[hiteshkava]

Backports the upstream fix for GHSA-c6fp-f54c-6cv4 to release-ulmo. It uses upstream's 0.4.x backport 91d9b9f (of 322ca14), which matches this fork's flat forum/ layout.

Ticket: https://2u-internal.atlassian.net/browse/LP-1391

Changes

• Routing: /forum/api/v1/ and /forum/api/v2/ aren't routed unless FORUM_ENABLE_HTTP_API is True. It defaults to False, including when the setting isn't defined. edx-platform calls forum.api in process, so discussions don't use these routes.
• Auth: every API view now requires a staff caller through the new ForumAPIView base class (forum/views/base.py, forum/permissions.py).
• Fork-only ban views: views/bans.py (ban, unban, banned users, ban detail) now uses ForumAPIView, and AllowAny is removed. Upstream doesn't have these views, so the backport alone wouldn't cover them.
• Tests: adds upstream's tests/test_permissions.py and tests/test_urls.py. The permission test walks the URLconf, so it covers the ban routes on v1 and v2. With the old bans.py, 8 cases fail.
• e2e tests: tests/e2e/conftest.py overrode api_client with an anonymous client, so with the new permission every e2e request got a 403. The override is removed so e2e uses the staff-authenticated fixture from tests/conftest.py. This is the same change as upstream openedx/forum 8149351.
• Conflicts: the fork's telemetry imports conflicted with the new import; both are kept. The version stays 0.7.4, and the changelog entry goes under Unreleased.

The setting will be pinned off explicitly in edx-internal for edge, stage and prod (separate PR).

Testing

Unit tests: pytest passes 598/598 on Python 3.12 and Django 5.2. manage.py check, pylint, pycodestyle/pydocstyle and mypy pass. black reports the same 2 files as release-ulmo (setup.py, tests/test_backends/test_mongodb/test_comments.py); this PR doesn't touch them.

e2e: tests/e2e passes 74/74 locally against the compose services (MongoDB, Elasticsearch, