SOL-1222

Update permissions in edx-proctoring so that course staff members can view list of attempts and allowances

edx_proctoring/api.py

@@ -198,11 +198,13 @@ def add_allowance_for_user(exam_id, user_info, key, value):
     ProctoredExamStudentAllowance.add_allowance_for_user(exam_id, user_info, key, value)
 
 
-def get_allowances_for_course(course_id):
+def get_allowances_for_course(course_id, timed_exams_only):
     """
     Get all the allowances for the course.
     """
-    student_allowances = ProctoredExamStudentAllowance.get_allowances_for_course(course_id)
+    student_allowances = ProctoredExamStudentAllowance.get_allowances_for_course(
+        course_id, timed_exams_only=timed_exams_only
+    )
     return [ProctoredExamStudentAllowanceSerializer(allowance).data for allowance in student_allowances]
 
 
@@ -765,7 +767,7 @@ def remove_exam_attempt(attempt_id):
         )
 
 
-def get_all_exams_for_course(course_id):
+def get_all_exams_for_course(course_id, timed_exams_only):
     """
     This method will return all exams for a course. This will return a list
     of dictionaries, whose schema is the same as what is returned in
@@ -789,7 +791,7 @@ def get_all_exams_for_course(course_id):
     ..
     ]
     """
-    exams = ProctoredExam.get_all_exams_for_course(course_id)
+    exams = ProctoredExam.get_all_exams_for_course(course_id, timed_exams_only=timed_exams_only)
 
     return [ProctoredExamSerializer(proctored_exam).data for proctored_exam in exams]
 

edx_proctoring/models.py

@@ -72,14 +72,18 @@ class ProctoredExam(TimeStampedModel):
         return proctored_exam
 
     @classmethod
-    def get_all_exams_for_course(cls, course_id, active_only=False):
+    def get_all_exams_for_course(cls, course_id, active_only=False, timed_exams_only=False):
         """
         Returns all exams for a give course
         """
-        result = cls.objects.filter(course_id=course_id)
+        filtered_query = Q(course_id=course_id)
+
         if active_only:
-            result = result.filter(is_active=True)
-        return result
+            filtered_query = filtered_query & Q(is_active=True)
+        if timed_exams_only:
+            filtered_query = filtered_query & Q(is_proctored=False)
+
+        return cls.objects.filter(filtered_query)
 
 
 class ProctoredExamStudentAttemptStatus(object):
@@ -237,20 +241,26 @@ class ProctoredExamStudentAttemptManager(models.Manager):
             exam_attempt_obj = None
         return exam_attempt_obj
 
-    def get_all_exam_attempts(self, course_id):
+    def get_all_exam_attempts(self, course_id, timed_exams_only=False):
         """
         Returns the Student Exam Attempts for the given course_id.
         """
+        filtered_query = Q(proctored_exam__course_id=course_id)
 
-        return self.filter(proctored_exam__course_id=course_id).order_by('-created')
+        if timed_exams_only:
+            filtered_query = filtered_query & Q(proctored_exam__is_proctored=False)
 
-    def get_filtered_exam_attempts(self, course_id, search_by):
+        return self.filter(filtered_query).order_by('-created')
+
+    def get_filtered_exam_attempts(self, course_id, search_by, timed_exams_only=False):
         """
         Returns the Student Exam Attempts for the given course_id filtered by search_by.
         """
         filtered_query = Q(proctored_exam__course_id=course_id) & (
             Q(user__username__contains=search_by) | Q(user__email__contains=search_by)
         )
+        if timed_exams_only:
+            filtered_query = filtered_query & Q(proctored_exam__is_proctored=False)
 
         return self.filter(filtered_query).order_by('-created')
 
@@ -465,11 +475,15 @@ class ProctoredExamStudentAllowance(TimeStampedModel):
         verbose_name = 'proctored allowance'
 
     @classmethod
-    def get_allowances_for_course(cls, course_id):
+    def get_allowances_for_course(cls, course_id, timed_exams_only=False):
         """
         Returns all the allowances for a course.
         """
-        return cls.objects.filter(proctored_exam__course_id=course_id)
+        filtered_query = Q(proctored_exam__course_id=course_id)
+        if timed_exams_only:
+            filtered_query = filtered_query & Q(proctored_exam__is_proctored=False)
+
+        return cls.objects.filter(filtered_query)
 
