Skip to content

feat: apply ADR 0034 (auth standardization) across 6 standardized APIs - #38796

Merged
Faraz32123 merged 6 commits into
openedx:feat/axim-api_improvementsfrom
edly-io:feat/apply_auth_adr_on_apis
Jun 23, 2026
Merged

feat: apply ADR 0034 (auth standardization) across 6 standardized APIs#38796
Faraz32123 merged 6 commits into
openedx:feat/axim-api_improvementsfrom
edly-io:feat/apply_auth_adr_on_apis

Conversation

@taimoor-ahmed-1

@taimoor-ahmed-1 taimoor-ahmed-1 commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

Summary

Applies ADR 0034 — Unify Auth (OAuth2 DOT v2) to the 6 APIs previously standardized under the FC-0118 effort.

ADR 0034 (per OEP-0042) deprecates `BearerAuthentication` / `BearerAuthenticationAllowInactiveUser` and their `OAuth2Authentication*` aliases. Target pattern is `(JwtAuthentication, SessionAuthenticationAllowInactiveUser)` (or the platform default `JwtAuthentication + SessionAuthentication`).

Commit Area Related PR Type Bearer/OAuth2 found?
1 Xblock v1 #38723 `docs` audit no — already compliant
2 CourseHome v3 #38694 `docs` audit no — already compliant
3 CourseHome v4 #38684 `docs` audit no — already compliant
4 Enrollment v2 #38724 `feat` — Bearer removed yes (4 viewsets)
5 Course Detail v3 #38708 `docs` audit no — already compliant
6 AuthorGrading v3 #38726 `feat` — Bearer removed yes (1 viewset)

Changes

`feat` — Enrollment v2 (commit 4)

`BearerAuthenticationAllowInactiveUser` removed from 4 viewsets/views:

View Before After
`EnrollmentViewSet` `(Jwt, Bearer, EnrollmentCrossDomainSessionAuth)` `(Jwt, EnrollmentCrossDomainSessionAuth)`
`EnrollmentRetrieveView` same same
`UserRolesView` same same
`EnrollmentsAdminListView` same same

`EnrollmentCrossDomainSessionAuth` is retained (rather than the platform-default `SessionAuthentication`) because these endpoints must accept cross-domain Studio/LMS CSRF-validated session cookies. Each viewset carries an inline comment explaining the deviation.

`feat` — AuthorGrading v3 (commit 6)

`BearerAuthenticationAllowInactiveUser` removed from `AuthoringGradingViewSet`:

Before After
`(Jwt, Bearer, SessionAuthenticationAllowInactiveUser)` `(Jwt, SessionAuthenticationAllowInactiveUser)`

`SessionAuthenticationAllowInactiveUser` is retained so Studio authors whose accounts are temporarily inactive can still update grading.

`docs` — 4 already-compliant areas (commits 1, 2, 3, 5)

Each already uses the ADR 0034 target pattern `(JwtAuthentication, SessionAuthenticationAllowInactiveUser)` (or with `EnrollmentCrossDomainSessionAuth` in enrollment-adjacent code). The docs commits add an `ADR 0034` line to the module docstring confirming compliance and recording why the explicit declaration is kept rather than relying on platform defaults.

Behaviour

  • JWT callers — no change.
  • Cookie / session callers — no change.
  • Bearer-token callers — affected. Per OEP-0042 and the DEPR ticket these clients must migrate to JWT. Token expiry differs (Bearer ~2 weeks → JWT ~1 hour), so long-running jobs that reuse a token without checking expiry will need adjustment.

Test plan

  • Existing test suites still pass for all 6 endpoints (no auth-class regressions)
  • `pytest cms/djangoapps/contentstore/rest_api/v3/views/tests/test_authoring_grading.py -v` — verify the grading viewset still authenticates JWT + session requests correctly
  • `pytest openedx/core/djangoapps/enrollments/v2/tests/ -v` — verify the enrollment viewsets still authenticate JWT + cross-domain session requests correctly
  • Smoke-check each affected endpoint with a fresh JWT — confirm 200 response
  • Smoke-check each affected endpoint with an old Bearer token — confirm 401 (expected per ADR; clients must migrate)

🤖 Generated with Claude Code

Taimoor Ahmed added 6 commits June 23, 2026 12:03
Taimoor Ahmed Taimoor Ahmed
docs(adr-0034): audit Xblock v1 against auth standardization (already…
daafbaa 
… compliant)

ADR 0034 — Unify Auth (OAuth2 DOT v2) — requires removing
BearerAuthentication / BearerAuthenticationAllowInactiveUser /
OAuth2Authentication / OAuth2AuthenticationAllowInactiveUser from
authentication_classes per OEP-0042.

XblockViewSet.authentication_classes is already:
    (JwtAuthentication, SessionAuthenticationAllowInactiveUser)

— matches the ADR 0034 target pattern. The explicit declaration is
preserved (rather than relying on platform defaults) because the endpoint
needs SessionAuthenticationAllowInactiveUser rather than the default
SessionAuthentication. Documented in the module docstring.

