Skip to content

chore: updating edx-platform to ulmo.1#184

Draft
ktyagiapphelix2u wants to merge 171 commits intorelease-ulmofrom
ktyagi/ulmo.1
Draft

chore: updating edx-platform to ulmo.1#184
ktyagiapphelix2u wants to merge 171 commits intorelease-ulmofrom
ktyagi/ulmo.1

Conversation

@ktyagiapphelix2u
Copy link

No description provided.

kyrylo-kh and others added 30 commits May 21, 2025 19:32
Removed Django version '5.2' from the workflow.
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 5.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v5)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
This error was occurring because the way the redirect URL was constructed caused the entire base path to be removed. This commit updates the URL construction method to correctly preserve the MFE's path.
Commit generated by workflow `openedx/edx-platform/.github/workflows/upgrade-one-python-dependency.yml@refs/heads/master`
…rprise-integrated-channels-904b6c1

feat: Upgrade Python dependency enterprise-integrated-channels
- Move Video Block JS files from xmodule/js/src/video/ to xmodule/assets/video/public/js/ 
- Update JavaScript files from  RequireJS to ES6 import/export
- test: Enable and fix Karma Js tests for Video XBlock (openedx#37351)

---------

Co-authored-by: salmannawaz <salman.nawaz@arbisoft.com>
fix: Profile MFE redirection issue (URL path override)
This helps us avoid additional API calls just to fetch display name of
the container block that is being previewed.
…vel organization name (openedx#37331)

By adjusting social media sharing settings(specifically linkedin) certificate parameters are autopopulated to LinkedIn API. Additional setting parameters(such as CERTIFICATE_LINKEDIN_DEFAULTS_TO_COURSE_ORGANIZATION_NAME) are introduced to override existing(platform level parameter for organization name) parameters for an operator to configure course level organization name. This will enable learners to share certificate in to LinkedIn with an option for course associated organization to be autopopulated.
…eOverview sync (openedx#37339)

* fix: prevent None entrance_exam_minimum_score_pct from breaking CourseOverview sync

When entrance exams are disabled in Studio, the field
`entrance_exam_minimum_score_pct` was set to `None`. This caused silent failures
when saving `CourseOverview` because the database column requires a float (NOT NULL).

This patch ensures that:
- CourseOverview sanitizes None values by falling back to
  `settings.ENTRANCE_EXAM_MIN_SCORE_PCT` (default=50).
- Studio avoids writing `None` and instead applies the configured default.

Impact:
- Prevents IntegrityErrors and silent failures when updating course settings.
- Restores proper syncing between modulestore (Mongo) and CourseOverview (MySQL).
- Fixes reported issues such as display name changes not persisting and course
  start dates not syncing.

Closes: openedx#37319

* refactor: clean up entrance_exam_minimum_score_pct handling

- Consolidate logic to avoid repeated assignments
- Centralize None fallback and int/float normalization
- Improve readability with inline comment and consistency with Open edX style

* test: update entrance exam deletion test to expect default min score

- Adjusted `test_entrance_exam_created_updated_and_deleted_successfully` to check for
  `settings.ENTRANCE_EXAM_MIN_SCORE_PCT` instead of `None` after exam deletion
- Added handling for both int and float defaults (`/100` for integer case)
This removes the last remaining code that called out to the
cs_comments_service. All forums backend logic now uses the v2 API from
the forum repo (https://github.com/openedx/forum). This does NOT remove
MongoDB support.

This also implements the endpoint to retrieve all comments for a user
using the new forum backend. This is not actually called from any known
frontend code, but it has not been formally deprecated as an endpoint,
and therefore needs to be supported.

As part of the cleanup, the ENABLE_FORUM_V2 course waffle flag has also
been removed, along with all remaining switching logic that used to
route between the Python API in the forum repo and service calls to the
cs_comments_service Ruby service.

Other endpoints affected (switching logic removed):

* get course commentable counts
* get/update course user stats
* update comment/thread/user
* delete thread (implementation moved to forum repo)
* follow
* retire user

This is part of the following overall DEPR ticket:
  https://github.com/openedx/cs_comments_service/issues/437
…ng-all-past-due-dates

feat: api for shifting all relative past due dates
…downstream_parent_key (openedx#37448)

* refactor!: use String field instead of Dict field to store top_level_downstream_parent_key

Since this is a new field no production instance should have this field
yet. Developers need to delete their old courses as this change will
raise error in all course pages.

* chore: add `top_level_parent` field in ComponentLink and ContainerLink admin

* refactor: use ":" as separator

* refactor: block key parsing and tests
ormsbee and others added 28 commits November 7, 2025 12:07
This pulls in publishing dependency changes from:
openedx/openedx-core#369

This fixes a bug where publishing a Content Library v2 container would
publish only its direct children instead of publishing all ancestors.

Backports: 190a8b8

Co-authored-by: Kyle McCormick <kyle@axim.org>
Signed-off-by: Farhaan Bukhsh <farhaan@opencraft.com>
…nedx#37622) (openedx#37629)

Calls `LIBRARY_CONTAINER_PUBLISHED` when publishing a container that is child of another container.
fix: validation API for certificates (backport - Ulmo)
…cement points (openedx#37633)

* feat: filter libraries based on user-role scopes (openedx#37564)

(cherry picked from commit 6c6fc5d)

* feat: add openedx-authz to user_can_create_library and require_permission_for_library_key (openedx#37501)

* feat: add the authz check to the library api function

feat: add the authz publish check in rest_api blocks and containers

feat: add the authz checks in libraries and refactor

feat: add collections checks

feat: update enforcement in serializer file

refactor: refactor the permission check functions

fix: fix value error

fix: calling the queries twice

* test: add structure for test and apply feedback

refactor: refactor the tests and apply feedback

fix: apply feedback

Revert "refactor: refactor the tests and apply feedback"

This reverts commit aa0bd52.

refactor: use constants and avoid mapping

test: fix the test to have them in order

docs: about we rely on bridgekeeper and the old check for two cases

docs: update openedx/core/djangoapps/content_libraries/api/libraries.py

Co-authored-by: Maria Grimaldi (Majo) <maria.grimaldi@edunext.co>

refactor: use global scope wildcard instead of *

refactor: allow receiving PermissionData objects

refactor: do not inherit from BaseRolesTestCase to favor CL setup methods

If both BaseRolesTestCase and ContentLibrariesRestApiTest define a method
with the same name (e.g., setUp()), Python will use the one found first
in the MRO, which is the one in BaseRolesTestCase because it is
listed first in the class definition leading to unexpected behavior.

refactor: remove unnecessary imports and indent

* chore: bump openedx-authz version

(cherry picked from commit f4f14a6)

* feat: Upgrade Python dependency openedx-authz (openedx#37652)

* feat: Upgrade Python dependency openedx-authz

handle cache invalidation

Commit generated by workflow `openedx/edx-platform/.github/workflows/upgrade-one-python-dependency.yml@refs/heads/master`

* fix: update the num of queries in tests

---------

Co-authored-by: MaferMazu <35668326+MaferMazu@users.noreply.github.com>
Co-authored-by: Maria Fernanda Magallanes Zubillaga <maria.magallanes@edunext.co>
(cherry picked from commit 122b4e0)

* chore: update requirements to fix the inconsistency

---------

Co-authored-by: Maria Grimaldi (Majo) <maria.grimaldi@edunext.co>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This was originally permitted for forum moderators and course staff as a
way to fight spam, but it was decided that this functionality was too
dangerous to open up that widely. There are some tentative plans around
how to make this a more fully supported feature, but until then, we're
restricting this to global staff on the Ulmo release branch as an
interim measure. The frontend was already disabled in the Ulmo release,
meaning that this will be a backend-only API (i.e. if you really know
what you're doing and absolutely need this functionality).

The assumption is that this feature will continue to be developed on the
master branch and will be in better shape for Verawood.
…edx#37644) (openedx#37679)

- Fix the issue described in openedx/frontend-app-authoring#2626
- Publish components and containers after migrate

(cherry picked from commit b9e5683)
…) (openedx#37688)

Prevents notification failures with MySQL backend by ensuring signals
are only sent after database transactions commit. This fixes race
conditions where Celery workers couldn't see newly created threads.

- Added send_signal_after_commit() helper function
- Updated both thread creation paths to use the helper

Co-authored-by: Taimoor  Ahmed <taimoor.ahmed@A006-01711.local>
Commit generated by workflow `openedx/edx-platform/.github/workflows/upgrade-one-python-dependency.yml@refs/heads/master`
* fix: Course search pill not cleared when text deleted

* chore: fix spacing

Co-authored-by: Feanil Patel <feanil@axim.org>

---------

Co-authored-by: Feanil Patel <feanil@axim.org>
There is no way to resume either the backup or restore library actions,
i.e. if you navigate away from it, you have to do it again. This is a
limitation of the current UI because we wanted to get something quick
and simple in for Ulmo, but it also reflects the fact that library
backup/restore should be much faster than course import/export has
historically been.

In any case, sending an email for a 5-10 second task is unnecessary and
distracting, so this commit suppresses the email.

Note: I'm using local imports to get around the fact that the
content_libraries public API is used by content_libraries/tasks.py
which defines the tasks. I can't import from content_libraries/tasks.py
directly, because that would violate import linter rules forbidding
other apps from importing things outside of api.py. This isn't ideal,
but it keeps the fix small and it keeps the logic in the
content_libraries app.
We previously fixed this when the CourseLimitedStaffRole was applied to
a course but did not handle the case where the role is applied to a user
for a whole org.  The underlying issue is that the CourseLimitedStaffRole
is a subclass of the CourseStaffRole and much of the system assumes that
subclesses are for giving more access not less access.

To prevent that from happening for the case of the CourseLimitedStaffRole,
when we do CourseStaffRole access checks, we use the strict_role_checking
context manager to ensure that we're not accidentally granting the
limited_staff role too much access.
The "overview" and "about_sidebar_html" fields in the
CoursewareInformation view (/api/courseware/course/{courseId}) were
returning unsanitized HTML and relying on the client to sanitize it.
This commit shifts that work to the server side (clean_dangerous_html)
to remove potentially dangerous tags when generating the response. The
source of this data is modified in the "Settings and Details" section
of a course in Studio.
…ff_fix

fix: CourseLimitedStaffRole should not be able to access studio.
Prior to this, if ENABLE_ORGANIZATION_STAFF_ACCESS_FOR_CONTENT_LIBRARIES
was enabled, we would not return the orgs that someone had course
creator rights on, even if ENABLE_CREATOR_GROUP was enabled. (For the
moment, we are conflating "can create courses" with "can create
libraries" for a given org, even though we should probably eventually
split those apart.)
Re-compilation and upgrade-package should be able to run without
updating the common_constraints.txt file.  We do this all the time when
backporting fixes to older releases.  We shouldn't pull in the latest
common_constraints.txt in those cases as they may not be compatible with
older releases.
…t_backport

build: Don't update common_constraints.txt on re-compilation.
…7796)

For legacy library_content references in courses, this PR:
- **Removes the spurious sync after updating a reference to a migrated
  library**, so that users don't need to "update" their content _after_
  updating their reference, _unless_ there were real content edits that
  happened since they last synced. We do this by correctly associating a
  DraftChangeLogRecord with the ModulestoreBlockSource migration artifact,
  and then comparing that version information before offering a sync.
  (related issue:
  openedx/frontend-app-authoring#2626).
- **Prompts users to update a reference to a migrated library with higher
  priority than prompting them to sync legacy content updates for that
  reference**, so that users don't end up needing to accept legacy content
  updates in order to get a to a point where they can update to V2 content.
- **Ensures the library references in courses always follow the correct
  migration,** as defined by the data `forwarded` fields in the data model,
  which are populated based on the REST API spec and the stated product UI
  requirements.

For the migration itself, this PR:
- **Allows non-admins to migrate libraries**, fixing:
  openedx#37774
- **When triggered via the UI, ensures the migration uses nice title-based
  target slugs instead of ugly source-hash-based slugs.** We've had this as an
  option for a long time, but preserve_url_slugs defaulted to True instead of
  False in the REST API serializer, so we weren't taking advantage of it.
- **Unifies logic between single-source and bulk migration**. These were
  implement as two separate code paths, with drift in their implementations. In
  particular, the collection update-vs-create-new logic was completely
  different for single-souce vs. bulk.
- **When using the Skip or Update strategies for repeats, it consistently
  follows mappings established by the latest successful migration** rather than
  following mappings across arbitrary previous migrations.
- **We log unexpected exceptions more often**, although there is so much more
  room for improvement here.
- **Adds more validation to the REST API** so that client mistakes more often
  become 400s with validation messages rather than 500s.

For developers, this PR:
- Adds unit tests to the REST API
- Ensures that all migration business logic now goes through a general-purpose
  Python API.
- Ensures that the data model (specifically `forwarded`, and
  `change_log_record`) is now populated and respected.
- Adds more type annotations.

Backports: 91e521e
Backport note: Compared to the original commit, this backport commit
excludes the REST APIs which were not defined at the time of the
Ulmo cutoff:
* /api/v1/modulestore_migrator/libraries
* /api/v1/modulestore_migrator/migration_info
* /api/v1/modulestore_migrator/migration_blocks
This is to fix an issue in the following common migration situation:

1. An existing course references content in a legacy content library.
2. The legacy content library is migrated to the new library system.
3. The user clicks on "Update reference" from the Randomized Content
   Block in the course.

This action is supposed to update the children of the
LibraryContentBlock (usually ProblemBlocks) so that the "upstream"
attribute is set to point at the UsageKeys of the content in the new
libraries they were migrated to. What was happening instead was that the
upstream entries for these child blocks were left blank, breaking the
upstream/sync connection and making it so that the courses did not
receive any updates from the migrated libraries.

There were two issues:

1. get_forwarding_for_blocks() was being called with the child UsageKeys
   in the course, when it should have been called with the v1 library
   usage keys instead (since those are the things being forwarded).
2. We were checking that the target_key was a v2 Library key, but really
   the upstream target_key is supposed to be a LibraryUsageLocatorV2,
   i.e. the key of the specific piece of content, not the library it
   ended up in.

Note on testing:

Although there were unit tests for the migration of legacy content
libraries, there were not any unit tests for the migration of legacy
library *blocks*.

This commit adds a minimal test, which would have caught the bug we're
fixing. It would be good to add more comprehensive testing unit testing
for this part of the migration flow.

---------

Co-authored-by: Kyle McCormick <kyle@axim.org>
There is a singleton SplitMongoModuleStore instance that is returned
whenever we call the ubiquitous modulestore() function (wrapped in a
MixedModuleStore). During initialization, SplitMongoModuleStore sets
up a small handful of XBlock runtime services that are intended to be
shared globally: i18n, fs, cache.

When we get an individual block back from the store using get_item(),
SplitMongoModuleStore creates a SplitModuleStoreRuntime using
SplitMongoModuleStore.create_runtime(). These runtimes are intended to
be modified on a per-item, and later per-user basis (using
prepare_runtime_for_user()).

Prior to this commit, the create_runtime() method was assigning the
globally shared SplitMongoModuleStore.services dict directly to the
newly instantiated SplitModuleStoreRuntime. This meant that even though
each block had its own _services dict, they were all in fact pointing
to the same underlying object. This exposed us to a risk of multiple
threads contaminating each other's SplitModuleStoreRuntime services
when deployed under load in multithreaded mode. We believe this led to
a race condition that caused student submissions to be mis-scored in
some cases.

This commit makes a copy of the SplitMongoModuleStore.services dict for
each SplitModuleStoreRuntime. The baseline global services are still
shared, but other per-item and per-user services are now better
isolated from each other.

This commit also includes a small modification to the PartitionService,
which up until this point had relied on the (incorrect) shared instance
behavior. The details are provided in the comments in the
PartitionService __init__().

It's worth noting that the historical rationale for having a singleton
ModuleStore instance is that the ModuleStore used to be extremely
expensive to initialize. This was because at one point, the init
process required reading entire XML-based courses into memory, or
pre-computing complex field inheritance caches. This is no longer the
case, and SplitMongoModuleStore initialization is in the 1-2 ms range,
with most of that being for PyMongo's connection setup. We should try
to fully remove the global singleton in the Verawood release cycle in
order to make this kind of bug less likely.
This commit updates the logic in the build_block_structure function to
ensure that block locations are consistently normalized by removing
branch and version information. This change addresses issues when
creating a BlockStructure from modulestore using the published_only
branch. Without this change, we end up comparing versioned keys to
unversioned ones later on, which always yields False.
@github-actions
Copy link

Thank you for your pull request! Congratulations on completing the Open edX tutorial! A team member will be by to take a look shortly.
To those watching community pull requests: No need to worry about this one, a tCRIL team member will be taking care of it.
For this PR's author: If this is a PR that is NOT coming from the Open edX tutorial, please comment and let us know to disregard this message.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.