     @classmethod
     def get_allowance_for_user(cls, exam_id, user_id, key):

edx_proctoring/tests/test_api.py

@@ -115,7 +115,7 @@ class ProctoredExamApiTests(LoggedInTestCase):
         self.proctored_exam_email_body = 'the status of your proctoring session review'
 
         set_runtime_service('credit', MockCreditService())
-        set_runtime_service('instructor', MockInstructorService())
+        set_runtime_service('instructor', MockInstructorService(is_user_course_staff=True))
 
     def _create_proctored_exam(self):
         """
@@ -303,9 +303,27 @@ class ProctoredExamApiTests(LoggedInTestCase):
         self.assertEqual(proctored_exam['content_id'], self.content_id)
         self.assertEqual(proctored_exam['exam_name'], self.exam_name)
 
-        exams = get_all_exams_for_course(self.course_id)
+        exams = get_all_exams_for_course(self.course_id, False)
         self.assertEqual(len(exams), 4)
 
+    def test_get_timed_exam(self):
+        """
+        test to get the exam by the exam_id and
+        then compare their values.
+        """
+        timed_exam = get_exam_by_id(self.timed_exam)
+        self.assertEqual(timed_exam['course_id'], self.course_id)
+        self.assertEqual(timed_exam['content_id'], self.content_id_timed)
+        self.assertEqual(timed_exam['exam_name'], self.exam_name)
+
+        timed_exam = get_exam_by_content_id(self.course_id, self.content_id_timed)
+        self.assertEqual(timed_exam['course_id'], self.course_id)
+        self.assertEqual(timed_exam['content_id'], self.content_id_timed)
+        self.assertEqual(timed_exam['exam_name'], self.exam_name)
+
+        exams = get_all_exams_for_course(self.course_id, True)
+        self.assertEqual(len(exams), 1)
+
     def test_get_invalid_proctored_exam(self):
         """
         test to get the exam by the invalid exam_id which will
@@ -354,7 +372,7 @@ class ProctoredExamApiTests(LoggedInTestCase):
         Test to get all the allowances for a course.
         """
         allowance = self._add_allowance_for_user()
-        course_allowances = get_allowances_for_course(self.course_id)
+        course_allowances = get_allowances_for_course(self.course_id, False)
         self.assertEqual(len(course_allowances), 1)
         self.assertEqual(course_allowances[0]['proctored_exam']['course_id'], allowance.proctored_exam.course_id)
 

edx_proctoring/tests/test_services.py

@@ -86,12 +86,24 @@ class MockInstructorService(object):
     """
     Simple mock of the Instructor Service
     """
+    def __init__(self, is_user_course_staff=True):
+        """
+        Initializer
+        """
+        self.is_user_course_staff = is_user_course_staff
+
     def delete_student_attempt(self, student_identifier, course_id, content_id):  # pylint: disable=unused-argument
         """
         Mock implementation
         """
         return True
 
+    def is_course_staff(self, user, course_id):
+        """
+        Mocked implementation of is_course_staff
+        """
+        return self.is_user_course_staff
+
 
 class TestProctoringService(unittest.TestCase):
     """

edx_proctoring/tests/test_views.py

@@ -20,7 +20,7 @@ from edx_proctoring.models import (
     ProctoredExamStudentAllowance,
     ProctoredExamStudentAttemptStatus,
 )
-from edx_proctoring.views import require_staff
+from edx_proctoring.views import require_staff, require_course_or_global_staff
 from edx_proctoring.api import (
     create_exam,
     create_exam_attempt,
@@ -35,7 +35,7 @@ from .utils import (
 from edx_proctoring.urls import urlpatterns
 from edx_proctoring.backends.tests.test_review_payload import TEST_REVIEW_PAYLOAD
 from edx_proctoring.backends.tests.test_software_secure import mock_response_content
-from edx_proctoring.tests.test_services import MockCreditService
+from edx_proctoring.tests.test_services import MockCreditService, MockInstructorService
 from edx_proctoring.runtime import set_runtime_service, get_runtime_service
 
 
@@ -204,11 +204,23 @@ class ProctoredExamViewTests(LoggedInTestCase):
         self.assertEqual(response.status_code, 403)
         self.assertFalse(func.called)
 
+    def test_decorator_require_course_or_global_staff(self):  # pylint: disable=invalid-name
+        """
+        Test assert require_course_or_global_staff before hitting any api url.
+        """
+        func = Mock()
+        decorated_func = require_course_or_global_staff(func)
+        request = self.mock_request()
+        response = decorated_func(request)
+        self.assertEqual(response.status_code, 403)
+        self.assertFalse(func.called)
+
     def mock_request(self):
         """
         mock request
         """
         request = Mock()
+        request.DATA = {}
         self.user.is_staff = False
         self.user.save()
         request.user = self.user
@@ -393,6 +405,8 @@ class TestStudentProctoredExamAttempt(LoggedInTestCase):
         self.student_taking_exam = User()
         self.student_taking_exam.save()
 
+        set_runtime_service('instructor', MockInstructorService(is_user_course_staff=True))
+
     def test_start_exam_create(self):
         """
         Start an exam (create an exam attempt)
@@ -707,12 +721,57 @@ class TestStudentProctoredExamAttempt(LoggedInTestCase):
         attempt_id = response_data['exam_attempt_id']
         self.assertGreater(attempt_id, 0)
 
+        self.user.is_staff = False
+        self.user.save()
         response = self.client.delete(
             reverse('edx_proctoring.proctored_exam.attempt', args=[attempt_id])
         )
 
         self.assertEqual(response.status_code, 200)
 
+    def test_remove_attempt_non_staff(self):
+        """
+        Confirms that an attempt cannot be removed
+        by the not staff/global user
+        """
+        # Create an exam.
+        proctored_exam = ProctoredExam.objects.create(
+            course_id='a/b/c',
+            content_id='test_content',
+            exam_name='Test Exam',
+            external_id='123aXqe3',
+            time_limit_mins=90
+        )
+
+        attempt_data = {
+            'exam_id': proctored_exam.id,
+            'external_id': proctored_exam.external_id,
+            'start_clock': True,
+        }
+        response = self.client.post(
+            reverse('edx_proctoring.proctored_exam.attempt.collection'),
+            attempt_data
+        )
+
+        self.assertEqual(response.status_code, 200)
+        response_data = json.loads(response.content)
+        attempt_id = response_data['exam_attempt_id']
+        self.assertGreater(attempt_id, 0)
+
+        # now set the user is_staff t0 false
+        # and also user is not a course staff
+        self.user.is_staff = False
+        self.user.save()
+        set_runtime_service('instructor', MockInstructorService(is_user_course_staff=False))
+
+        response = self.client.delete(
+            reverse('edx_proctoring.proctored_exam.attempt', args=[attempt_id])
+        )
+
+        self.assertEqual(response.status_code, 403)
+        response_data = json.loads(response.content)
+        self.assertEqual(response_data['detail'], 'Must be a instructor of the course to Perform this request.')
+
     def test_read_others_attempt(self):
         """
         Confirms that we cnanot read someone elses attempt
@@ -935,22 +994,44 @@ class TestStudentProctoredExamAttempt(LoggedInTestCase):
 
     def test_exam_attempts_not_staff(self):
         """
-        Test to get the exam attempts in a course.
+        Test to get the exam attempts in a course as a not
+        staff user but still we get the timed exams attempts
+        but not the proctored exam attempts
         """
-        # Create an exam.
-        proctored_exam = ProctoredExam.objects.create(
+        # Create an timed_exam.
+        timed_exam = ProctoredExam.objects.create(
             course_id='a/b/c',
             content_id='test_content',
             exam_name='Test Exam',
             external_id='123aXqe3',
-            time_limit_mins=90
+            time_limit_mins=90,
+            is_proctored=False
+        )
+        attempt_data = {
+            'exam_id': timed_exam.id,
+            'user_id': self.student_taking_exam.id,
+            'external_id': timed_exam.external_id
+        }
+        self.client.post(
+            reverse('edx_proctoring.proctored_exam.attempt.collection'),
+            attempt_data
+        )
+
+        # Create a proctored exam.
+        proctored_exam = ProctoredExam.objects.create(
+            course_id='a/b/c',
+            content_id='test_content1',
+            exam_name='Test Exam',
+            external_id='123aXqe3',
+            time_limit_mins=90,
+            is_proctored=True
         )
         attempt_data = {
             'exam_id': proctored_exam.id,
             'user_id': self.student_taking_exam.id,
             'external_id': proctored_exam.external_id
         }
-        response = self.client.post(
+        self.client.post(
             reverse('edx_proctoring.proctored_exam.attempt.collection'),
             attempt_data
         )
@@ -960,7 +1041,15 @@ class TestStudentProctoredExamAttempt(LoggedInTestCase):
         self.user.save()
 
