From e11c8209d80ae9b04ee4fec7cd974e2e013ee4b5 Mon Sep 17 00:00:00 2001
From: Diane Kaplan <dkaplan@edx.org>
Date: Tue, 27 Oct 2020 12:49:31 -0400
Subject: [PATCH 1/8] ported logic from user_metadata.html to utils so it can
 be reused by new endpoint

---
 lms/djangoapps/experiments/utils.py          | 74 ++++++++++++++++++++
 lms/templates/experiments/user_metadata.html | 69 +-----------------
 2 files changed, 76 insertions(+), 67 deletions(-)

diff --git a/lms/djangoapps/experiments/utils.py b/lms/djangoapps/experiments/utils.py
index 05cc3ceda09e..a34099f126cf 100644
--- a/lms/djangoapps/experiments/utils.py
+++ b/lms/djangoapps/experiments/utils.py
@@ -408,3 +408,77 @@ def get_program_context(course, user_enrollments):
             }
     return program_key
 # TODO: clean up as part of REVEM-199 (START)
+
+
+from opaque_keys.edx.keys import CourseKey
+import six
+
+def generate_processed_user_metadata(context, user, course, course_id): 
+    user_metadata = {
+        key: context.get(key)
+        for key in (
+            'username',
+            'user_id',
+            'course_id',
+            'enrollment_mode',
+            'upgrade_link',
+            'upgrade_price',
+            'audit_access_deadline',
+            'course_duration',
+            'pacing_type',
+            'has_staff_access',
+            'forum_roles',
+            'partition_groups',
+            # TODO: clean up as part of REVO-28 (START)
+            'has_non_audit_enrollments',
+            # TODO: clean up as part of REVO-28 (END)
+            # TODO: clean up as part of REVEM-199 (START)
+            'program_key_fields',
+            # TODO: clean up as part of REVEM-199 (END)
+        )
+    }
+
+    if user:
+        user_metadata['username'] = user.username
+        user_metadata['user_id'] = user.id
+        if hasattr(user, 'email'):
+            user_metadata['email'] = user.email
+
+    for datekey in (
+            'schedule_start',
+            'enrollment_time',
+            'course_start',
+            'course_end',
+            'dynamic_upgrade_deadline',
+            'course_upgrade_deadline',
+            'audit_access_deadline',
+    ):
+        user_metadata[datekey] = (
+            context.get(datekey).isoformat() if context.get(datekey) else None
+        )
+
+    for timedeltakey in (
+        'course_duration',
+    ):
+        user_metadata[timedeltakey] = (
+            context.get(timedeltakey).total_seconds() if context.get(timedeltakey) else None
+        )
+
+    course_key = context.get('course_key')
+    if course and not course_key:
+        course_key = course.id
+
+    if course_key:
+        if isinstance(course_key, CourseKey):
+            user_metadata['course_key_fields'] = {
+                'org': course_key.org,
+                'course': course_key.course,
+                'run': course_key.run,
+            }
+
+            if not course_id:
+                user_metadata['course_id'] = six.text_type(course_key)
+        elif isinstance(course_key, six.string_types):
+            user_metadata['course_id'] = course_key
+
+    return user_metadata
\ No newline at end of file
diff --git a/lms/templates/experiments/user_metadata.html b/lms/templates/experiments/user_metadata.html
index 8600ec11e152..c3052e6f81fc 100644
--- a/lms/templates/experiments/user_metadata.html
+++ b/lms/templates/experiments/user_metadata.html
@@ -1,78 +1,13 @@
 <%page expression_filter="h"/>
 <%!
+from experiments.utils import generate_processed_user_metadata
 from openedx.core.djangolib.js_utils import dump_js_escaped_json
 from eventtracking import tracker
 from opaque_keys.edx.keys import CourseKey
 import six
 %>
 <%
-user_metadata = {
-    key: context.get(key)
-    for key in (
-        'username',
-        'user_id',
-        'course_id',
-        'enrollment_mode',
-        'upgrade_link',
-        'upgrade_price',
-        'audit_access_deadline',
-        'course_duration',
-        'pacing_type',
-        'has_staff_access',
-        'forum_roles',
-        'partition_groups',
-        # TODO: clean up as part of REVO-28 (START)
-        'has_non_audit_enrollments',
-        # TODO: clean up as part of REVO-28 (END)
-        # TODO: clean up as part of REVEM-199 (START)
-        'program_key_fields',
-        # TODO: clean up as part of REVEM-199 (END)
-    )
-}
-
-if user:
-    user_metadata['username'] = user.username
-    user_metadata['user_id'] = user.id
-    if hasattr(user, 'email'):
-        user_metadata['email'] = user.email
-
-for datekey in (
-        'schedule_start',
-        'enrollment_time',
-        'course_start',
-        'course_end',
-        'dynamic_upgrade_deadline',
-        'course_upgrade_deadline',
-        'audit_access_deadline',
-):
-    user_metadata[datekey] = (
-        context.get(datekey).isoformat() if context.get(datekey) else None
-    )
-
-for timedeltakey in (
-    'course_duration',
-):
-    user_metadata[timedeltakey] = (
-        context.get(timedeltakey).total_seconds() if context.get(timedeltakey) else None
-    )
-
-course_key = context.get('course_key')
-if course and not course_key:
-    course_key = course.id
-
-if course_key:
-    if isinstance(course_key, CourseKey):
-        user_metadata['course_key_fields'] = {
-            'org': course_key.org,
-            'course': course_key.course,
-            'run': course_key.run,
-        }
-
-        if not course_id:
-            user_metadata['course_id'] = six.text_type(course_key)
-    elif isinstance(course_key, six.string_types):
-        user_metadata['course_id'] = course_key
-
+user_metadata = generate_processed_user_metadata(context, user, course, course_id)
 %>
 <script type="application/json" id="user-metadata">
     ${user_metadata | n, dump_js_escaped_json}

From 466f57a2a41dd6e3cf8d8801030f3f04900908f6 Mon Sep 17 00:00:00 2001
From: Diane Kaplan <dkaplan@edx.org>
Date: Tue, 27 Oct 2020 12:50:44 -0400
Subject: [PATCH 2/8] added url and endpoint view to get metadata

---
 lms/djangoapps/experiments/urls.py  |  5 ++++-
 lms/djangoapps/experiments/utils.py |  7 ++-----
 lms/djangoapps/experiments/views.py | 25 +++++++++++++++++++++----
 3 files changed, 27 insertions(+), 10 deletions(-)

diff --git a/lms/djangoapps/experiments/urls.py b/lms/djangoapps/experiments/urls.py
index ec6af20e1a4f..005c9ed0d2d7 100644
--- a/lms/djangoapps/experiments/urls.py
+++ b/lms/djangoapps/experiments/urls.py
@@ -2,7 +2,7 @@
 Experimentation URLs
 """
 
-
+from django.conf import settings
 from django.conf.urls import include, url
 
 from . import routers, views, views_custom
@@ -14,4 +14,7 @@
 urlpatterns = [
     url(r'^v0/custom/REV-934/', views_custom.Rev934.as_view(), name='rev_934'),
     url(r'^v0/', include((router.urls, "api"), namespace='v0')),
+    url(r'^v0/custom/userMetadata/{username},{course_key}$'.format(
+        username=settings.USERNAME_PATTERN,
+        course_key=settings.COURSE_ID_PATTERN), views.UserMetaDataView.as_view(), name='user_metadata'),
 ]
diff --git a/lms/djangoapps/experiments/utils.py b/lms/djangoapps/experiments/utils.py
index a34099f126cf..aec39f6530df 100644
--- a/lms/djangoapps/experiments/utils.py
+++ b/lms/djangoapps/experiments/utils.py
@@ -410,10 +410,7 @@ def get_program_context(course, user_enrollments):
 # TODO: clean up as part of REVEM-199 (START)
 
 
-from opaque_keys.edx.keys import CourseKey
-import six
-
-def generate_processed_user_metadata(context, user, course, course_id): 
+def generate_processed_user_metadata(context, user, course, course_id):
     user_metadata = {
         key: context.get(key)
         for key in (
@@ -481,4 +478,4 @@ def generate_processed_user_metadata(context, user, course, course_id):
         elif isinstance(course_key, six.string_types):
             user_metadata['course_id'] = course_key
 
-    return user_metadata
\ No newline at end of file
+    return user_metadata
diff --git a/lms/djangoapps/experiments/views.py b/lms/djangoapps/experiments/views.py
index 14606e49333b..9a9385f4f2d6 100644
--- a/lms/djangoapps/experiments/views.py
+++ b/lms/djangoapps/experiments/views.py
@@ -2,19 +2,24 @@
 Experimentation views
 """
 
-
 from django.contrib.auth import get_user_model
 from django.db import transaction
 from django_filters.rest_framework import DjangoFilterBackend
 from edx_rest_framework_extensions.auth.jwt.authentication import JwtAuthentication
 from edx_rest_framework_extensions.auth.session.authentication import SessionAuthenticationAllowInactiveUser
+from lms.djangoapps.courseware import courses
+from opaque_keys.edx.keys import CourseKey
 from rest_framework import permissions, viewsets
 from rest_framework.response import Response
+from rest_framework.views import APIView
+from util.json_request import JsonResponse
 
-from lms.djangoapps.experiments import filters, serializers
-from lms.djangoapps.experiments.models import ExperimentData, ExperimentKeyValue
-from lms.djangoapps.experiments.permissions import IsStaffOrOwner, IsStaffOrReadOnly
+from experiments import filters, serializers
+from experiments.models import ExperimentData, ExperimentKeyValue
+from experiments.permissions import IsStaffOrOwner, IsStaffOrReadOnly
+from experiments.utils import get_experiment_user_metadata_context, generate_processed_user_metadata
 from openedx.core.djangoapps.cors_csrf.authentication import SessionAuthenticationCrossDomainCsrf
+from student.models import get_user_by_username_or_email
 
 User = get_user_model()  # pylint: disable=invalid-name
 
@@ -84,3 +89,15 @@ class ExperimentKeyValueViewSet(viewsets.ModelViewSet):
     permission_classes = (IsStaffOrReadOnly,)
     queryset = ExperimentKeyValue.objects.all()
     serializer_class = serializers.ExperimentKeyValueSerializer
+
+
+class UserMetaDataView(APIView):
+
+    def get(self, request, course_id=None, username=None):
+        """ Return user-metadata for the given course and user """
+        user = get_user_by_username_or_email(username)
+        course_key = CourseKey.from_string(course_id)
+        course = courses.get_course_by_id(course_key)
+        data = get_experiment_user_metadata_context(course, user)
+        processed_data = generate_processed_user_metadata(data, user, course, course_id)
+        return JsonResponse(processed_data)

From 837bc4a4b5eae773bd990b11a17f0523b86d01f3 Mon Sep 17 00:00:00 2001
From: Diane Kaplan <dkaplan@edx.org>
Date: Wed, 28 Oct 2020 12:53:34 -0400
Subject: [PATCH 3/8] updated get_experiment_user_metadata_context to set a
 user_metadata piece in the context, using logic formerly done in
 user_metatdata.html

---
 lms/djangoapps/experiments/utils.py          | 140 +++++++++----------
 lms/djangoapps/experiments/views.py          |   8 +-
 lms/templates/experiments/user_metadata.html |   3 +-
 3 files changed, 74 insertions(+), 77 deletions(-)

diff --git a/lms/djangoapps/experiments/utils.py b/lms/djangoapps/experiments/utils.py
index aec39f6530df..58fe1c133425 100644
--- a/lms/djangoapps/experiments/utils.py
+++ b/lms/djangoapps/experiments/utils.py
@@ -304,6 +304,75 @@ def get_experiment_user_metadata_context(course, user):
     context['has_staff_access'] = has_staff_access
     context['forum_roles'] = forum_roles
     context['partition_groups'] = user_partitions
+
+    user_metadata = {
+        key: context.get(key)
+        for key in (
+            'username',
+            'user_id',
+            'course_id',
+            'enrollment_mode',
+            'upgrade_link',
+            'upgrade_price',
+            'audit_access_deadline',
+            'course_duration',
+            'pacing_type',
+            'has_staff_access',
+            'forum_roles',
+            'partition_groups',
+            # TODO: clean up as part of REVO-28 (START)
+            'has_non_audit_enrollments',
+            # TODO: clean up as part of REVO-28 (END)
+            # TODO: clean up as part of REVEM-199 (START)
+            'program_key_fields',
+            # TODO: clean up as part of REVEM-199 (END)
+        )
+    }
+
+    if user:
+        user_metadata['username'] = user.username
+        user_metadata['user_id'] = user.id
+        if hasattr(user, 'email'):
+            user_metadata['email'] = user.email
+
+    for datekey in (
+            'schedule_start',
+            'enrollment_time',
+            'course_start',
+            'course_end',
+            'dynamic_upgrade_deadline',
+            'course_upgrade_deadline',
+            'audit_access_deadline',
+    ):
+        user_metadata[datekey] = (
+            context.get(datekey).isoformat() if context.get(datekey) else None
+        )
+
+    for timedeltakey in (
+        'course_duration',
+    ):
+        user_metadata[timedeltakey] = (
+            context.get(timedeltakey).total_seconds() if context.get(timedeltakey) else None
+        )
+
+    course_key = context.get('course_key')
+    if course and not course_key:
+        course_key = course.id
+
+    if course_key:
+        if isinstance(course_key, CourseKey):
+            user_metadata['course_key_fields'] = {
+                'org': course_key.org,
+                'course': course_key.course,
+                'run': course_key.run,
+            }
+
+            if not context.get('course_id'):
+                user_metadata['course_id'] = six.text_type(course_key)
+        elif isinstance(course_key, six.string_types):
+            user_metadata['course_id'] = course_key
+
+    context['user_metadata'] = user_metadata
     return context
 
 
@@ -408,74 +477,3 @@ def get_program_context(course, user_enrollments):
             }
     return program_key
 # TODO: clean up as part of REVEM-199 (START)
-
-
-def generate_processed_user_metadata(context, user, course, course_id):
-    user_metadata = {
-        key: context.get(key)
-        for key in (
-            'username',
-            'user_id',
-            'course_id',
-            'enrollment_mode',
-            'upgrade_link',
-            'upgrade_price',
-            'audit_access_deadline',
-            'course_duration',
-            'pacing_type',
-            'has_staff_access',
-            'forum_roles',
-            'partition_groups',
-            # TODO: clean up as part of REVO-28 (START)
-            'has_non_audit_enrollments',
-            # TODO: clean up as part of REVO-28 (END)
-            # TODO: clean up as part of REVEM-199 (START)
-            'program_key_fields',
-            # TODO: clean up as part of REVEM-199 (END)
-        )
-    }
-
-    if user:
-        user_metadata['username'] = user.username
-        user_metadata['user_id'] = user.id
-        if hasattr(user, 'email'):
-            user_metadata['email'] = user.email
-
-    for datekey in (
-            'schedule_start',
-            'enrollment_time',
-            'course_start',
-            'course_end',
-            'dynamic_upgrade_deadline',
-            'course_upgrade_deadline',
-            'audit_access_deadline',
-    ):
-        user_metadata[datekey] = (
-            context.get(datekey).isoformat() if context.get(datekey) else None
-        )
-
-    for timedeltakey in (
-        'course_duration',
-    ):
-        user_metadata[timedeltakey] = (
-            context.get(timedeltakey).total_seconds() if context.get(timedeltakey) else None
-        )
-
-    course_key = context.get('course_key')
-    if course and not course_key:
-        course_key = course.id
-
-    if course_key:
-        if isinstance(course_key, CourseKey):
-            user_metadata['course_key_fields'] = {
-                'org': course_key.org,
-                'course': course_key.course,
-                'run': course_key.run,
-            }
-
-            if not course_id:
-                user_metadata['course_id'] = six.text_type(course_key)
-        elif isinstance(course_key, six.string_types):
-            user_metadata['course_id'] = course_key
-
-    return user_metadata
diff --git a/lms/djangoapps/experiments/views.py b/lms/djangoapps/experiments/views.py
index 9a9385f4f2d6..dad8192fdeb1 100644
--- a/lms/djangoapps/experiments/views.py
+++ b/lms/djangoapps/experiments/views.py
@@ -17,7 +17,7 @@
 from experiments import filters, serializers
 from experiments.models import ExperimentData, ExperimentKeyValue
 from experiments.permissions import IsStaffOrOwner, IsStaffOrReadOnly
-from experiments.utils import get_experiment_user_metadata_context, generate_processed_user_metadata
+from experiments.utils import get_experiment_user_metadata_context
 from openedx.core.djangoapps.cors_csrf.authentication import SessionAuthenticationCrossDomainCsrf
 from student.models import get_user_by_username_or_email
 
@@ -98,6 +98,6 @@ def get(self, request, course_id=None, username=None):
         user = get_user_by_username_or_email(username)
         course_key = CourseKey.from_string(course_id)
         course = courses.get_course_by_id(course_key)
-        data = get_experiment_user_metadata_context(course, user)
-        processed_data = generate_processed_user_metadata(data, user, course, course_id)
-        return JsonResponse(processed_data)
+        context = get_experiment_user_metadata_context(course, user)
+        user_metadata = context.get('user_metadata')
+        return JsonResponse(user_metadata)
diff --git a/lms/templates/experiments/user_metadata.html b/lms/templates/experiments/user_metadata.html
index c3052e6f81fc..275893e57b71 100644
--- a/lms/templates/experiments/user_metadata.html
+++ b/lms/templates/experiments/user_metadata.html
@@ -1,13 +1,12 @@
 <%page expression_filter="h"/>
 <%!
-from experiments.utils import generate_processed_user_metadata
 from openedx.core.djangolib.js_utils import dump_js_escaped_json
 from eventtracking import tracker
 from opaque_keys.edx.keys import CourseKey
 import six
 %>
 <%
-user_metadata = generate_processed_user_metadata(context, user, course, course_id)
+user_metadata = context.get('user_metadata')
 %>
 <script type="application/json" id="user-metadata">
     ${user_metadata | n, dump_js_escaped_json}

From 5b05a9b028ce4be263e68e333e938aba8b1c2ab1 Mon Sep 17 00:00:00 2001
From: Diane Kaplan <dkaplan@edx.org>
Date: Wed, 28 Oct 2020 15:45:53 -0400
Subject: [PATCH 4/8] added basic tests for
 get_experiment_user_metadata_context and the view

---
 .../experiments/tests/test_utils.py           | 46 +++++++++++++++++--
 .../experiments/tests/test_views.py           | 18 +++++++-
 lms/djangoapps/experiments/utils.py           |  2 +-
 lms/djangoapps/experiments/views.py           |  6 ++-
 4 files changed, 65 insertions(+), 7 deletions(-)

diff --git a/lms/djangoapps/experiments/tests/test_utils.py b/lms/djangoapps/experiments/tests/test_utils.py
index 8e3881de68d6..f3479754231b 100644
--- a/lms/djangoapps/experiments/tests/test_utils.py
+++ b/lms/djangoapps/experiments/tests/test_utils.py
@@ -2,21 +2,26 @@
 Tests of experiment functionality
 """
 
-
+from datetime import timedelta
 from decimal import Decimal
+from django.utils.timezone import now
 from unittest import TestCase
 
 from opaque_keys.edx.keys import CourseKey
-
+from lms.djangoapps.course_blocks.transformers.tests.helpers import ModuleStoreTestCase
+from lms.djangoapps.courseware import courses
 from lms.djangoapps.experiments.utils import (
     get_course_entitlement_price_and_sku,
+    get_experiment_user_metadata_context,
     get_program_price_and_skus,
     get_unenrolled_courses,
     is_enrolled_in_course_run
 )
+from student.tests.factories import CourseEnrollmentFactory, UserFactory
+from xmodule.modulestore.tests.factories import CourseFactory
 
 
-class ExperimentUtilsTests(TestCase):
+class ExperimentUtilsTests(ModuleStoreTestCase, TestCase):
     """
     Tests of experiment functionality
     """
@@ -116,3 +121,38 @@ def test_price_and_sku_from_multiple_courses(self):
         self.assertEqual(2, len(skus))
         self.assertIn(self.run_a_sku, skus)
         self.assertIn(self.entitlement_a_sku, skus)
+
+    def test_get_experiment_user_metadata_context(self):
+        course = CourseFactory.create(start=now() - timedelta(days=30), pacing_type="instructor_paced", course_duration=None, upgrade_price='Free',
+                                      upgrade_link=None, enrollment_mode=None, audit_access_deadline=None, program_key_fields=None, schedule_start=None,
+                                      enrollment_time=None, dynamic_upgrade_deadline=None, course_upgrade_deadline=None, course_key_fields={'org': 'org.0', 'course': 'course_0', 'run': 'Run_0'})
+        user = UserFactory()
+        context = get_experiment_user_metadata_context(course, user)
+        CourseEnrollmentFactory(course_id=course.id, user=user)
+
+        user_metadata_expected_result = {'username': user.username,
+                                         'user_id': user.id,
+                                         'course_id': course.id,
+                                         'enrollment_mode': course.enrollment_mode,
+                                         'upgrade_link': course.upgrade_link,
+                                         'upgrade_price': course.upgrade_price,
+                                         'audit_access_deadline': course.audit_access_deadline,
+                                         'course_duration': course.course_duration,
+                                         'pacing_type': course.pacing_type,
+                                         'has_staff_access': False,
+                                         'forum_roles': [],
+                                         'partition_groups': {},
+                                         'has_non_audit_enrollments': False,
+                                         'program_key_fields': course.program_key_fields,
+                                         'email': user.email,
+                                         'schedule_start': course.schedule_start,
+                                         'enrollment_time': course.enrollment_time,
+                                         'course_start': course.start,
+                                         'course_end': course.end,
+                                         'dynamic_upgrade_deadline': course.dynamic_upgrade_deadline,
+                                         'course_upgrade_deadline': course.course_upgrade_deadline,
+                                         'course_key_fields': course.course_key_fields}
+
+        user_metadata = context.get('user_metadata')
+
+        self.assertTrue(user_metadata, user_metadata_expected_result)
diff --git a/lms/djangoapps/experiments/tests/test_views.py b/lms/djangoapps/experiments/tests/test_views.py
index 5ab08b046410..871aa0536886 100644
--- a/lms/djangoapps/experiments/tests/test_views.py
+++ b/lms/djangoapps/experiments/tests/test_views.py
@@ -8,10 +8,13 @@
 import six.moves.urllib.error
 import six.moves.urllib.parse
 import six.moves.urllib.request
+from datetime import timedelta
 from django.conf import settings
 from django.core.handlers.wsgi import WSGIRequest
+from django.utils.timezone import now
 from django.test.utils import override_settings
 from django.urls import reverse
+from lms.djangoapps.course_blocks.transformers.tests.helpers import ModuleStoreTestCase
 from mock import patch
 from rest_framework.test import APITestCase
 
@@ -20,10 +23,12 @@
 from lms.djangoapps.experiments.serializers import ExperimentDataSerializer
 from student.tests.factories import UserFactory
 
+from xmodule.modulestore.tests.factories import CourseFactory
+
 CROSS_DOMAIN_REFERER = 'https://ecommerce.edx.org'
 
 
-class ExperimentDataViewSetTests(APITestCase):
+class ExperimentDataViewSetTests(APITestCase, ModuleStoreTestCase):
 
     def assert_data_created_for_user(self, user, method='post', status=201):
         url = reverse('api_experiments:v0:data-list')
@@ -288,3 +293,14 @@ def test_permissions(self):
 
         response = self.client.delete(url)
         self.assertEqual(response.status_code, 403)
+
+
+class ExperimentUserMetaDataViewTests(APITestCase, ModuleStoreTestCase):
+
+    def test_UserMetaDataView_get(self):
+        """ Internal user_metadata view/API for use in Optimizely experiments """
+        user = UserFactory()
+        course = CourseFactory.create(start=now() - timedelta(days=30))
+        call_args = [user.username, course.id]
+        response = self.client.get(reverse('api_experiments:user_metadata', args=call_args))
+        self.assertEqual(response.status_code, 200)
diff --git a/lms/djangoapps/experiments/utils.py b/lms/djangoapps/experiments/utils.py
index 58fe1c133425..499ec0277279 100644
--- a/lms/djangoapps/experiments/utils.py
+++ b/lms/djangoapps/experiments/utils.py
@@ -264,7 +264,7 @@ def get_dashboard_course_info(user, dashboard_enrollments):
 
 def get_experiment_user_metadata_context(course, user):
     """
-    Return a context dictionary with the keys used by the user_metadata.html.
+    Return a context dictionary with the keys used for Optimizely experiments, exposed via user_metadata.html
     """
     enrollment = None
     # TODO: clean up as part of REVO-28 (START)
diff --git a/lms/djangoapps/experiments/views.py b/lms/djangoapps/experiments/views.py
index dad8192fdeb1..a55a60cb257c 100644
--- a/lms/djangoapps/experiments/views.py
+++ b/lms/djangoapps/experiments/views.py
@@ -2,6 +2,7 @@
 Experimentation views
 """
 
+
 from django.contrib.auth import get_user_model
 from django.db import transaction
 from django_filters.rest_framework import DjangoFilterBackend
@@ -92,12 +93,13 @@ class ExperimentKeyValueViewSet(viewsets.ModelViewSet):
 
 
 class UserMetaDataView(APIView):
+    authentication_classes = (JwtAuthentication, ExperimentCrossDomainSessionAuth,)
+    permission_classes = (IsStaffOrReadOnly,)
 
     def get(self, request, course_id=None, username=None):
         """ Return user-metadata for the given course and user """
         user = get_user_by_username_or_email(username)
-        course_key = CourseKey.from_string(course_id)
-        course = courses.get_course_by_id(course_key)
+        course = courses.get_course_by_id(CourseKey.from_string(course_id))
         context = get_experiment_user_metadata_context(course, user)
         user_metadata = context.get('user_metadata')
         return JsonResponse(user_metadata)

From ed8405baa82344c7730d957805b26a7e423a96b5 Mon Sep 17 00:00:00 2001
From: Diane Kaplan <dkaplan@edx.org>
Date: Thu, 29 Oct 2020 17:40:39 -0400
Subject: [PATCH 5/8] added handling/tests for requested course or user not
 being found

---
 lms/djangoapps/experiments/tests/test_views.py | 10 ++++++++++
 lms/djangoapps/experiments/views.py            | 15 +++++++++++++--
 2 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/lms/djangoapps/experiments/tests/test_views.py b/lms/djangoapps/experiments/tests/test_views.py
index 871aa0536886..47c9f1b1aad1 100644
--- a/lms/djangoapps/experiments/tests/test_views.py
+++ b/lms/djangoapps/experiments/tests/test_views.py
@@ -304,3 +304,13 @@ def test_UserMetaDataView_get(self):
         call_args = [user.username, course.id]
         response = self.client.get(reverse('api_experiments:user_metadata', args=call_args))
         self.assertEqual(response.status_code, 200)
+
+        call_args_with_bogus_user = ['bugsbunny', course.id]
+        response = self.client.get(reverse('api_experiments:user_metadata', args=call_args_with_bogus_user))
+        self.assertEqual(response.status_code, 404)
+        self.assertEqual(response.json()['message'], 'Provided user is not found')
+
+        call_args_with_bogus_course = [user.username, 'course-v1:edX+DemoX+Demo_BOGUS']
+        response = self.client.get(reverse('api_experiments:user_metadata', args=call_args_with_bogus_course))
+        self.assertEqual(response.status_code, 404)
+        self.assertEqual(response.json()['message'], 'Provided course is not found')
diff --git a/lms/djangoapps/experiments/views.py b/lms/djangoapps/experiments/views.py
index a55a60cb257c..38079844a7bf 100644
--- a/lms/djangoapps/experiments/views.py
+++ b/lms/djangoapps/experiments/views.py
@@ -6,6 +6,7 @@
 from django.contrib.auth import get_user_model
 from django.db import transaction
 from django_filters.rest_framework import DjangoFilterBackend
+from django.http import Http404
 from edx_rest_framework_extensions.auth.jwt.authentication import JwtAuthentication
 from edx_rest_framework_extensions.auth.session.authentication import SessionAuthenticationAllowInactiveUser
 from lms.djangoapps.courseware import courses
@@ -98,8 +99,18 @@ class UserMetaDataView(APIView):
 
     def get(self, request, course_id=None, username=None):
         """ Return user-metadata for the given course and user """
-        user = get_user_by_username_or_email(username)
-        course = courses.get_course_by_id(CourseKey.from_string(course_id))
+        try:
+            user = get_user_by_username_or_email(username)
+        except User.DoesNotExist:
+            message = "Provided user is not found"
+            return JsonResponse({'message': message}, status=404)
+
+        try:
+            course = courses.get_course_by_id(CourseKey.from_string(course_id))
+        except Http404:
+            message = "Provided course is not found"
+            return JsonResponse({'message': message}, status=404)
+
         context = get_experiment_user_metadata_context(course, user)
         user_metadata = context.get('user_metadata')
         return JsonResponse(user_metadata)

From 13721ba85390e20d534ad3e8d289c2b930f0ac9e Mon Sep 17 00:00:00 2001
From: Diane Kaplan <dkaplan@edx.org>
Date: Fri, 30 Oct 2020 06:18:30 -0400
Subject: [PATCH 6/8] Let dashboard call get_experiment_user_metadata_context
 with only a user

---
 common/djangoapps/student/views/dashboard.py |  9 ++-
 lms/djangoapps/experiments/utils.py          | 67 ++++++++++----------
 2 files changed, 43 insertions(+), 33 deletions(-)

diff --git a/common/djangoapps/student/views/dashboard.py b/common/djangoapps/student/views/dashboard.py
index 071cd3840d16..55e1e2497a11 100644
--- a/common/djangoapps/student/views/dashboard.py
+++ b/common/djangoapps/student/views/dashboard.py
@@ -29,7 +29,7 @@
 from entitlements.models import CourseEntitlement
 from lms.djangoapps.commerce.utils import EcommerceService
 from lms.djangoapps.courseware.access import has_access
-from lms.djangoapps.experiments.utils import get_dashboard_course_info
+from lms.djangoapps.experiments.utils import get_dashboard_course_info, get_experiment_user_metadata_context
 from lms.djangoapps.verify_student.services import IDVerificationService
 from openedx.core.djangoapps.catalog.utils import (
     get_programs,
@@ -805,6 +805,13 @@ def student_dashboard(request):
     )
     context.update(context_from_plugins)
 
+    course = None
+    context.update(
+        get_experiment_user_metadata_context(
+            course,
+            user,
+        )
+    )
     if ecommerce_service.is_enabled(request.user):
         context.update({
             'use_ecommerce_payment_flow': True,
diff --git a/lms/djangoapps/experiments/utils.py b/lms/djangoapps/experiments/utils.py
index 499ec0277279..b973d41449de 100644
--- a/lms/djangoapps/experiments/utils.py
+++ b/lms/djangoapps/experiments/utils.py
@@ -265,45 +265,48 @@ def get_dashboard_course_info(user, dashboard_enrollments):
 def get_experiment_user_metadata_context(course, user):
     """
     Return a context dictionary with the keys used for Optimizely experiments, exposed via user_metadata.html
+    Most views call this function with both parameters, but student dashboard has only a user
     """
     enrollment = None
     # TODO: clean up as part of REVO-28 (START)
     user_enrollments = None
     audit_enrollments = None
     has_non_audit_enrollments = False
-    try:
-        user_enrollments = CourseEnrollment.objects.select_related('course', 'schedule').filter(user_id=user.id)
-        has_non_audit_enrollments = user_enrollments.exclude(mode__in=CourseMode.UPSELL_TO_VERIFIED_MODES).exists()
+    context = {}
+    if course is not None:
+        try:
+            user_enrollments = CourseEnrollment.objects.select_related('course', 'schedule').filter(user_id=user.id)
+            has_non_audit_enrollments = user_enrollments.exclude(mode__in=CourseMode.UPSELL_TO_VERIFIED_MODES).exists()
+            # TODO: clean up as part of REVO-28 (END)
+            enrollment = CourseEnrollment.objects.select_related(
+                'course', 'schedule'
+            ).get(user_id=user.id, course_id=course.id)
+        except CourseEnrollment.DoesNotExist:
+            pass  # Not enrolled, use the default values
+
+        has_entitlements = False
+        if user.is_authenticated:
+            has_entitlements = CourseEntitlement.objects.filter(user=user).exists()
+
+        context = get_base_experiment_metadata_context(course, user, enrollment, user_enrollments)
+        has_staff_access = has_staff_access_to_preview_mode(user, course.id)
+        forum_roles = []
+        if user.is_authenticated:
+            forum_roles = list(Role.objects.filter(users=user, course_id=course.id).values_list('name').distinct())
+
+        # get user partition data
+        if user.is_authenticated:
+            partition_groups = get_all_partitions_for_course(course)
+            user_partitions = get_user_partition_groups(course.id, partition_groups, user, 'name')
+        else:
+            user_partitions = {}
+
+        # TODO: clean up as part of REVO-28 (START)
+        context['has_non_audit_enrollments'] = has_non_audit_enrollments or has_entitlements
         # TODO: clean up as part of REVO-28 (END)
-        enrollment = CourseEnrollment.objects.select_related(
-            'course', 'schedule'
-        ).get(user_id=user.id, course_id=course.id)
-    except CourseEnrollment.DoesNotExist:
-        pass  # Not enrolled, use the default values
-
-    has_entitlements = False
-    if user.is_authenticated:
-        has_entitlements = CourseEntitlement.objects.filter(user=user).exists()
-
-    context = get_base_experiment_metadata_context(course, user, enrollment, user_enrollments)
-    has_staff_access = has_staff_access_to_preview_mode(user, course.id)
-    forum_roles = []
-    if user.is_authenticated:
-        forum_roles = list(Role.objects.filter(users=user, course_id=course.id).values_list('name').distinct())
-
-    # get user partition data
-    if user.is_authenticated:
-        partition_groups = get_all_partitions_for_course(course)
-        user_partitions = get_user_partition_groups(course.id, partition_groups, user, 'name')
-    else:
-        user_partitions = {}
-
-    # TODO: clean up as part of REVO-28 (START)
-    context['has_non_audit_enrollments'] = has_non_audit_enrollments or has_entitlements
-    # TODO: clean up as part of REVO-28 (END)
-    context['has_staff_access'] = has_staff_access
-    context['forum_roles'] = forum_roles
-    context['partition_groups'] = user_partitions
+        context['has_staff_access'] = has_staff_access
+        context['forum_roles'] = forum_roles
+        context['partition_groups'] = user_partitions
 
