[taimoor-ahmed-1]

Stacked on #39303 and #39229. This branch starts from a merge of #39303 (advanced settings, head 9b4d60ea0d, which adds IsExistingCourse and the shared test helpers) into #39229 (course outline v2, head 53ea5f44a1, which adds CanViewCourse). The PR targets master, so until both merge it also carries their commits and that merge commit; only the last 3 commits belong to this PR. Once #39303 and #39229 merge, this branch is rebased onto master. The merge commit's conflict resolution (in views/permissions.py, cms/lib/spectacular.py and its test) only keeps both sides' additions, so it leaves nothing of its own to carry.

Summary

Standardizes the course rerun defaults and course settings resources of the Course Management area (#39059, part of #38137). This is PR F of the eight resource-group PRs for the area; #39303 (advanced settings) is PR A and #39305 (custom pages and tabs) is PR C.

Two conforming operations replace the two v1 endpoints:

v1 (unchanged, now deprecated: true)	v2	URL name (authoring_v2:)
GET /api/contentstore/v1/course_rerun/{course_id}	GET /api/authoring/v2/courses/{course_key}/rerun_defaults/	course_rerun_defaults
GET /api/contentstore/v1/course_settings/{course_id}	GET /api/authoring/v2/courses/{course_key}/settings/ (?view=minimal, the default, or ?view=full)	course_settings

It applies ADRs 0025–0038 and OEP-69.

Rerun defaults. The values Studio's rerun page starts from: the course's org, number, run and display_name, the site's allow_unicode_course_id, and the caller's course_creator_status. These are the same six fields as v1, with the same values. Only global staff may read them. v2 uses DRF's IsAdminUser, which checks user.is_staff, as v1's GlobalStaff().has_user does; a test compares the two for every combination of is_staff, is_superuser and is_active. The address names what the payload is (the defaults for a rerun of this course), not v1's screen name. Since only staff get past the permission check, the course-creator lookup never runs for anyone else. That matters because, with ENABLE_CREATOR_GROUP on, the lookup records a course creator request for a non-staff user, which is a write. course_creator_status is therefore always granted, and its help text says so.

Course settings. What Studio's settings pages need about a course and the site: which settings are edited in Studio, which site features are on, the course's names, about page address, proctored exam settings path and upgrade deadline. view=minimal (the default) returns these 20 members. view=full adds language_options, possible_pre_requisite_courses (while prerequisite courses are on) and credit_requirements (for a credit course while credit eligibility is on). Access goes through CanViewCourse from #39229: the course must exist (404), then the caller needs user_has_course_permission(courses.view_course, READ), the same call v1 makes inline. Two content changes:

• content_experiments_enabled is added. It says whether content experiments apply to the course (split_test installed and in the course's advanced modules). This is the value v1's group configurations listing reports as should_show_experiment_groups. That listing's successor (PR G) drops the flag, and also drops mfe_proctored_exam_settings_url, which v1 course settings already returns and v2 keeps. Both fields' help texts tell callers to read them here.
• The prerequisite list no longer depends on the request's query string. v1 passes its own request to Studio's course listing, which reads search, ordering, active_only and its other parameters. Sent to v1, those parameters narrowed or reordered possible_pre_requisite_courses, and a malformed start_date_on_or_after made v1 answer 400. v2 gives the listing a request that carries the caller and no query parameters.

Known gaps and risks have their own section below.

Why a new version and not a fix in place. Each of these changes the contract for v1's callers (frontend-app-authoring calls both endpoints), so they ride v2 (ADR 0037):

• course settings returns its three heavy members only on request (view=full), gains content_experiments_enabled, and refuses an unknown view (400);
• the prerequisite list ignores the course listing's query parameters;
• errors use the standard envelope, and a course the modulestore cannot load is a 404, not a 500;
• Bearer tokens are refused;
• addresses gain a trailing slash and a checked course key.

Changes

Commits (one per concern):

Commit	Endpoint(s)	Legacy behaviour kept	New behaviour
feat: serve course rerun defaults from authoring v2	GET …/v2/courses/{course_key}/rerun_defaults/ (new)	v1 route, view and URL name unchanged	View, service, serializer, route and tests. The service reuses the legacy helper contentstore.utils.get_course_rerun_context, which is not edited. Permissions: DRF's IsAdminUser and IsExistingCourse from #39303
feat: serve course settings from authoring v2	GET …/v2/courses/{course_key}/settings/ (new)	v1 route, view and URL name unchanged	View, service, serializers, route and tests. The service reuses contentstore.utils.get_course_settings, contentstore.views.course.are_content_experiments_enabled and certificates.api.can_show_certificate_available_date_field, none of them edited. Permission: CanViewCourse from #39229
docs: mark the v1 course rerun and settings endpoints deprecated in favour of authoring v2	the two v1 operations	Routes, views and responses unchanged	Docstrings name each successor and #39128. (deprecated: true in the schema comes from the two exact SUPERSEDED_PATHS entries, each with a test, added in the feat commits so every commit is green.)

ADRs applied

• 0025 serializers — separate output serializers (CourseRerunDefaults.v2, CourseSettings.v2, PrerequisiteCourse.v2, CreditRequirement.v2), help_text on every field, explicit .v2 component names, a query serializer for view; read-only, so no request body serializer
• 0026 permissions — rerun defaults: IsAuthenticated, IsExistingCourse, IsAdminUser (equivalent to v1's GlobalStaff().has_user); settings: IsAuthenticated, CanViewCourse (v1's inline call); deny matrix with policy permissions off and on
• 0027 schema / docs — @extend_schema on both with summary, description, parameters, examples and every 4xx as ErrorResponse; both tagged openedx-platform-sdk
• 0028 viewsets — applied except router registration: two ViewSets over service modules, mounted with path(...) like every route in v2/authoring_urls.py, because a router's regex routes cannot use the shared path converters
• 0029 errors — partial: the envelope on every response these views produce; 405 and 406 are typed internal, and a malformed course key or an address no route matches gets the CMS HTML 404 (library and routing gaps, pinned by tests); the published ErrorResponse component's text comes from edx-drf-extensions
• 0030 GET idempotence — met for this code (no write, signal or event on GET or HEAD, on either view), with one inherited write outside it: openedx-authz may insert its PolicyCacheControl row on the first lookup against a database that lacks it, exactly as the v1 read does there
• 0031 merged endpoints — n/a: nothing merged; rerun defaults and settings stay separate resources (different payloads, different gates), and content_experiments_enabled is one member moved from the group configurations listing, not a merged endpoint
• 0032 pagination — n/a: both resources are one object per course; the full view's prerequisite list stays unbounded, as on v1 (see Known gaps and risks)
• 0033 filtering — n/a: no filter or sort parameter; the course listing's parameters that leaked into v1's prerequisite list are no longer read
• 0034 authentication — (JwtAuthentication, SessionAuthenticationAllowInactiveUser) declared with its reason, as ADR 0034 requires for an endpoint that used SessionAuthenticationAllowInactiveUser; Bearer dropped
• 0035 MFE config — n/a: per-course authoring data behind authentication; the site switches settings carries are part of what the settings pages need about the course, not front-end configuration
• 0036 nested JSON — settings: the language list, prerequisite list and credit requirements are opt-in with view=full, so they are never in the default payload (payload only: see Known gaps and risks); rerun defaults are six flat scalars
• 0037 versioning — partial: new v2 modules, v1 frozen (docstring-only markers) and deprecated: true in the schema; the DEPR entry for [DEPR]: Contentstore and enrollment API versions superseded by FC-0118 #39128 is to be posted with this PR, and no removal release is named yet
• 0038 URL structure — courses/{course_key}/rerun_defaults/ and courses/{course_key}/settings/; shared converter, trailing slash, version-free URL names; the v1 names kept (naming risk on settings/ stated)
• OEP-66 queryset scoping — n/a as a mechanism: neither view owns a get_queryset(); the prerequisite list comes from Studio's course listing for the caller, as on v1; the layering is shown in the matrix
• OEP-69 conventions — the decisions above as recorded, with the 0028, 0029, 0030 and 0037 departures stated; no governance identifiers in code or schema text

