feat: added country disabling feature (#35451)

* feat: added country disabling feature

cms/envs/common.py

@@ -2936,3 +2936,10 @@ def _should_send_learning_badge_events(settings):
 # See https://www.meilisearch.com/docs/learn/security/tenant_tokens
 MEILISEARCH_INDEX_PREFIX = ""
 MEILISEARCH_API_KEY = "devkey"
+
+# .. setting_name: DISABLED_COUNTRIES
+# .. setting_default: []
+# .. setting_description: List of country codes that should be disabled
+# .. for now it wil impact country listing in auth flow and user profile.
+# .. eg ['US', 'CA']
+DISABLED_COUNTRIES = []

cms/envs/production.py

@@ -689,3 +689,10 @@ def get_env_setting(setting):
 }
 
 BEAMER_PRODUCT_ID = ENV_TOKENS.get('BEAMER_PRODUCT_ID', BEAMER_PRODUCT_ID)
+
+# .. setting_name: DISABLED_COUNTRIES
+# .. setting_default: []
+# .. setting_description: List of country codes that should be disabled
+# .. for now it wil impact country listing in auth flow and user profile.
+# .. eg ['US', 'CA']
+DISABLED_COUNTRIES = ENV_TOKENS.get('DISABLED_COUNTRIES', [])

lms/envs/common.py

@@ -5544,3 +5544,11 @@ def _should_send_learning_badge_events(settings):
 # .. setting_default: empty dictionary
 # .. setting_description: Dictionary with additional information that you want to share in the report.
 SURVEY_REPORT_EXTRA_DATA = {}
+
+
+# .. setting_name: DISABLED_COUNTRIES
+# .. setting_default: []
+# .. setting_description: List of country codes that should be disabled
+# .. for now it wil impact country listing in auth flow and user profile.
+# .. eg ['US', 'CA']
+DISABLED_COUNTRIES = []

lms/envs/production.py

@@ -1124,3 +1124,10 @@ def get_env_setting(setting):
 EVENT_BUS_PRODUCER_CONFIG = merge_producer_configs(EVENT_BUS_PRODUCER_CONFIG,
  ENV_TOKENS.get('EVENT_BUS_PRODUCER_CONFIG', {}))
 BEAMER_PRODUCT_ID = ENV_TOKENS.get('BEAMER_PRODUCT_ID', BEAMER_PRODUCT_ID)
+
+# .. setting_name: DISABLED_COUNTRIES
+# .. setting_default: []
+# .. setting_description: List of country codes that should be disabled
+# .. for now it wil impact country listing in auth flow and user profile.
+# .. eg ['US', 'CA']
+DISABLED_COUNTRIES = ENV_TOKENS.get('DISABLED_COUNTRIES', [])

openedx/core/djangoapps/user_api/accounts/api.py

@@ -3,7 +3,6 @@
 Programmatic integration point for User API Accounts sub-application
 """
 
-
 import datetime
 import re
 
@@ -152,6 +151,12 @@ def update_account_settings(requesting_user, update, username=None):
 
  _validate_email_change(user, update, field_errors)
  _validate_secondary_email(user, update, field_errors)
+ if update.get('country', '') in settings.DISABLED_COUNTRIES:
+ field_errors['country'] = {
+ 'developer_message': 'Country is disabled for registration',
+ 'user_message': 'This country cannot be selected for user registration'
+ }
+
  old_name = _validate_name_change(user_profile, update, field_errors)
  old_language_proficiencies = _get_old_language_proficiencies_if_updating(user_profile, update)
 

openedx/core/djangoapps/user_api/accounts/tests/test_api.py

@@ -3,7 +3,6 @@
 Most of the functionality is covered in test_views.py.
 """
 
-
 import datetime
 import itertools
 import unicodedata
@@ -16,6 +15,7 @@
 from django.http import HttpResponse
 from django.test import TestCase
 from django.test.client import RequestFactory
+from django.test.utils import override_settings
 from django.urls import reverse
 from pytz import UTC
 from social_django.models import UserSocialAuth
@@ -82,7 +82,8 @@ def create_account(self, username, password, email):
 
