Initial API implementation

common/djangoapps/api_manager/courses_urls.py

+"""
+Courses API URI specification
+The order of the URIs really matters here, due to the slash characters present in the identifiers
+"""
+from django.conf.urls import patterns, url
+
+urlpatterns = patterns('api_manager.courses_views',
+                       url(r'/*$^', 'courses_list'),
+                       url(r'^(?P<course_id>[a-zA-Z0-9/_:]+)/modules/(?P<module_id>[a-zA-Z0-9/_:]+)/submodules/*$', 'modules_list'),
+                       url(r'^(?P<course_id>[a-zA-Z0-9/_:]+)/modules/(?P<module_id>[a-zA-Z0-9/_:]+)$', 'modules_detail'),
+                       url(r'^(?P<course_id>[a-zA-Z0-9/_:]+)/modules/*$', 'modules_list'),
+                       url(r'^(?P<course_id>[a-zA-Z0-9/_:]+)$', 'courses_detail'),
+                       )

common/djangoapps/api_manager/courses_views.py

+""" API implementation for course-oriented interactions. """
+
+from rest_framework import status
+from rest_framework.decorators import api_view, permission_classes
+from rest_framework.response import Response
+
+from api_manager.permissions import ApiKeyHeaderPermission
+from xmodule.modulestore.django import modulestore
+from xmodule.modulestore import Location, InvalidLocationError
+
+
+def _get_module_submodules(module, submodule_type=None):
+    """
+    Parses the provided module looking for child modules
+    Matches on submodule type (category) when specified
+    """
+    submodules = []
+    if hasattr(module, 'children'):
+        child_modules = module.get_children()
+        for child_module in child_modules:
+            if submodule_type:
+                if getattr(child_module, 'category') == submodule_type:
+                    submodules.append(child_module)
+            else:
+                submodules.append(child_module)
+    return submodules
+
+
+def _serialize_module(request, course_id, module):
+    """
+    Loads the specified module data into the response dict
+    This should probably evolve to use DRF serializers
+    """
+    data = {}
+
+    if getattr(module, 'id') == course_id:
+        module_id = module.id
+    else:
+        module_id = module.location.url()
+    data['id'] = module_id
+
+    if hasattr(module, 'display_name'):
+        data['name'] = module.display_name
+
+    data['category'] = module.location.category
+
+    protocol = 'http'
+    if request.is_secure():
+        protocol = protocol + 's'
+    module_uri = '{}://{}/api/courses/{}'.format(
+        protocol,
+        request.get_host(),
+        course_id.encode('utf-8')
+    )
+
+    # Some things we do only if the module is a course
+    if (course_id == module_id):
+        data['number'] = module.location.course
+        data['org'] = module.location.org
+
+    # Other things we do only if the module is not a course
+    else:
+        module_uri = '{}/modules/{}'.format(module_uri, module_id)
+    data['uri'] = module_uri
+
+    return data
+
+
+def _serialize_module_submodules(request, course_id, submodules):
+    """
+    Loads the specified module submodule data into the response dict
+    This should probably evolve to use DRF serializers
+    """
+    data = []
+    if submodules:
+        for submodule in submodules:
+            submodule_data = _serialize_module(
+                request,
+                course_id,
+                submodule
+            )
+            data.append(submodule_data)
+    return data
+
+
+@api_view(['GET'])
+@permission_classes((ApiKeyHeaderPermission,))
+def modules_list(request, course_id, module_id=None):
+    """
+    GET retrieves the list of submodules for a given module
+    We don't know where in the module hierarchy we are -- could even be the top
+    """
+    if module_id is None:
+        module_id = course_id
+    response_data = []
+    submodule_type = request.QUERY_PARAMS.get('type', None)
+    store = modulestore()
+    if course_id != module_id:
+        try:
+            module = store.get_instance(course_id, Location(module_id))
+        except InvalidLocationError:
+            module = None
+    else:
+        module = store.get_course(course_id)
+    if module:
+        submodules = _get_module_submodules(module, submodule_type)
+        response_data = _serialize_module_submodules(
+            request,
+            course_id,
+            submodules
+        )
+        status_code = status.HTTP_200_OK
+    else:
+        status_code = status.HTTP_404_NOT_FOUND
+    return Response(response_data, status=status_code)
+
+
+@api_view(['GET'])
+@permission_classes((ApiKeyHeaderPermission,))
+def modules_detail(request, course_id, module_id):
+    """
+    GET retrieves an existing module from the system
+    """
+    store = modulestore()
+    response_data = {}
+    submodule_type = request.QUERY_PARAMS.get('type', None)
+    if course_id != module_id:
+        try:
+            module = store.get_instance(course_id, Location(module_id))
+        except InvalidLocationError:
+            module = None
+    else:
+        module = store.get_course(course_id)
+    if module:
+        response_data = _serialize_module(
+            request,
+            course_id,
+            module
+        )
+        submodules = _get_module_submodules(module, submodule_type)
+        response_data['modules'] = _serialize_module_submodules(
+            request,
+            course_id,
+            submodules
+        )
+        status_code = status.HTTP_200_OK
+    else:
+        status_code = status.HTTP_404_NOT_FOUND
+    return Response(response_data, status=status_code)
+
+
+@api_view(['GET'])
+@permission_classes((ApiKeyHeaderPermission,))
+def courses_list(request):
+    """
+    GET returns the list of available courses
+    """
+    response_data = []
+    store = modulestore()
+    course_descriptors = store.get_courses()
+    for course_descriptor in course_descriptors:
+        course_data = _serialize_module(
+            request,
+            course_descriptor.id,
+            course_descriptor
+        )
+        response_data.append(course_data)
+    return Response(response_data, status=status.HTTP_200_OK)
+
+
+@api_view(['GET'])
+@permission_classes((ApiKeyHeaderPermission,))
+def courses_detail(request, course_id):
+    """
+    GET retrieves an existing course from the system
+    """
+    response_data = {}
+    store = modulestore()
+    try:
+        course_descriptor = store.get_course(course_id)
+    except ValueError:
+        course_descriptor = None
+    if course_descriptor:
+        response_data = _serialize_module(
+            request,
+            course_descriptor.id,
+            course_descriptor
+        )
+        submodules = _get_module_submodules(course_descriptor, None)
+        response_data['modules'] = _serialize_module_submodules(
+            request,
+            course_id,
+            submodules
+        )
+        status_code = status.HTTP_200_OK
+    else:
+        status_code = status.HTTP_404_NOT_FOUND
+    return Response(response_data, status=status_code)

common/djangoapps/api_manager/groups_urls.py

+""" Groups API URI specification """
+from django.conf.urls import patterns, url
+
+urlpatterns = patterns('api_manager.groups_views',
+                       url(r'/*$^', 'group_list'),
+                       url(r'^(?P<group_id>[0-9]+)$', 'group_detail'),
+                       url(r'^(?P<group_id>[0-9]+)/users/*$', 'group_users_list'),
+                       url(r'^(?P<group_id>[0-9]+)/users/(?P<user_id>[0-9]+)$', 'group_users_detail'),
+                       url(r'^(?P<group_id>[0-9]+)/groups/*$', 'group_groups_list'),
+                       url(r'^(?P<group_id>[0-9]+)/groups/(?P<related_group_id>[0-9]+)$', 'group_groups_detail'),
+                       )

common/djangoapps/api_manager/groups_views.py

+""" API implementation for gourse-oriented interactions. """
+import uuid
+
+from django.contrib.auth.models import Group, User
+from django.core.exceptions import ObjectDoesNotExist
+from django.utils import timezone
+
+from rest_framework import status
+from rest_framework.decorators import api_view, permission_classes
+from rest_framework.response import Response
+
+from api_manager.permissions import ApiKeyHeaderPermission
+from api_manager.models import GroupRelationship
+
+RELATIONSHIP_TYPES = {'hierarchical': 'h', 'graph': 'g'}
+
+
+def _generate_base_uri(request):
+    """
+    Constructs the protocol:host:path component of the resource uri
+    """
+    protocol = 'http'
+    if request.is_secure():
+        protocol = protocol + 's'
+    resource_uri = '{}://{}{}'.format(
+        protocol,
+        request.get_host(),
+        request.path
+    )
+    return resource_uri
+
+
+@api_view(['POST'])
+@permission_classes((ApiKeyHeaderPermission,))
+def group_list(request):
+    """
+    POST creates a new group in the system
+    """
+    response_data = {}
+    base_uri = _generate_base_uri(request)
+    # Group name must be unique, but we need to support dupes
+    group = Group.objects.create(name=str(uuid.uuid4()))
+    original_group_name = request.DATA['name']
+    group.name = '{:04d}: {}'.format(group.id, original_group_name)
+    group.record_active = True
+    group.record_date_created = timezone.now()
+    group.record_date_modified = timezone.now()
+    group.save()
+    # Relationship model also allows us to use duplicate names
+    GroupRelationship.objects.create(name=original_group_name, group_id=group.id, parent_group=None)
+    response_data = {'id': group.id, 'name': original_group_name}
+    base_uri = _generate_base_uri(request)
+    response_data['uri'] = '{}/{}'.format(base_uri, group.id)
+    response_status = status.HTTP_201_CREATED
+    return Response(response_data, status=response_status)
+
+
+@api_view(['GET'])
+@permission_classes((ApiKeyHeaderPermission,))
+def group_detail(request, group_id):
+    """
+    GET retrieves an existing group from the system
+    """
+    response_data = {}
+    base_uri = _generate_base_uri(request)
+    try:
+        existing_group = Group.objects.get(id=group_id)
+        existing_group_relationship = GroupRelationship.objects.get(group_id=group_id)
+    except ObjectDoesNotExist:
+        existing_group = None
+        existing_group_relationship = None
+    if existing_group and existing_group_relationship:
+        response_data['name'] = existing_group_relationship.name
+        response_data['id'] = existing_group.id
+        response_data['uri'] = base_uri
+        response_data['resources'] = []
+        resource_uri = '{}/users'.format(base_uri)
+        response_data['resources'].append({'uri': resource_uri})
+        resource_uri = '{}/groups'.format(base_uri)
+        response_data['resources'].append({'uri': resource_uri})
+        response_status = status.HTTP_200_OK
+    else:
+        response_status = status.HTTP_404_NOT_FOUND
+    return Response(response_data, status=response_status)
+
+
+@api_view(['POST'])
+@permission_classes((ApiKeyHeaderPermission,))
+def group_users_list(request, group_id):
+    """
+    POST creates a new group-user relationship in the system
+    """
+    response_data = {}
+    group_id = group_id
+    user_id = request.DATA['user_id']
+    base_uri = _generate_base_uri(request)
+    try:
+        existing_group = Group.objects.get(id=group_id)
+        existing_user = User.objects.get(id=user_id)
+    except ObjectDoesNotExist:
+        existing_group = None
+        existing_user = None
+    if existing_group and existing_user:
+        try:
+            existing_relationship = Group.objects.get(user=existing_user)
+        except ObjectDoesNotExist:
+            existing_relationship = None
+        if existing_relationship is None:
+            existing_group.user_set.add(existing_user.id)
+            response_data['uri'] = '{}/{}'.format(base_uri, existing_user.id)
+            response_data['group_id'] = str(existing_group.id)
+            response_data['user_id'] = str(existing_user.id)
+            response_status = status.HTTP_201_CREATED
+        else:
+            response_data['uri'] = '{}/{}'.format(base_uri, existing_user.id)
+            response_data['message'] = "Relationship already exists."
+            response_status = status.HTTP_409_CONFLICT
+    else:
+        response_status = status.HTTP_404_NOT_FOUND
+    return Response(response_data, status=response_status)
+
+
+@api_view(['GET', 'DELETE'])
+@permission_classes((ApiKeyHeaderPermission,))
+def group_users_detail(request, group_id, user_id):
+    """
+    GET retrieves an existing group-user relationship from the system
+    DELETE removes/inactivates/etc. an existing group-user relationship
+    """
+    if request.method == 'GET':
+        response_data = {}
+        base_uri = _generate_base_uri(request)
+        try:
+            existing_group = Group.objects.get(id=group_id)
+            existing_relationship = existing_group.user_set.get(id=user_id)
+        except ObjectDoesNotExist:
+            existing_group = None
+            existing_relationship = None
+        if existing_group and existing_relationship:
+            response_data['group_id'] = existing_group.id
+            response_data['user_id'] = existing_relationship.id
+            response_data['uri'] = base_uri
+            response_status = status.HTTP_200_OK
+        else:
+            response_status = status.HTTP_404_NOT_FOUND
+        return Response(response_data, status=response_status)
+    elif request.method == 'DELETE':
+        try:
+            existing_group = Group.objects.get(id=group_id)
+            existing_group.user_set.remove(user_id)
+            existing_group.save()
+        except ObjectDoesNotExist:
+            pass
+        return Response({}, status=status.HTTP_204_NO_CONTENT)
+
+
+@api_view(['POST', 'GET'])
+@permission_classes((ApiKeyHeaderPermission,))
+def group_groups_list(request, group_id):
+    """
+    POST creates a new group-group relationship in the system
+    GET retrieves the existing group-group relationships for the specified group
+    """
+    if request.method == 'POST':
+        response_data = {}
+        to_group_id = request.DATA['group_id']
+        relationship_type = request.DATA['relationship_type']
+        base_uri = _generate_base_uri(request)
+        response_data['uri'] = '{}/{}'.format(base_uri, to_group_id)
+        response_data['group_id'] = str(to_group_id)
+        response_data['relationship_type'] = relationship_type
+        try:
+            from_group_relationship = GroupRelationship.objects.get(group__id=group_id)
+            to_group_relationship = GroupRelationship.objects.get(group__id=to_group_id)
+        except ObjectDoesNotExist:
+            from_group_relationship = None
+            to_group_relationship = None
+        if from_group_relationship and to_group_relationship:
+            response_status = status.HTTP_201_CREATED
+            if relationship_type == RELATIONSHIP_TYPES['hierarchical']:
+                to_group_relationship.parent_group = from_group_relationship
+                to_group_relationship.save()
+            elif relationship_type == RELATIONSHIP_TYPES['graph']:
+                from_group_relationship.add_linked_group_relationship(to_group_relationship)
+            else:
+                response_data['message'] = "Relationship type '%s' not currently supported" % relationship_type
+                response_data['field_conflict'] = 'relationship_type'
+                response_status = status.HTTP_406_NOT_ACCEPTABLE
+        else:
+            response_status = status.HTTP_404_NOT_FOUND
+        return Response(response_data, status=response_status)
+    elif request.method == 'GET':
+        try:
+            from_group_relationship = GroupRelationship.objects.get(group__id=group_id)
+        except ObjectDoesNotExist:
+            from_group_relationship = None
+        response_data = []
+        if from_group_relationship:
+            base_uri = _generate_base_uri(request)
+            child_groups = GroupRelationship.objects.filter(parent_group_id=group_id)
+            if child_groups:
+                for group in child_groups:
+                    response_data.append({
+                                         "id": group.group_id,
+                                         "relationship_type": RELATIONSHIP_TYPES['hierarchical'],
+                                         "uri": '{}/{}'.format(base_uri, group.group.id)
+                                         })
+            linked_groups = from_group_relationship.get_linked_group_relationships()
+            if linked_groups:
+                for group in linked_groups:
+                    response_data.append({
+                                         "id": group.to_group_relationship_id,
+                                         "relationship_type": RELATIONSHIP_TYPES['graph'],
+                                         "uri": '{}/{}'.format(base_uri, group.to_group_relationship_id)
+                                         })
+            response_status = status.HTTP_200_OK
+        else:
+            response_status = status.HTTP_404_NOT_FOUND
+        return Response(response_data, status=response_status)
+
+
+@api_view(['GET', 'DELETE'])
+@permission_classes((ApiKeyHeaderPermission,))
+def group_groups_detail(request, group_id, related_group_id):
+    """
+    GET retrieves an existing group-group relationship from the system
+    DELETE removes/inactivates/etc. an existing group-group relationship
+    """
+    if request.method == 'GET':
+        response_data = {}
+        base_uri = _generate_base_uri(request)
+        response_data['uri'] = base_uri
+        response_data['from_group_id'] = group_id
+        response_data['to_group_id'] = related_group_id
+        response_status = status.HTTP_404_NOT_FOUND
+        from_group_relationship = GroupRelationship.objects.get(group__id=group_id)
+        if from_group_relationship:
+            to_group_relationship = GroupRelationship.objects.get(group__id=related_group_id)
+            if to_group_relationship and str(to_group_relationship.parent_group_id) == str(group_id):
+                response_data['relationship_type'] = RELATIONSHIP_TYPES['hierarchical']
+                response_status = status.HTTP_200_OK
+            else:
+                to_group = Group.objects.get(id=to_group_relationship.group_id)
+                linked_group_exists = from_group_relationship.check_linked_group_relationship(to_group, symmetrical=True)
+                if linked_group_exists:
+                    response_data['relationship_type'] = RELATIONSHIP_TYPES['graph']
+                    response_status = status.HTTP_200_OK
+        return Response(response_data, response_status)
+    elif request.method == 'DELETE':
+        try:
+            from_group_relationship = GroupRelationship.objects.get(group__id=group_id)
+        except ObjectDoesNotExist:
+            from_group_relationship = None
+        try:
+            to_group_relationship = GroupRelationship.objects.get(group__id=related_group_id)
+        except ObjectDoesNotExist:
+            to_group = None
+            to_group_relationship = None
+        if from_group_relationship:
+            if to_group_relationship:
+                if to_group_relationship.parent_group_id is from_group_relationship.group_id:
+                    to_group_relationship.parent_group_id = None
+                    to_group_relationship.save()
+                else:
+                    from_group_relationship.remove_linked_group_relationship(to_group_relationship)
+                    from_group_relationship.save()
+            # No 'else' clause here -> It's ok if we didn't find a match
+            response_status = status.HTTP_204_NO_CONTENT
+        else:
+            response_status = status.HTTP_404_NOT_FOUND
+        return Response({}, status=response_status)

common/djangoapps/api_manager/migrations/0001_initial.py

+# -*- coding: utf-8 -*-
+import datetime
+from south.db import db
+from south.v2 import SchemaMigration
+from django.db import models
+
+
+class Migration(SchemaMigration):
+
+    def forwards(self, orm):
+        # Adding model 'GroupRelationship'
+        db.create_table('api_manager_grouprelationship', (
+            ('group', self.gf('django.db.models.fields.related.OneToOneField')(to=orm['auth.Group'], unique=True, primary_key=True)),
+            ('name', self.gf('django.db.models.fields.CharField')(max_length=255)),
+            ('parent_group', self.gf('django.db.models.fields.related.ForeignKey')(default=0, related_name='child_groups', null=True, blank=True, to=orm['api_manager.GroupRelationship'])),
+            ('record_active', self.gf('django.db.models.fields.BooleanField')(default=True)),
+            ('record_date_created', self.gf('django.db.models.fields.DateTimeField')(default=datetime.datetime(2014, 3, 27, 0, 0))),
+            ('record_date_modified', self.gf('django.db.models.fields.DateTimeField')(auto_now=True, blank=True)),
+        ))
+        db.send_create_signal('api_manager', ['GroupRelationship'])
+
+        # Adding model 'LinkedGroupRelationship'
+        db.create_table('api_manager_linkedgrouprelationship', (
+            ('id', self.gf('django.db.models.fields.AutoField')(primary_key=True)),
+            ('from_group_relationship', self.gf('django.db.models.fields.related.ForeignKey')(related_name='from_group_relationships', to=orm['api_manager.GroupRelationship'])),
+            ('to_group_relationship', self.gf('django.db.models.fields.related.ForeignKey')(related_name='to_group_relationships', to=orm['api_manager.GroupRelationship'])),
+            ('record_active', self.gf('django.db.models.fields.BooleanField')(default=True)),
+            ('record_date_created', self.gf('django.db.models.fields.DateTimeField')(default=datetime.datetime(2014, 3, 27, 0, 0))),
+            ('record_date_modified', self.gf('django.db.models.fields.DateTimeField')(auto_now=True, blank=True)),
+        ))
+        db.send_create_signal('api_manager', ['LinkedGroupRelationship'])
+
+
+    def backwards(self, orm):
+        # Deleting model 'GroupRelationship'
+        db.delete_table('api_manager_grouprelationship')
+
+        # Deleting model 'LinkedGroupRelationship'
+        db.delete_table('api_manager_linkedgrouprelationship')
+
+
+    models = {
+        'api_manager.grouprelationship': {
+            'Meta': {'object_name': 'GroupRelationship'},
+            'group': ('django.db.models.fields.related.OneToOneField', [], {'to': "orm['auth.Group']", 'unique': 'True', 'primary_key': 'True'}),
+            'name': ('django.db.models.fields.CharField', [], {'max_length': '255'}),
+            'parent_group': ('django.db.models.fields.related.ForeignKey', [], {'default': '0', 'related_name': "'child_groups'", 'null': 'True', 'blank': 'True', 'to': "orm['api_manager.GroupRelationship']"}),
+            'record_active': ('django.db.models.fields.BooleanField', [], {'default': 'True'}),
+            'record_date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime(2014, 3, 27, 0, 0)'}),
+            'record_date_modified': ('django.db.models.fields.DateTimeField', [], {'auto_now': 'True', 'blank': 'True'})
+        },
+        'api_manager.linkedgrouprelationship': {
+            'Meta': {'object_name': 'LinkedGroupRelationship'},
+            'from_group_relationship': ('django.db.models.fields.related.ForeignKey', [], {'related_name': "'from_group_relationships'", 'to': "orm['api_manager.GroupRelationship']"}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'record_active': ('django.db.models.fields.BooleanField', [], {'default': 'True'}),
+            'record_date_created': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime(2014, 3, 27, 0, 0)'}),
+            'record_date_modified': ('django.db.models.fields.DateTimeField', [], {'auto_now': 'True', 'blank': 'True'}),
+            'to_group_relationship': ('django.db.models.fields.related.ForeignKey', [], {'related_name': "'to_group_relationships'", 'to': "orm['api_manager.GroupRelationship']"})
+        },
+        'auth.group': {
+            'Meta': {'object_name': 'Group'},
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'name': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '80'}),
+            'permissions': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Permission']", 'symmetrical': 'False', 'blank': 'True'})
+        },
+        'auth.permission': {
+            'Meta': {'ordering': "('content_type__app_label', 'content_type__model', 'codename')", 'unique_together': "(('content_type', 'codename'),)", 'object_name': 'Permission'},
+            'codename': ('django.db.models.fields.CharField', [], {'max_length': '100'}),
+            'content_type': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['contenttypes.ContentType']"}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'name': ('django.db.models.fields.CharField', [], {'max_length': '50'})
+        },
+        'contenttypes.contenttype': {
+            'Meta': {'ordering': "('name',)", 'unique_together': "(('app_label', 'model'),)", 'object_name': 'ContentType', 'db_table': "'django_content_type'"},
+            'app_label': ('django.db.models.fields.CharField', [], {'max_length': '100'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'model': ('django.db.models.fields.CharField', [], {'max_length': '100'}),
+            'name': ('django.db.models.fields.CharField', [], {'max_length': '100'})
+        }
+    }
+
+    complete_apps = ['api_manager']
\ No newline at end of file

common/djangoapps/api_manager/models.py

+# pylint: disable=E1101
+
+""" Database ORM models managed by this Django app """
+
+from django.contrib.auth.models import Group
+from django.db import models
+from django.utils import timezone
+
+
+class GroupRelationship(models.Model):
+    """
+    The GroupRelationship model contains information describing the relationships of a group,
+    which allows us to utilize Django's user/group/permission
+    models and features instead of rolling our own.
+    """
+    group = models.OneToOneField(Group, primary_key=True)
+    name = models.CharField(max_length=255)
+    parent_group = models.ForeignKey('self',
+                                     related_name="child_groups",
+                                     blank=True, null=True, default=0)
+    linked_groups = models.ManyToManyField('self',
+                                           through="LinkedGroupRelationship",
+                                           symmetrical=False,
+                                           related_name="linked_to+"),
+    record_active = models.BooleanField(default=True)
+    record_date_created = models.DateTimeField(default=timezone.now())
+    record_date_modified = models.DateTimeField(auto_now=True)
+
+    def add_linked_group_relationship(self, to_group_relationship, symmetrical=True):
+        """ Create a new group-group relationship """
+        relationship = LinkedGroupRelationship.objects.get_or_create(
+            from_group_relationship=self,
+            to_group_relationship=to_group_relationship)
+        if symmetrical:
+            # avoid recursion by passing `symm=False`
+            to_group_relationship.add_linked_group_relationship(self, False)
+        return relationship
+
+    def remove_linked_group_relationship(self, to_group_relationship, symmetrical=True):
+        """ Remove an existing group-group relationship """
+        LinkedGroupRelationship.objects.filter(
+            from_group_relationship=self,
+            to_group_relationship=to_group_relationship).delete()
+        if symmetrical:
+            # avoid recursion by passing `symm=False`
+            to_group_relationship.remove_linked_group_relationship(self, False)
+        return
+
+    def get_linked_group_relationships(self):
+        """ Retrieve an existing group-group relationship """
+        efferent_relationships = LinkedGroupRelationship.objects.filter(from_group_relationship=self)
+        matching_relationships = efferent_relationships
+        return matching_relationships
+
+    def check_linked_group_relationship(self, relationship_to_check, symmetrical=False):
+        """ Confirm the existence of a possibly-existing group-group relationship """
+        query = dict(
+            to_group_relationships__from_group_relationship=self,
+            to_group_relationships__to_group_relationship=relationship_to_check,
+        )
+        if symmetrical:
+            query.update(
+                from_group_relationships__to_group_relationship=self,
+                from_group_relationships__from_group_relationship=relationship_to_check,
+            )
+        return GroupRelationship.objects.filter(**query).exists()
+
+
+class LinkedGroupRelationship(models.Model):
+    """
+    The LinkedGroupRelationship model manages self-referential two-way
+    relationships between group entities via the GroupRelationship model.
+    Specifying the intermediary table allows for the definition of additional
+    relationship information
+    """
+    from_group_relationship = models.ForeignKey(GroupRelationship,
+                                                related_name="from_group_relationships",
+                                                verbose_name="From Group")
+    to_group_relationship = models.ForeignKey(GroupRelationship,
+                                              related_name="to_group_relationships",
+                                              verbose_name="To Group")
+    record_active = models.BooleanField(default=True)
+    record_date_created = models.DateTimeField(default=timezone.now())
+    record_date_modified = models.DateTimeField(auto_now=True)

