Rework program filtering when an org_id is specified (#2696)

Author: jkachel

courses/views/v2/__init__.py

@@ -8,6 +8,7 @@
 from drf_spectacular.utils import extend_schema
 from rest_framework import viewsets
 from rest_framework.pagination import PageNumberPagination
+from rest_framework.permissions import IsAuthenticatedOrReadOnly
 
 from courses.models import (
     Course,
@@ -53,12 +54,33 @@ class Meta:
         model = Program
         fields = ["id", "live", "readable_id", "page__live", "org_id"]
 
-    def __init__(self, *args, request_user=None, **kwargs):
-        self.user = request_user
+    def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
 
+    @property
+    def qs(self):
+        """If the request isn't explicitly filtering on org_id, exclude contracted courses."""
+
+        if "org_id" not in getattr(self.request, "GET", {}):
+            program_requirements_with_contract_runs = ProgramRequirement.objects.filter(
+                node_type=ProgramRequirementNodeType.COURSE,
+                course__courseruns__b2b_contract__isnull=False,
+                program_id=OuterRef("pk"),
+            )
+            return (
+                super()
+                .qs.annotate(
+                    has_contracted_courses=Exists(
+                        program_requirements_with_contract_runs
+                    )
+                )
+                .filter(has_contracted_courses=False)
+            )
+
+        return super().qs
+
     def filter_by_org_id(self, queryset, _, org_id):
-        if user_has_org_access(self.user, org_id):
+        if self.request and user_has_org_access(self.request.user, org_id):
             program_requirements_with_contract_runs = ProgramRequirement.objects.filter(
                 node_type=ProgramRequirementNodeType.COURSE,
                 course__courseruns__b2b_contract__organization_id=org_id,
@@ -82,29 +104,27 @@ def filter_by_org_id(self, queryset, _, org_id):
 class ProgramViewSet(viewsets.ReadOnlyModelViewSet):
     """API viewset for Programs"""
 
-    permission_classes = []
+    permission_classes = [IsAuthenticatedOrReadOnly]
     serializer_class = ProgramSerializer
     pagination_class = Pagination
     filter_backends = [DjangoFilterBackend]
     filterset_class = ProgramFilterSet
 
     def get_queryset(self):
+        """Get the queryset"""
         return Program.objects.order_by("title").prefetch_related("departments")
 
-    def get_filterset_kwargs(self):
-        kwargs = super().get_filterset_kwargs()
-        kwargs["request_user"] = self.request.user
-        return kwargs
-
     @extend_schema(
         operation_id="programs_retrieve_v2",
         description="API view set for Programs - v2",
     )
     def retrieve(self, request, *args, **kwargs):
+        """Retrieve a specific program."""
         return super().retrieve(request, *args, **kwargs)
 
     @extend_schema(operation_id="programs_list_v2", description="List Programs - v2")
     def list(self, request, *args, **kwargs):
+        """List the available programs."""
         return super().list(request, *args, **kwargs)
 
 

openapi/specs/v0.yaml

@@ -970,6 +970,8 @@ paths:
           type: string
       tags:
       - programs
+      security:
+      - {}
       responses:
         '200':
           content:
@@ -990,6 +992,8 @@ paths:
         required: true
       tags:
       - programs
+      security:
+      - {}
       responses:
         '200':
           content:

openapi/specs/v1.yaml

@@ -970,6 +970,8 @@ paths:
           type: string
       tags:
       - programs
+      security:
+      - {}
       responses:
         '200':
           content:
@@ -990,6 +992,8 @@ paths:
         required: true
       tags:
       - programs
+      security:
+      - {}
       responses:
         '200':
           content:

openapi/specs/v2.yaml

@@ -970,6 +970,8 @@ paths:
           type: string
       tags:
       - programs
+      security:
+      - {}
       responses:
         '200':
           content:
@@ -990,6 +992,8 @@ paths:
         required: true
       tags:
       - programs
+      security:
+      - {}
       responses:
         '200':
           content: