fix: enforce GlobalRestrictedCountry on course access, not just registration

cms/djangoapps/contentstore/views/tests/test_course_index.py

@@ -227,7 +227,10 @@ def test_number_of_calls_to_db(self):
         """
         Test to check number of queries made to mysql and mongo
         """
-        with self.assertNumQueries(21, table_ignorelist=WAFFLE_TABLES):
+        # 22, not 21: EmbargoMiddleware now always resolves GlobalRestrictedCountry's cached
+        # country list (one query on a cold cache) even when the course has no RestrictedCourse
+        # row, so a global block applies without needing a per-course row.
+        with self.assertNumQueries(22, table_ignorelist=WAFFLE_TABLES):
             with check_mongo_calls(3):
                 self.client.get(reverse_course_url('course_handler', self.course.id), content_type="application/json")
 

lms/djangoapps/course_home_api/course_metadata/tests/test_views.py

@@ -27,6 +27,7 @@
     COURSEWARE_MICROFRONTEND_PROGRESS_MILESTONES_STREAK_CELEBRATION,
 )
 from openedx.core.djangoapps.discussions.models import DiscussionsConfiguration
+from openedx.core.djangoapps.embargo.models import Country, GlobalRestrictedCountry
 
 
 @ddt.ddt
@@ -241,6 +242,48 @@ def test_course_access(
 
         self._assert_course_access_response(response, expect_course_access, error_code)
 
+    @override_settings(EMBARGO=True)
+    def test_embargo_blocks_access(self):
+        """
+        A `GlobalRestrictedCountry` block applies here too, not just to the legacy
+        courseware page - this is the metadata endpoint the Learning MFE actually
+        reads `course_access` from, which `EmbargoMiddleware`'s URL-pattern matching
+        does not cover.
+        """
+        CourseEnrollment.enroll(self.user, self.course.id)
+        GlobalRestrictedCountry.objects.create(country=Country.objects.create(country='CU'))
+
+        with patch('openedx.core.djangoapps.embargo.api.country_code_from_ip', return_value='CU'):
+            response = self.client.get(self.url, HTTP_X_FORWARDED_FOR='1.2.3.4')
+
+        self._assert_course_access_response(response, False, 'embargo')
+
+    @override_settings(EMBARGO=True)
+    def test_embargo_does_not_mask_a_more_specific_denial(self):
+        """
+        An unenrolled learner in a restricted country keeps `enrollment_required` - the
+        embargo check only runs once access is otherwise granted, so the learner is told
+        the thing they can act on first, and blocked requests skip the country lookups.
+        """
+        GlobalRestrictedCountry.objects.create(country=Country.objects.create(country='CU'))
+
+        with patch('openedx.core.djangoapps.embargo.api.country_code_from_ip', return_value='CU'):
+            response = self.client.get(self.url, HTTP_X_FORWARDED_FOR='1.2.3.4')
+
+        self._assert_course_access_response(response, False, 'enrollment_required')
+
+    @override_settings(EMBARGO=True)
+    def test_embargo_staff_bypass(self):
+        """ Course staff should still get access even when their country is globally restricted. """
+        CourseInstructorRole(self.course.id).add_users(self.user)
+        GlobalRestrictedCountry.objects.create(country=Country.objects.create(country='CU'))
+
+        with patch('openedx.core.djangoapps.embargo.api.country_code_from_ip', return_value='CU'):
+            response = self.client.get(self.url, HTTP_X_FORWARDED_FOR='1.2.3.4')
+
+        assert response.status_code == 200
+        assert response.data['course_access']['has_access'] is True
+
     @override_settings(ENABLE_DISCUSSION_SERVICE=True)
     @ddt.data(True, False)
     def test_discussion_tab_visible(self, visible):

lms/djangoapps/course_home_api/course_metadata/views.py

@@ -20,6 +20,7 @@
 from lms.djangoapps.course_home_api.course_metadata.serializers import CourseHomeMetadataSerializer
 from lms.djangoapps.course_home_api.toggles import new_discussion_sidebar_view_is_enabled
 from lms.djangoapps.courseware.access import has_access, has_cms_access
+from lms.djangoapps.courseware.access_utils import check_embargo_access
 from lms.djangoapps.courseware.context_processor import user_timezone_locale_prefs
 from lms.djangoapps.courseware.courses import check_course_access
 from lms.djangoapps.courseware.exceptions import CourseAccessRedirect
@@ -104,6 +105,16 @@ def get(self, request, *args, **kwargs):
             check_if_authenticated=True,
             apply_priority_access_checks=True,
         )
+        # A country embargo (GlobalRestrictedCountry / CountryAccessRule) is checked here -
+        # rather than shared into check_course_access() - so it stays scoped to metadata's
+        # UI-level access flag for now. Only worth checking once access is otherwise granted:
+        # a more specific denial (enrollment_required, authentication_required) keeps its own
+        # error code, and we skip the embargo check's country lookups on requests that are
+        # already blocked.
+        if load_access:
+            embargo_access = check_embargo_access(request.user, course)
+            if not embargo_access:
+                load_access = embargo_access
 