common/djangoapps/api_manager/permissions.py

+""" Permissions classes utilized by Django REST Framework """
+import logging
+
+from django.conf import settings
+
+from rest_framework import permissions
+
+log = logging.getLogger(__name__)
+
+
+class ApiKeyHeaderPermission(permissions.BasePermission):
+    """
+    Check for permissions by matching the configured API key and header
+
+    """
+    def has_permission(self, request, view):
+        """
+        If settings.DEBUG is True and settings.EDX_API_KEY is not set or None,
+        then allow the request. Otherwise, allow the request if and only if
+        settings.EDX_API_KEY is set and the X-Edx-Api-Key HTTP header is
+        present in the request and matches the setting.
+        """
+
+        debug_enabled = settings.DEBUG
+        api_key = getattr(settings, "EDX_API_KEY", None)
+
+        # DEBUG mode rules over all else
+        # Including the api_key check here ensures we don't break the feature locally
+        if debug_enabled and api_key is None:
+            log.warn("EDX_API_KEY Override: Debug Mode")
+            return True
+
+        # If we're not DEBUG, we need a local api key
+        if api_key is None:
+            return False
+
+        # The client needs to present the same api key
+        header_key = request.META['headers'].get('X-Edx-Api-Key')
+        if header_key is None:
+            return False
+
+        # The api key values need to be the same
+        if header_key != api_key:
+            return False
+
+        # Allow the request to take place
+        return True

common/djangoapps/api_manager/serializers.py

+""" Django REST Framework Serializers """
+
+from django.contrib.auth.models import User
+
+from rest_framework import serializers
+
+
+class UserSerializer(serializers.ModelSerializer):
+    """ Serializer for User model interactions """
+    class Meta:
+        """ Serializer/field specification """
+        model = User
+        fields = ("id", "email", "username")
+        read_only_fields = ("id", "email", "username")

common/djangoapps/api_manager/sessions_urls.py

+""" Sessions API URI specification """
+from django.conf.urls import patterns, url
+
+urlpatterns = patterns('api_manager.sessions_views',
+                       url(r'/*$^', 'session_list'),
+                       url(r'^(?P<session_id>[a-z0-9]+)$', 'session_detail'),
+                       )

common/djangoapps/api_manager/sessions_views.py

+# pylint: disable=E1101
+
+""" API implementation for session-oriented interactions. """
+
+from django.conf import settings
+from django.contrib.auth import authenticate, login
+from django.contrib.auth import SESSION_KEY, BACKEND_SESSION_KEY, load_backend
+from django.contrib.auth.models import AnonymousUser, User
+from django.core.exceptions import ObjectDoesNotExist
+from django.utils.importlib import import_module
+
+from rest_framework import status
+from rest_framework.decorators import api_view, permission_classes
+from rest_framework.response import Response
+
+from api_manager.permissions import ApiKeyHeaderPermission
+from api_manager.serializers import UserSerializer
+
+
+def _generate_base_uri(request):
+    """
+    Constructs the protocol:host:path component of the resource uri
+    """
+    protocol = 'http'
+    if request.is_secure():
+        protocol = protocol + 's'
+    resource_uri = '{}://{}{}'.format(
+        protocol,
+        request.get_host(),
+        request.path
+    )
+    return resource_uri
+
+
+@api_view(['POST'])
+@permission_classes((ApiKeyHeaderPermission,))
+def session_list(request):
+    """
+    POST creates a new system session, supported authentication modes:
+    1. Open edX username/password
+    """
+    response_data = {}
+    base_uri = _generate_base_uri(request)
+    try:
+        existing_user = User.objects.get(username=request.DATA['username'])
+    except ObjectDoesNotExist:
+        existing_user = None
+    if existing_user:
+        user = authenticate(username=existing_user.username, password=request.DATA['password'])
+        if user is not None:
+            if user.is_active:
+                login(request, user)
+                response_data['token'] = request.session.session_key
+                response_data['expires'] = request.session.get_expiry_age()
+                user_dto = UserSerializer(user)
+                response_data['user'] = user_dto.data
+                response_data['uri'] = '{}/{}'.format(base_uri, request.session.session_key)
+                response_status = status.HTTP_201_CREATED
+            else:
+                response_status = status.HTTP_403_FORBIDDEN
+        else:
+            response_status = status.HTTP_401_UNAUTHORIZED
+    else:
+        response_status = status.HTTP_404_NOT_FOUND
+    return Response(response_data, status=response_status)
+
+
+@api_view(['GET', 'DELETE'])
+@permission_classes((ApiKeyHeaderPermission,))
+def session_detail(request, session_id):
+    """
+    GET retrieves an existing system session
+    DELETE flushes an existing system session from the system
+    """
+    response_data = {}
+    base_uri = _generate_base_uri(request)
+    engine = import_module(settings.SESSION_ENGINE)
+    session = engine.SessionStore(session_id)
+    if request.method == 'GET':
+        try:
+            user_id = session[SESSION_KEY]
+            backend_path = session[BACKEND_SESSION_KEY]
+            backend = load_backend(backend_path)
+            user = backend.get_user(user_id) or AnonymousUser()
+        except KeyError:
+            user = AnonymousUser()
+        if user.is_authenticated():
+            response_data['token'] = session.session_key
+            response_data['expires'] = session.get_expiry_age()
+            response_data['uri'] = base_uri
+            response_data['user_id'] = user.id
+            return Response(response_data, status=status.HTTP_200_OK)
+        else:
+            return Response(response_data, status=status.HTTP_404_NOT_FOUND)
+    elif request.method == 'DELETE':
+        session.flush()
+        return Response(response_data, status=status.HTTP_204_NO_CONTENT)

common/djangoapps/api_manager/system_views.py

+""" BASE API VIEWS """
+
+from rest_framework import status
+from rest_framework.decorators import api_view, permission_classes
+from rest_framework.response import Response
+
+from api_manager.permissions import ApiKeyHeaderPermission
+
+
+def _generate_base_uri(request):
+    """
+    Constructs the protocol:host:path component of the resource uri
+    """
+    protocol = 'http'
+    if request.is_secure():
+        protocol = protocol + 's'
+    resource_uri = '{}://{}{}'.format(
+        protocol,
+        request.get_host(),
+        request.path
+    )
+    return resource_uri
+
+
+@api_view(['GET'])
+@permission_classes((ApiKeyHeaderPermission,))
+def system_detail(request):
+    """Returns top-level descriptive information about the Open edX API"""
+    base_uri = _generate_base_uri(request)
+    response_data = {}
+    response_data['name'] = "Open edX System API"
+    response_data['description'] = "System interface for managing groups, users, and sessions."
+    response_data['documentation'] = "http://docs.openedxapi.apiary.io/#get-%2Fapi%2Fsystem"
+    response_data['uri'] = base_uri
+    return Response(response_data, status=status.HTTP_200_OK)
+
+
+@api_view(['GET'])
+@permission_classes((ApiKeyHeaderPermission,))
+def api_detail(request):
+    """Returns top-level descriptive information about the Open edX API"""
+    base_uri = _generate_base_uri(request)
+    response_data = {}
+    response_data['name'] = "Open edX API"
+    response_data['description'] = "Machine interface for interactions with Open edX."
+    response_data['documentation'] = "http://docs.openedxapi.apiary.io"
+    response_data['uri'] = base_uri
+    response_data['resources'] = []
+    response_data['resources'].append({'uri': base_uri + 'courses'})
+    response_data['resources'].append({'uri': base_uri + 'groups'})
+    response_data['resources'].append({'uri': base_uri + 'sessions'})
+    response_data['resources'].append({'uri': base_uri + 'system'})
+    response_data['resources'].append({'uri': base_uri + 'users'})
+    return Response(response_data, status=status.HTTP_200_OK)

common/djangoapps/api_manager/tests/test_courses_views.py

+# pylint: disable=E1103
+
+"""
+Run these tests @ Devstack:
+    rake fasttest_lms[common/djangoapps/api_manager/tests/test_group_views.py]
+"""
+import unittest
+import uuid
+
+from django.conf import settings
+from django.core.cache import cache
+from django.test import TestCase, Client
+from django.test.utils import override_settings
+
+from courseware.tests.modulestore_config import TEST_DATA_MIXED_MODULESTORE
+from xmodule.modulestore.tests.factories import CourseFactory, ItemFactory
+
+
+TEST_API_KEY = str(uuid.uuid4())
+
+
+class SecureClient(Client):
+    """ Django test client using a "secure" connection. """
+    def __init__(self, *args, **kwargs):
+        kwargs = kwargs.copy()
+        kwargs.update({'SERVER_PORT': 443, 'wsgi.url_scheme': 'https'})
+        super(SecureClient, self).__init__(*args, **kwargs)
+
+
+@override_settings(MODULESTORE=TEST_DATA_MIXED_MODULESTORE)
+@override_settings(EDX_API_KEY=TEST_API_KEY)
+class CoursesApiTests(TestCase):
+    """ Test suite for Courses API views """
+
+    def setUp(self):
+        self.test_server_prefix = 'https://testserver'
+        self.base_courses_uri = '/api/courses'
+
+        self.course = CourseFactory.create()
+        self.test_data = '<html>{}</html>'.format(str(uuid.uuid4()))
+
+        self.chapter = ItemFactory.create(
+            category="chapter",
+            parent_location=self.course.location,
+            data=self.test_data,
+            display_name="Overview"
+        )
+
+        self.module = ItemFactory.create(
+            category="videosequence",
+            parent_location=self.chapter.location,
+            data=self.test_data,
+            display_name="Video_Sequence"
+        )
+
+        self.submodule = ItemFactory.create(
+            category="video",
+            parent_location=self.module.location,
+            data=self.test_data,
+            display_name="Video_Resources"
+        )
+
+        self.test_course_id = self.course.id
+        self.test_course_name = self.course.display_name
+        self.test_course_number = self.course.number
+        self.test_course_org = self.course.org
+        self.test_chapter_id = self.chapter.id
+        self.test_module_id = self.module.id
+        self.test_submodule_id = self.submodule.id
+        self.base_modules_uri = '/api/courses/' + self.test_course_id + '/modules'
+        self.base_chapters_uri = self.base_modules_uri + '?type=chapter'
+
+        self.client = SecureClient()
+        cache.clear()
+
+    def do_get(self, uri):
+        """Submit an HTTP GET request"""
+        headers = {
+            'Content-Type': 'application/json',
+            'X-Edx-Api-Key': str(TEST_API_KEY),
+        }
+        print "GET: " + uri
+        response = self.client.get(uri, headers=headers)
+        return response
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_course_list_get(self):
+        test_uri = self.base_courses_uri
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 200)
+        self.assertGreater(len(response.data), 0)
+        matched_course = False
+        for course in response.data:
+            if matched_course is False and course['id'] == self.test_course_id:
+                self.assertEqual(course['name'], self.test_course_name)
+                self.assertEqual(course['number'], self.test_course_number)
+                self.assertEqual(course['org'], self.test_course_org)
+                confirm_uri = self.test_server_prefix + test_uri + '/' + course['id']
+                self.assertEqual(course['uri'], confirm_uri)
+                matched_course = True
+        self.assertTrue(matched_course)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_course_detail_get(self):
+        test_uri = self.base_courses_uri + '/' + self.test_course_id
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 200)
+        self.assertGreater(len(response.data), 0)
+        self.assertEqual(response.data['id'], self.test_course_id)
+        self.assertEqual(response.data['name'], self.test_course_name)
+        self.assertEqual(response.data['number'], self.test_course_number)
+        self.assertEqual(response.data['org'], self.test_course_org)
+        confirm_uri = self.test_server_prefix + test_uri
+        self.assertEqual(response.data['uri'], confirm_uri)
+        self.assertGreater(len(response.data['modules']), 0)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_course_detail_get_notfound(self):
+        test_uri = self.base_courses_uri + '/' + 'p29038cvp9hjwefion'
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 404)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_chapter_list_get(self):
+        test_uri = self.base_chapters_uri
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 200)
+        self.assertGreater(len(response.data), 0)
+        matched_chapter = False
+        for chapter in response.data:
+            if matched_chapter is False and chapter['id'] == self.test_chapter_id:
+                self.assertIsNotNone(chapter['uri'])
+                self.assertGreater(len(chapter['uri']), 0)
+                confirm_uri = self.test_server_prefix + self.base_modules_uri + '/' + chapter['id']
+                self.assertEqual(chapter['uri'], confirm_uri)
+                matched_chapter = True
+        self.assertTrue(matched_chapter)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_chapter_detail_get(self):
+        test_uri = self.base_modules_uri + '/' + self.test_chapter_id
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 200)
+        self.assertGreater(len(response.data['id']), 0)
+        self.assertEqual(response.data['id'], self.test_chapter_id)
+        confirm_uri = self.test_server_prefix + test_uri
+        self.assertEqual(response.data['uri'], confirm_uri)
+        self.assertGreater(len(response.data['modules']), 0)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_modules_list_get(self):
+        test_uri = self.base_modules_uri + '/' + self.test_module_id
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 200)
+        self.assertGreater(len(response.data), 0)
+        matched_submodule = False
+        for submodule in response.data['modules']:
+            if matched_submodule is False and submodule['id'] == self.test_submodule_id:
+                self.assertIsNotNone(submodule['uri'])
+                self.assertGreater(len(submodule['uri']), 0)
+                confirm_uri = self.test_server_prefix + self.base_modules_uri + '/' + submodule['id']
+                self.assertEqual(submodule['uri'], confirm_uri)
+                matched_submodule = True
+        self.assertTrue(matched_submodule)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_modules_detail_get(self):
+        test_uri = self.base_modules_uri + '/' + self.test_module_id
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 200)
+        self.assertGreater(len(response.data), 0)
+        self.assertEqual(response.data['id'], self.test_module_id)
+        confirm_uri = self.test_server_prefix + test_uri
+        self.assertEqual(response.data['uri'], confirm_uri)
+        self.assertGreater(len(response.data['modules']), 0)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_modules_detail_get_notfound(self):
+        test_uri = self.base_modules_uri + '/' + '2p38fp2hjfp9283'
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 404)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_modules_list_get_filtered_submodules_for_module(self):
+        test_uri = self.base_modules_uri + '/' + self.test_module_id + '/submodules?type=video'
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 200)
+        self.assertGreater(len(response.data), 0)
+        matched_submodule = False
+        for submodule in response.data:
+            if matched_submodule is False and submodule['id'] == self.test_submodule_id:
+                confirm_uri = self.test_server_prefix + self.base_modules_uri + '/' + submodule['id']
+                self.assertEqual(submodule['uri'], confirm_uri)
+                matched_submodule = True
+        self.assertTrue(matched_submodule)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_modules_list_get_notfound(self):
+        test_uri = self.base_modules_uri + '/2p38fp2hjfp9283/submodules?type=video'
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 404)