Compliance matrix

Decision	Status	How it is met, or the concrete reason it is excluded	Evidence (test / gate)
0025	met	CourseRerunDefaultsSerializer (CourseRerunDefaults.v2: v1's six fields, display_name nullable). CourseSettingsSerializer (CourseSettings.v2: 20 required members, plus credit_requirements, language_options and possible_pre_requisite_courses, which are not required). The prerequisite items are typed (PrerequisiteCourse.v2), the credit requirements are typed (CreditRequirement.v2, grouped by namespace) and the language options are [code, name] pairs. CourseSettingsQuerySerializer validates view. Explicit .v2 ref_names: v1's serializers have none, so they publish as CourseRerun and CourseSettings, and an unsuffixed v2 CourseSettings would collide with v1's. Nullability follows the data, not v1's declarations (Known gaps and risks)	RerunDefaultsSchemaTest (test_the_defaults_component, test_the_example_is_a_valid_body); RerunDefaultsReadTest.test_the_body_matches_the_published_schema; SettingsSchemaTest (test_the_settings_component, test_the_prerequisite_course_component, test_every_member_is_described); SettingsReadTest.test_the_body_matches_the_published_schema (both views); hygiene PASS
0026	met	Every v1 check has a v2 home (Authorization below). Order 401, 404, 403. Rerun defaults: IsAuthenticated, IsExistingCourse, IsAdminUser. Settings: IsAuthenticated, CanViewCourse (existence, then courses.view_course READ). Each viewset has one permission tuple, so retrieve, OPTIONS and unrouted methods all run the same checks	RerunDefaultsAccess{LegacyPermissions,Authz}Test, SettingsAccess{LegacyPermissions,Authz}Test (each access case asserts v1's answer too); RerunDefaultsPermissionWiringTest (test_the_course_is_checked_before_staff_status, test_the_staff_check_decides_as_the_v1_check); SettingsPermissionWiringTest.test_the_course_view_permission_is_checked_after_authentication; RerunDefaultsCourseCreatorTest.test_a_caller_who_is_not_staff_is_refused_before_the_lookup
0027	met	Operation IDs v2_courses_rerun_defaults_retrieve, v2_courses_settings_retrieve. course_key is a path parameter with the converter's pattern; settings adds view (query, enum minimal/full, default minimal). Examples RerunDefaults, CourseSettings and CourseSettingsWithLists validate against the published components. Every 4xx is ErrorResponse (settings 400, 401, 403, 404; rerun defaults 401, 403, 404). Both tagged openedx-platform-sdk; the deprecated v1 operations lose the tag through untag_deprecated_operations	RerunDefaultsSchemaTest (test_the_read_is_published_for_the_sdk, test_the_only_parameter_is_the_course_key, test_the_v1_read_is_deprecated_and_left_out_of_the_sdk); SettingsSchemaTest (test_the_read_is_published_for_the_sdk, test_the_parameters, test_the_examples_are_valid_bodies, test_the_v1_read_is_deprecated_and_left_out_of_the_sdk)
0028	applied except router registration	CourseRerunDefaultsViewSet and CourseSettingsViewSet (StandardizedErrorMixin first, then viewsets.ViewSet) over v2/rerun_defaults_service.py and v2/course_settings_service.py. Plain ViewSets, because the data comes from the course block in the modulestore, site settings and feature modules, not from rows of one model. Deviation: mounted with path(), not a router	RerunDefaultsRoutingTest.test_the_address; SettingsRoutingTest.test_the_address
0029	partial	StandardizedErrorMixin first. 401 authn, 403 authz, 404 not-found (unknown, version-only or library course; a course whose overview exists but which the modulestore returns nothing for, logged at INFO). Settings: 400 validation for an unknown view, with errors keyed by view. Gaps pinned by tests that flip when fixed: 405 and 406 are typed internal (edx-drf-extensions 10.9.0 does not catalogue them); a malformed or slash-form key gets the CMS HTML 404 at routing. The published ErrorResponse component's description is the library's own text, which names ADR 0029; changing it is a library change	SettingsReadTest.test_an_unknown_view_is_refused; RerunDefaultsResponseDifferencesTest and SettingsResponseDifferencesTest (test_a_course_the_modulestore_returns_nothing_for); RerunDefaultsRoutingTest and SettingsRoutingTest (test_other_methods_are_not_allowed, test_unsupported_accept_is_refused_with_406, test_an_unparsable_or_slash_form_key_is_an_html_404)
