feat: add courseware-access pipeline steps

This commit replaces most enterprise-specific logic serving the purpose
of conditionally blocking courseware access.

Enterprise steps added:
- EnterpriseStartDateAccessFailureStep supplies an enterprise-specific start-date error for enterprise learners.
- ActiveEnterpriseCheckStep denies access when the learner's active EnterpriseCustomer differs from the enrollment's customer.

Consent steps added:
- DataSharingConsentRedirectStep supplies a redirect URL to collect data sharing consent when it is required.
- DataSharingConsentCourseAccessStep denies access when consent is required.

ENT-11544

Author: pwnage101

CHANGELOG.rst

@@ -17,6 +17,10 @@ Unreleased
 ----------
 * nothing unreleased
 
+[8.1.0] - 2026-06-17
+---------------------
+* feat: Add the ``enable_credit_and_industry_pathways`` field for EnterpriseCustomer
+
 [8.0.19] - 2026-06-16
 ---------------------
 * feat: Add the ``enable_credit_and_industry_pathways`` field for EnterpriseCustomer

consent/filters/__init__.py

@@ -0,0 +1 @@
+"""Pipeline steps registered against openedx-filters by the Consent app."""

consent/filters/courseware.py

@@ -0,0 +1,105 @@
+"""
+Pipeline steps for courseware filters, contributed by the Consent app.
+
+DataSharingConsentRedirectStep and DataSharingConsentCourseAccessStep both enforce the
+same consent requirement but are registered against different platform hooks that fire
+at different points in the courseware experience. The two hooks may sometimes run in
+the same request, but not always — so both registrations are necessary to ensure
+consent is enforced across all entry points.
+"""
+import logging
+from typing import Any
+
+from crum import get_current_request
+from opaque_keys.edx.keys import CourseKey
+from openedx_filters.filters import PipelineStep
+from openedx_filters.learning.filters import CoursewareAccessChecksRequested, CoursewareViewStarted
+
+from consent.helpers import get_enterprise_consent_url
+
+log = logging.getLogger(__name__)
+
+
+class DataSharingConsentRedirectStep(PipelineStep):
+    """
+    Redirects the user to the consent page when data sharing consent is required.
+
+    Registered against ``org.openedx.learning.courseware.view.started.v1``.
+    Raises ``CoursewareViewStarted.RedirectToUrl`` to redirect when consent is needed.
+    If consent is not required, the step is a no-op.
+    """
+
+    def run_filter(self, course_key: CourseKey, view_name: str) -> dict:  # pylint: disable=arguments-differ
+        request = get_current_request()
+        log.info(
+            "DataSharingConsentRedirectStep running: course_key=%s, view_name=%s, user_id=%s",
+            course_key,
+            view_name,
+            request.user.id if request else None,
+        )
+        if request is None:
+            return {"course_key": course_key, "view_name": view_name}
+        consent_url = get_enterprise_consent_url(
+            request=request,
+            course_id=str(course_key),
+            # An enrollment is assumed to exist if a courseware view has started, so just hard-code the value here.
+            enrollment_exists=True,
+            # `source` is tracked in consent DB records so we can audit which view initiated the consent redirect.
+            source=view_name,
+            # Omitted kwargs:
+            # - user: Defaults to request.user, which matches original decorator behavior.
+            # - return_to: Defaults to request.path, which should already be the courseware view.
+        )
+        # Redirect to the consent page if consent is required.
+        if consent_url:
+            raise CoursewareViewStarted.RedirectToUrl(
+                message="Data sharing consent required",
+                redirect_to=consent_url,
+            )
+        # No consent required — pass through.
+        return {"course_key": course_key, "view_name": view_name}
+
+
+class DataSharingConsentCourseAccessStep(PipelineStep):
+    """
+    Deny courseware access when data sharing consent is required but not granted.
+
+    Registered against ``org.openedx.learning.courseware.access_checks.requested.v1``.
+    Raises ``CoursewareAccessChecksRequested.PreventCoursewareAccess`` to deny
+    access when ``get_enterprise_consent_url`` returns a URL.
+    """
+
+    def run_filter(self, user: Any, course_key: CourseKey) -> dict:  # pylint: disable=arguments-differ
+        log.info(
+            "DataSharingConsentCourseAccessStep running: user_id=%s, course_key=%s",
+            user.id,
+            course_key,
+        )
+        request = get_current_request()
+        if request is None:
+            return {"user": user, "course_key": course_key}
+        consent_url = get_enterprise_consent_url(
+            request=request,
+            course_id=str(course_key),
+            # We must pass the given user even though the request already has a user attached. They could differ.
+            user=user,
+            # This is always True since the step only runs in course access checks that require an existing enrollment.
+            enrollment_exists=True,
+            # After granting consent, make sure to redirect to the courseware view regardless of where they came from.
+            return_to="courseware",
+            # Identify as originating from the access check context.
+            source="CoursewareAccess",
+        )
+        # Deny courseware access if consent is required.
+        if consent_url:
+            raise CoursewareAccessChecksRequested.PreventCoursewareAccess(
+                message="Data sharing consent required",
+                error_code="data_sharing_access_required",
+                # developer_message carries the consent redirect URL by convention: the Learning MFE treats this message
+                # as a URL when error_code is "data_sharing_access_required" and performs a client-side redirect.
+                # See frontend-app-learning/src/shared/access.js.
+                developer_message=consent_url,
+                user_message="You must give Data Sharing Consent for the course",
+            )
+        # No consent required — pass through.
+        return {"user": user, "course_key": course_key}