 @skip_unless_lms
 @ddt.ddt
-@patch('common.djangoapps.student.views.management.render_to_response', Mock(side_effect=mock_render_to_response, autospec=True)) # lint-amnesty, pylint: disable=line-too-long
+@patch('common.djangoapps.student.views.management.render_to_response',
+ Mock(side_effect=mock_render_to_response, autospec=True)) # lint-amnesty, pylint: disable=line-too-long
 class TestAccountApi(UserSettingsEventTestMixin, EmailTemplateTagMixin, CreateAccountMixin, RetirementTestCase):
  """
  These tests specifically cover the parts of the API methods that are not covered by test_views.py.
@@ -205,7 +206,7 @@ def test_add_social_links(self):
 
  account_settings = get_account_settings(self.default_request)[0]
  assert account_settings['social_links'] == \
- sorted((original_social_links + extra_social_links), key=(lambda s: s['platform']))
+  sorted((original_social_links + extra_social_links), key=(lambda s: s['platform']))
 
  def test_replace_social_links(self):
  original_facebook_link = dict(platform="facebook", social_link="https://www.facebook.com/myself")
@@ -306,7 +307,7 @@ def test_update_validation_error_for_enterprise(
  with pytest.raises(AccountValidationError) as validation_error:
  update_account_settings(self.user, update_data)
  field_errors = validation_error.value.field_errors
- assert 'This field is not editable via this API' ==\
+ assert 'This field is not editable via this API' == \
  field_errors[field_name_value[0]]['developer_message']
  else:
  update_account_settings(self.user, update_data)
@@ -424,8 +425,8 @@ def test_name_update_does_not_require_idv(self, has_passable_cert, enrolled_in_v
  """
  Test that the user can change their name if change does not require IDV.
  """
- with patch('openedx.core.djangoapps.user_api.accounts.api.get_certificates_for_user') as mock_get_certs,\
-  patch('openedx.core.djangoapps.user_api.accounts.api.get_verified_enrollments') as \
+ with patch('openedx.core.djangoapps.user_api.accounts.api.get_certificates_for_user') as mock_get_certs, \
+ patch('openedx.core.djangoapps.user_api.accounts.api.get_verified_enrollments') as \
  mock_get_verified_enrollments:
  mock_get_certs.return_value = (
  [{'status': CertificateStatuses.downloadable}] if
@@ -439,7 +440,8 @@ def test_name_update_does_not_require_idv(self, has_passable_cert, enrolled_in_v
  assert account_settings['name'] == 'New Name'
 
  @patch('django.core.mail.EmailMultiAlternatives.send')
- @patch('common.djangoapps.student.views.management.render_to_string', Mock(side_effect=mock_render_to_string, autospec=True)) # lint-amnesty, pylint: disable=line-too-long
+ @patch('common.djangoapps.student.views.management.render_to_string',
+ Mock(side_effect=mock_render_to_string, autospec=True))
  def test_update_sending_email_fails(self, send_mail):
  """Test what happens if all validation checks pass, but sending the email for email change fails."""
  send_mail.side_effect = [Exception, None]
@@ -514,6 +516,7 @@ def test_language_proficiency_eventing(self):
  """
  Test that eventing of language proficiencies, which happens update_account_settings method, behaves correctly.
  """
+
  def verify_event_emitted(new_value, old_value):
  """
  Confirm that the user setting event was properly emitted
@@ -571,6 +574,20 @@ def test_change_country_removes_state(self):
  assert account_settings['country'] is None
  assert account_settings['state'] is None
 
+ @override_settings(DISABLED_COUNTRIES=['KP'])
+ def test_change_to_disabled_country(self):
+ """
+ Test that changing the country to a disabled country is not allowed
+ """
+ # First set the country and state
+ update_account_settings(self.user, {"country": UserProfile.COUNTRY_WITH_STATES, "state": "MA"})
+ account_settings = get_account_settings(self.default_request)[0]
+ assert account_settings['country'] == UserProfile.COUNTRY_WITH_STATES
+ assert account_settings['state'] == 'MA'
+
+ with self.assertRaises(AccountValidationError):
+ update_account_settings(self.user, {"country": "KP"})
+
  def test_get_name_validation_error_too_long(self):
  """
  Test validation error when the name is too long.

openedx/core/djangoapps/user_authn/config/waffle.py

@@ -2,7 +2,6 @@
 Waffle flags and switches for user authn.
 """
 
-
 from edx_toggles.toggles import WaffleSwitch
 
 _WAFFLE_NAMESPACE = 'user_authn'

openedx/core/djangoapps/user_authn/views/registration_form.py

@@ -23,6 +23,7 @@
 from openedx.core.djangoapps.user_api import accounts
 from openedx.core.djangoapps.user_api.helpers import FormDescription
 from openedx.core.djangoapps.user_authn.utils import check_pwned_password, is_registration_api_v1 as is_api_v1
+from openedx.core.djangoapps.user_authn.views.utils import remove_disabled_country_from_list
 from openedx.core.djangolib.markup import HTML, Text
 from openedx.features.enterprise_support.api import enterprise_customer_for_request
 from common.djangoapps.student.models import (
@@ -297,6 +298,15 @@ def cleaned_extended_profile(self):
  if key in self.extended_profile_fields and value is not None
  }
 