0030	met for this code; one inherited write	GET and HEAD of both endpoints, both settings views, with policy permissions off and on, and for settings with prerequisite courses off and on, write nothing. No read writes to SQL or Mongo, stores through the modulestore, or sends a Django signal or Open edX event. Settings is read by course staff (or a policy role holder), global staff, and a reader whose role records send the course listing to its every-course fallback. The fixture covers every lookup: a credit course with a verified mode, and another course with a rerun still running. Reading a course that has no overview does not build one. Rerun defaults never reach the course-creator lookup for a non-staff caller. The one exception is the first read on a database without openedx-authz's PolicyCacheControl row, which may insert it. That write belongs to the permission library, and v2 does exactly what the v1 read does there	RerunDefaultsReadSideEffects{LegacyPermissions,Authz}Test.test_reads_have_no_side_effects; SettingsReadSideEffects{,Prerequisites}{LegacyPermissions,Authz}Test (test_reads_have_no_side_effects, test_each_reader_reaches_its_course_listing_branch, test_a_course_without_an_overview_is_read_without_building_one); RerunDefaultsCourseCreatorTest
0031	excluded	Nothing merged. Rerun defaults (global staff) and settings (courses.view_course) have different payloads and gates. content_experiments_enabled moves one member, not an endpoint	—
0032	excluded	One object per course. possible_pre_requisite_courses (view=full only) is unbounded, as on v1	—
0033	excluded	No filter or sort. The course listing's parameters are no longer read	SettingsReadTest.test_the_course_list_parameters_change_nothing
0034	met with declared deviation	(JwtAuthentication, SessionAuthenticationAllowInactiveUser), commented at each declaration: an inactive account's session stays authenticated, so the permission decides. Rerun defaults: inactive global staff 200, inactive course instructor 403. Settings with policy permissions off: inactive global staff 200; inactive course staff and inactive holders of the course staff policy role 403 (a role does not count while the account is inactive). With them on: an inactive policy role holder 200 (the policy does not look at activation). All as v1. Bearer is dropped. Same as #39303 and #39305	RerunDefaultsAuthenticationTest and SettingsAuthenticationTest (test_a_jwt_caller_…, test_a_session_caller_…, test_an_inactive_session_is_authenticated, test_a_bearer_token_is_refused); SettingsAccessLegacyPermissionsTest.test_a_policy_role_does_not_count_for_an_inactive_account; SettingsAccessAuthzTest.test_an_inactive_session_with_a_role_may_read
0035	excluded	Per-course authoring data behind authentication; not front-end configuration	—
0036	met (settings); n/a (rerun defaults)	view=minimal is the default and leaves out the language list, the prerequisite list and the credit requirements; view=full adds them; an unknown view is 400. This saves payload, not work (Known gaps and risks). Rerun defaults: six flat scalars	SettingsReadTest (test_the_minimal_view_leaves_out_the_lists_and_credit_requirements, test_the_full_view_adds_the_lists_and_credit_requirements, test_the_full_view_without_prerequisites_or_credit_adds_the_language_list_only, test_the_minimal_view_is_the_default, test_an_unknown_view_is_refused); SettingsSchemaTest.test_the_parameters
0037	partial	New modules in v2/. v1 frozen apart from docstring-only markers: for both files, the syntax tree with docstrings stripped equals the base. deprecated: true through two exact SUPERSEDED_PATHS entries; no runtime header (frozen routes). DEPR: one entry for #39128 covering both, to be posted with this PR; no removal release is named	versions gate; CmsMarkSupersededPathsTest (test_the_course_rerun_read_is_marked_and_its_successor_is_not, test_the_course_settings_read_is_marked_and_its_successor_is_not); RerunDefaultsSchemaTest and SettingsSchemaTest (test_the_v1_read_is_deprecated_and_left_out_of_the_sdk, test_only_superseded_or_migrated_addresses_are_deprecated)
0038	met	rerun_defaults and settings under the course (rule 4: what the payload is). Shared course_key converter, trailing slash, version-free URL names course_rerun_defaults and course_settings; v1's names kept. Two risks are stated under Known gaps and risks: the verb heuristic flags rerun, and settings is a screen-like name	RerunDefaultsRoutingTest and SettingsRoutingTest (test_the_address, test_the_v1_address_is_unchanged, test_v1_still_takes_a_slash_separated_key_that_v2_does_not, test_the_url_names_are_unique_in_the_namespace, test_the_address_without_its_trailing_slash_redirects_to_it); the urls gate itself was skipped
OEP-66	mechanism excluded, layering met	(1) Endpoint access: the permission classes. (2) Record visibility: one course. The prerequisite list holds the courses the caller may view in Studio, from Studio's course listing for the caller, without this course and without courses still being created as reruns, as on v1. (3) User selection: view chooses members, not records; the course listing's own parameters are no longer read	access tests above; SettingsReadTest.test_the_course_listing_is_given_the_caller_and_no_query_parameters; SettingsParityAllFeatures{LegacyPermissions,Authz}Test.test_courses_being_created_as_reruns_are_not_prerequisites
OEP-69	met	The decisions above, with the departures stated in their rows. No ADR/OEP/PR identifiers or narration in code or schema text	hygiene gate PASS (0 FAIL, 0 WARN)

Backward compatibility

• v1 is unchanged. v1/views/course_rerun.py and v1/views/settings.py gain docstring text only; for each, the syntax tree with docstrings stripped equals the base. Their routes, views and URL names are untouched, and v1's own tests are not edited.

• Parity. v2 is compared with v1 through the Django test client, with policy permissions off and on:

  • rerun defaults: global staff get an identical body, with the same members in the same order;
  • settings: view=full is v1's body plus content_experiments_enabled, and view=minimal is that without the three heavy members. This holds for course staff (or the course staff policy role) and for global staff, across these fixtures: prerequisite courses off and a course without credit; prerequisite courses and credit eligibility on for a credit course; credit eligibility off for a registered credit course; a course managed by a publishing service; a verified mode with a deadline; a credit course without a minimum grade; a course whose rerun is still running;
  • content_experiments_enabled equals v1's group configurations should_show_experiment_groups, with content experiments off and on;
  • 401, 403 and 404 differ only in the error body, on both views.

  The only declared body differences, verbatim from the two test modules:

  # test_rerun_defaults.py
  INTENTIONAL_DIFFERENCES = [
      ("type", "errors use the standardized envelope"),
      ("title", "errors use the standardized envelope"),
      ("status", "errors use the standardized envelope"),
      ("detail", "errors use the standardized envelope"),
      ("developer_message", "the v1 error body carries developer_message; the envelope does not"),
      ("error_code", "the v1 not-found body carries error_code; the envelope does not"),
  ]
  
  # test_course_settings.py
  INTENTIONAL_DIFFERENCES = [
      ("content_experiments_enabled", "added: whether content experiments apply to the course, which the v1 "
                                      "group configurations read reports as should_show_experiment_groups"),
      ("language_options", "returned only with view=full"),
      ("possible_pre_requisite_courses", "returned only with view=full"),
      ("credit_requirements", "returned only with view=full"),
      ("type", "errors use the standardized envelope"),
      ("title", "errors use the standardized envelope"),
      ("status", "errors use the standardized envelope"),
      ("detail", "errors use the standardized envelope"),
      ("developer_message", "the v1 error body carries developer_message; the envelope does not"),
      ("error_code", "the v1 not-found body carries error_code; the envelope does not"),
  ]

  The comparison fails on any undeclared difference. It also fails when a declared difference never occurs: test_every_declared_difference_occurs, which for settings runs on the all-features fixture.

• Status and request differences from v1. Each is listed in its test module and observed against v1's own answer:

  # test_rerun_defaults.py
  RESPONSE_DIFFERENCES = [
      ("read of a course the modulestore returns nothing for", "500", "404",
       "test_a_course_the_modulestore_returns_nothing_for"),
      ("read with a Bearer token", "200", "401", "test_a_bearer_token"),
      ("slash-separated course key", "404 JSON", "404 HTML", "test_a_slash_separated_course_key"),
  ]
  
  # test_course_settings.py
  RESPONSE_DIFFERENCES = [
      ("read with course list parameters such as search", "prerequisites narrowed or reordered",
       "prerequisites unchanged", "test_course_list_parameters"),
      ("read with a malformed start_date_on_or_after", "400", "200", "test_a_malformed_start_date_parameter"),
      ("read with view=default", "200", "400", "test_an_unknown_view"),
      ("read of a course the modulestore returns nothing for", "500", "404",
       "test_a_course_the_modulestore_returns_nothing_for"),
      ("read with a Bearer token", "200", "401", "test_a_bearer_token"),
      ("slash-separated course key", "404 JSON", "404 HTML", "test_a_slash_separated_course_key"),
  ]

  As a table, with the request-shape changes that carry no status difference:

  Request	v1	v2	Test
  settings, default read	every member, the three heavy ones included	the 20 members, content_experiments_enabled among them; the heavy ones only with view=full	SettingsReadTest.test_the_minimal_view_leaves_out_the_lists_and_credit_requirements
  settings with search, ordering, active_only and other course list parameters	prerequisites narrowed or reordered	prerequisites unchanged	SettingsResponseDifferencesTest.test_course_list_parameters
  settings with a malformed start_date_on_or_after	400	200 (parameter not read)	…test_a_malformed_start_date_parameter
  settings with view=default (or any value but minimal/full)	200 (view not read)	400 validation	…test_an_unknown_view
  a course whose overview exists but which the modulestore returns nothing for (both endpoints)	500	404, logged at INFO	…test_a_course_the_modulestore_returns_nothing_for (both modules)
  Bearer token (both endpoints)	200	401	…test_a_bearer_token (both modules)
  slash-form course key (both endpoints)	404 JSON (course_does_not_exist)	404 HTML (no route)	…test_a_slash_separated_course_key (both modules)
  address without the trailing slash	served	301 to the slashed address	RerunDefaultsRoutingTest and SettingsRoutingTest (test_the_address_without_its_trailing_slash_redirects_to_it)

• Query counts, relative to v1. No literal baseline was measured, because no platform environment was available. Instead, in the same test, each read runs no more SQL queries and no more Mongo reads than v1's read, and makes no Mongo writes, with policy permissions off and on. Rerun defaults are measured for global staff. Settings is measured for both views, with prerequisite courses on and a credit course, for course staff and for global staff.

• Schema. Two new operations, and deprecated: true on the two v1 operations. docs/cms-openapi.yaml is not edited; the generate_openapi_schemas workflow regenerates it.

