fix: use originalUserIsStaff to gate bulk email tool over isStaff
[MICROBA-1822][CR-4822] * use `originalUserIsStaff` to gate bulk email tool access over `isStaff` Additional Context Access to this tool was originally gated by looking at the `isStaff` value from the CourseMetadata data returned to us from the LMS. The user masquerading feature seems to have some interesting interactions with the Instructor Dashboard and we may be denying legitimate staff/admin/instructors access to the tool. Instead of using the value of `isStaff` we will now use `originalUserIsStaff` to determine if the user accessing the tool should be allowed access (and this follows how the Learning MFE gates content).
This commit is contained in:
@@ -19,7 +19,7 @@ export default function BulkEmailTool() {
|
||||
|
||||
return (
|
||||
<CourseMetadataContext.Consumer>
|
||||
{(courseMetadata) => (courseMetadata.isStaff ? (
|
||||
{(courseMetadata) => (courseMetadata.originalUserIsStaff ? (
|
||||
<div>
|
||||
<NavigationTabs courseId={courseId} tabData={courseMetadata.tabs} />
|
||||
<div>
|
||||
|
||||
@@ -3,6 +3,7 @@
|
||||
*/
|
||||
import React from 'react';
|
||||
import { Factory } from 'rosie';
|
||||
import { camelCaseObject } from '@edx/frontend-platform';
|
||||
import {
|
||||
render, screen, cleanup, initializeMockApp,
|
||||
} from '../../../setupTest';
|
||||
@@ -36,15 +37,15 @@ describe('BulkEmailTool', () => {
|
||||
*/
|
||||
function buildCourseMetadata(cohortData, courseData) {
|
||||
const {
|
||||
org, number, title, tabs, is_staff: isStaff,
|
||||
} = courseData;
|
||||
org, number, title, tabs, originalUserIsStaff,
|
||||
} = camelCaseObject(courseData);
|
||||
const { cohorts } = cohortData;
|
||||
|
||||
return {
|
||||
org,
|
||||
number,
|
||||
title,
|
||||
isStaff,
|
||||
originalUserIsStaff,
|
||||
tabs: [...tabs],
|
||||
cohorts: cohorts.map(({ name }) => name),
|
||||
};
|
||||
@@ -78,7 +79,7 @@ describe('BulkEmailTool', () => {
|
||||
|
||||
test('BulkEmailTool renders error page on no staff user', async () => {
|
||||
const cohorts = { cohorts: [] };
|
||||
const courseInfo = Factory.build('courseMetadata', { is_staff: false });
|
||||
const courseInfo = Factory.build('courseMetadata', { original_user_is_staff: false });
|
||||
const courseMetadata = buildCourseMetadata(cohorts, courseInfo);
|
||||
renderBulkEmailTool(courseMetadata);
|
||||
// verify error page is displayed for user without staff permissions
|
||||
|
||||
@@ -31,7 +31,7 @@ export default function PageContainer(props) {
|
||||
org: '',
|
||||
number: '',
|
||||
title: '',
|
||||
isStaff: false,
|
||||
originalUserIsStaff: false,
|
||||
tabs: [],
|
||||
cohorts: [],
|
||||
});
|
||||
@@ -39,7 +39,7 @@ export default function PageContainer(props) {
|
||||
}
|
||||
|
||||
const {
|
||||
org, number, title, tabs, is_staff: isStaff,
|
||||
org, number, title, tabs, originalUserIsStaff,
|
||||
} = metadataResponse;
|
||||
const { cohorts } = cohortsResponse;
|
||||
|
||||
@@ -47,7 +47,7 @@ export default function PageContainer(props) {
|
||||
org,
|
||||
number,
|
||||
title,
|
||||
isStaff,
|
||||
originalUserIsStaff,
|
||||
tabs: [...tabs],
|
||||
cohorts: cohorts.map(({ name }) => name),
|
||||
});
|
||||
|
||||
@@ -6,7 +6,7 @@ export default Factory.define('courseMetadata')
|
||||
.option('host', 'http://localhost:18000')
|
||||
.attrs({
|
||||
is_staff: true,
|
||||
original_user_is_staff: false,
|
||||
original_user_is_staff: true,
|
||||
number: 'DemoX',
|
||||
org: 'edX',
|
||||
title: 'Demonstration Course',
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
import { getConfig } from '@edx/frontend-platform';
|
||||
import { camelCaseObject, getConfig } from '@edx/frontend-platform';
|
||||
import { getAuthenticatedHttpClient } from '@edx/frontend-platform/auth';
|
||||
|
||||
const courseHomeBaseUrl = `${getConfig().LMS_BASE_URL}/api/course_home/v1/course_metadata`;
|
||||
@@ -6,7 +6,7 @@ const courseHomeBaseUrl = `${getConfig().LMS_BASE_URL}/api/course_home/v1/course
|
||||
export async function getCourseHomeCourseMetadata(courseId) {
|
||||
const courseHomeMetadataUrl = `${courseHomeBaseUrl}/${courseId}`;
|
||||
const { data } = await getAuthenticatedHttpClient().get(courseHomeMetadataUrl);
|
||||
return data;
|
||||
return camelCaseObject(data);
|
||||
}
|
||||
|
||||
export async function getCohorts(courseId) {
|
||||
|
||||
Reference in New Issue
Block a user