         _, request.user = setup_masquerade(
             request,

lms/djangoapps/courseware/access_response.py

@@ -290,3 +290,15 @@ def __init__(self, courselike):
             course_name=courselike.display_name_with_default,
         )
         super().__init__(error_code, developer_message, user_message)
+
+
+class EmbargoAccessError(AccessError):
+    """
+    Access denied because the user's country is blocked by embargo rules
+    (`GlobalRestrictedCountry` or a per-course `CountryAccessRule`).
+    """
+    def __init__(self):
+        error_code = "embargo"
+        developer_message = "User's location is blocked by country embargo rules"
+        user_message = _("Access to this course is blocked from your current location")
+        super().__init__(error_code, developer_message, user_message)

lms/djangoapps/courseware/access_utils.py

@@ -6,7 +6,9 @@
 from datetime import datetime, timedelta
 from logging import getLogger
 
+from crum import get_current_request
 from django.conf import settings
+from edx_django_utils import ip
 from openedx_filters.learning.filters import CourseStartDateValidationFailed
 from pytz import UTC
 
@@ -15,10 +17,12 @@
 from lms.djangoapps.courseware.access_response import (
     AccessResponse,
     AuthenticationRequiredAccessError,
+    EmbargoAccessError,
     EnrollmentRequiredAccessError,
     StartDateError,
 )
 from lms.djangoapps.courseware.masquerade import get_course_masquerade, is_masquerading_as_student
+from openedx.core.djangoapps.embargo import api as embargo_api
 from openedx.features.course_experience import (
     COURSE_ENABLE_UNENROLLED_ACCESS_FLAG,
     COURSE_PRE_START_ACCESS_FLAG,
@@ -159,6 +163,32 @@ def check_authentication(user, course):
     return AuthenticationRequiredAccessError()
 
 
+def check_embargo_access(user, course):
+    """
+    Deny access if the user's country is blocked by embargo rules.
+
+    Currently called only from the course_metadata BFF view, to report embargo denial
+    via its `course_access` JSON field - not from the shared `check_course_access()`
+    that other course-home BFF views (outline, dates, progress, navigation) route
+    through, so those still serve content to an embargoed learner. Legacy courseware
+    pages are covered separately by `EmbargoMiddleware` for URLs it recognizes.
+
+    Callers should only reach for this once access is otherwise granted: a more specific
+    denial keeps its own error code, and the country lookups behind this check are not free.
+
+    Returns:
+        AccessResponse: Either ACCESS_GRANTED or EmbargoAccessError.
+    """
+    request = get_current_request()
+    ip_addresses = ip.get_all_client_ips(request) if request is not None else None
+    url = request.path if request is not None else None
+
+    if embargo_api.check_course_access(course.id, user=user, ip_addresses=ip_addresses, url=url):
+        return ACCESS_GRANTED
+
+    return EmbargoAccessError()
+
+
 def check_public_access(course, visibilities):
     """
     This checks if the unenrolled access waffle flag for the course is set

lms/djangoapps/courseware/tests/test_views.py

@@ -1270,8 +1270,8 @@ def test_view_certificate_link(self):
             self.assertContains(resp, "earned a certificate for this course.")
 
     @ddt.data(
-        (True, 56),
-        (False, 56),
+        (True, 57),
+        (False, 57),
     )
     @ddt.unpack
     def test_progress_queries_paced_courses(self, self_paced, query_count):
@@ -1285,8 +1285,11 @@ def test_progress_queries_paced_courses(self, self_paced, query_count):
     def test_progress_queries(self):
         ContentTypeGatingConfig.objects.create(enabled=True, enabled_as_of=datetime(2018, 1, 1))
         self.setup_course()
+        # 57, not 56: EmbargoMiddleware now always resolves GlobalRestrictedCountry's cached
+        # country list (one query on a cold cache) even when the course has no RestrictedCourse
+        # row, so a global block applies without needing a per-course row.
         with self.assertNumQueries(
-            56, table_ignorelist=QUERY_COUNT_TABLE_IGNORELIST
+            57, table_ignorelist=QUERY_COUNT_TABLE_IGNORELIST
         ), check_mongo_calls(2):
             self._get_progress_page()