         response = self.client.get(url)
-        self.assertEqual(response.status_code, 403)
+        self.assertEqual(response.status_code, 200)
+        response_data = json.loads(response.content)
+        # we should only get the timed exam attempt in this case
+        # so the len should be 1
+        self.assertEqual(len(response_data['proctored_exam_attempts']), 1)
+        self.assertEqual(
+            response_data['proctored_exam_attempts'][0]['proctored_exam']['is_proctored'],
+            timed_exam.is_proctored
+        )
 
     def test_get_filtered_exam_attempts(self):
         """
@@ -1016,6 +1105,63 @@ class TestStudentProctoredExamAttempt(LoggedInTestCase):
         self.assertEqual(attempt['proctored_exam']['id'], proctored_exam.id)
         self.assertEqual(attempt['user']['id'], self.user.id)
 
+    def test_get_filtered_timed_exam_attempts(self):  # pylint: disable=invalid-name
+        """
+        Test to get the filtered timed exam attempts in a course.
+        """
+        # Create an exam.
+        timed_exm = ProctoredExam.objects.create(
+            course_id='a/b/c',
+            content_id='test_content',
+            exam_name='Test Exam',
+            external_id='123aXqe3',
+            time_limit_mins=90,
+            is_proctored=False
+        )
+        attempt_data = {
+            'exam_id': timed_exm.id,
+            'start_clock': False,
+            'attempt_proctored': False
+        }
+        # create a exam attempt
+        response = self.client.post(
+            reverse('edx_proctoring.proctored_exam.attempt.collection'),
+            attempt_data
+        )
+        self.assertEqual(response.status_code, 200)
+
+        self.client.login_user(self.second_user)
+        # create a new exam attempt for second student
+        response = self.client.post(
+            reverse('edx_proctoring.proctored_exam.attempt.collection'),
+            attempt_data
+        )
+        self.assertEqual(response.status_code, 200)
+
+        self.user.is_staff = False
+        self.user.save()
+        self.client.login_user(self.user)
+        response = self.client.get(
+            reverse(
+                'edx_proctoring.proctored_exam.attempts.search',
+                kwargs={
+                    'course_id': timed_exm.course_id,
+                    'search_by': 'tester'
+                }
+            )
+        )
+        self.assertEqual(response.status_code, 200)
+        response_data = json.loads(response.content)
+
+        self.assertEqual(len(response_data['proctored_exam_attempts']), 2)
+        attempt = response_data['proctored_exam_attempts'][0]
+        self.assertEqual(attempt['proctored_exam']['id'], timed_exm.id)
+        self.assertEqual(attempt['user']['id'], self.second_user.id)
+
+        attempt = response_data['proctored_exam_attempts'][1]
+        self.assertEqual(attempt['proctored_exam']['id'], timed_exm.id)
+        self.assertEqual(attempt['user']['id'], self.user.id)
+
     def test_paginated_exam_attempts(self):
         """
         Test to get the paginated exam attempts in a course.
@@ -1144,6 +1290,48 @@ class TestStudentProctoredExamAttempt(LoggedInTestCase):
         # make sure we have the accessible human string
         self.assertEqual(data['accessibility_time_string'], 'you have 1 hour and 30 minutes remaining')
 