     user_metadata = {
         key: context.get(key)

From 0bbb3a98d1ed571af320af71043ec4739f07c760 Mon Sep 17 00:00:00 2001
From: Diane Kaplan <dkaplan@edx.org>
Date: Fri, 30 Oct 2020 14:45:21 -0400
Subject: [PATCH 7/8] made new permission for user-level results, updated view
 to use it, updated tests accordingly

---
 lms/djangoapps/experiments/permissions.py     | 10 ++++
 .../experiments/tests/test_views.py           | 46 +++++++++++++++----
 lms/djangoapps/experiments/views.py           |  4 +-
 3 files changed, 48 insertions(+), 12 deletions(-)

diff --git a/lms/djangoapps/experiments/permissions.py b/lms/djangoapps/experiments/permissions.py
index 165a0d470646..8c256725d3c2 100644
--- a/lms/djangoapps/experiments/permissions.py
+++ b/lms/djangoapps/experiments/permissions.py
@@ -29,3 +29,13 @@ def has_permission(self, request, view):
 class IsStaffOrReadOnly(BasePermission):
     def has_permission(self, request, view):
         return request.user.is_staff or request.method in SAFE_METHODS
+
+
+class IsStaffOrReadOnlyForSelf(BasePermission):
+    """
+    Grants access to staff or to user reading info about their own user
+    """
+    def has_permission(self, request, view):
+        username = request.user.username
+        return request.user.is_staff or (request.method in SAFE_METHODS and (
+            username == request.parser_context['kwargs']['username']))
diff --git a/lms/djangoapps/experiments/tests/test_views.py b/lms/djangoapps/experiments/tests/test_views.py
index 47c9f1b1aad1..876b55f37094 100644
--- a/lms/djangoapps/experiments/tests/test_views.py
+++ b/lms/djangoapps/experiments/tests/test_views.py
@@ -296,21 +296,47 @@ def test_permissions(self):
 
 
 class ExperimentUserMetaDataViewTests(APITestCase, ModuleStoreTestCase):
+    """ Internal user_metadata view/API for use in Optimizely experiments """
+
+    def test_UserMetaDataView_get_success_same_user(self):
+        """ Request succeeds when logged-in user makes request for self """
+        lookup_user = UserFactory()
+        lookup_course = CourseFactory.create(start=now() - timedelta(days=30))
+        call_args = [lookup_user.username, lookup_course.id]
+        self.client.login(username=lookup_user.username, password=UserFactory._DEFAULT_PASSWORD)
 
-    def test_UserMetaDataView_get(self):
-        """ Internal user_metadata view/API for use in Optimizely experiments """
-        user = UserFactory()
-        course = CourseFactory.create(start=now() - timedelta(days=30))
-        call_args = [user.username, course.id]
         response = self.client.get(reverse('api_experiments:user_metadata', args=call_args))
         self.assertEqual(response.status_code, 200)
 
-        call_args_with_bogus_user = ['bugsbunny', course.id]
-        response = self.client.get(reverse('api_experiments:user_metadata', args=call_args_with_bogus_user))
-        self.assertEqual(response.status_code, 404)
-        self.assertEqual(response.json()['message'], 'Provided user is not found')
+    def test_UserMetaDataView_get_success_staff_user(self):
+        """ Request succeeds when logged-in staff user makes request for different user """
+        lookup_user = UserFactory()
+        lookup_course = CourseFactory.create(start=now() - timedelta(days=30))
+        call_args = [lookup_user.username, lookup_course.id]
+        staff_user = UserFactory(is_staff=True)
+
+        self.client.login(username=staff_user.username, password=UserFactory._DEFAULT_PASSWORD)
+
+        response = self.client.get(reverse('api_experiments:user_metadata', args=call_args))
+        self.assertEqual(response.status_code, 200)
+
+    def test_UserMetaDataView_get_different_user(self):
+        """ Request fails when not logged in for requested user or staff  """
+        lookup_user = UserFactory()
+        lookup_course = CourseFactory.create(start=now() - timedelta(days=30))
+        call_args = [lookup_user.username, lookup_course.id]
+
+        response = self.client.get(reverse('api_experiments:user_metadata', args=call_args))
+        self.assertEqual(response.status_code, 401)
+
+    def test_UserMetaDataView_get_missing_course(self):
+        """ Request fails when not course not found  """
+        lookup_user = UserFactory()
+        lookup_course = CourseFactory.create(start=now() - timedelta(days=30))
+        call_args = [lookup_user.username, lookup_course.id]
+        self.client.login(username=lookup_user.username, password=UserFactory._DEFAULT_PASSWORD)
 