common/djangoapps/api_manager/tests/test_groups_views.py

+# pylint: disable=E1103
+
+"""
+Run these tests @ Devstack:
+    rake fasttest_lms[common/djangoapps/api_manager/tests/test_group_views.py]
+"""
+from random import randint
+import unittest
+import uuid
+
+from django.conf import settings
+from django.core.cache import cache
+from django.test import TestCase, Client
+from django.test.utils import override_settings
+
+from api_manager.models import GroupRelationship
+
+TEST_API_KEY = str(uuid.uuid4())
+
+
+class SecureClient(Client):
+    """ Django test client using a "secure" connection. """
+    def __init__(self, *args, **kwargs):
+        kwargs = kwargs.copy()
+        kwargs.update({'SERVER_PORT': 443, 'wsgi.url_scheme': 'https'})
+        super(SecureClient, self).__init__(*args, **kwargs)
+
+
+@override_settings(EDX_API_KEY=TEST_API_KEY)
+class GroupsApiTests(TestCase):
+    """ Test suite for Groups API views """
+
+    def setUp(self):
+        self.test_server_prefix = 'https://testserver'
+        self.test_username = str(uuid.uuid4())
+        self.test_password = str(uuid.uuid4())
+        self.test_email = str(uuid.uuid4()) + '@test.org'
+        self.test_group_name = str(uuid.uuid4())
+        self.base_users_uri = '/api/users'
+        self.base_groups_uri = '/api/groups'
+
+        self.client = SecureClient()
+        cache.clear()
+
+    def do_post(self, uri, data):
+        """Submit an HTTP POST request"""
+        headers = {
+            'Content-Type': 'application/json',
+            'X-Edx-Api-Key': str(TEST_API_KEY),
+        }
+        response = self.client.post(uri, headers=headers, data=data)
+        return response
+
+    def do_get(self, uri):
+        """Submit an HTTP GET request"""
+        headers = {
+            'Content-Type': 'application/json',
+            'X-Edx-Api-Key': str(TEST_API_KEY),
+        }
+        response = self.client.get(uri, headers=headers)
+        return response
+
+    def do_delete(self, uri):
+        """Submit an HTTP DELETE request"""
+        headers = {
+            'Content-Type': 'application/json',
+            'X-Edx-Api-Key': str(TEST_API_KEY),
+        }
+        response = self.client.delete(uri, headers=headers)
+        return response
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_group_list_post(self):
+        data = {'name': self.test_group_name}
+        response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(response.status_code, 201)
+        self.assertGreater(response.data['id'], 0)
+        confirm_uri = self.test_server_prefix + self.base_groups_uri + '/' + str(response.data['id'])
+        self.assertEqual(response.data['uri'], confirm_uri)
+        self.assertGreater(len(response.data['name']), 0)
+
+    # @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    # def test_group_list_post_duplicate(self):
+    #     data = {'name': self.test_group_name}
+    #     response = self.do_post(self.base_groups_uri, data)
+    #     self.assertEqual(response.status_code, 201)
+    #     self.assertGreater(response.data['id'], 0)
+    #     confirm_uri = self.test_server_prefix + self.base_groups_uri + '/' + str(response.data['id'])
+    #     self.assertEqual(response.data['uri'], confirm_uri)
+    #     response = self.do_post(self.base_groups_uri, data)
+    #     self.assertEqual(response.status_code, 409)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_group_detail_get(self):
+        data = {'name': self.test_group_name}
+        response = self.do_post(self.base_groups_uri, data)
+        self.assertGreater(response.data['id'], 0)
+        group_id = response.data['id']
+        test_uri = self.base_groups_uri + '/' + str(group_id)
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.data['id'], group_id)
+        confirm_uri = self.test_server_prefix + test_uri
+        self.assertEqual(response.data['uri'], confirm_uri)
+        self.assertEqual(response.data['name'], self.test_group_name)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_group_detail_get_undefined(self):
+        test_uri = self.base_groups_uri + '/123456789'
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 404)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_group_users_list_post(self):
+        local_username = self.test_username + str(randint(11, 99))
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password}
+        response = self.do_post(self.base_users_uri, data)
+        user_id = response.data['id']
+        data = {'name': 'Alpha Group'}
+        response = self.do_post(self.base_groups_uri, data)
+        group_id = response.data['id']
+        test_uri = self.base_groups_uri + '/' + str(group_id)
+        response = self.do_get(test_uri)
+        test_uri = test_uri + '/users'
+        data = {'user_id': user_id}
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 201)
+        confirm_uri = self.test_server_prefix + test_uri + '/' + str(response.data['user_id'])
+        self.assertEqual(response.data['uri'], confirm_uri)
+        self.assertEqual(response.data['group_id'], str(group_id))
+        self.assertEqual(response.data['user_id'], str(user_id))
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_group_users_list_post_duplicate(self):
+        local_username = self.test_username + str(randint(11, 99))
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password}
+        response = self.do_post(self.base_users_uri, data)
+        user_id = response.data['id']
+        data = {'name': 'Alpha Group'}
+        response = self.do_post(self.base_groups_uri, data)
+        test_uri = self.base_groups_uri + '/' + str(response.data['id'])
+        response = self.do_get(test_uri)
+        test_uri = test_uri + '/users'
+        data = {'user_id': user_id}
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 201)
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 409)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_group_users_list_post_invalid_resources(self):
+        test_uri = self.base_groups_uri + '/1239878976'
+        test_uri = test_uri + '/users'
+        data = {'user_id': "98723896"}
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 404)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_group_users_detail_get(self):
+        local_username = self.test_username + str(randint(11, 99))
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password}
+        response = self.do_post(self.base_users_uri, data)
+        user_id = response.data['id']
+        data = {'name': 'Alpha Group'}
+        response = self.do_post(self.base_groups_uri, data)
+        group_id = response.data['id']
+        test_uri = self.base_groups_uri + '/' + str(response.data['id'])
+        response = self.do_get(test_uri)
+        test_uri = test_uri + '/users'
+        data = {'user_id': user_id}
+        response = self.do_post(test_uri, data)
+        test_uri = test_uri + '/' + str(user_id)
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 200)
+        self.assertGreater(len(response.data['uri']), 0)
+        confirm_uri = self.test_server_prefix + test_uri
+        self.assertEqual(response.data['uri'], confirm_uri)
+        self.assertEqual(response.data['group_id'], group_id)
+        self.assertEqual(response.data['user_id'], user_id)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_group_users_detail_delete(self):
+        local_username = self.test_username + str(randint(11, 99))
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password}
+        response = self.do_post(self.base_users_uri, data)
+        user_id = response.data['id']
+        data = {'name': 'Alpha Group'}
+        response = self.do_post(self.base_groups_uri, data)
+        test_uri = self.base_groups_uri + '/' + str(response.data['id'])
+        response = self.do_get(test_uri)
+        test_uri = test_uri + '/users'
+        data = {'user_id': user_id}
+        response = self.do_post(test_uri, data)
+        test_uri = test_uri + '/' + str(user_id)
+        response = self.do_delete(test_uri)
+        self.assertEqual(response.status_code, 204)
+        response = self.do_delete(test_uri)
+        self.assertEqual(response.status_code, 204)  # Idempotent
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 404)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_group_users_detail_delete_invalid_group(self):
+        test_uri = self.base_groups_uri + '/123987102/users/123124'
+        response = self.do_delete(test_uri)
+        self.assertEqual(response.status_code, 204)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_group_users_detail_delete_invalid_user(self):
+        data = {'name': self.test_group_name}
+        response = self.do_post(self.base_groups_uri, data)
+        test_uri = self.base_groups_uri + '/' + str(response.data['id'])
+        test_uri = test_uri + '/users/123124'
+        response = self.do_delete(test_uri)
+        self.assertEqual(response.status_code, 204)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_group_users_detail_get_undefined(self):
+        local_username = self.test_username + str(randint(11, 99))
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password}
+        response = self.do_post(self.base_users_uri, data)
+        user_id = response.data['id']
+        data = {'name': 'Alpha Group'}
+        response = self.do_post(self.base_groups_uri, data)
+        group_id = response.data['id']
+        test_uri = self.base_groups_uri + '/' + str(group_id) + '/users/' + str(user_id)
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 404)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_group_groups_list_post_hierarchical(self):
+        data = {'name': 'Alpha Group'}
+        alpha_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(alpha_response.status_code, 201)
+        data = {'name': 'Beta Group'}
+        beta_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(beta_response.status_code, 201)
+        data = {'name': 'Delta Group'}
+        delta_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(delta_response.status_code, 201)
+        test_uri = alpha_response.data['uri'] + '/groups'
+        group_id = delta_response.data['id']
+        relationship_type = 'h'  # Hierarchical
+        data = {'group_id': group_id, 'relationship_type': relationship_type}
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 201)
+        self.assertGreater(len(response.data['uri']), 0)
+        confirm_uri = test_uri + '/' + str(response.data['group_id'])
+        self.assertEqual(response.data['uri'], confirm_uri)
+        self.assertEqual(response.data['group_id'], str(group_id))
+        self.assertEqual(response.data['relationship_type'], relationship_type)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_group_groups_list_post_linked(self):
+        data = {'name': 'Alpha Group'}
+        alpha_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(alpha_response.status_code, 201)
+        data = {'name': 'Beta Group'}
+        beta_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(beta_response.status_code, 201)
+        data = {'name': 'Delta Group'}
+        delta_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(delta_response.status_code, 201)
+        test_uri = alpha_response.data['uri'] + '/groups'
+        group_id = delta_response.data['id']
+        relationship_type = 'g'  # Graph
+        data = {'group_id': group_id, 'relationship_type': relationship_type}
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 201)
+        self.assertGreater(len(response.data['uri']), 0)
+        confirm_uri = test_uri + '/' + str(response.data['group_id'])
+        self.assertEqual(response.data['uri'], confirm_uri)
+        self.assertEqual(response.data['group_id'], str(group_id))
+        self.assertEqual(response.data['relationship_type'], relationship_type)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_group_groups_list_post_linked_duplicate(self):
+        data = {'name': 'Alpha Group'}
+        alpha_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(alpha_response.status_code, 201)
+        data = {'name': 'Beta Group'}
+        beta_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(beta_response.status_code, 201)
+        data = {'name': 'Delta Group'}
+        delta_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(delta_response.status_code, 201)
+        test_uri = alpha_response.data['uri'] + '/groups'
+        group_id = delta_response.data['id']
+        relationship_type = 'g'  # Graph
+        data = {'group_id': group_id, 'relationship_type': relationship_type}
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 201)
+        response = self.do_post(test_uri, data)
+        # Duplicate responses are idemnotent in this case
+        self.assertEqual(response.status_code, 201)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_group_groups_list_post_invalid_group(self):
+        test_uri = self.base_groups_uri + '/123098/groups'
+        relationship_type = 'g'  # Graph
+        data = {'group_id': '232987', 'relationship_type': relationship_type}
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 404)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_group_groups_list_post_invalid_relationship_type(self):
+        data = {'name': 'Alpha Group'}
+        alpha_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(alpha_response.status_code, 201)
+        data = {'name': 'Beta Group'}
+        beta_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(beta_response.status_code, 201)
+        data = {'name': 'Delta Group'}
+        delta_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(delta_response.status_code, 201)
+        test_uri = alpha_response.data['uri'] + '/groups'
+        group_id = delta_response.data['id']
+        relationship_type = "z"  # Graph
+        data = {'group_id': group_id, 'relationship_type': relationship_type}
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 406)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_group_groups_list_get(self):
+        data = {'name': 'Bravo Group'}
+        bravo_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(bravo_response.status_code, 201)
+        bravo_group_id = bravo_response.data['id']
+        bravo_groups_uri = bravo_response.data['uri'] + '/groups'
+
+        data = {'name': 'Charlie Group'}
+        charlie_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(charlie_response.status_code, 201)
+        charlie_group_id = charlie_response.data['id']
+        relationship_type = 'h'  # Hierarchical
+        data = {'group_id': charlie_group_id, 'relationship_type': relationship_type}
+        response = self.do_post(bravo_groups_uri, data)
+        self.assertEqual(response.status_code, 201)
+
+        data = {'name': 'Foxtrot Group'}
+        foxtrot_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(foxtrot_response.status_code, 201)
+        foxtrot_group_id = foxtrot_response.data['id']
+        relationship_type = 'g'  # Graph
+        data = {'group_id': foxtrot_group_id, 'relationship_type': relationship_type}
+        response = self.do_post(bravo_groups_uri, data)
+        self.assertEqual(response.status_code, 201)
+
+        data = {'name': 'Tango Group'}
+        tango_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(tango_response.status_code, 201)
+        tango_group_id = tango_response.data['id']
+        tango_uri = tango_response.data['uri']
+        data = {'group_id': bravo_group_id, 'relationship_type': relationship_type}
+        tango_groups_uri = tango_uri + '/groups'
+        response = self.do_post(tango_groups_uri, data)
+        self.assertEqual(response.status_code, 201)
+
+        response = self.do_get(bravo_groups_uri)
+        self.assertEqual(response.status_code, 200)
+        self.assertGreater(len(response.data), 0)
+        group_idlist = (charlie_group_id, foxtrot_group_id, tango_group_id)
+        relationship_count = 0
+        for relationship in response.data:
+            relationship_count = relationship_count + 1
+            group_id = relationship['id']
+            self.assertGreater(group_id, 0)
+            self.assertFalse(bravo_group_id == group_id)
+            self.assertTrue(relationship['relationship_type'] in ["h", "g"])
+            self.assertGreater(len(relationship['uri']), 0)
+        self.assertEqual(relationship_count, len(group_idlist))
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_group_groups_list_get_notfound(self):
+        test_uri = self.base_groups_uri + '/213213123/groups'
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 404)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_group_groups_detail_get_hierarchical(self):
+        data = {'name': 'Alpha Group'}
+        alpha_response = self.do_post(self.base_groups_uri, data)
+        alpha_group_id = alpha_response.data['id']
+        self.assertEqual(alpha_response.status_code, 201)
+        data = {'name': 'Beta Group'}
+        beta_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(beta_response.status_code, 201)
+        data = {'name': 'Delta Group'}
+        delta_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(delta_response.status_code, 201)
+        test_uri = alpha_response.data['uri'] + '/groups'
+        delta_group_id = delta_response.data['id']
+        relationship_type = 'h'  # Hierarchical
+        data = {'group_id': delta_group_id, 'relationship_type': relationship_type}
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 201)
+        test_uri = response.data['uri']
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 200)
+        self.assertGreater(len(response.data['uri']), 0)
+        confirm_uri = test_uri
+        self.assertEqual(response.data['uri'], confirm_uri)
+        self.assertEqual(response.data['from_group_id'], str(alpha_group_id))
+        self.assertEqual(response.data['to_group_id'], str(delta_group_id))
+        self.assertEqual(response.data['relationship_type'], relationship_type)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_group_groups_detail_get_linked(self):
+        data = {'name': 'Alpha Group'}
+        alpha_response = self.do_post(self.base_groups_uri, data)
+        alpha_group_id = alpha_response.data['id']
+        self.assertEqual(alpha_response.status_code, 201)
+        data = {'name': 'Beta Group'}
+        beta_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(beta_response.status_code, 201)
+        data = {'name': 'Delta Group'}
+        delta_response = self.do_post(self.base_groups_uri, data)
+        delta_group_id = delta_response.data['id']
+        self.assertEqual(delta_response.status_code, 201)
+        test_uri = alpha_response.data['uri'] + '/groups'
+        relationship_type = 'g'  # Graph
+        data = {'group_id': delta_group_id, 'relationship_type': relationship_type}
+        delta_group = GroupRelationship.objects.get(group_id=delta_group_id)
+        delta_group.parent_group_id = None
+        delta_group.save()
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 201)
+        test_uri = response.data['uri']
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 200)
+        self.assertGreater(len(response.data['uri']), 0)
+        confirm_uri = test_uri
+        self.assertEqual(response.data['uri'], confirm_uri)
+        self.assertEqual(response.data['from_group_id'], str(alpha_group_id))
+        self.assertEqual(response.data['to_group_id'], str(delta_group_id))
+        self.assertEqual(response.data['relationship_type'], relationship_type)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_group_groups_detail_get_notfound(self):
+        data = {'name': 'Alpha Group'}
+        alpha_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(alpha_response.status_code, 201)
+        test_uri = alpha_response.data['uri'] + '/groups/gaois89sdf98'
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 404)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_group_groups_detail_delete_hierarchical(self):
+        data = {'name': 'Alpha Group'}
+        alpha_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(alpha_response.status_code, 201)
+        data = {'name': 'Beta Group'}
+        beta_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(beta_response.status_code, 201)
+        data = {'name': 'Delta Group'}
+        delta_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(delta_response.status_code, 201)
+        data = {'name': 'Gamma Group'}
+        gamma_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(gamma_response.status_code, 201)
+        test_uri = alpha_response.data['uri'] + '/groups'
+        group_id = gamma_response.data['id']
+        relationship_type = 'h'
+        data = {'group_id': group_id, 'relationship_type': relationship_type}
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 201)
+        test_uri = response.data['uri']
+        response = self.do_delete(test_uri)
+        self.assertEqual(response.status_code, 204)
+        response = self.do_delete(test_uri)
+        self.assertEqual(response.status_code, 204)
+        try:
+            self.assertIsNone(response.data['message'])
+        except KeyError:
+            pass
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 404)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_group_groups_detail_delete_linked(self):
+        data = {'name': 'Alpha Group'}
+        alpha_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(alpha_response.status_code, 201)
+        data = {'name': 'Beta Group'}
+        beta_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(beta_response.status_code, 201)
+        data = {'name': 'Delta Group'}
+        delta_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(delta_response.status_code, 201)
+        data = {'name': 'Gamma Group'}
+        gamma_response = self.do_post(self.base_groups_uri, data)
+        self.assertEqual(gamma_response.status_code, 201)
+        test_uri = alpha_response.data['uri'] + '/groups'
+        group_id = gamma_response.data['id']
+        relationship_type = 'g'
+        data = {'group_id': group_id, 'relationship_type': relationship_type}
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 201)
+        test_uri = response.data['uri']
+        response = self.do_delete(test_uri)
+        self.assertEqual(response.status_code, 204)
+        try:
+            self.assertIsNone(response.data['message'])
+        except KeyError:
+            pass
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 404)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_group_groups_detail_delete_invalid(self):
+        test_uri = self.base_groups_uri + '/1231234232/groups/1'
+        response = self.do_delete(test_uri)
+        self.assertEqual(response.status_code, 404)

