Merge branch 'master' into maq/openedx#33589

.github/CODEOWNERS

@@ -17,6 +17,7 @@ lms/djangoapps/instructor_task/
 lms/djangoapps/mobile_api/
 openedx/core/djangoapps/credentials                                 @openedx/2U-aperture
 openedx/core/djangoapps/credit                                      @openedx/2U-aperture
+openedx/core/djangoapps/enrollments/                                @openedx/2U-aperture
 openedx/core/djangoapps/heartbeat/
 openedx/core/djangoapps/oauth_dispatch
 openedx/core/djangoapps/user_api/                                   @openedx/2U-aperture
@@ -37,8 +38,9 @@ lms/djangoapps/certificates/                                        @openedx/2U-
 # Discovery
 common/djangoapps/course_modes/
 common/djangoapps/enrollment/
+lms/djangoapps/branding/                                             @openedx/2U-aperture
 lms/djangoapps/commerce/
-lms/djangoapps/experiments/
+lms/djangoapps/experiments/                                          @openedx/2U-aperture
 lms/djangoapps/learner_dashboard/                                    @openedx/2U-aperture
 lms/djangoapps/learner_home/                                         @openedx/2U-aperture
 openedx/features/content_type_gating/

.github/workflows/ci-static-analysis.yml

@@ -10,7 +10,7 @@ jobs:
       matrix:
         python-version:
           - "3.11"
-        os: ["ubuntu-20.04"]
+        os: ["ubuntu-latest"]
 
     steps:
       - uses: actions/checkout@v4

.github/workflows/compile-python-requirements.yml

@@ -15,7 +15,7 @@ defaults:
 
 jobs:
   recompile-python-dependencies:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
 
     steps:
       - name: Check out target branch

.github/workflows/js-tests.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-20.04]
+        os: [ubuntu-latest]
         node-version: [18, 20]
         python-version:
           - "3.11"

.github/workflows/lint-imports.yml

@@ -9,7 +9,7 @@ on:
 jobs:
   lint-imports:
     name: Lint Python Imports
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
 
     steps:
       - name: Check out branch

.github/workflows/migrations-check.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-20.04]
+        os: [ubuntu-latest]
         python-version:
           - "3.11"
         # 'pinned' is used to install the latest patch version of Django
@@ -52,7 +52,7 @@ jobs:
     steps:
       - name: Setup mongodb user
         run: |
-          mongosh edxapp --eval '
+          docker exec ${{ job.services.mongo.id }} mongosh edxapp --eval '
             db.createUser(
               {
                 user: "edxapp",
@@ -67,7 +67,7 @@ jobs:
       - name: Verify mongo and mysql db credentials
         run: |
           mysql -h 127.0.0.1 -uedxapp001 -ppassword -e "select 1;" edxapp
-          mongosh --host 127.0.0.1 --username edxapp --password password --eval 'use edxapp; db.adminCommand("ping");' edxapp
+          docker exec ${{ job.services.mongo.id }} mongosh --host 127.0.0.1 --username edxapp --password password --eval 'use edxapp; db.adminCommand("ping");' edxapp
 
       - name: Checkout repo
         uses: actions/checkout@v4

.github/workflows/publish-ci-docker-image.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   push:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
 
     steps:
       - name: Checkout

.github/workflows/pylint-checks.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   run-pylint:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:

.github/workflows/quality-checks.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-20.04]
+        os: [ubuntu-latest]
         python-version:
           - "3.11"
         node-version: [20]

.github/workflows/semgrep.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: "${{ matrix.os }}"
     strategy:
       matrix:
-        os: ["ubuntu-20.04"]
+        os: ["ubuntu-latest"]
         python-version:
           - "3.11"
 

.github/workflows/static-assets-check.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-20.04]
+        os: [ubuntu-latest]
         python-version:
           - "3.11"
         node-version: [18, 20]
@@ -72,9 +72,6 @@ jobs:
         run: |
           pip install -r requirements/edx/assets.txt
 
-      - name: Initiate Mongo DB Service
-        run: sudo systemctl start mongod
-
       - name: Add node_modules bin to $Path
         run: echo $GITHUB_WORKSPACE/node_modules/.bin >> $GITHUB_PATH
 

.github/workflows/unit-tests.yml

@@ -15,7 +15,7 @@ concurrency:
 jobs:
   run-tests:
     name: ${{ matrix.shard_name }}(py=${{ matrix.python-version }},dj=${{ matrix.django-version }},mongo=${{ matrix.mongo-version }})
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     strategy:
       matrix:
         python-version:
@@ -66,7 +66,29 @@ jobs:
 
