[BB-2853] Add OAuth2-enabled endpoints for problem response report generation

[xitij2000]

Currently, the endpoints related to generation of problem response reports, only support session-based authentication, and cannot be easily used by MFE or other API clients.

A previous PR for this was reverted since it causes some issues. While we were not able to reproduce these issues, in the interest of disturbing as little of the existing code as possible, this PR retains the existing endpoints, but adds alternative endpoints that expose the same views but through a DRF setup that supports OAuth2-based authentication.

Discussions:

• https://github.com/edx/edx-platform/pull/19635
• https://github.com/edx/edx-platform/pull/24873
• This PR is following the pattern detailed in this ADR PR:https://github.com/edx/edx-platform/pull/27129

Sandbox URL: TBD - sandbox is being provisioned.

Merge deadline: "None"

Testing instructions:

1. paer test_system -t lms/djangoapps/instructor/tests/test_api.py
2. Ensure that the existing instructor dashboard report generation works by generating a problem response report, and seeing that it runs properly and creates a new report.
3. Create an OAuth2 token. You can either create a new OAuth2 client, and use the OAuth2 api to generate a token. Or just add one manually here; /admin/oauth2_provider/accesstoken/add/
   Make sure to use a user that has permissions to generate a report, such as a staff user/
4. Use postman/httpie/curl etc to call the generate_problem_responses endpoint for a course with a corresponding problem_location. This will return a task id.
5. Call the list_instructor_task endpoint for the same course. Usually, it is hard to observe the task actually in progress in the devstack, without too much data. The endpoint should work with OAuth though, which is the main thing to test.
6. Call the list_report_downloads endpoint. It should include the newly-generated report.

Reviewers

• @arjunsinghy96
• edX reviewer[s] TBD

Settings

EDXAPP_FEATURES:
  ENABLE_COMBINED_LOGIN_REGISTRATION: true

[openedx-webhooks]

Thanks for the pull request, @xitij2000! I've created OSPR-5734 to keep track of it in JIRA, where we prioritize reviews. Please note that it may take us up to several weeks or months to complete a review and merge your PR.

Feel free to add as much of the following information to the ticket:

• supporting documentation
• Open edX discussion forum threads
• timeline information ("this must be merged by XX date", and why that is)
• partner information ("this is a course on edx.org")
• any other information that can help Product understand the context for the PR

All technical communication about the code itself will be done via the GitHub pull request interface. As a reminder, our process documentation is here.

Please let us know once your PR is ready for our review and all tests are green.

[xitij2000]

Originally, these were POST endpoints, however they are GET endpoints under the new API since they simply list items, and potentially a future API could add support for other operations.

[xitij2000]

This remains a POST operation since it's not idempotent.

[xitij2000]

I've reused the existing tests here, and just pointed them to run against the new API as well.

[xitij2000]

The base path is now set here instead of in the plugin config.

[xitij2000]

I'm just directly using the existing view method since it already does what we want with the exception of the auth methods supported.

[bradenmacdonald]

It's a bit weird to use comma-separated strings in a JSON body, when we could even more easily use a proper list. But if that's what the existing API does, we better leave it that way.

[xitij2000]

If we're coming to this method from the DRF view above, this data will be available in request.data, while for the Django view it will be in request.POST.

[bradenmacdonald]

^ This helpful comment should be added into the code itself, please.

[xitij2000]

I've split the parsing of this part out separately so that the new API can use a better format.

[xitij2000]

The original API uses POST, while the new endpoint is GET, so I've created a very small wrapper to just add the post requirement and CSRF requirement.

[xitij2000]

They are v0 URLs only because they are just porting existing code. They've been around a long time and have stayed stable to might be good candidates for v1.

However, when the UI that uses these is ported to an MFE, these APIs can be reevaluated, and a decision can be made about whether these are good enough, or if we need new v1 APIs the are better driven by MFEs.

[bradenmacdonald]

^ This comment may be worth including inline in the code itself too?

[xitij2000]

Actually, while writing that comment I convinced myself to just call these v1. With v0 the implication is that the API is still in development and may change in backwards-incompatible ways without bumping up the version number. That doesn't seem to be the case here. These APIs have been in use for a while without major changes.

[natabene]

@xitij2000 Thank you for your contribution. Please let me know once it is ready for our review.

[xitij2000]

@natabene Sure, will do.

[bradenmacdonald]

@xitij2000 Good idea to make these new endpoints. And thanks for adding these nice comments explaining your changes.

[arjunsinghy96]

LGTM 👍

• I tested this: Old endpoints work, task_id is returned on new endpoint and a new report is generated and list api returns the list of all tasks
• I read through the code
• I checked for accessibility issues
• Includes documentation

@xitij2000 Thanks for the helpful comments.

[xitij2000]

@natabene This is good to review now.

CC: @bradenmacdonald Is this a candidate for core committer review? If so I can mark you as reviewer and you could take it up next sprint?

[bradenmacdonald]

@natabene @xitij2000 I would be happy to review this, but I'll give @ormsbee the option first, since he reviewed the earlier version of it and also had to revert it. @ormsbee do you want to review?

[natabene]

@bradenmacdonald Sounds like this is yours to review.

[bradenmacdonald]

@xitij2000 Nice work, thanks 👍🏻

Please squash and fix the minor docs issues I just noticed:

[xitij2000]

@bradenmacdonald Done!

[edx-status-bot]

Your PR has finished running tests. There were no failures.

[openedx-webhooks]

@xitij2000 🎉 Your pull request was merged!

Please take a moment to answer a two question survey so we can improve your experience in the future.

[edx-pipeline-bot]

EdX Release Notice: This PR has been deployed to the staging environment in preparation for a release to production.

[edx-pipeline-bot]

EdX Release Notice: This PR has been deployed to the production environment.

[xitij2000]

Thanks!

[alfredchavez]

@xitij2000 could you port this changes to lilac.master? as part of BB-4877
CC: @arbrandes for review