In-place edits

File	Category	Evidence
cms/djangoapps/contentstore/rest_api/v1/views/course_rerun.py	docstring-only deprecation marker (class and get)	syntax tree with docstrings stripped equals the base; versions gate ALLOWED
cms/djangoapps/contentstore/rest_api/v1/views/settings.py	docstring-only deprecation marker (class and get; get also says what view=full adds and that the prerequisite list ignores the course list's parameters)	syntax tree with docstrings stripped equals the base; versions gate ALLOWED
cms/djangoapps/contentstore/rest_api/v2/authoring_urls.py	strictly opt-in addition: two imports, two routes	no line removed; RerunDefaultsRoutingTest, SettingsRoutingTest
cms/lib/spectacular.py, cms/lib/tests/test_spectacular.py	two exact SUPERSEDED_PATHS entries; the exact-set test updated and a test added for each path	CmsMarkSupersededPathsTest

views/permissions.py is not edited by this PR: IsExistingCourse comes from #39303, CanViewCourse from #39229, and IsAdminUser from DRF.

New files inside the pre-existing v2/: rerun_defaults_service.py, course_settings_service.py, serializers/rerun_defaults.py, serializers/course_settings.py, views/rerun_defaults.py, views/course_settings.py, views/tests/test_rerun_defaults.py, views/tests/test_course_settings.py. The production modules import nothing from rest_api/v0/ or rest_api/v1/.

Test-only imports from v1. Both test modules import these shared helpers from rest_api/v1/views/tests/helpers.py (added by #39303): FIRST_LOOKUP_SIGNALS, FIRST_LOOKUP_WRITES, UNKNOWN_COURSE_KEY, VERSION_ONLY_KEY, api_client, assert_matches_published_schema, assert_refused, changed_paths, measure, published_schema, record_effects, undeclared_paths. They are the area's shared test helpers (clients, the side-effect recorder, the parity diff, the cost measure, the schema check); importing them keeps one copy rather than a second one in v2/. PASSWORD and logged_in_client come from the existing v2/views/tests/helpers.py.

Error-format decision

Versioned. v1 keeps its developer_message/error_code bodies unchanged. v2 uses the envelope. frontend-app-authoring calls both v1 endpoints: rerun defaults from src/generic/data/api.ts, course settings from src/data/api.ts and src/content-tags-drawer/data/api.ts. The settings payload change (heavy members opt-in, one member added) already forces a new version, and the error format rides with it.

Deprecations

Both v1 operations are superseded by the v2 operations in the Summary. They are deprecated: true in the CMS schema, and the docstrings name the successors. The views are otherwise unchanged: no runtime header. Tracked on the FC-0118 umbrella DEPR ticket, #39128; one entry covering both is posted there with the PR. Window per #39128: removed one named release after the release this ships in.

Migration notes:

• Rerun defaults: call GET /api/authoring/v2/courses/{course_key}/rerun_defaults/. Same six fields and values; still global staff only.
• Course settings: call GET /api/authoring/v2/courses/{course_key}/settings/?view=full for v1's body plus content_experiments_enabled. Without view=full (or with view=minimal), language_options, possible_pre_requisite_courses and credit_requirements are left out. view takes only minimal or full; any other value is a 400.
• The prerequisite list no longer changes with search, ordering, active_only or the course listing's other parameters, and a malformed start_date_on_or_after is ignored.
• Group configurations callers: read content_experiments_enabled here instead of should_show_experiment_groups, and mfe_proctored_exam_settings_url here; the group configurations successor (PR G) does not return them.
• Errors use the standard envelope.
• Bearer tokens are refused; use JWT or a session.
• Every address ends with a slash. Slash-separated (deprecated) course keys are not accepted.

Authorization

Legacy check	Where it lives in v2	Deny-path tests
@view_auth_classes(is_authenticated=True) (both)	IsAuthenticated	test_anonymous_caller_is_refused_with_401 (both endpoints, both permission modes, both views); test_anonymous_caller_of_an_unknown_course_is_refused_with_401
@verify_course_exists() (both)	rerun defaults: IsExistingCourse; settings: CanViewCourse's existence check (both also 404 for version-only and library keys)	unknown course, version-only key and library key → 404, before any role check (test_unknown_course_is_404_before_permission_is_checked, test_a_version_only_course_key_is_404, test_a_library_is_not_a_course); test_global_staff_learn_that_a_course_does_not_exist
rerun: GlobalStaff().has_user(request.user), else permission_denied, inline in get	IsAdminUser (DRF; user.is_staff, the same test)	no role; course staff, instructor and limited staff, org staff and org instructor, on the course and on another course; with policy permissions on, the course admin, staff, editor and auditor roles and a Studio instructor record; a superuser without staff status in both modes; an inactive instructor; a JWT instructor
settings: user_has_course_permission(user, courses.view_course, course_key, READ), else permission_denied, inline in get	CanViewCourse (#39229), same call	with policy permissions off: no role, limited staff, staff and instructors of another course, a superuser without staff status, inactive course staff, an inactive holder of the course staff policy role; with them on: limited staff, data researcher and beta tester roles, a course admin role on another course, a Studio staff record without a policy role

Order: 401, then 404 for a missing course, then 403. Allowed on rerun defaults: global staff only (also when the account is inactive). Allowed on settings: with policy permissions off, course staff and instructors, org staff and org instructors, global staff, and active holders of the course staff policy role; with them on, the course auditor, editor, staff and admin roles and global staff.