       - name: install system requirements
         run: |
-          sudo apt-get update && sudo apt-get install libmysqlclient-dev libxmlsec1-dev lynx
+          sudo apt-get update && sudo apt-get install libmysqlclient-dev libxmlsec1-dev lynx openssl
+
+      # This is needed until the ENABLE_BLAKE2B_HASHING can be removed and we
+      # can stop using MD4 by default.
+      - name: enable md4 hashing in libssl
+        run: |
+          cat <<EOF | sudo tee /etc/ssl/openssl.cnf
+          # Use this in order to automatically load providers.
+          openssl_conf = openssl_init
+
+          [openssl_init]
+          providers = provider_sect
+
+          [provider_sect]
+          default = default_sect
+          legacy = legacy_sect
+
+          [default_sect]
+          activate = 1
+
+          [legacy_sect]
+          activate = 1
+          EOF
 
       - name: install mongo version
         run: |
@@ -142,7 +164,7 @@ jobs:
           overwrite: true
 
   collect-and-verify:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - name: Setup Python
@@ -207,7 +229,7 @@ jobs:
   # https://github.com/orgs/community/discussions/33579
   success:
     name: Unit tests successful
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     if: always()
     needs: [run-tests]
     steps:
@@ -218,7 +240,7 @@ jobs:
           jobs: ${{ toJSON(needs) }}
 
   compile-warnings-report:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     needs: [run-tests]
     steps:
       - uses: actions/checkout@v4
@@ -246,7 +268,7 @@ jobs:
           overwrite: true
 
   merge-artifacts:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     needs: [compile-warnings-report]
     steps:
       - name: Merge Pytest Warnings JSON Artifacts
@@ -266,7 +288,7 @@ jobs:
   # Combine and upload coverage reports.
   coverage:
     if: (github.repository == 'edx/edx-platform-private') || (github.repository == 'openedx/edx-platform' && (startsWith(github.base_ref, 'open-release') == false))
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     needs: [run-tests]
     strategy:
       matrix:

.github/workflows/upgrade-one-python-dependency.yml

@@ -28,7 +28,7 @@ defaults:
 
 jobs:
   upgrade-one-python-dependency:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
 
     steps:
       - name: Check out target branch

.github/workflows/verify-dunder-init.yml

@@ -8,7 +8,7 @@ on:
 jobs:
   verify_dunder_init:
     name: Verify __init__.py Files
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
 
     steps:
       - name: Check out branch

README.rst

@@ -124,18 +124,47 @@ sites)::
   ./manage.py lms collectstatic
   ./manage.py cms collectstatic
 
+Set up CMS SSO (for Development)::
+
+  ./manage.py lms manage_user studio_worker example@example.com --unusable-password
+  # DO NOT DO THIS IN PRODUCTION. It will make your auth insecure.
+  ./manage.py lms create_dot_application studio-sso-id studio_worker \
+      --grant-type authorization-code \
+      --skip-authorization \
+      --redirect-uris 'http://localhost:18010/complete/edx-oauth2/' \
+      --scopes user_id  \
+      --client-id 'studio-sso-id' \
+      --client-secret 'studio-sso-secret'
+
+Set up CMS SSO (for Production):
+
+* Create the CMS user and the OAuth application::
+
+    ./manage.py lms manage_user studio_worker <email@yourcompany.com> --unusable-password
+    ./manage.py lms create_dot_application studio-sso-id studio_worker \
+        --grant-type authorization-code \
+        --skip-authorization \
+        --redirect-uris 'http://localhost:18010/complete/edx-oauth2/' \
+        --scopes user_id
+
+* Log into Django admin (eg. http://localhost:18000/admin/oauth2_provider/application/),
+  click into the application you created above (``studio-sso-id``), and copy its "Client secret".
+* In your private LMS_CFG yaml file or your private Django settings module:
+
+ * Set ``SOCIAL_AUTH_EDX_OAUTH2_KEY`` to the client ID (``studio-sso-id``).
+ * Set ``SOCIAL_AUTH_EDX_OAUTH2_SECRET`` to the client secret (which you copied).
 Run the Platform
 ----------------
 
 First, ensure MySQL, Mongo, and Memcached are running.
 