consent/helpers.py

@@ -2,11 +2,162 @@
 Helper functions for the Consent application.
 """
 
+import logging
+from urllib.parse import urlencode
+
+from edx_django_utils.cache import TieredCache
+
 from django.apps import apps
+from django.conf import settings
+from django.contrib.sites.models import Site
+from django.urls import reverse
 
 from consent.models import ProxyDataSharingConsent
 from enterprise.api_client.discovery import get_course_catalog_api_service_client
-from enterprise.utils import get_enterprise_customer
+from enterprise.utils import get_active_enterprise_customer_user, get_enterprise_customer
+
+# ENT-11576: CONSENT_FAILED_PARAMETER, ConsentApiClient, enterprise_customer_uuid_for_request,
+# and get_data_consent_share_cache_key will be migrated from the platform's enterprise_support
+# module into edx-enterprise, eliminating these cross-boundary imports.
+try:
+    from openedx.features.enterprise_support.api import (
+        CONSENT_FAILED_PARAMETER,
+        ConsentApiClient,
+        enterprise_customer_uuid_for_request,
+    )
+    from openedx.features.enterprise_support.utils import get_data_consent_share_cache_key
+except ImportError:
+    CONSENT_FAILED_PARAMETER = 'consent_failed'
+    ConsentApiClient = None
+    enterprise_customer_uuid_for_request = None
+    get_data_consent_share_cache_key = None
+
+LOGGER = logging.getLogger(__name__)
+
+
+def consent_needed_for_course(request, user, course_id, enrollment_exists=False):
+    """
+    Determine whether ``user`` must grant data-sharing consent before accessing ``course_id``.
+    """
+    # Consent is never required if the enterprise feature is disabled.
+    if not getattr(settings, 'ENABLE_ENTERPRISE_INTEGRATION', False):
+        return False
+
+    LOGGER.info(
+        "[ENTERPRISE DSC] Determining if user [%s] must consent to data sharing for course [%s]",
+        user.username, course_id,
+    )
+
+    active_enterprise_learner_info = get_active_enterprise_customer_user(user)
+    if not active_enterprise_learner_info:
+        LOGGER.info(
+            "[ENTERPRISE DSC] Consent from user [%s] is not needed for course [%s]. "
+            "The user is not linked to an enterprise.",
+            user.username, course_id,
+        )
+        return False
+
+    active_enterprise_customer = active_enterprise_learner_info.enterprise_customer
+
+    consent_cache_key = get_data_consent_share_cache_key(
+        user.id, course_id, str(active_enterprise_customer.uuid),
+    )
+    cached = TieredCache.get_cached_response(consent_cache_key)
+    if cached.is_found and cached.value == 0:
+        LOGGER.info(
+            "[ENTERPRISE DSC] Consent from user [%s] is not needed for course [%s]. "
+            "The DSC cache was checked and the value was 0.",
+            user.username, course_id,
+        )
+        return False
+
+    if not active_enterprise_customer.enable_data_sharing_consent:
+        LOGGER.info(
+            "[ENTERPRISE DSC] DSC is disabled for enterprise customer [%s]. "
+            "Consent from user [%s] is not needed for course [%s]",
+            active_enterprise_customer.slug, user.username, course_id,
+        )
+        TieredCache.set_all_tiers(consent_cache_key, 0, settings.DATA_CONSENT_SHARE_CACHE_TIMEOUT)
+        return False
+
+    current_enterprise_uuid = enterprise_customer_uuid_for_request(request)
+    if str(current_enterprise_uuid) != str(active_enterprise_customer.uuid):
+        LOGGER.info(
+            '[ENTERPRISE DSC] Enterprise mismatch. USER: [%s], RequestEnterprise: [%s], '
+            'LearnerEnterprise: [%s]',
+            user.username, current_enterprise_uuid, active_enterprise_customer.uuid,
+        )
+        TieredCache.set_all_tiers(consent_cache_key, 0, settings.DATA_CONSENT_SHARE_CACHE_TIMEOUT)
+        return False
+
+    enterprise_domain = Site.objects.get(domain=active_enterprise_customer.site.domain)
+    if enterprise_domain != request.site:
+        LOGGER.info(
+            '[ENTERPRISE DSC] Site mismatch. USER: [%s], RequestSite: [%s], '
+            'LearnerEnterpriseDomain: [%s]',
+            user.username, request.site, enterprise_domain,
+        )
+        TieredCache.set_all_tiers(consent_cache_key, 0, settings.DATA_CONSENT_SHARE_CACHE_TIMEOUT)
+        return False
+
+    client = ConsentApiClient(user=request.user)
+    consent_required = client.consent_required(
+        username=user.username,
+        course_id=course_id,
+        enterprise_customer_uuid=current_enterprise_uuid,
+        enrollment_exists=enrollment_exists,
+    )
+    if not consent_required:
+        LOGGER.info(
+            "[ENTERPRISE DSC] Consent from user [%s] is not needed for course [%s]. "
+            "The user's current enterprise does not require data sharing consent.",
+            user.username, course_id,
+        )
+        TieredCache.set_all_tiers(consent_cache_key, 0, settings.DATA_CONSENT_SHARE_CACHE_TIMEOUT)
+        return False
+
+    LOGGER.info(
+        "[ENTERPRISE DSC] Consent from user [%s] is needed for course [%s]. "
+        "The user's current enterprise requires data sharing consent, and it has not been given.",
+        user.username, course_id,
+    )
+    return True
+
+
+def get_enterprise_consent_url(request, course_id, user=None, return_to=None, enrollment_exists=False, source='lms'):
+    """
+    Build a URL to redirect the user to the data-sharing consent page for a specific course.
+
+    Arguments:
+        request: Django request object.
+        course_id: Course key/identifier string.
+        user: user to check for consent. If None, uses ``request.user``.
+        return_to: url name for the page to return to after consent is granted; defaults to
+            ``request.path``.
+        enrollment_exists: forwarded to ``consent_needed_for_course``.
+        source: opaque string identifying the caller, recorded on the consent URL.
+    """
+    user = user or request.user
+    LOGGER.info(
+        'Getting enterprise consent url for user [%s] and course [%s].',
+        user.username,
+        course_id,
+    )
+    if not consent_needed_for_course(request, user, course_id, enrollment_exists=enrollment_exists):
+        return None
+    return_path = request.path if return_to is None else reverse(return_to, args=(course_id,))
+    url_params = {
+        'enterprise_customer_uuid': enterprise_customer_uuid_for_request(request),
+        'course_id': course_id,
+        'source': source,
+        'next': request.build_absolute_uri(return_path),
+        'failure_url': request.build_absolute_uri(
+            reverse('dashboard') + '?' + urlencode({CONSENT_FAILED_PARAMETER: course_id})
+        ),
+    }
+    full_url = reverse('grant_data_sharing_permissions') + '?' + urlencode(url_params)
+    LOGGER.info('Redirecting to %s to complete data sharing consent', full_url)
+    return full_url
 
 
 def get_data_sharing_consent(username, enterprise_customer_uuid, course_id=None, program_uuid=None):

consent/settings/common.py

@@ -6,7 +6,16 @@
 # enterprise plugin's settings module.
 from enterprise.settings.common import FiltersConfig, _merge_filters_config
 
-CONSENT_FILTERS_CONFIG: FiltersConfig = {}
+CONSENT_FILTERS_CONFIG: FiltersConfig = {
+    "org.openedx.learning.courseware.view.started.v1": {
+        "fail_silently": False,
+        "pipeline": ["consent.filters.courseware.DataSharingConsentRedirectStep"],
+    },
+    "org.openedx.learning.courseware.access_checks.requested.v1": {
+        "fail_silently": False,
+        "pipeline": ["consent.filters.courseware.DataSharingConsentCourseAccessStep"],
+    },
+}
 
 
 def plugin_settings(settings):

enterprise/__init__.py

@@ -2,4 +2,4 @@
 Your project description goes here.
 """
 
-__version__ = "8.0.19"
+__version__ = "8.1.0"