refactor: modify REST API endpoints for LR MFE

[MaxFrank13]

This is a PR to modify the existing REST API endpoints used by the LR MFE. This modification adds a username query param that is employed the the Support Tools MFE to fetch the same data learners see.

Custom permissions classes were necessary here to block access from unauthorized users. We needed to ensure that learners (or other non-staff, non-superusers) couldn't view the records of others.

Here is a truth table that attempts to illustrate how access is handled with the addition of this query parameter.

[cdeery]

How does this check if the requesting user is the owner of the record? I can see that it works in the unit tests, but I don't understand the mechanism.

[MaxFrank13]

Oh nice catch! It actually doesn't. I need to change the documentation. I initially thought we'd allow the user to do this but now I'm under the impression that a learner/normal user should never need to use this username query parameter.

[justinhynes]

A couple of things...

1. I think the information we're passing to get_user_program_data here differs in your if vs. your else. In the if, you are sending the entire User object to get_user_program_data. In your else, you are sending just the username. Which should it be?

2. I think we want to code a bit more defensively. I think this code has a chance to throw an exception and maybe not return any data back to the caller. It's not guaranteed a user will exist with the username passed in to the API call. A call to {Model}.objects.get(blah=blah) will throw a DoesNotExist exception if the object doesn't exist. We will likely want to do something like...

username = request.user.username

query_param_username = request.query_params.get("username", "")
if query_param_username:
    try:
        other_user = User.objects.get(username=query_param_username)
    except User.DoesNotExist:
        # Log something here
        return Response({"enrolled_programs": []}) # empty list, string, dictionary, whatever we would pass back when there is no data
    else:
        (else section only executes if the "try" didn't throw an exception)
        username = other_user.username

programs = get_user_program_data(
    username, request.site, include_empty_programs=False, include_retired_programs=True
)

This way we also cut down on code duplication of the call to get_user_program_data.

[MaxFrank13]

I had a feeling there may be a better way to do this. Thanks for the example!

[MaxFrank13]

An interesting note about the first question you had: It is supposed to be a username, however, it was still working by passing in the User. Is this some Django magic perhaps?

[justinhynes]

Let me know if you have any questions regarding my comments/suggestions!

[justinhynes]

I had a few minor requests to update logs and comments but I don't need to re-review afterwards. Thanks, Max!