def cm_enroll_user(request):
    response_format = request.REQUEST.get('format','html')
    if response_format == 'json' or 'application/json' in request.META.get('HTTP/ACCEPT', 'application/json'):
        if request.method == 'POST':
            if validate_token(request.body, request) is False:
                return HttpResponse('Unauthorized', status=401)
            if 'email' not in request.json or 'course_id' not in request.json:
                return HttpResponse(content=json.dumps({'errors':'Missing params'}), \
                        content_type = 'application/json', status=400)
            try:
                log.info("Enrolling user: " + request.json.get('email') + " course: " + request.json.get('course_id'))
                CourseEnrollment.enroll_by_email(request.json.get('email'), \
                                                 get_key_from_course_id(request.json.get('course_id')), ignore_errors=False)

                # See if enrolling with staff credentials
                if request.json.get('role') == 'staff':
                    global_admin = AdminFactory()
                    course = get_key_from_course_id(request.json.get('course_id'))
                    auth.add_users(global_admin, CourseInstructorRole(course), User.objects.get(email=request.json.get('email')))
                    
                content = {'success':'ok'}
                status_code = 200
            except User.DoesNotExist:
                content = {'errors':'User does not exist'}
                status_code = 422
            return HttpResponse(content=json.dumps(content), status=status_code, \
                    content_type = 'application/json')
        else:
            return HttpResponse(content=json.dumps({}), status=404, content_type = 'application/json')
    else:
        return HttpResponse(content=json.dumps({}), status=404, content_type = 'application/json')

    def test_add_user_to_group_requires_staff_access(self):
        with self.assertRaises(PermissionDenied):
            self.admin.is_staff = False
            add_users(self.admin, CourseCreatorRole(), self.user)

        with self.assertRaises(PermissionDenied):
            add_users(self.user, CourseCreatorRole(), self.user)

    def test_get_all_users(self):
        """
        Test getting all authors for a course where their permissions run the gamut of allowed group
        types.
        """
        # first check the course creator.has explicit access (don't use has_access as is_staff
        # will trump the actual test)
        self.assertTrue(CourseInstructorRole(self.course_key).has_user(self.user), "Didn't add creator as instructor.")
        users = copy.copy(self.users)
        # doesn't use role.users_with_role b/c it's verifying the roles.py behavior
        user_by_role = {}
        # add the misc users to the course in different groups
        for role in [CourseInstructorRole, CourseStaffRole, OrgStaffRole, OrgInstructorRole]:
            user_by_role[role] = []
            # Org-based roles are created via org name, rather than course_key
            if (role is OrgStaffRole) or (role is OrgInstructorRole):
                group = role(self.course_key.org)
            else:
                group = role(self.course_key)
            # NOTE: this loop breaks the roles.py abstraction by purposely assigning
            # users to one of each possible groupname in order to test that has_course_author_access
            # and remove_user work
            user = users.pop()
            group.add_users(user)
            user_by_role[role].append(user)
            self.assertTrue(
                auth.has_course_author_access(user, self.course_key), "{} does not have access".format(user)
            )

        course_team_url = reverse_course_url("course_team_handler", self.course_key)
        response = self.client.get_html(course_team_url)
        for role in [CourseInstructorRole, CourseStaffRole]:  # Global and org-based roles don't appear on this page
            for user in user_by_role[role]:
                self.assertContains(response, user.email)

        # test copying course permissions
        copy_course_key = self.store.make_course_key("copyu", "copydept.mycourse", "myrun")
        for role in [CourseInstructorRole, CourseStaffRole, OrgStaffRole, OrgInstructorRole]:
            if (role is OrgStaffRole) or (role is OrgInstructorRole):
                auth.add_users(self.user, role(copy_course_key.org), *role(self.course_key.org).users_with_role())
            else:
                auth.add_users(self.user, role(copy_course_key), *role(self.course_key).users_with_role())
        # verify access in copy course and verify that removal from source course w/ the various
        # groupnames works
        for role in [CourseInstructorRole, CourseStaffRole, OrgStaffRole, OrgInstructorRole]:
            for user in user_by_role[role]:
                # forcefully decache the groups: premise is that any real request will not have
                # multiple objects repr the same user but this test somehow uses different instance
                # in above add_users call
                if hasattr(user, "_roles"):
                    del user._roles