Superusers. Saving a superuser sets is_staff: the pre_save receiver grant_staff_access_to_superusers (common/djangoapps/student/signals/receivers.py) makes every saved superuser global staff, so superusers are admitted as staff on both endpoints. A superuser whose staff status was cleared without a save is a different case. Rerun defaults refuse it with policy permissions off and on, because both addresses check staff status alone. Settings refuse it with policy permissions off, because Studio read access comes from staff status or a role, and admit it with them on, because the policy admits superusers. v1 answers the same in every case (test_a_saved_superuser_has_staff_status_and_may_read, test_a_superuser_without_staff_status_is_refused, test_a_superuser_without_staff_status_may_read_without_a_role). #39303 and #39305 give the policy engine as the reason superusers are admitted; that is the wrong cause.

Corrections to the area plan, found in review and checked against the code. The tests follow the platform's behaviour, which v2 keeps:

• Inactive accounts. The plan expected an inactive session to get 200 on every view. Rerun defaults: inactive global staff 200, an inactive course instructor 403. Settings with policy permissions off: inactive global staff 200, while inactive course staff and inactive policy role holders get 403. With them on, an inactive policy role holder gets 200. The tests are RerunDefaultsAuthenticationTest.test_an_inactive_session_is_authenticated, SettingsAuthenticationTest.test_an_inactive_session_is_authenticated, SettingsAccessLegacyPermissionsTest.test_a_policy_role_does_not_count_for_an_inactive_account and SettingsAccessAuthzTest.test_an_inactive_session_with_a_role_may_read.
• Query counts are relative to v1 (no more than v1), not the literal baselines the plan asked for (Backward compatibility).

Known gaps and risks

• view=minimal saves payload, not work. The shared helper contentstore.utils.get_course_settings (frozen, reused unedited) builds the language list, the prerequisite list and the credit requirements whatever the view. The prerequisite list is built by listing every course the caller may view, while prerequisite courses are on. v2 removes those members afterwards, so the default read makes the same lookups as view=full; the query-count tests bound each view by v1's read, not the default by the full view. A helper that skips the lists is a future-version item. The service says so in a comment.
• The full view's prerequisite list is unbounded, as on v1, because the settings page fills a dropdown with it. A reference to the courses list is a future-version candidate.
• settings/ is named after a screen. ADR 0038 lists course_settings among screen names used as resources and points such data at courses/{course_key}/details/ and its siblings. This resource is not folded into v3 details/ because its gate differs: courses.view_course here, courses.view_schedule_and_details there, so it is a different resource. Reviewers may ask for a narrower noun; renaming before merge is cheap.
• Component names on the /api/authoring/v2/ mount disagree. This PR's components are suffixed (CourseSettings.v2, CourseRerunDefaults.v2, PrerequisiteCourse.v2, CreditRequirement.v2); feat: serve the course outline from authoring v2 #39229's on the same mount are not (CourseOutline and its parts). The suffix is needed here: v1's CourseSettingsSerializer has no ref_name and publishes as CourseSettings, so an unsuffixed v2 component would collide with it. The mount mixes the two conventions until one side changes.
• Nullability corrected in the new components, so typed clients see different declarations than v1's:
  • CourseSettings.v2.course_display_name and CourseRerunDefaults.v2.display_name are nullable; v1 declared them non-null but returns null for a course without a name (tested on both).
  • PrerequisiteCourse.v2 makes display_name, lms_link, rerun_link and url nullable; v1's CourseCommonSerializer declares all of them non-null.
  • lms_link_for_about_page is a plain string; v1 declared a URL format, but the value can be the course's social sharing URL, its marketing URL, or a filter's output.
  • mfe_proctored_exam_settings_url is a non-null string, empty when the page is not served by the authoring app; v1 declared it nullable.
  • credit_requirements is typed by namespace and requirement (v1 declared a bare object), and each language_options item is a [code, name] pair (v1 declared lists of any length).
• Query counts are relative to v1, not literal (Backward compatibility).
• URL verb heuristic. The urls gate's rule-10 heuristic flags rerun_defaults, because its first word, rerun, is in its verb list. Here the word is a noun (the defaults for a rerun), so the WARN is a false positive, as the plan recorded. The urls gate was skipped, so the WARN is expected on its first run rather than observed.
• Moving the experiments flag to settings. A caller who may view a course's group configurations but not the course itself (courses.view_group_configurations without courses.view_course, policy permissions on) cannot read content_experiments_enabled. The plan found no shipped role with that combination.