+    def test_get_exam_attempt_with_non_staff_user(self):  # pylint: disable=invalid-name
+        """
+        Test Case for retrieving student proctored exam attempt status.
+        """
+        # Create an exam.
+        proctored_exam = ProctoredExam.objects.create(
+            course_id='a/b/c',
+            content_id='test_content',
+            exam_name='Test Exam',
+            external_id='123aXqe3',
+            time_limit_mins=90
+        )
+        response = self.client.get(
+            reverse('edx_proctoring.proctored_exam.attempt.collection')
+        )
+        self.assertEqual(response.status_code, 200)
+        data = json.loads(response.content)
+        self.assertNotIn('exam_display_name', data)
+
+        attempt_data = {
+            'exam_id': proctored_exam.id,
+            'user_id': self.user.id,
+            'external_id': proctored_exam.external_id,
+            'start_clock': True
+        }
+        response = self.client.post(
+            reverse('edx_proctoring.proctored_exam.attempt.collection'),
+            attempt_data
+        )
+        self.assertEqual(response.status_code, 200)
+
+        response = self.client.get(
+            reverse('edx_proctoring.proctored_exam.attempt.collection')
+        )
+        self.assertEqual(response.status_code, 200)
+        data = json.loads(response.content)
+        self.assertEqual(data['exam_display_name'], 'Test Exam')
+        self.assertEqual(data['low_threshold_sec'], 1080)
+        self.assertEqual(data['critically_low_threshold_sec'], 270)
+        # make sure we have the accessible human string
+        self.assertEqual(data['accessibility_time_string'], 'you have 1 hour and 30 minutes remaining')
+
     def test_get_expired_attempt(self):
         """
         Test Case for retrieving student proctored exam attempt status after it has expired
@@ -1506,6 +1694,8 @@ class TestExamAllowanceView(LoggedInTestCase):
         self.student_taking_exam = User()
         self.student_taking_exam.save()
 
+        set_runtime_service('instructor', MockInstructorService(is_user_course_staff=True))
+
     def test_add_allowance_for_user(self):
         """
         Add allowance for a user for an exam.
@@ -1589,6 +1779,37 @@ class TestExamAllowanceView(LoggedInTestCase):
         )
         self.assertEqual(response.status_code, 200)
 
+    def test_add_allowance_non_staff_user(self):  # pylint: disable=invalid-name
+        """
+        Test to add allowance with not staff/global user
+        returns forbidden response.
+        """
+        self.user.is_staff = False
+        self.user.save()
+        set_runtime_service('instructor', MockInstructorService(is_user_course_staff=False))
+        # Create an exam.
+        proctored_exam = ProctoredExam.objects.create(
+            course_id='a/b/c',
+            content_id='test_content',
+            exam_name='Test Exam',
+            external_id='123aXqe3',
+            time_limit_mins=90,
+            is_proctored=False
+        )
+        allowance_data = {
+            'exam_id': proctored_exam.id,
+            'user_info': self.student_taking_exam.username,
+            'key': 'a_key',
+            'value': '30'
+        }
+        response = self.client.put(
+            reverse('edx_proctoring.proctored_exam.allowance'),
+            allowance_data
+        )
+        self.assertEqual(response.status_code, 403)
+        response_data = json.loads(response.content)
+        self.assertEqual(response_data['detail'], 'Must be a instructor of the course to Perform this request.')
+
     def test_get_allowances_for_course(self):
         """
         Remove allowance for a user for an exam.
@@ -1623,6 +1844,107 @@ class TestExamAllowanceView(LoggedInTestCase):
         self.assertEqual(response_data[0]['proctored_exam']['course_id'], proctored_exam.course_id)
         self.assertEqual(response_data[0]['key'], allowance_data['key'])
 