common/djangoapps/api_manager/tests/test_permissions.py

+"""
+Run these tests @ Devstack:
+    rake fasttest_lms[common/djangoapps/api_manager/tests/test_permissions.py]
+"""
+from random import randint
+import unittest
+import uuid
+
+from django.conf import settings
+from django.test import TestCase
+from django.test.utils import override_settings
+
+TEST_API_KEY = "123456ABCDEF"
+
+
+@override_settings(DEBUG=True, EDX_API_KEY=None)
+class PermissionsTestsDebug(TestCase):
+    """ Test suite for Permissions helper classes """
+    def setUp(self):
+        self.test_username = str(uuid.uuid4())
+        self.test_password = str(uuid.uuid4())
+        self.test_email = str(uuid.uuid4()) + '@test.org'
+
+    def do_post(self, uri, data):
+        """Submit an HTTP POST request"""
+        headers = {
+            'Content-Type': 'application/json',
+            'X-Edx-Api-Key': str(TEST_API_KEY),
+        }
+        response = self.client.post(uri, headers=headers, data=data)
+        return response
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_has_permission_debug_enabled(self):
+        test_uri = '/api/users'
+        local_username = self.test_username + str(randint(11, 99))
+        local_username = local_username[3:-1]  # username is a 32-character field
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password}
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 201)
+
+
+@override_settings(DEBUG=False, EDX_API_KEY="123456ABCDEF")
+class PermissionsTestsApiKey(TestCase):
+    """ Test suite for Permissions helper classes """
+    def setUp(self):
+        self.test_username = str(uuid.uuid4())
+        self.test_password = str(uuid.uuid4())
+        self.test_email = str(uuid.uuid4()) + '@test.org'
+
+    def do_post(self, uri, data):
+        """Submit an HTTP POST request"""
+        headers = {
+            'Content-Type': 'application/json',
+            'X-Edx-Api-Key': str(TEST_API_KEY),
+        }
+        response = self.client.post(uri, headers=headers, data=data)
+        return response
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_has_permission_valid_api_key(self):
+        test_uri = '/api/users'
+        local_username = self.test_username + str(randint(11, 99))
+        local_username = local_username[3:-1]  # username is a 32-character field
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password}
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 201)
+
+
+@override_settings(DEBUG=False, EDX_API_KEY=None)
+class PermissionsTestDeniedMissingServerKey(TestCase):
+    """ Test suite for Permissions helper classes """
+    def setUp(self):
+        self.test_username = str(uuid.uuid4())
+        self.test_password = str(uuid.uuid4())
+        self.test_email = str(uuid.uuid4()) + '@test.org'
+
+    def do_post(self, uri, data):
+        """Submit an HTTP POST request"""
+        headers = {
+            'Content-Type': 'application/json',
+            'X-Edx-Api-Key': str(TEST_API_KEY),
+        }
+        response = self.client.post(uri, headers=headers, data=data)
+        return response
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_has_permission_missing_server_key(self):
+        test_uri = '/api/users'
+        local_username = self.test_username + str(randint(11, 99))
+        local_username = local_username[3:-1]  # username is a 32-character field
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password}
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 403)
+
+
+@override_settings(DEBUG=False, EDX_API_KEY="67890VWXYZ")
+class PermissionsTestDeniedMissingClientKey(TestCase):
+    """ Test suite for Permissions helper classes """
+    def setUp(self):
+        self.test_username = str(uuid.uuid4())
+        self.test_password = str(uuid.uuid4())
+        self.test_email = str(uuid.uuid4()) + '@test.org'
+
+    def do_post(self, uri, data):
+        """Submit an HTTP POST request"""
+        headers = {
+            'Content-Type': 'application/json',
+        }
+        response = self.client.post(uri, headers=headers, data=data)
+        return response
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_has_permission_invalid_client_key(self):
+        test_uri = '/api/users'
+        local_username = self.test_username + str(randint(11, 99))
+        local_username = local_username[3:-1]  # username is a 32-character field
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password}
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 403)
+
+
+@override_settings(DEBUG=False, EDX_API_KEY="67890VWXYZ")
+class PermissionsTestDeniedInvalidClientKey(TestCase):
+    """ Test suite for Permissions helper classes """
+    def setUp(self):
+        self.test_username = str(uuid.uuid4())
+        self.test_password = str(uuid.uuid4())
+        self.test_email = str(uuid.uuid4()) + '@test.org'
+
+    def do_post(self, uri, data):
+        """Submit an HTTP POST request"""
+        headers = {
+            'Content-Type': 'application/json',
+            'X-Edx-Api-Key': str(TEST_API_KEY),
+        }
+        response = self.client.post(uri, headers=headers, data=data)
+        return response
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_has_permission_invalid_client_key(self):
+        test_uri = '/api/users'
+        local_username = self.test_username + str(randint(11, 99))
+        local_username = local_username[3:-1]  # username is a 32-character field
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password}
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 403)

common/djangoapps/api_manager/tests/test_sessions_views.py

+# pylint: disable=E1101
+# pylint: disable=E1103
+
+"""
+Run these tests @ Devstack:
+    rake fasttest_lms[common/djangoapps/api_manager/tests/test_session_views.py]
+"""
+from random import randint
+import unittest
+import uuid
+
+from django.conf import settings
+from django.contrib.auth.models import User
+from django.core.cache import cache
+from django.test import TestCase, Client
+from django.test.utils import override_settings
+
+TEST_API_KEY = str(uuid.uuid4())
+
+
+class SecureClient(Client):
+    """ Django test client using a "secure" connection. """
+    def __init__(self, *args, **kwargs):
+        kwargs = kwargs.copy()
+        kwargs.update({'SERVER_PORT': 443, 'wsgi.url_scheme': 'https'})
+        super(SecureClient, self).__init__(*args, **kwargs)
+
+
+@override_settings(EDX_API_KEY=TEST_API_KEY)
+class SessionsApiTests(TestCase):
+    """ Test suite for Sessions API views """
+
+    def setUp(self):
+        self.test_server_prefix = 'https://testserver'
+        self.test_username = str(uuid.uuid4())
+        self.test_password = str(uuid.uuid4())
+        self.test_email = str(uuid.uuid4()) + '@test.org'
+        self.base_users_uri = '/api/users'
+        self.base_sessions_uri = '/api/sessions'
+
+        self.client = SecureClient()
+        cache.clear()
+
+    def do_post(self, uri, data):
+        """Submit an HTTP POST request"""
+        headers = {
+            'Content-Type': 'application/json',
+            'X-Edx-Api-Key': str(TEST_API_KEY),
+        }
+        response = self.client.post(uri, headers=headers, data=data)
+        return response
+
+    def do_get(self, uri):
+        """Submit an HTTP GET request"""
+        headers = {
+            'Content-Type': 'application/json',
+            'X-Edx-Api-Key': str(TEST_API_KEY),
+        }
+        response = self.client.get(uri, headers=headers)
+        return response
+
+    def do_delete(self, uri):
+        """Submit an HTTP DELETE request"""
+        headers = {
+            'Content-Type': 'application/json',
+            'X-Edx-Api-Key': str(TEST_API_KEY),
+        }
+        response = self.client.delete(uri, headers=headers)
+        return response
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_session_list_post_valid(self):
+        local_username = self.test_username + str(randint(11, 99))
+        local_username = local_username[3:-1]  # username is a 32-character field
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password}
+        response = self.do_post(self.base_users_uri, data)
+        user_id = response.data['id']
+        data = {'username': local_username, 'password': self.test_password}
+        response = self.do_post(self.base_sessions_uri, data)
+        self.assertEqual(response.status_code, 201)
+        self.assertGreater(len(response.data['token']), 0)
+        confirm_uri = self.test_server_prefix + self.base_sessions_uri + '/' + response.data['token']
+        self.assertEqual(response.data['uri'], confirm_uri)
+        self.assertGreater(response.data['expires'], 0)
+        self.assertGreater(len(response.data['user']), 0)
+        self.assertEqual(str(response.data['user']['username']), local_username)
+        self.assertEqual(response.data['user']['id'], user_id)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_session_list_post_invalid(self):
+        local_username = self.test_username + str(randint(11, 99))
+        local_username = local_username[3:-1]  # username is a 32-character field
+        bad_password = "12345"
+        data = {'email': self.test_email, 'username': local_username, 'password': bad_password}
+        response = self.do_post(self.base_users_uri, data)
+        data = {'username': local_username, 'password': self.test_password}
+        response = self.do_post(self.base_sessions_uri, data)
+        self.assertEqual(response.status_code, 401)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_session_list_post_valid_inactive(self):
+        local_username = self.test_username + str(randint(11, 99))
+        local_username = local_username[3:-1]  # username is a 32-character field
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password}
+        response = self.do_post(self.base_users_uri, data)
+        user = User.objects.get(username=local_username)
+        user.is_active = False
+        user.save()
+        data = {'username': local_username, 'password': self.test_password}
+        response = self.do_post(self.base_sessions_uri, data)
+        self.assertEqual(response.status_code, 403)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_session_list_post_invalid_notfound(self):
+        data = {'username': 'user_12321452334', 'password': self.test_password}
+        response = self.do_post(self.base_sessions_uri, data)
+        self.assertEqual(response.status_code, 404)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_session_detail_get(self):
+        local_username = self.test_username + str(randint(11, 99))
+        local_username = local_username[3:-1]  # username is a 32-character field
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password}
+        response = self.do_post(self.base_users_uri, data)
+        data = {'username': local_username, 'password': self.test_password}
+        response = self.do_post(self.base_sessions_uri, data)
+        test_uri = self.base_sessions_uri + '/' + response.data['token']
+        post_token = response.data['token']
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.data['token'], post_token)
+        response = self.do_delete(test_uri)
+        self.assertEqual(response.status_code, 204)
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 404)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_session_detail_get_undefined(self):
+        test_uri = self.base_sessions_uri + "/123456789"
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 404)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_session_detail_delete(self):
+        local_username = self.test_username + str(randint(11, 99))
+        local_username = local_username[3:-1]  # username is a 32-character field
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password}
+        response = self.do_post(self.base_users_uri, data)
+        self.assertEqual(response.status_code, 201)
+        data = {'username': local_username, 'password': self.test_password}
+        response = self.do_post(self.base_sessions_uri, data)
+        self.assertEqual(response.status_code, 201)
+        test_uri = self.base_users_uri + str(response.data['user']['id'])
+        response = self.do_delete(test_uri)
+        self.assertEqual(response.status_code, 204)
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 404)