No code changes required.
Taimoor Ahmed Taimoor Ahmed
docs(adr-0034): audit CourseHome v3 against auth standardization (alr…
cd5498c 
…eady compliant)

HomeViewSet.authentication_classes is already
``(JwtAuthentication, SessionAuthenticationAllowInactiveUser)`` —
matches the ADR 0034 target. No Bearer or OAuth2 authentication classes
to remove. Explicit declaration kept (rather than relying on platform
defaults) so SessionAuthenticationAllowInactiveUser is used instead of
the default SessionAuthentication. Documented in the module docstring.
Taimoor Ahmed Taimoor Ahmed
docs(adr-0034): audit CourseHome v4 against auth standardization (alr…
9969811 
…eady compliant)

HomeCoursesViewSet.authentication_classes is already
``(JwtAuthentication, SessionAuthenticationAllowInactiveUser)`` —
matches the ADR 0034 target. No Bearer or OAuth2 authentication classes
to remove. Documented in the class's ADR-compliance docstring.
Taimoor Ahmed Taimoor Ahmed
feat(adr-0034): remove BearerAuthentication from Enrollment v2 viewsets
1a94972 
ADR 0034 (Unify Auth — OEP-0042 alignment) deprecates
BearerAuthenticationAllowInactiveUser. All four enrollment v2 views had
the pattern (JwtAuthentication, BearerAuthenticationAllowInactiveUser,
EnrollmentCrossDomainSessionAuth); per the ADR's "Standard API" target,
the Bearer entry is removed and the rest of the tuple kept unchanged.

Updated:
  * EnrollmentViewSet              (list / create / unenroll / allowed)
  * EnrollmentRetrieveView         (GET /enrollment/{course_key})
  * UserRolesView                  (GET /roles/)
  * EnrollmentsAdminListView       (GET /enrollments/, admin)

EnrollmentCrossDomainSessionAuth is retained (not replaced by the
platform-default SessionAuthentication) because these endpoints must
accept cross-domain Studio/LMS CSRF-validated session cookies. Each
viewset carries an inline comment explaining the deviation.

Dropped the now-unused BearerAuthenticationAllowInactiveUser import.
Module docstring updated to reflect ADR 0034 compliance.

No new dependencies. No behaviour changes for legitimate JWT or session
callers; Bearer-token callers (deprecated per OEP-0042) must migrate
to JWT.
Taimoor Ahmed Taimoor Ahmed
docs(adr-0034): audit Course Detail v3 against auth standardization (…
d72e5b1 
…already compliant)

CourseDetailsViewSet.authentication_classes is already
``(JwtAuthentication, SessionAuthenticationAllowInactiveUser)`` —
matches the ADR 0034 target. No Bearer or OAuth2 authentication classes
to remove. Documented in the module docstring.
Taimoor Ahmed Taimoor Ahmed
feat(adr-0034): remove BearerAuthentication from AuthorGrading v3 vie…
ba938e3 
…wset

ADR 0034 (Unify Auth — OEP-0042 alignment) deprecates
BearerAuthenticationAllowInactiveUser. AuthoringGradingViewSet had the
pattern (JwtAuthentication, BearerAuthenticationAllowInactiveUser,
SessionAuthenticationAllowInactiveUser); per the ADR's "Standard API"
target the Bearer entry is removed and the rest of the tuple kept
unchanged.

SessionAuthenticationAllowInactiveUser is retained (rather than relying
on the platform-default SessionAuthentication) so Studio authors whose
accounts are temporarily inactive can still update grading; an inline
comment records the deviation.

Dropped the now-unused BearerAuthenticationAllowInactiveUser import.
Module docstring updated to reflect ADR 0034 compliance.

No new dependencies. No behaviour changes for JWT or session callers;
Bearer-token callers (deprecated per OEP-0042) must migrate to JWT.
@taimoor-ahmed-1
taimoor-ahmed-1 requested a review from a team as a code owner June 23, 2026 07:12
@openedx-webhooks

openedx-webhooks commented Jun 23, 2026

Copy link
Copy Markdown

Thanks for the pull request, @taimoor-ahmed-1!

This repository is currently maintained by @openedx/wg-maintenance-openedx-platform.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

  • If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
    • This process (including the steps you'll need to take) is documented here.
  • If it doesn't, simply proceed with the next step.
🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

  • Dependencies

    This PR must be merged before / after / at the same time as ...

  • Blockers

    This PR is waiting for OEP-1234 to be accepted.

  • Timeline information

    This PR must be merged by XX date because ...

  • Partner information

    This is for a course on edx.org.

  • Supporting documentation
  • Relevant Open edX discussion forum threads
🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

Details
Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

  • The size and impact of the changes that it introduces
  • The need for product review
  • Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

@openedx-webhooks openedx-webhooks added the open-source-contribution PR author is not from Axim or 2U label Jun 23, 2026
@github-project-automation github-project-automation Bot moved this to Needs Triage in Contributions Jun 23, 2026
@taimoor-ahmed-1 taimoor-ahmed-1 self-assigned this Jun 23, 2026
@Faraz32123
Faraz32123 merged commit 3bc64c8 into openedx:feat/axim-api_improvements Jun 23, 2026
42 checks passed
@github-project-automation github-project-automation Bot moved this to Needs Triage in Contributions Jun 23, 2026
@github-project-automation github-project-automation Bot moved this from Needs Triage to Done in Contributions Jun 23, 2026
@taimoor-ahmed-1 taimoor-ahmed-1 mentioned this pull request Jun 23, 2026
Closed
3 tasks
Faraz32123 pushed a commit that referenced this pull request Jun 24, 2026
@taimoor-ahmed-1 @Faraz32123
feat: apply ADR 0034 (auth standardization) across 6 standardized APIs (
080544c 
#38796)
@Abdul-Muqadim-Arbisoft Abdul-Muqadim-Arbisoft mentioned this pull request Jul 4, 2026
Closed
feanil pushed a commit that referenced this pull request Jul 29, 2026
@taimoor-ahmed-1 @feanil
feat: apply ADR 0034 (auth standardization) across 6 standardized APIs (
28f2c22 
#38796)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Faraz32123 Faraz32123 Faraz32123 approved these changes

Assignees

@taimoor-ahmed-1 taimoor-ahmed-1

Labels

open-source-contribution PR author is not from Axim or 2U

Projects

Contributions
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@taimoor-ahmed-1 @openedx-webhooks @Faraz32123