Reorder transformers to fix MA-1981.

lms/djangoapps/course_api/blocks/api.py

@@ -52,9 +52,10 @@ def get_blocks(
     )
 
     # list of transformers to apply, adding user-specific ones if user is provided
-    transformers = [blocks_api_transformer]
+    transformers = []
     if user is not None:
         transformers += COURSE_BLOCK_ACCESS_TRANSFORMERS + [ProctoredExamTransformer()]
+    transformers += [blocks_api_transformer]
 
     blocks = get_course_blocks(
         user,

lms/djangoapps/course_api/blocks/tests/test_api.py

@@ -42,3 +42,17 @@ class TestGetBlocks(SharedModuleStoreTestCase):
     def test_no_user(self):
         blocks = get_blocks(self.request, self.course.location)
         self.assertIn(unicode(self.html_block.location), blocks['blocks'])
+
+    def test_access_before_api_transformer_order(self):
+        """
+        Tests the order of transformers: access checks are made before the api
+        transformer is applied.
+        """
+        blocks = get_blocks(self.request, self.course.location, self.user, nav_depth=5, requested_fields=['nav_depth'])
+        vertical_block = self.store.get_item(self.course.id.make_usage_key('vertical', 'vertical_x1a'))
+        problem_block = self.store.get_item(self.course.id.make_usage_key('problem', 'problem_x1a_1'))
+
+        vertical_descendants = blocks['blocks'][unicode(vertical_block.location)]['descendants']
+
+        self.assertIn(unicode(problem_block.location), vertical_descendants)
+        self.assertNotIn(unicode(self.html_block.location), vertical_descendants)