+    def test_get_allowance_non_staff_user(self):  # pylint: disable=invalid-name
+        """
+        Test to get allowance of a user with not staff/global user
+        returns forbidden response.
+        """
+        self.user.is_staff = False
+        self.user.save()
+        # Create an exam.
+        proctored_exam = ProctoredExam.objects.create(
+            course_id='a/b/c',
+            content_id='test_content',
+            exam_name='Test Exam',
+            external_id='123aXqe3',
+            time_limit_mins=90,
+            is_proctored=False
+        )
+        allowance_data = {
+            'exam_id': proctored_exam.id,
+            'user_info': self.student_taking_exam.username,
+            'key': 'a_key',
+            'value': '30'
+        }
+        response = self.client.put(
+            reverse('edx_proctoring.proctored_exam.allowance'),
+            allowance_data
+        )
+        self.assertEqual(response.status_code, 200)
+
+        # update the Instructor Mock service to return the course staff to False
+        # which will return in the Forbidden request.
+        set_runtime_service('instructor', MockInstructorService(is_user_course_staff=False))
+        response = self.client.get(
+            reverse('edx_proctoring.proctored_exam.allowance', kwargs={'course_id': proctored_exam.course_id})
+        )
+
+        self.assertEqual(response.status_code, 403)
+        response_data = json.loads(response.content)
+        self.assertEqual(response_data['detail'], 'Must be a instructor of the course to Perform this request.')
+
+    def test_get_timed_exam_allowances_for_course(self):  # pylint: disable=invalid-name
+        """
+        get the timed exam allowances for the course
+        """
+        self.user.is_staff = False
+        self.user.save()
+
+        # Create an timed exam.
+        timed_exam = ProctoredExam.objects.create(
+            course_id='a/b/c',
+            content_id='test_content',
+            exam_name='Test Exam',
+            external_id='123aXqe3',
+            time_limit_mins=90,
+            is_proctored=False
+        )
+        allowance_data = {
+            'exam_id': timed_exam.id,
+            'user_info': self.student_taking_exam.username,
+            'key': 'a_key',
+            'value': '30'
+        }
+        response = self.client.put(
+            reverse('edx_proctoring.proctored_exam.allowance'),
+            allowance_data
+        )
+        self.assertEqual(response.status_code, 200)
+
+        # Create proctored exam.
+        proctored_exam = ProctoredExam.objects.create(
+            course_id='a/b/c',
+            content_id='test_content1',
+            exam_name='Test Exam',
+            external_id='123aXqe3',
+            time_limit_mins=90,
+            is_proctored=True
+        )
+        allowance_data = {
+            'exam_id': proctored_exam.id,
+            'user_info': self.student_taking_exam.username,
+            'key': 'a_key',
+            'value': '30'
+        }
+        response = self.client.put(
+            reverse('edx_proctoring.proctored_exam.allowance'),
+            allowance_data
+        )
+        self.assertEqual(response.status_code, 200)
+
+        response = self.client.get(
+            reverse('edx_proctoring.proctored_exam.allowance', kwargs={'course_id': proctored_exam.course_id})
+        )
+
+        self.assertEqual(response.status_code, 200)
+        response_data = json.loads(response.content)
+        # we should only get the timed exam allowance
+        # We are not logged in as a global user
+        self.assertEqual(len(response_data), 1)
+        self.assertEqual(response_data[0]['proctored_exam']['course_id'], timed_exam.course_id)
+        self.assertEqual(response_data[0]['proctored_exam']['content_id'], timed_exam.content_id)
+        self.assertEqual(response_data[0]['key'], allowance_data['key'])
+
 
 class TestActiveExamsForUserView(LoggedInTestCase):
     """

edx_proctoring/views.py

@@ -38,8 +38,9 @@ from edx_proctoring.exceptions import (
     ProctoredExamPermissionDenied,
     StudentExamAttemptDoesNotExistsException,
 )
+from edx_proctoring.runtime import get_runtime_service
 from edx_proctoring.serializers import ProctoredExamSerializer, ProctoredExamStudentAttemptSerializer
-from edx_proctoring.models import ProctoredExamStudentAttemptStatus, ProctoredExamStudentAttempt
+from edx_proctoring.models import ProctoredExamStudentAttemptStatus, ProctoredExamStudentAttempt, ProctoredExam
 
 from .utils import AuthenticatedAPIView, get_time_remaining_for_attempt, humanized_time
 