common/djangoapps/api_manager/tests/test_users_views.py

+# pylint: disable=E1103
+
+"""
+Run these tests @ Devstack:
+    rake fasttest_lms[common/djangoapps/api_manager/tests/test_user_views.py]
+"""
+from random import randint
+import simplejson as json
+import unittest
+import uuid
+
+from django.conf import settings
+from django.contrib.auth.models import User
+from django.core.cache import cache
+from django.test import TestCase, Client
+from django.test.utils import override_settings
+
+from courseware.tests.modulestore_config import TEST_DATA_MIXED_MODULESTORE
+from xmodule.modulestore.tests.factories import CourseFactory, ItemFactory
+
+TEST_API_KEY = str(uuid.uuid4())
+
+
+class SecureClient(Client):
+    """ Django test client using a "secure" connection. """
+    def __init__(self, *args, **kwargs):
+        kwargs = kwargs.copy()
+        kwargs.update({'SERVER_PORT': 443, 'wsgi.url_scheme': 'https'})
+        super(SecureClient, self).__init__(*args, **kwargs)
+
+
+@override_settings(MODULESTORE=TEST_DATA_MIXED_MODULESTORE)
+@override_settings(EDX_API_KEY=TEST_API_KEY)
+class UsersApiTests(TestCase):
+    """ Test suite for Users API views """
+
+    def setUp(self):
+        self.test_server_prefix = 'https://testserver'
+        self.test_username = str(uuid.uuid4())
+        self.test_password = str(uuid.uuid4())
+        self.test_email = str(uuid.uuid4()) + '@test.org'
+        self.test_first_name = str(uuid.uuid4())
+        self.test_last_name = str(uuid.uuid4())
+
+        self.client = SecureClient()
+        cache.clear()
+
+    def do_post(self, uri, data):
+        """Submit an HTTP POST request"""
+        headers = {
+            'X-Edx-Api-Key': str(TEST_API_KEY),
+        }
+        json_data = json.dumps(data)
+        print "POST: " + uri
+        print json_data
+        print ""
+
+        response = self.client.post(uri, headers=headers, content_type='application/json', data=json_data)
+        return response
+
+    def do_get(self, uri):
+        """Submit an HTTP GET request"""
+        headers = {
+            'Content-Type': 'application/json',
+            'X-Edx-Api-Key': str(TEST_API_KEY),
+        }
+        response = self.client.get(uri, headers=headers)
+        return response
+
+    def do_delete(self, uri):
+        """Submit an HTTP DELETE request"""
+        headers = {
+            'Content-Type': 'application/json',
+            'X-Edx-Api-Key': str(TEST_API_KEY),
+        }
+        response = self.client.delete(uri, headers=headers)
+        return response
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_user_list_post(self):
+        test_uri = '/api/users'
+        local_username = self.test_username + str(randint(11, 99))
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password, 'first_name': self.test_first_name, 'last_name': self.test_last_name}
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 201)
+        self.assertGreater(response.data['id'], 0)
+        confirm_uri = self.test_server_prefix + test_uri + '/' + str(response.data['id'])
+        self.assertEqual(response.data['uri'], confirm_uri)
+        self.assertEqual(response.data['email'], self.test_email)
+        self.assertEqual(response.data['username'], local_username)
+        self.assertEqual(response.data['first_name'], self.test_first_name)
+        self.assertEqual(response.data['last_name'], self.test_last_name)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_user_list_post_duplicate(self):
+        test_uri = '/api/users'
+        local_username = self.test_username + str(randint(11, 99))
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password, 'first_name': self.test_first_name, 'last_name': self.test_last_name}
+        response = self.do_post(test_uri, data)
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 409)
+        self.assertGreater(response.data['message'], 0)
+        self.assertEqual(response.data['field_conflict'], 'username')
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_user_detail_get(self):
+        test_uri = '/api/users'
+        local_username = self.test_username + str(randint(11, 99))
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password, 'first_name': self.test_first_name, 'last_name': self.test_last_name}
+        response = self.do_post(test_uri, data)
+        test_uri = test_uri + '/' + str(response.data['id'])
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 200)
+        self.assertGreater(response.data['id'], 0)
+        confirm_uri = self.test_server_prefix + test_uri
+        self.assertEqual(response.data['uri'], confirm_uri)
+        self.assertEqual(response.data['email'], self.test_email)
+        self.assertEqual(response.data['username'], local_username)
+        self.assertEqual(response.data['first_name'], self.test_first_name)
+        self.assertEqual(response.data['last_name'], self.test_last_name)
+        self.assertEqual(len(response.data['resources']), 2)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_user_detail_delete(self):
+        test_uri = '/api/users'
+        local_username = self.test_username + str(randint(11, 99))
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password, 'first_name': self.test_first_name, 'last_name': self.test_last_name}
+        response = self.do_post(test_uri, data)
+        test_uri = test_uri + '/' + str(response.data['id'])
+        response = self.do_delete(test_uri)
+        self.assertEqual(response.status_code, 204)
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 404)
+        response = self.do_delete(test_uri)  # User no longer exists, should get a 204 all the same
+        self.assertEqual(response.status_code, 204)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_user_detail_get_undefined(self):
+        test_uri = '/api/users/123456789'
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 404)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_user_groups_list_post(self):
+        test_uri = '/api/groups'
+        data = {'name': 'Alpha Group'}
+        response = self.do_post(test_uri, data)
+        group_id = response.data['id']
+        test_uri = '/api/users'
+        local_username = self.test_username + str(randint(11, 99))
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password, 'first_name': self.test_first_name, 'last_name': self.test_last_name}
+        response = self.do_post(test_uri, data)
+        user_id = response.data['id']
+        test_uri = test_uri + '/' + str(response.data['id'])
+        response = self.do_get(test_uri)
+        test_uri = test_uri + '/groups'
+        data = {'group_id': group_id}
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 201)
+        self.assertGreater(len(response.data['uri']), 0)
+        confirm_uri = self.test_server_prefix + test_uri + '/' + str(group_id)
+        self.assertEqual(response.data['uri'], confirm_uri)
+        self.assertEqual(response.data['group_id'], str(group_id))
+        self.assertEqual(response.data['user_id'], str(user_id))
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_user_groups_list_post_duplicate(self):
+        test_uri = '/api/groups'
+        data = {'name': 'Alpha Group'}
+        response = self.do_post(test_uri, data)
+        group_id = response.data['id']
+        test_uri = '/api/users'
+        local_username = self.test_username + str(randint(11, 99))
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password, 'first_name': self.test_first_name, 'last_name': self.test_last_name}
+        response = self.do_post(test_uri, data)
+        test_uri = test_uri + '/' + str(response.data['id'])
+        response = self.do_get(test_uri)
+        test_uri = test_uri + '/groups'
+        data = {'group_id': group_id}
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 201)
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 409)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_user_groups_list_post_invalid_user(self):
+        test_uri = '/api/groups'
+        data = {'name': 'Alpha Group'}
+        response = self.do_post(test_uri, data)
+        group_id = response.data['id']
+        test_uri = '/api/users/897698769/groups'
+        data = {'group_id': group_id}
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 404)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_user_groups_detail_get(self):
+        test_uri = '/api/groups'
+        data = {'name': 'Alpha Group'}
+        response = self.do_post(test_uri, data)
+        group_id = response.data['id']
+        test_uri = '/api/users'
+        local_username = self.test_username + str(randint(11, 99))
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password, 'first_name': self.test_first_name, 'last_name': self.test_last_name}
+        response = self.do_post(test_uri, data)
+        user_id = response.data['id']
+        test_uri = test_uri + '/' + str(response.data['id']) + '/groups'
+        data = {'group_id': group_id}
+        response = self.do_post(test_uri, data)
+        test_uri = test_uri + '/' + str(group_id)
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 200)
+        self.assertGreater(len(response.data['uri']), 0)
+        confirm_uri = self.test_server_prefix + test_uri
+        self.assertEqual(response.data['uri'], confirm_uri)
+        self.assertEqual(response.data['group_id'], group_id)
+        self.assertEqual(response.data['user_id'], user_id)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_user_groups_detail_delete(self):
+        test_uri = '/api/groups'
+        data = {'name': 'Alpha Group'}
+        response = self.do_post(test_uri, data)
+        group_id = response.data['id']
+        test_uri = '/api/users'
+        local_username = self.test_username + str(randint(11, 99))
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password, 'first_name': self.test_first_name, 'last_name': self.test_last_name}
+        response = self.do_post(test_uri, data)
+        test_uri = test_uri + '/' + str(response.data['id']) + '/groups'
+        data = {'group_id': group_id}
+        response = self.do_post(test_uri, data)
+        test_uri = test_uri + '/' + str(group_id)
+        response = self.do_delete(test_uri)
+        self.assertEqual(response.status_code, 204)
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 404)
+        response = self.do_delete(test_uri)  # Relationship no longer exists, should get a 204 all the same
+        self.assertEqual(response.status_code, 204)
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 404)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_user_groups_detail_get_undefined(self):
+        test_uri = '/api/groups'
+        data = {'name': 'Alpha Group'}
+        response = self.do_post(test_uri, data)
+        group_id = response.data['id']
+        test_uri = '/api/users'
+        local_username = self.test_username + str(randint(11, 99))
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password, 'first_name': self.test_first_name, 'last_name': self.test_last_name}
+        response = self.do_post(test_uri, data)
+        user_id = response.data['id']
+        test_uri = '/api/users/' + str(user_id) + '/groups/' + str(group_id)
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 404)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_user_courses_list_post(self):
+        course = CourseFactory.create()
+        test_uri = '/api/users'
+        local_username = self.test_username + str(randint(11, 99))
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password, 'first_name': self.test_first_name, 'last_name': self.test_last_name}
+        response = self.do_post(test_uri, data)
+        user_id = response.data['id']
+        test_uri = '{}/{}/courses'.format(test_uri, str(user_id))
+        data = {'course_id': course.id}
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 201)
+        confirm_uri = self.test_server_prefix + test_uri + '/' + course.id
+        self.assertEqual(response.data['uri'], confirm_uri)
+        self.assertEqual(response.data['id'], course.id)
+        self.assertTrue(response.data['is_active'])
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_user_courses_list_post_undefined_user(self):
+        course = CourseFactory.create()
+        test_uri = '/api/users'
+        user_id = '234234'
+        test_uri = '{}/{}/courses'.format(test_uri, str(user_id))
+        data = {'course_id': course.id}
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 404)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_user_courses_list_post_undefined_course(self):
+        test_uri = '/api/users'
+        local_username = self.test_username + str(randint(11, 99))
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password, 'first_name': self.test_first_name, 'last_name': self.test_last_name}
+        response = self.do_post(test_uri, data)
+        user_id = response.data['id']
+        test_uri = '{}/{}/courses'.format(test_uri, str(user_id))
+        data = {'course_id': '234asdfapsdf'}
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 404)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_user_courses_list_get(self):
+        course = CourseFactory.create(display_name="TEST COURSE")
+        test_uri = '/api/users'
+        local_username = self.test_username + str(randint(11, 99))
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password, 'first_name': self.test_first_name, 'last_name': self.test_last_name}
+        response = self.do_post(test_uri, data)
+        user_id = response.data['id']
+        test_uri = '{}/{}/courses'.format(test_uri, str(user_id))
+        data = {'course_id': course.id}
+        response = self.do_post(test_uri, data)
+        self.assertEqual(response.status_code, 201)
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 200)
+        confirm_uri = self.test_server_prefix + test_uri + '/' + course.id
+        self.assertEqual(response.data[0]['uri'], confirm_uri)
+        self.assertEqual(response.data[0]['id'], course.id)
+        self.assertTrue(response.data[0]['is_active'])
+        self.assertEqual(response.data[0]['name'], course.display_name)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_user_courses_list_get_undefined_user(self):
+        test_uri = '/api/users/2134234/courses'
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 404)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_user_courses_detail_post_position_course_as_descriptor(self):
+        course = CourseFactory.create()
+        test_data = '<html>{}</html>'.format(str(uuid.uuid4()))
+        chapter1 = ItemFactory.create(
+            category="chapter",
+            parent_location=course.location,
+            data=test_data,
+            display_name="Chapter 1"
+        )
+        chapter2 = ItemFactory.create(
+            category="chapter",
+            parent_location=course.location,
+            data=test_data,
+            display_name="Chapter 2"
+        )
+        chapter3 = ItemFactory.create(
+            category="chapter",
+            parent_location=course.location,
+            data=test_data,
+            display_name="Chapter 3"
+        )
+        test_uri = '/api/users'
+        local_username = self.test_username + str(randint(11, 99))
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password, 'first_name': self.test_first_name, 'last_name': self.test_last_name}
+        response = self.do_post(test_uri, data)
+        user_id = response.data['id']
+        test_uri = test_uri + '/' + str(user_id) + '/courses'
+        data = {'course_id': course.id}
+        response = self.do_post(test_uri, data)
+        test_uri = test_uri + '/' + str(course.id)
+        self.assertEqual(response.status_code, 201)
+        position_data = {
+            'position': {
+                'parent_module_id': str(course.id),
+                'child_module_id': str(chapter3.location)
+
+            }
+        }
+        response = self.do_post(test_uri, data=position_data)
+        self.assertEqual(response.data['position'], chapter3.id)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_user_courses_detail_post_position_invalid_user(self):
+        course = CourseFactory.create()
+        test_data = '<html>{}</html>'.format(str(uuid.uuid4()))
+        chapter1 = ItemFactory.create(
+            category="chapter",
+            parent_location=course.location,
+            data=test_data,
+            display_name="Chapter 1"
+        )
+        user_id = 2342334
+        course_id = 'asdfa9sd8fasdf'
+        test_uri = '/api/users/{}/courses/{}'.format(str(user_id), course_id)
+        position_data = {
+            'position': {
+                'parent_module_id': course_id,
+                'child_module_id': str(chapter1.location)
+
+            }
+        }
+        response = self.do_post(test_uri, data=position_data)
+        self.assertEqual(response.status_code, 404)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_user_courses_detail_post_position_course_as_module(self):
+        course = CourseFactory.create()
+        test_data = '<html>{}</html>'.format(str(uuid.uuid4()))
+        chapter1 = ItemFactory.create(
+            category="chapter",
+            parent_location=course.location,
+            data=test_data,
+            display_name="Chapter 1"
+        )
+        test_uri = '/api/users'
+        local_username = self.test_username + str(randint(11, 99))
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password, 'first_name': self.test_first_name, 'last_name': self.test_last_name}
+        response = self.do_post(test_uri, data)
+        user_id = response.data['id']
+        test_uri = test_uri + '/' + str(user_id) + '/courses'
+        data = {'course_id': course.id}
+        response = self.do_post(test_uri, data)
+        test_uri = test_uri + '/' + str(course.id)
+        self.assertEqual(response.status_code, 201)
+        position_data = {
+            'position': {
+                'parent_module_id': str(course.location),
+                'child_module_id': str(chapter1.location)
+
+            }
+        }
+        response = self.do_post(test_uri, data=position_data)
+        self.assertEqual(response.data['position'], chapter1.id)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_user_courses_detail_get(self):
+        course = CourseFactory.create()
+        test_data = '<html>{}</html>'.format(str(uuid.uuid4()))
+        chapter1 = ItemFactory.create(
+            category="chapter",
+            parent_location=course.location,
+            data=test_data,
+            display_name="Overview"
+        )
+        test_uri = '/api/users'
+        local_username = self.test_username + str(randint(11, 99))
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password, 'first_name': self.test_first_name, 'last_name': self.test_last_name}
+        response = self.do_post(test_uri, data)
+        user_id = response.data['id']
+        test_uri = test_uri + '/' + str(user_id) + '/courses'
+        data = {'course_id': course.id}
+        response = self.do_post(test_uri, data)
+        test_uri = test_uri + '/' + str(course.id)
+        self.assertEqual(response.status_code, 201)
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 200)
+        confirm_uri = self.test_server_prefix + test_uri
+        self.assertEqual(response.data['uri'], confirm_uri)
+        self.assertEqual(response.data['course_id'], course.id)
+        self.assertEqual(response.data['user_id'], user_id)
+        position_data = {
+            'position': {
+                'parent_module_id': str(course.location),
+                'child_module_id': str(chapter1.location)
+
+            }
+        }
+        response = self.do_post(confirm_uri, data=position_data)
+        self.assertEqual(response.data['position'], chapter1.id)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_user_courses_detail_get_undefined_user(self):
+        test_uri = '/api/users/2134234/courses/a8df7asvd98'
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 404)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_user_courses_detail_get_undefined_enrollment(self):
+        course = CourseFactory.create()
+        test_uri = '/api/users'
+        local_username = self.test_username + str(randint(11, 99))
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password, 'first_name': self.test_first_name, 'last_name': self.test_last_name}
+        response = self.do_post(test_uri, data)
+        user_id = response.data['id']
+        test_uri = '/api/users/' + str(user_id) + '/courses/' + str(course.id)
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 404)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_user_courses_detail_delete(self):
+        course = CourseFactory.create()
+        test_uri = '/api/users'
+        local_username = self.test_username + str(randint(11, 99))
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password, 'first_name': self.test_first_name, 'last_name': self.test_last_name}
+        response = self.do_post(test_uri, data)
+        user_id = response.data['id']
+        post_uri = test_uri + '/' + str(user_id) + '/courses'
+        data = {'course_id': course.id}
+        response = self.do_post(post_uri, data)
+        self.assertEqual(response.status_code, 201)
+        test_uri = post_uri + '/' + str(course.id)
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 200)
+        response = self.do_delete(test_uri)
+        self.assertEqual(response.status_code, 204)
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 404)
+        response = self.do_post(post_uri, data)  # Re-enroll the student in the course
+        self.assertEqual(response.status_code, 201)
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 200)
+        response = self.do_delete(test_uri)
+        self.assertEqual(response.status_code, 204)
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 404)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_user_courses_detail_delete_undefined_user(self):
+        course = CourseFactory.create()
+        user_id = '2134234'
+        test_uri = '/api/users/{}/courses/{}'.format(str(user_id), str(course.id))
+        response = self.do_delete(test_uri)
+        self.assertEqual(response.status_code, 204)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_user_courses_detail_delete_undefined_course(self):
+        test_uri = '/api/users'
+        local_username = self.test_username + str(randint(11, 99))
+        data = {'email': self.test_email, 'username': local_username, 'password': self.test_password, 'first_name': self.test_first_name, 'last_name': self.test_last_name}
+        response = self.do_post(test_uri, data)
+        user_id = response.data['id']
+        test_uri = '{}/{}/oasdf987sdf'.format(test_uri, str(user_id))
+        response = self.do_delete(test_uri)
+        self.assertEqual(response.status_code, 404)