 Start the LMS::
 
-  ./manage.py lms runserver
+  ./manage.py lms runserver 18000
 
 Start the CMS::
 
-  ./manage.py cms runserver
+  ./manage.py cms runserver 18010
 
 This will give you a mostly-headless Open edX platform. Most frontends have
 been migrated to "Micro-Frontends (MFEs)" which need to be installed and run

cms/djangoapps/contentstore/rest_api/v1/serializers/home.py

@@ -51,6 +51,7 @@ class CourseHomeSerializer(serializers.Serializer):
         allow_empty=True
     )
     archived_courses = CourseCommonSerializer(required=False, many=True)
+    can_access_advanced_settings = serializers.BooleanField()
     can_create_organizations = serializers.BooleanField()
     course_creator_status = serializers.CharField()
     courses = CourseCommonSerializer(required=False, many=True)

cms/djangoapps/contentstore/rest_api/v1/views/home.py

@@ -52,6 +52,7 @@ def get(self, request: Request):
             "allow_unicode_course_id": false,
             "allowed_organizations": [],
             "archived_courses": [],
+            "can_access_advanced_settings": true,
             "can_create_organizations": true,
             "course_creator_status": "granted",
             "courses": [],

cms/djangoapps/contentstore/rest_api/v1/views/tests/test_course_index.py

@@ -1,6 +1,7 @@
 """
 Unit tests for course index outline.
 """
+from django.conf import settings
 from django.test import RequestFactory
 from django.urls import reverse
 from rest_framework import status
@@ -62,7 +63,7 @@ def test_course_index_response(self):
                 "advance_settings_url": f"/settings/advanced/{self.course.id}"
             },
             "discussions_incontext_feedback_url": "",
-            "discussions_incontext_learnmore_url": "",
+            "discussions_incontext_learnmore_url": settings.DISCUSSIONS_INCONTEXT_LEARNMORE_URL,
             "is_custom_relative_dates_active": True,
             "initial_state": None,
             "initial_user_clipboard": {
@@ -103,7 +104,7 @@ def test_course_index_response_with_show_locators(self):
                 "advance_settings_url": f"/settings/advanced/{self.course.id}"
             },
             "discussions_incontext_feedback_url": "",
-            "discussions_incontext_learnmore_url": "",
+            "discussions_incontext_learnmore_url": settings.DISCUSSIONS_INCONTEXT_LEARNMORE_URL,
             "is_custom_relative_dates_active": False,
             "initial_state": {
                 "expanded_locators": [

cms/djangoapps/contentstore/rest_api/v1/views/tests/test_home.py

@@ -44,6 +44,7 @@ def test_home_page_courses_response(self):
             "allow_unicode_course_id": False,
             "allowed_organizations": [],
             "archived_courses": [],
+            "can_access_advanced_settings": True,
             "can_create_organizations": True,
             "course_creator_status": "granted",
             "courses": [],

cms/djangoapps/contentstore/rest_api/v1/views/tests/test_proctoring.py

@@ -277,18 +277,14 @@ def test_update_exam_settings_invalid_value(self):
 
         # response is correct
         assert response.status_code == status.HTTP_400_BAD_REQUEST
-        self.assertDictEqual(
-            response.data,
+        self.assertIn(
             {
-                "detail": [
-                    {
-                        "proctoring_provider": (
-                            "The selected proctoring provider, notvalidprovider, is not a valid provider. "
-                            "Please select from one of ['test_proctoring_provider']."
-                        )
-                    }
-                ]
+                "proctoring_provider": (
+                    "The selected proctoring provider, notvalidprovider, is not a valid provider. "
+                    "Please select from one of ['test_proctoring_provider']."
+                )
             },
+            response.data['detail'],
         )
 
         # course settings have been updated
@@ -408,18 +404,14 @@ def test_400_for_disabled_lti(self):
 
         # response is correct
         assert response.status_code == status.HTTP_400_BAD_REQUEST
-        self.assertDictEqual(
-            response.data,
+        self.assertIn(
             {
-                "detail": [
-                    {
-                        "proctoring_provider": (
-                            "The selected proctoring provider, lti_external, is not a valid provider. "
-                            "Please select from one of ['null']."
-                        )
-                    }
-                ]
+                "proctoring_provider": (
+                    "The selected proctoring provider, lti_external, is not a valid provider. "
+                    "Please select from one of ['null']."
+                )
             },
+            response.data['detail'],
         )
 
         # course settings have been updated