                self.assertTrue(auth.has_course_author_access(user, copy_course_key), "{} no copy access".format(user))
                if (role is OrgStaffRole) or (role is OrgInstructorRole):
                    auth.remove_users(self.user, role(self.course_key.org), user)
                else:
                    auth.remove_users(self.user, role(self.course_key), user)
                self.assertFalse(
                    auth.has_course_author_access(user, self.course_key), "{} remove didn't work".format(user)
                )

 def test_add_user_to_group_requires_authenticated(self):
     with self.assertRaises(PermissionDenied):
         with mock.patch(
             'django.contrib.auth.models.User.is_authenticated',
             new_callable=mock.PropertyMock
         ) as mock_is_auth:
             mock_is_auth.return_value = False
             add_users(self.admin, CourseCreatorRole(), self.user)

    def test_detail_delete_staff(self):
        auth.add_users(self.user, CourseStaffRole(self.course.id), self.ext_user)

        resp = self.client.delete(self.detail_url, HTTP_ACCEPT="application/json")
        self.assertEqual(resp.status_code, 204)
        # reload user from DB
        ext_user = User.objects.get(email=self.ext_user.email)
        self.assertFalse(auth.user_has_role(ext_user, CourseStaffRole(self.course.id)))

def add_instructor(course_key, requesting_user, new_instructor):
    """
    Adds given user as instructor and staff to the given course,
    after verifying that the requesting_user has permission to do so.
    """
    # can't use auth.add_users here b/c it requires user to already have Instructor perms in this course
    CourseInstructorRole(course_key).add_users(new_instructor)
    auth.add_users(requesting_user, CourseStaffRole(course_key), new_instructor)

    def test_detail_delete_instructor(self):
        auth.add_users(self.user, CourseInstructorRole(self.course_locator), self.ext_user, self.user)

        resp = self.client.delete(self.detail_url, HTTP_ACCEPT="application/json")
        self.assertEqual(resp.status_code, 204)
        # reload user from DB
        ext_user = User.objects.get(email=self.ext_user.email)
        self.assertFalse(auth.has_access(ext_user, CourseInstructorRole(self.course_locator)))

def add_course_author(user, course):
    """
    Add the user to the instructor group of the course
    so they will have the permissions to see it in studio
    """
    global_admin = AdminFactory()
    for role in (CourseStaffRole, CourseInstructorRole):
        auth.add_users(global_admin, role(course.id), user)

 def test_get_user_role_staff(self):
     """
     Verifies if user is staff.
     """
     add_users(self.global_admin, CourseStaffRole(self.course_key), self.staff)
     self.assertEqual(
         'staff',
         get_user_role(self.staff, self.course_key)
     )

 def test_get_user_role_staff_locator(self):
     """
     Verifies if user is staff, using a CourseLocator.
     """
     add_users(self.global_admin, CourseStaffRole(self.locator), self.staff)
     self.assertEqual(
         'staff',
         get_user_role(self.staff, self.locator)
     )

 def setUp(self):
     """
     Set up test variables
     """
     super(CCXCourseGroupTest, self).setUp()
     self.global_admin = AdminFactory()
     self.staff = User.objects.create_user('teststaff', '[email protected]', 'foo')
     self.ccx_course_key = CCXLocator.from_string('ccx-v1:[email protected]')
     add_users(self.global_admin, CourseStaffRole(self.ccx_course_key), self.staff)

 def test_get_user_role_instructor(self):
     """
     Verifies if user is instructor.
     """
     add_users(self.global_admin, CourseInstructorRole(self.location), self.instructor)
     self.assertEqual(
         'instructor',
         get_user_role(self.instructor, self.location, self.location.course_id)
     )

    def test_permission_denied_other(self):
        auth.add_users(self.user, CourseStaffRole(self.course_locator), self.user)
        self.user.is_staff = False
        self.user.save()

        resp = self.client.post(self.detail_url, data={"role": "instructor"}, HTTP_ACCEPT="application/json")
        self.assertEqual(resp.status_code, 400)
        result = json.loads(resp.content)
        self.assertIn("error", result)

 def test_remove_user_from_course_group_permission_denied(self):
     """
     Verifies PermissionDenied if caller of remove_user_from_course_group is not instructor role.
     """
     add_users(self.global_admin, CourseInstructorRole(self.course_key), self.creator)
     another_staff = User.objects.create_user('another', '[email protected]', 'foo')
     add_users(self.global_admin, CourseStaffRole(self.course_key), self.creator, self.staff, another_staff)
     with self.assertRaises(PermissionDenied):
         remove_users(self.staff, CourseStaffRole(self.course_key), another_staff)

 def test_add_user_not_active(self):
     """
     Tests that adding to creator group fails if user is not active
     """
     with mock.patch.dict('django.conf.settings.FEATURES',
                          {'DISABLE_COURSE_CREATION': False, "ENABLE_CREATOR_GROUP": True}):
         self.user.is_active = False
         add_users(self.admin, CourseCreatorRole(), self.user)
         self.assertFalse(has_access(self.user, CourseCreatorRole()))

    def test_studio_user_permissions(self):
        """
        Test that user could attach to the problem only libraries that he has access (or which were created by him).
        This test was created on the basis of bug described in the pull requests on github:
        https://github.com/edx/edx-platform/pull/11331
        https://github.com/edx/edx-platform/pull/11611
        """
        self._create_library(org='admin_org_1', library='lib_adm_1', display_name='admin_lib_1')
        self._create_library(org='admin_org_2', library='lib_adm_2', display_name='admin_lib_2')

        self._login_as_non_staff_user()

        self._create_library(org='staff_org_1', library='lib_staff_1', display_name='staff_lib_1')
        self._create_library(org='staff_org_2', library='lib_staff_2', display_name='staff_lib_2')

        with modulestore().default_store(ModuleStoreEnum.Type.split):
            course = CourseFactory.create()

        instructor_role = CourseInstructorRole(course.id)
        auth.add_users(self.user, instructor_role, self.non_staff_user)

        lib_block = ItemFactory.create(
            category='library_content',
            parent_location=course.location,
            user_id=self.non_staff_user.id,
            publish_item=False
        )

        def _get_settings_html():
            """
            Helper function to get block settings HTML
            Used to check the available libraries.
            """
            edit_view_url = reverse_usage_url("xblock_view_handler", lib_block.location, {"view_name": STUDIO_VIEW})

            resp = self.client.get_json(edit_view_url)
            self.assertEquals(resp.status_code, 200)

            return parse_json(resp)['html']

        self._login_as_staff_user()
        staff_settings_html = _get_settings_html()
        self.assertIn('staff_lib_1', staff_settings_html)
        self.assertIn('staff_lib_2', staff_settings_html)
        self.assertIn('admin_lib_1', staff_settings_html)
        self.assertIn('admin_lib_2', staff_settings_html)

        self._login_as_non_staff_user()
        response = self.client.get_json(LIBRARY_REST_URL)
        staff_libs = parse_json(response)
        self.assertEquals(2, len(staff_libs))

        non_staff_settings_html = _get_settings_html()
        self.assertIn('staff_lib_1', non_staff_settings_html)
        self.assertIn('staff_lib_2', non_staff_settings_html)
        self.assertNotIn('admin_lib_1', non_staff_settings_html)
        self.assertNotIn('admin_lib_2', non_staff_settings_html)

def update_course_creator_group(caller, user, add):
    """
    Method for adding and removing users from the creator group.

    Caller must have staff permissions.
    """
    if add:
        auth.add_users(caller, CourseCreatorRole(), user)
    else:
        auth.remove_users(caller, CourseCreatorRole(), user)

    def test_post_last_instructor(self):
        auth.add_users(self.user, CourseInstructorRole(self.course_locator), self.ext_user)

        resp = self.client.post(self.detail_url, data={"role": "staff"}, HTTP_ACCEPT="application/json")
        self.assertEqual(resp.status_code, 400)
        result = json.loads(resp.content)
        self.assertIn("error", result)
        # reload user from DB
        ext_user = User.objects.get(email=self.ext_user.email)
        self.assertTrue(auth.has_access(ext_user, CourseInstructorRole(self.course_locator)))

    def test_delete_last_instructor(self):
        auth.add_users(self.user, CourseInstructorRole(self.course.id), self.ext_user)

        resp = self.client.delete(self.detail_url, HTTP_ACCEPT="application/json")
        self.assertEqual(resp.status_code, 400)
        result = json.loads(resp.content)
        self.assertIn("error", result)
        # reload user from DB
        ext_user = User.objects.get(email=self.ext_user.email)
        self.assertTrue(auth.user_has_role(ext_user, CourseInstructorRole(self.course.id)))

 def test_add_user_not_authenticated(self):
     """
     Tests that adding to creator group fails if user is not authenticated
     """
     with mock.patch.dict('django.conf.settings.FEATURES',
                          {'DISABLE_COURSE_CREATION': False, "ENABLE_CREATOR_GROUP": True}):
         anonymous_user = AnonymousUser()
         role = CourseCreatorRole()
         add_users(self.admin, role, anonymous_user)
         self.assertFalse(has_access(anonymous_user, role))