + '.' + user.username if use_cache else None
+    api = get_credentials_api_client(user)
 
     return get_edx_api_data(
-        credential_configuration, user, 'credentials', querystring=querystring, cache_key=cache_key
+        credential_configuration, 'credentials', api=api, querystring=querystring, cache_key=cache_key
     )