Merge pull request #10567 from edx/jia/MA-860

MA-860; No moderator permissions on closed thread

lms/djangoapps/discussion_api/api.py

@@ -601,6 +601,10 @@ def create_comment(request, comment_data):
     except Http404:
         raise ValidationError({"thread_id": ["Invalid value."]})
 
+    # if a thread is closed; no new comments could be made to it
+    if cc_thread['closed']:
+        raise PermissionDenied
+
     _check_initializable_comment_fields(comment_data, context)
     serializer = CommentSerializer(data=comment_data, context=context)
     actions_form = CommentActionsForm(comment_data)

lms/djangoapps/discussion_api/permissions.py

@@ -56,8 +56,16 @@ def get_editable_fields(cc_content, context):
     """
     Return the set of fields that the requester can edit on the given content
     """
+
+    # no edits, except 'abuse_flagged' are allowed on closed threads
+    ret = {"abuse_flagged"}
+    if (cc_content["type"] == "thread" and cc_content["closed"]) or (
+            cc_content["type"] == "comment" and context["thread"]["closed"]
+    ):
+        return ret
+
     # Shared fields
-    ret = {"abuse_flagged", "voted"}
+    ret |= {"voted"}
     if _is_author_or_privileged(cc_content, context):
         ret |= {"raw_body"}
 

lms/djangoapps/discussion_api/tests/test_api.py

@@ -614,7 +614,7 @@ class GetThreadListTest(CommentsServiceMockMixin, UrlResetMixin, SharedModuleSto
                 "title": "Another Test Title",
                 "body": "More content",
                 "pinned": False,
-                "closed": True,
+                "closed": False,
                 "abuse_flaggers": [],
                 "votes": {"up_count": 9},
                 "comments_count": 18,
@@ -668,7 +668,7 @@ class GetThreadListTest(CommentsServiceMockMixin, UrlResetMixin, SharedModuleSto
                 "raw_body": "More content",
                 "rendered_body": "<p>More content</p>",
                 "pinned": False,
-                "closed": True,
+                "closed": False,
                 "following": False,
                 "abuse_flagged": False,
                 "voted": False,

lms/djangoapps/discussion_api/tests/utils.py

@@ -301,6 +301,16 @@ class CommentsServiceMockMixin(object):
         """
         self.assert_query_params_equal(httpretty.last_request(), expected_params)
 
+    def request_patch(self, request_data):
+        """
+        make a request to PATCH endpoint and return response
+        """
+        return self.client.patch(  # pylint: disable=no-member
+            self.url,
+            json.dumps(request_data),
+            content_type="application/merge-patch+json"
+        )
+
 
 def make_minimal_cs_thread(overrides=None):
     """