@@ -63,6 +64,48 @@ def require_staff(func):
     return wrapped
 
 
+def require_course_or_global_staff(func):
+    """View decorator that requires that the user have staff permissions. """
+    def wrapped(request, *args, **kwargs):  # pylint: disable=missing-docstring
+        instructor_service = get_runtime_service('instructor')
+        course_id = kwargs['course_id'] if 'course_id' in kwargs else None
+        exam_id = request.DATA.get('exam_id', None)
+        attempt_id = kwargs['attempt_id'] if 'attempt_id' in kwargs else None
+        response_message = _("Must be a instructor of the course to Perform this request.")
+        if request.user.is_staff:
+            is_request_allowed = True
+        elif course_id is not None:
+            if instructor_service.is_course_staff(request.user, course_id):
+                is_request_allowed = True
+            else:
+                is_request_allowed = False
+        elif exam_id is not None:
+            # get the course_id from the exam
+            exam = ProctoredExam.get_exam_by_id(exam_id)
+            if instructor_service.is_course_staff(request.user, exam.course_id):
+                is_request_allowed = True
+            else:
+                is_request_allowed = False
+        elif attempt_id is not None:
+            exam_attempt = ProctoredExamStudentAttempt.objects.get_exam_attempt_by_id(attempt_id)
+            if instructor_service.is_course_staff(request.user, exam_attempt.proctored_exam.course_id):
+                is_request_allowed = True
+            else:
+                is_request_allowed = False
+        else:
+            is_request_allowed = False
+            response_message = _("Must be a Staff User to Perform this request.")
+
+        if is_request_allowed:
+            return func(request, *args, **kwargs)
+        else:
+            return Response(
+                status=status.HTTP_403_FORBIDDEN,
+                data={"detail": response_message}
+            )
+    return wrapped
+
+
 class ProctoredExamView(AuthenticatedAPIView):
     """
     Endpoint for the Proctored Exams
@@ -215,8 +258,10 @@ class ProctoredExamView(AuthenticatedAPIView):
                             data={"detail": "The exam with course_id, content_id does not exist."}
                         )
                 else:
+                    timed_exams_only = not request.user.is_staff
                     result_set = get_all_exams_for_course(
-                        course_id=course_id
+                        course_id=course_id,
+                        timed_exams_only=timed_exams_only
                     )
                     return Response(result_set)
 
@@ -378,7 +423,7 @@ class StudentProctoredExamAttempt(AuthenticatedAPIView):
                 data={"detail": str(ex)}
             )
 
-    @method_decorator(require_staff)
+    @method_decorator(require_course_or_global_staff)
     def delete(self, request, attempt_id):  # pylint: disable=unused-argument
         """
         HTTP DELETE handler. Removes an exam attempt.
@@ -560,17 +605,23 @@ class StudentProctoredExamAttemptsByCourse(AuthenticatedAPIView):
 
     A search parameter is optional
     """
-    @method_decorator(require_staff)
+    @method_decorator(require_course_or_global_staff)
     def get(self, request, course_id, search_by=None):  # pylint: disable=unused-argument
         """
         HTTP GET Handler. Returns the status of the exam attempt.
         """
+        # course staff only views attempts of timed exams. edx staff can view both timed and proctored attempts.
+        time_exams_only = not request.user.is_staff
 
         if search_by is not None:
-            exam_attempts = ProctoredExamStudentAttempt.objects.get_filtered_exam_attempts(course_id, search_by)
+            exam_attempts = ProctoredExamStudentAttempt.objects.get_filtered_exam_attempts(
+                course_id, search_by, time_exams_only
+            )
             attempt_url = reverse('edx_proctoring.proctored_exam.attempts.search', args=[course_id, search_by])
         else:
-            exam_attempts = ProctoredExamStudentAttempt.objects.get_all_exam_attempts(course_id)
+            exam_attempts = ProctoredExamStudentAttempt.objects.get_all_exam_attempts(
+                course_id, time_exams_only
+            )
             attempt_url = reverse('edx_proctoring.proctored_exam.attempts.course', args=[course_id])
 
         paginator = Paginator(exam_attempts, ATTEMPTS_PER_PAGE)
@@ -644,17 +695,21 @@ class ExamAllowanceView(AuthenticatedAPIView):
     **Response Values**
         * returns Nothing. deletes the allowance for the user proctored exam.
     """
-    @method_decorator(require_staff)
+    @method_decorator(require_course_or_global_staff)
     def get(self, request, course_id):  # pylint: disable=unused-argument
         """
         HTTP GET handler. Get all allowances for a course.
         """
+        # course staff only views attempts of timed exams. edx staff can view both timed and proctored attempts.
+        time_exams_only = not request.user.is_staff
+
         result_set = get_allowances_for_course(
-            course_id=course_id
+            course_id=course_id,
+            timed_exams_only=time_exams_only
         )
         return Response(result_set)
 
-    @method_decorator(require_staff)
+    @method_decorator(require_course_or_global_staff)
     def put(self, request):
         """
         HTTP GET handler. Adds or updates Allowance
@@ -674,7 +729,7 @@ class ExamAllowanceView(AuthenticatedAPIView):
                 data={"detail": str(ex)}
             )
 
-    @method_decorator(require_staff)
+    @method_decorator(require_course_or_global_staff)
     def delete(self, request):
         """
         HTTP DELETE handler. Removes Allowance.