Gate report

Run on the host against a1b1c074a2 (the merge of #39303 into #39229 that this branch stacks on). No platform environment was available, so four gates were skipped. The test modules have not been run locally, and CI is their first run.

Gate	Result
versions	PASS: 3 ALLOWED (v1/views/course_rerun.py and v1/views/settings.py docstring markers, v2/authoring_urls.py), 8 new files in the existing v2 directories, 2 other files (cms/lib/spectacular.py and its test), nothing protected touched (23 shared legacy modules protected)
hygiene	PASS (0 FAIL, 0 WARN) over 13 files
ruff	clean; no line over 120 characters
pylint (4.1.3, repo pylintrc)	only C1803 (== [] comparisons), the same message #39303 carries with its CI pylint passing
supplementary, not a gate: offline harness with fakes	44/44 checks; 15/15 mutants killed (v1 modelled by stand-ins)
schema	SKIPPED (no platform environment)
urls	SKIPPED (no platform environment)
old-tests	SKIPPED (no platform environment)
tests	SKIPPED (no platform environment)

Follow-ups

• SDK: both operations carry openedx-platform-sdk; the next openedx-platform-sdk regeneration gains them.
• frontend-app-authoring: the rerun page (src/generic/data/api.ts) can move to rerun_defaults/ unchanged. The settings callers (src/data/api.ts, src/content-tags-drawer/data/api.ts) can move to settings/, requesting view=full where they use the language list, prerequisites or credit requirements. The group configurations page needs this PR before it moves to PR G's listing, because it reads content_experiments_enabled and mfe_proctored_exam_settings_url from here.
• Future version of course settings: a settings helper that does not build the lists for view=minimal, and a bounded or referenced prerequisite list.
• Naming on /api/authoring/v2/: agree one component-name convention (suffixed or not) for the mount, and settle the settings noun in review.
• edx-drf-extensions:
  • Catalogue MethodNotAllowed and NotAcceptable.
  • The shared ErrorResponse component's description is ErrorResponseSerializer's docstring, which names ADR 0029 and carries a usage example; it should describe the error body instead. Issue to be filed.
• Platform: a JSON 404 for addresses under /api/ that match no route, instead of the CMS HTML page. Issue to be filed.
• openedx-authz PolicyCacheControl: the first permission check on a fresh database inserts the cache row on a read; seeding it by migration would make reads write-free. Issue to be filed.
• Authentication across /api/authoring/v2/: v2 here and the feat: apply FC-0118 ADRs to course content APIs #39157 v2 views keep SessionAuthenticationAllowInactiveUser; feat: serve the course outline from authoring v2 #39229 and feat: serve course containers from authoring v2 #39274 use the default on the same mount. One policy for new versions of such endpoints should be agreed.
• feat: serve course advanced settings from authoring v1 #39303 and feat: serve course custom pages and tabs from authoring v1 #39305 explain superuser admission with the wrong cause, in their descriptions and test docstrings; to be corrected in those PRs.
• Rebase: once feat: serve course advanced settings from authoring v1 #39303 and feat: serve the course outline from authoring v2 #39229 merge, this branch is rebased onto master and the merge commit drops out.
• Sibling PRs G (group configurations) and H (course team) edit the same shared files: v2/authoring_urls.py, cms/lib/spectacular.py and its test. The conflicts are additive, resolved by rebasing in merge order.

[openedx-webhooks]

Thanks for the pull request, @taimoor-ahmed-1!

This repository is currently maintained by @openedx/wg-maintenance-openedx-platform-oncall.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

• If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
  • This process (including the steps you'll need to take) is documented here.
• If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

• Dependencies

  This PR must be merged before / after / at the same time as ...

• Blockers

  This PR is waiting for OEP-1234 to be accepted.

• Timeline information

  This PR must be merged by XX date because ...

• Partner information

  This is for a course on edx.org.

• Supporting documentation
• Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

🔘 Update the status of your PR

Your PR is currently marked as a draft. After completing the steps above, update its status by clicking "Ready for Review", or removing "WIP" from the title, as appropriate.

---

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

• Overview of Review Process for Community Contributions
• Pull Request Status Guide
• Making changes to your pull request

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

• The size and impact of the changes that it introduces
• The need for product review
• Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.