common/djangoapps/api_manager/tests/test_views.py

+# pylint: disable=E1103
+
+"""
+Run these tests @ Devstack:
+    rake fasttest_lms[common/djangoapps/api_manager/tests/test_views.py]
+"""
+import unittest
+import uuid
+
+from django.conf import settings
+from django.core.cache import cache
+from django.test import TestCase, Client
+from django.test.utils import override_settings
+
+TEST_API_KEY = str(uuid.uuid4())
+
+
+class SecureClient(Client):
+    """ Django test client using a "secure" connection. """
+    def __init__(self, *args, **kwargs):
+        kwargs = kwargs.copy()
+        kwargs.update({'SERVER_PORT': 443, 'wsgi.url_scheme': 'https'})
+        super(SecureClient, self).__init__(*args, **kwargs)
+
+
+@override_settings(EDX_API_KEY=TEST_API_KEY)
+class SystemApiTests(TestCase):
+    """ Test suite for base API views """
+
+    def setUp(self):
+        self.test_server_prefix = "https://testserver/api"
+        self.test_username = str(uuid.uuid4())
+        self.test_password = str(uuid.uuid4())
+        self.test_email = str(uuid.uuid4()) + '@test.org'
+        self.test_group_name = str(uuid.uuid4())
+
+        self.client = SecureClient()
+        cache.clear()
+
+    def do_get(self, uri):
+        """Submit an HTTP GET request"""
+        headers = {
+            'Content-Type': 'application/json',
+            'X-Edx-Api-Key': str(TEST_API_KEY),
+        }
+        response = self.client.get(uri, headers=headers)
+        return response
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_system_detail_get(self):
+        """ Ensure the system returns base data about the system """
+        test_uri = self.test_server_prefix + '/system'
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 200)
+        self.assertIsNotNone(response.data['uri'])
+        self.assertGreater(len(response.data['uri']), 0)
+        self.assertEqual(response.data['uri'], test_uri)
+        self.assertIsNotNone(response.data['documentation'])
+        self.assertGreater(len(response.data['documentation']), 0)
+        self.assertIsNotNone(response.data['name'])
+        self.assertGreater(len(response.data['name']), 0)
+        self.assertIsNotNone(response.data['description'])
+        self.assertGreater(len(response.data['description']), 0)
+
+    @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
+    def test_system_detail_api_get(self):
+        """ Ensure the system returns base data about the API """
+        test_uri = self.test_server_prefix
+        response = self.do_get(test_uri)
+        self.assertEqual(response.status_code, 200)
+        self.assertIsNotNone(response.data['uri'])
+        self.assertGreater(len(response.data['uri']), 0)
+        self.assertEqual(response.data['uri'], test_uri)
+        self.assertIsNotNone(response.data['documentation'])
+        self.assertGreater(len(response.data['documentation']), 0)
+        self.assertIsNotNone(response.data['name'])
+        self.assertGreater(len(response.data['name']), 0)
+        self.assertIsNotNone(response.data['description'])
+        self.assertGreater(len(response.data['description']), 0)

common/djangoapps/api_manager/urls.py

+"""
+    The URI scheme for resources is as follows:
+        Resource type: /api/{resource_type}
+        Specific resource: /api/{resource_type}/{resource_id}
+
+    The remaining URIs provide information about the API and/or module
+        System: General context and intended usage
+        API: Top-level description of overall API (must live somewhere)
+"""
+
+from django.conf.urls import include, patterns, url
+
+urlpatterns = patterns('api_manager.system_views',
+                       url(r'^$', 'api_detail'),
+                       url(r'^system$', 'system_detail'),
+                       url(r'^users/*', include('api_manager.users_urls')),
+                       url(r'^groups/*', include('api_manager.groups_urls')),
+                       url(r'^sessions/*', include('api_manager.sessions_urls')),
+                       url(r'^courses/*', include('api_manager.courses_urls')),
+                       )

common/djangoapps/api_manager/users_urls.py

+""" Users API URI specification """
+from django.conf.urls import patterns, url
+
+urlpatterns = patterns('api_manager.users_views',
+                       url(r'/*$^', 'user_list'),
+                       url(r'^(?P<user_id>[0-9]+)$', 'user_detail'),
+                       url(r'^(?P<user_id>[0-9]+)/courses/*$', 'user_courses_list'),
+                       url(r'^(?P<user_id>[0-9]+)/courses/(?P<course_id>[a-zA-Z0-9/_:]+)$', 'user_courses_detail'),
+                       url(r'^(?P<user_id>[0-9]+)/groups/*$', 'user_groups_list'),
+                       url(r'^(?P<user_id>[0-9]+)/groups/(?P<group_id>[0-9]+)$', 'user_groups_detail'),
+                       )