+ def clean_country(self):
+ """
+ Check if the user's country is in the embargoed countries list.
+ """
+ country = self.cleaned_data.get("country")
+ if country in settings.DISABLED_COUNTRIES:
+ raise ValidationError(_("Registration from this country is not allowed due to restrictions."))
+ return self.cleaned_data.get("country")
+
 
 def get_registration_extension_form(*args, **kwargs):
  """
@@ -686,7 +696,7 @@ def _add_marketing_emails_opt_in_field(self, form_desc, required=False):
  """
  opt_in_label = _(
  'I agree that {platform_name} may send me marketing messages.').format(
-  platform_name=configuration_helpers.get_value('PLATFORM_NAME', settings.PLATFORM_NAME),
+ platform_name=configuration_helpers.get_value('PLATFORM_NAME', settings.PLATFORM_NAME),
  )
 
  form_desc.add_field(
@@ -974,7 +984,7 @@ def _add_country_field(self, form_desc, required=True):
  label=country_label,
  instructions=country_instructions,
  field_type="select",
- options=list(countries),
+ options=list(remove_disabled_country_from_list(dict(countries)).items()),
  include_default_option=True,
  required=required,
  error_messages={

openedx/core/djangoapps/user_authn/views/tests/test_register.py

@@ -65,6 +65,7 @@
  password_validators_instruction_texts,
  password_validators_restrictions
 )
+
 ENABLE_AUTO_GENERATED_USERNAME = settings.FEATURES.copy()
 ENABLE_AUTO_GENERATED_USERNAME['ENABLE_AUTO_GENERATED_USERNAME'] = True
 
@@ -1556,7 +1557,7 @@ def test_activation_email(self):
  assert len(mail.outbox) == 1
  sent_email = mail.outbox[0]
  assert sent_email.to == [self.EMAIL]
- assert sent_email.subject ==\
+ assert sent_email.subject == \
  f'Action Required: Activate your {settings.PLATFORM_NAME} account'
  assert f'high-quality {settings.PLATFORM_NAME} courses' in sent_email.body
 
@@ -2468,6 +2469,31 @@ def test_register_error_with_pwned_password(self, emit):
  })
  assert response.status_code == 400
 
+ @override_settings(DISABLED_COUNTRIES=['KP'])
+ def test_register_with_disabled_country(self):
+ """
+ Test case to check user registration is forbidden when registration is disabled for a country
+ """
+ response = self.client.post(self.url, {
+ "email": self.EMAIL,
+ "name": self.NAME,
+ "username": self.USERNAME,
+ "password": self.PASSWORD,
+ "honor_code": "true",
+ "country": "KP",
+ })
+ assert response.status_code == 400
+ response_json = json.loads(response.content.decode('utf-8'))
+ self.assertDictEqual(
+ response_json,
+ {'country':
+ [
+ {
+ 'user_message': 'Registration from this country is not allowed due to restrictions.'
+ }
+ ], 'error_code': 'validation-error'}
+ )
+
 
 @httpretty.activate
 @ddt.ddt
@@ -2575,6 +2601,24 @@ def test_success(self):
 
  self._verify_user_existence(user_exists=True, social_link_exists=True, user_is_active=False)
 
+ @override_settings(DISABLED_COUNTRIES=['US'])
+ def test_with_disabled_country(self):
+ """
+ Test case to check user registration is forbidden when registration is disabled for a country
+ """
+ self._verify_user_existence(user_exists=False, social_link_exists=False)
+ self._setup_provider_response(success=True)
+ response = self.client.post(self.url, self.data())
+ assert response.status_code == 400
+ assert response.json() == {
+ 'country': [
+ {
+ 'user_message': 'Registration from this country is not allowed due to restrictions.'
+ }
+ ], 'error_code': 'validation-error'
+ }
+ self._verify_user_existence(user_exists=False, social_link_exists=False, user_is_active=False)
+
  def test_unlinked_active_user(self):
  user = UserFactory()
  response = self.client.post(self.url, self.data(user))

openedx/core/djangoapps/user_authn/views/utils.py

@@ -3,6 +3,8 @@
 """
 import logging
 import re
+from typing import Dict
+
 from django.conf import settings
 from django.contrib import messages
 from django.utils.translation import gettext as _
@@ -177,3 +179,18 @@ def get_auto_generated_username(data):
  # We generate the username regardless of whether the name is empty or invalid. We do this
  # because the name validations occur later, ensuring that users cannot create an account without a valid name.
  return f"{username_prefix}_{username_suffix}" if username_prefix else username_suffix
+
+
+def remove_disabled_country_from_list(countries: Dict) -> Dict:
+ """
+ Remove disabled countries from the list of countries.
+
+ Args:
+ - countries (dict): List of countries.
+
+ Returns:
+ - dict: Dict of countries with disabled countries removed.
+ """
+ for country_code in settings.DISABLED_COUNTRIES:
+ del countries[country_code]
+ return countries