fix: record email optin preference against target user instead of caller

[ssurendrannair]

Description
Fixes a bug in the Enrollment REST API (POST /api/enrollment/v1/enrollment) where the email_opt_in preference was being recorded against the API caller (request.user) instead of the learner actually being enrolled.

In EnrollmentListView.post(), the view already looks up the correct target user via User.objects.get(username=username) (stored in the user variable) specifically because request.user may differ from the learner being enrolled — for example, when a staff member or a server-to-server (API key) caller enrolls a different student. However, the call to update_email_opt_in() was mistakenly passed request.user instead of user, so the org-wide email preference was written to the caller's account rather than the enrolled learner's.

Impact:

Learner: their email opt-in/opt-out preference was silently never recorded when someone else (staff or a service) enrolled them with email_opt_in set.
Course Author / Operator: any staff-driven enrollment flow that also sets email_opt_in (e.g. bulk enrollment tooling, support tooling, integrations) was incorrectly writing a UserOrgTag preference against the staff/service account instead of the student.
Developer: no API contract change — the fix only corrects which user record is written to internally.
Supporting information
Jira: AUT-315

Testing instructions
Log in as a global staff user (or use a server-to-server request with API key permissions).
Send a POST to /api/enrollment/v1/enrollment enrolling a different user, including "email_opt_in": true and that user's "user" (username) in the payload, e.g.:

{
  "course_details": {"course_id": "<course_id>"},
  "user": "<other_username>",
  "email_opt_in": true
}

Verify a UserOrgTag record with key="email-optin" and value="True" now exists for <other_username> (the enrolled learner), and that no such record is created for the staff/service caller.
Automated coverage: openedx/core/djangoapps/enrollments/tests/test_views.py::EnrollmentTest::test_email_opt_in_recorded_for_enrolled_user_not_caller — a new regression test that fails on the old code and passes with the fix.
Deadline
None.

Other information
No database migration required.
No dependency on other in-flight changes.
Single-line behavioral fix; no API request/response shape changes.

[Copilot]

Copilot review overview

🟢 Approval recommended

The targeted fix uses the already-authorized learner object and includes focused regression coverage.

Review effort: Balanced
Findings: None

What changed in this PR

Corrects Enrollment API email opt-in attribution for staff/service-initiated enrollments.

Changes:

• Records preferences against the enrolled learner.
• Adds regression coverage ensuring the caller remains unaffected.

File	Description
openedx/​core/​djangoapps/​enrollments/​views.py	Uses the resolved target user for email preferences.
openedx/​core/​djangoapps/​enrollments/​tests/​test_views.py	Tests enrollment by a different staff caller.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[subhashree-sahu31]

Small, well-scoped, single-purpose fix with focused test coverage — no concerns.
LGTM🚀.