From 4c4d8b9ad9af82644599cf980fce891a637b8159 Mon Sep 17 00:00:00 2001 From: ssurendrannair Date: Tue, 22 Sep 2026 06:58:57 +0000 Subject: [PATCH] fix: record email optin preference against target user instead of caller --- .../enrollments/tests/test_views.py | 22 +++++++++++++++++++ openedx/core/djangoapps/enrollments/views.py | 2 +- 2 files changed, 23 insertions(+), 1 deletion(-) diff --git a/openedx/core/djangoapps/enrollments/tests/test_views.py b/openedx/core/djangoapps/enrollments/tests/test_views.py index 137c3a600295..debf70332c7c 100644 --- a/openedx/core/djangoapps/enrollments/tests/test_views.py +++ b/openedx/core/djangoapps/enrollments/tests/test_views.py @@ -455,6 +455,28 @@ def _assert_no_opt_in_set(): preference = UserOrgTag.objects.get(user=self.user, org=self.course.id.org, key="email-optin") assert preference.value == pref_value + def test_email_opt_in_recorded_for_enrolled_user_not_caller(self): + """ + Regression test: when a staff user enrolls a different learner and passes + email_opt_in, the preference must be recorded against the enrolled learner, + not against the staff caller who made the request. + """ + self.client.logout() + staff_user = AdminFactory.create( + username='global_staff', email='global_staff@example.com', password=self.PASSWORD + ) + self.client.login(username='global_staff', password=self.PASSWORD) + + self.assert_enrollment_status(username=self.other_user.username, email_opt_in=True) + + # The preference should be recorded against the enrolled learner... + preference = UserOrgTag.objects.get(user=self.other_user, org=self.course.id.org, key="email-optin") + assert preference.value == "True" + + # ...and never against the staff user who made the API call. + with pytest.raises(UserOrgTag.DoesNotExist): + UserOrgTag.objects.get(user=staff_user, org=self.course.id.org, key="email-optin") + def test_enroll_prof_ed(self): # Create the prod ed mode. CourseModeFactory.create( diff --git a/openedx/core/djangoapps/enrollments/views.py b/openedx/core/djangoapps/enrollments/views.py index 022f6b14e87e..a14444e7e55b 100644 --- a/openedx/core/djangoapps/enrollments/views.py +++ b/openedx/core/djangoapps/enrollments/views.py @@ -853,7 +853,7 @@ def post(self, request): email_opt_in = request.data.get("email_opt_in", None) if email_opt_in is not None: org = course_id.org - update_email_opt_in(request.user, org, email_opt_in) + update_email_opt_in(user, org, email_opt_in) log.info("The user [%s] has already been enrolled in course run [%s].", username, course_id) return Response(response)