common/djangoapps/api_manager/users_views.py

+""" API implementation for user-oriented interactions. """
+
+import logging
+
+from django.contrib.auth.models import User, Group
+from django.core.exceptions import ObjectDoesNotExist
+from django.db import IntegrityError
+
+from rest_framework import status
+from rest_framework.decorators import api_view, permission_classes
+from rest_framework.response import Response
+
+from api_manager.permissions import ApiKeyHeaderPermission
+from courseware import module_render
+from courseware.model_data import FieldDataCache
+from courseware.views import get_module_for_descriptor, save_child_position, get_current_child
+from student.models import CourseEnrollment
+from xmodule.modulestore.django import modulestore
+
+log = logging.getLogger(__name__)
+
+
+def _generate_base_uri(request):
+    """
+    Constructs the protocol:host:path component of the resource uri
+    """
+    protocol = 'http'
+    if request.is_secure():
+        protocol = protocol + 's'
+    resource_uri = '{}://{}{}'.format(
+        protocol,
+        request.get_host(),
+        request.path
+    )
+    return resource_uri
+
+
+def _serialize_user(response_data, user):
+    """
+    Loads the object data into the response dict
+    This should probably evolve to use DRF serializers
+    """
+    response_data['email'] = user.email
+    response_data['username'] = user.username
+    response_data['first_name'] = user.first_name
+    response_data['last_name'] = user.last_name
+    response_data['id'] = user.id
+    return response_data
+
+
+def _save_module_position(request, user, course_id, course_descriptor, position):
+    """
+    Records the indicated position for the specified course
+    Really no reason to generalize this out of user_courses_detail aside from pylint complaining
+    """
+    field_data_cache = FieldDataCache([course_descriptor], course_id, user)
+    if course_id == position['parent_module_id']:
+        parent_module = get_module_for_descriptor(
+            user,
+            request,
+            course_descriptor,
+            field_data_cache,
+            course_id
+        )
+    else:
+        parent_module = module_render.get_module(
+            user,
+            request,
+            position['parent_module_id'],
+            field_data_cache,
+            course_id
+        )
+    child_module = module_render.get_module(
+        user,
+        request,
+        position['child_module_id'],
+        field_data_cache,
+        course_id
+    )
+    save_child_position(parent_module, child_module.location.name)
+    saved_module = get_current_child(parent_module)
+    return saved_module.id
+
+
+@api_view(['POST'])
+@permission_classes((ApiKeyHeaderPermission,))
+def user_list(request):
+    """
+    POST creates a new user in the system
+    """
+    response_data = {}
+    base_uri = _generate_base_uri(request)
+    email = request.DATA['email']
+    username = request.DATA['username']
+    password = request.DATA['password']
+    first_name = request.DATA.get('first_name', '')
+    last_name = request.DATA.get('last_name', '')
+    try:
+        user = User.objects.create(email=email, username=username)
+    except IntegrityError:
+        user = None
+    else:
+        user.set_password(password)
+        user.first_name = first_name
+        user.last_name = last_name
+        user.save()
+
+    if user:
+        status_code = status.HTTP_201_CREATED
+        response_data = _serialize_user(response_data, user)
+        response_data['uri'] = '{}/{}'.format(base_uri, str(user.id))
+    else:
+        status_code = status.HTTP_409_CONFLICT
+        response_data['message'] = "User '%s' already exists", username
+        response_data['field_conflict'] = "username"
+    return Response(response_data, status=status_code)
+
+
+@api_view(['GET', 'DELETE'])
+@permission_classes((ApiKeyHeaderPermission,))
+def user_detail(request, user_id):
+    """
+    GET retrieves an existing user from the system
+    DELETE removes/inactivates/etc. an existing user
+    """
+    if request.method == 'GET':
+        response_data = {}
+        base_uri = _generate_base_uri(request)
+        try:
+            existing_user = User.objects.get(id=user_id, is_active=True)
+            _serialize_user(response_data, existing_user)
+            response_data['uri'] = base_uri
+            response_data['resources'] = []
+            resource_uri = '{}/groups'.format(base_uri)
+            response_data['resources'].append({'uri': resource_uri})
+            resource_uri = '{}/courses'.format(base_uri)
+            response_data['resources'].append({'uri': resource_uri})
+            return Response(response_data, status=status.HTTP_200_OK)
+        except ObjectDoesNotExist:
+            return Response(response_data, status=status.HTTP_404_NOT_FOUND)
+    elif request.method == 'DELETE':
+        response_data = {}
+        try:
+            existing_user = User.objects.get(id=user_id, is_active=True)
+            existing_user.is_active = False
+            existing_user.save()
+        except ObjectDoesNotExist:
+            # It's ok if we don't find a match
+            pass
+        return Response(response_data, status=status.HTTP_204_NO_CONTENT)
+
+
+@api_view(['POST'])
+@permission_classes((ApiKeyHeaderPermission,))
+def user_groups_list(request, user_id):
+    """
+    POST creates a new user-group relationship in the system
+    """
+    response_data = {}
+    group_id = request.DATA['group_id']
+    base_uri = _generate_base_uri(request)
+    response_data['uri'] = '{}/{}'.format(base_uri, str(group_id))
+    try:
+        existing_user = User.objects.get(id=user_id)
+        existing_group = Group.objects.get(id=group_id)
+    except ObjectDoesNotExist:
+        existing_user = None
+        existing_group = None
+    if existing_user and existing_group:
+        try:
+            existing_relationship = existing_user.groups.get(id=existing_group.id)
+        except ObjectDoesNotExist:
+            existing_relationship = None
+        if existing_relationship is None:
+            existing_user.groups.add(existing_group.id)
+            response_data['uri'] = '{}/{}'.format(base_uri, existing_user.id)
+            response_data['group_id'] = str(existing_group.id)
+            response_data['user_id'] = str(existing_user.id)
+            response_status = status.HTTP_201_CREATED
+        else:
+            response_data['uri'] = '{}/{}'.format(base_uri, existing_group.id)
+            response_data['message'] = "Relationship already exists."
+            response_status = status.HTTP_409_CONFLICT
+    else:
+        response_status = status.HTTP_404_NOT_FOUND
+    return Response(response_data, status=response_status)
+
+
+@api_view(['GET', 'DELETE'])
+@permission_classes((ApiKeyHeaderPermission,))
+def user_groups_detail(request, user_id, group_id):
+    """
+    GET retrieves an existing user-group relationship from the system
+    DELETE removes/inactivates/etc. an existing user-group relationship
+    """
+    if request.method == 'GET':
+        response_data = {}
+        base_uri = _generate_base_uri(request)
+        try:
+            existing_user = User.objects.get(id=user_id, is_active=True)
+            existing_relationship = existing_user.groups.get(id=group_id)
+        except ObjectDoesNotExist:
+            existing_user = None
+            existing_relationship = None
+        if existing_user and existing_relationship:
+            response_data['user_id'] = existing_user.id
+            response_data['group_id'] = existing_relationship.id
+            response_data['uri'] = base_uri
+            response_status = status.HTTP_200_OK
+        else:
+            response_status = status.HTTP_404_NOT_FOUND
+        return Response(response_data, status=response_status)
+    elif request.method == 'DELETE':
+        existing_user = User.objects.get(id=user_id, is_active=True)
+        existing_user.groups.remove(group_id)
+        existing_user.save()
+        return Response({}, status=status.HTTP_204_NO_CONTENT)
+
+
+@api_view(['POST', 'GET'])
+@permission_classes((ApiKeyHeaderPermission,))
+def user_courses_list(request, user_id):
+    """
+    POST creates a new course enrollment for a user
+    GET creates the list of enrolled courses for a user
+    """
+    if request.method == 'POST':
+        store = modulestore()
+        response_data = {}
+        user_id = user_id
+        course_id = request.DATA['course_id']
+        try:
+            user = User.objects.get(id=user_id)
+            course_descriptor = store.get_course(course_id)
+        except (ObjectDoesNotExist, ValueError):
+            user = None
+            course_descriptor = None
+        if user and course_descriptor:
+            base_uri = _generate_base_uri(request)
+            course_enrollment = CourseEnrollment.enroll(user, course_id)
+            response_data['uri'] = '{}/{}'.format(base_uri, course_id)
+            response_data['id'] = course_id
+            response_data['name'] = course_descriptor.display_name
+            response_data['is_active'] = course_enrollment.is_active
+            status_code = status.HTTP_201_CREATED
+        else:
+            status_code = status.HTTP_404_NOT_FOUND
+        return Response(response_data, status=status_code)
+    elif request.method == 'GET':
+        store = modulestore()
+        response_data = []
+        base_uri = _generate_base_uri(request)
+        try:
+            user = User.objects.get(id=user_id)
+        except ObjectDoesNotExist:
+            user = None
+        if user:
+            enrollments = CourseEnrollment.enrollments_for_user(user=user)
+            for enrollment in enrollments:
+                descriptor = store.get_course(enrollment.course_id)
+                course_data = {
+                    "id": enrollment.course_id,
+                    "uri": '{}/{}'.format(base_uri, enrollment.course_id),
+                    "is_active": enrollment.is_active,
+                    "name": descriptor.display_name
+                }
+                response_data.append(course_data)
+            return Response(response_data, status=status.HTTP_200_OK)
+        else:
+            status_code = status.HTTP_404_NOT_FOUND
+        return Response(response_data, status=status_code)
+
+
+@api_view(['GET', 'POST', 'DELETE'])
+@permission_classes((ApiKeyHeaderPermission,))
+def user_courses_detail(request, user_id, course_id):
+    """
+    GET identifies an ACTIVE course enrollment for the specified user
+    DELETE unenrolls the specified user from a course
+    """
+    if request.method == 'GET':
+        store = modulestore()
+        response_data = {}
+        base_uri = _generate_base_uri(request)
+        try:
+            user = User.objects.get(id=user_id, is_active=True)
+            course_descriptor = store.get_course(course_id)
+        except (ObjectDoesNotExist, ValueError):
+            user = None
+            course_descriptor = None
+        if user and CourseEnrollment.is_enrolled(user, course_id):
+            response_data['user_id'] = user.id
+            response_data['course_id'] = course_id
+            response_data['uri'] = base_uri
+            field_data_cache = FieldDataCache([course_descriptor], course_id, user)
+            course_module = module_render.get_module(
+                user,
+                request,
+                course_descriptor.location,
+                field_data_cache,
+                course_id)
+            response_data['position'] = course_module.position
+            response_status = status.HTTP_200_OK
+        else:
+            response_status = status.HTTP_404_NOT_FOUND
+        return Response(response_data, status=response_status)
+    elif request.method == 'POST':
+        store = modulestore()
+        base_uri = _generate_base_uri(request)
+        response_data = {}
+        response_data['uri'] = base_uri
+        try:
+            user = User.objects.get(id=user_id)
+            course_descriptor = store.get_course(course_id)
+        except (ObjectDoesNotExist, ValueError):
+            user = None
+            course_descriptor = None
+        if user and course_descriptor:
+            response_data['user_id'] = user.id
+            response_data['course_id'] = course_id
+            response_status = status.HTTP_201_CREATED
+            if request.DATA['position']:
+                response_data['position'] = _save_module_position(
+                    request,
+                    user,
+                    course_id,
+                    course_descriptor,
+                    request.DATA['position']
+                )
+        else:
+            response_status = status.HTTP_404_NOT_FOUND
+        return Response(response_data, status=response_status)
+    elif request.method == 'DELETE':
+        try:
+            user = User.objects.get(id=user_id, is_active=True)
+        except ObjectDoesNotExist:
+            user = None
+        if user:
+            CourseEnrollment.unenroll(user, course_id)
+        return Response({}, status=status.HTTP_204_NO_CONTENT)

lms/djangoapps/courseware/views.py

@@ -169,6 +169,7 @@ def save_child_position(seq_module, child_name):
     """
     child_name: url_name of the child
     """
+    print child_name
     for position, c in enumerate(seq_module.get_display_items(), start=1):
         if c.url_name == child_name:
             # Only save if position changed

lms/envs/common.py

@@ -249,6 +249,9 @@ FEATURES = {
     
     # Turn off Advanced Security by default
     'ADVANCED_SECURITY': False,
+
+    # Turn on/off the Open edX API
+    'API': False,
 }
 
 # Used for A/B testing
@@ -1203,6 +1206,9 @@ INSTALLED_APPS = (
 
     # Monitoring functionality
     'monitoring',
+
+    # EDX API application
+    'api_manager',
 )
 
 ######################### MARKETING SITE ###############################

lms/envs/devstack.py

@@ -26,7 +26,6 @@ EMAIL_BACKEND = 'django.core.mail.backends.console.EmailBackend'
 FEATURES['ENABLE_INSTRUCTOR_EMAIL'] = True     # Enable email for all Studio courses
 FEATURES['REQUIRE_COURSE_EMAIL_AUTH'] = False  # Give all courses email (don't require django-admin perms)
 
-
 ################################ DEBUG TOOLBAR ################################
 
 INSTALLED_APPS += ('debug_toolbar',)
@@ -66,6 +65,11 @@ FEATURES['AUTOMATIC_VERIFY_STUDENT_IDENTITY_FOR_TESTING'] = True
 FEATURES['ENABLE_PAYMENT_FAKE'] = True
 CC_PROCESSOR['CyberSource']['PURCHASE_ENDPOINT'] = '/shoppingcart/payment_fake/'
 
+########################### EDX API #################################
+
+FEATURES['API'] = True
+
+
 #####################################################################
 # Lastly, see if the developer has any local overrides.
 try:

lms/envs/test.py

@@ -44,6 +44,9 @@ FEATURES['ALLOW_COURSE_STAFF_GRADE_DOWNLOADS'] = True
 # Toggles embargo on for testing
 FEATURES['EMBARGO'] = True
 
+# Toggles API on for testing
+FEATURES['API'] = True
+
 # Need wiki for courseware views to work. TODO (vshnayder): shouldn't need it.
 WIKI_ENABLED = True
 

lms/urls.py

@@ -67,8 +67,15 @@ urlpatterns = ('',  # nopep8
     url(r'^i18n/', include('django.conf.urls.i18n')),
 
     url(r'^embargo$', 'student.views.embargo', name="embargo"),
+
 )
 
+# OPEN EDX API
+if settings.FEATURES["API"]:
+    urlpatterns += (
+        url(r'^api/*', include('api_manager.urls')),
+    )
+
 # if settings.FEATURES.get("MULTIPLE_ENROLLMENT_ROLES"):
 urlpatterns += (
     url(r'^verify_student/', include('verify_student.urls')),