-        call_args_with_bogus_course = [user.username, 'course-v1:edX+DemoX+Demo_BOGUS']
+        call_args_with_bogus_course = [lookup_user.username, 'course-v1:edX+DemoX+Demo_BOGUS']
         response = self.client.get(reverse('api_experiments:user_metadata', args=call_args_with_bogus_course))
         self.assertEqual(response.status_code, 404)
         self.assertEqual(response.json()['message'], 'Provided course is not found')
diff --git a/lms/djangoapps/experiments/views.py b/lms/djangoapps/experiments/views.py
index 38079844a7bf..25e7edc9642d 100644
--- a/lms/djangoapps/experiments/views.py
+++ b/lms/djangoapps/experiments/views.py
@@ -18,7 +18,7 @@
 
 from experiments import filters, serializers
 from experiments.models import ExperimentData, ExperimentKeyValue
-from experiments.permissions import IsStaffOrOwner, IsStaffOrReadOnly
+from experiments.permissions import IsStaffOrOwner, IsStaffOrReadOnly, IsStaffOrReadOnlyForSelf
 from experiments.utils import get_experiment_user_metadata_context
 from openedx.core.djangoapps.cors_csrf.authentication import SessionAuthenticationCrossDomainCsrf
 from student.models import get_user_by_username_or_email
@@ -95,7 +95,7 @@ class ExperimentKeyValueViewSet(viewsets.ModelViewSet):
 
 class UserMetaDataView(APIView):
     authentication_classes = (JwtAuthentication, ExperimentCrossDomainSessionAuth,)
-    permission_classes = (IsStaffOrReadOnly,)
+    permission_classes = (IsStaffOrReadOnlyForSelf,)
 
     def get(self, request, course_id=None, username=None):
         """ Return user-metadata for the given course and user """

From 0e0c2238ce263cd9fe62a212f8d44372bfc1dd3e Mon Sep 17 00:00:00 2001
From: Diane Kaplan <dkaplan@edx.org>
Date: Mon, 2 Nov 2020 12:50:33 -0500
Subject: [PATCH 8/8] Updates for 11/2 feedback

---
 lms/djangoapps/experiments/tests/test_views.py | 7 ++++++-
 lms/djangoapps/experiments/utils.py            | 3 ++-
 lms/djangoapps/experiments/views.py            | 1 +
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/lms/djangoapps/experiments/tests/test_views.py b/lms/djangoapps/experiments/tests/test_views.py
index 876b55f37094..e5945dd5aa11 100644
--- a/lms/djangoapps/experiments/tests/test_views.py
+++ b/lms/djangoapps/experiments/tests/test_views.py
@@ -319,6 +319,10 @@ def test_UserMetaDataView_get_success_staff_user(self):
 
         response = self.client.get(reverse('api_experiments:user_metadata', args=call_args))
         self.assertEqual(response.status_code, 200)
+        self.assertTrue(response.json()['course_id'])
+        self.assertTrue(response.json()['user_id'])
+        self.assertEqual(response.json()['username'], lookup_user.username)
+        self.assertEqual(response.json()['email'], lookup_user.email)
 
     def test_UserMetaDataView_get_different_user(self):
         """ Request fails when not logged in for requested user or staff  """
@@ -335,8 +339,9 @@ def test_UserMetaDataView_get_missing_course(self):
         lookup_course = CourseFactory.create(start=now() - timedelta(days=30))
         call_args = [lookup_user.username, lookup_course.id]
         self.client.login(username=lookup_user.username, password=UserFactory._DEFAULT_PASSWORD)
+        bogus_course_name = str(lookup_course.id) + '_FOOBAR'
 
-        call_args_with_bogus_course = [lookup_user.username, 'course-v1:edX+DemoX+Demo_BOGUS']
+        call_args_with_bogus_course = [lookup_user.username, bogus_course_name]
         response = self.client.get(reverse('api_experiments:user_metadata', args=call_args_with_bogus_course))
         self.assertEqual(response.status_code, 404)
         self.assertEqual(response.json()['message'], 'Provided course is not found')
diff --git a/lms/djangoapps/experiments/utils.py b/lms/djangoapps/experiments/utils.py
index b973d41449de..b38f49cfdd84 100644
--- a/lms/djangoapps/experiments/utils.py
+++ b/lms/djangoapps/experiments/utils.py
@@ -264,7 +264,8 @@ def get_dashboard_course_info(user, dashboard_enrollments):
 
 def get_experiment_user_metadata_context(course, user):
     """
-    Return a context dictionary with the keys used for Optimizely experiments, exposed via user_metadata.html
+    Return a context dictionary with the keys used for Optimizely experiments, exposed via user_metadata.html:
+    view from the DOM in those calling views using: JSON.parse($("#user-metadata").text());
     Most views call this function with both parameters, but student dashboard has only a user
     """
     enrollment = None
diff --git a/lms/djangoapps/experiments/views.py b/lms/djangoapps/experiments/views.py
index 25e7edc9642d..52ab50250e95 100644
--- a/lms/djangoapps/experiments/views.py
+++ b/lms/djangoapps/experiments/views.py
@@ -102,6 +102,7 @@ def get(self, request, course_id=None, username=None):
         try:
             user = get_user_by_username_or_email(username)
         except User.DoesNotExist:
+            # Note: this will only be seen by staff, for administrative de-bugging purposes
             message = "Provided user is not found"
             return JsonResponse({'message': message}, status=404)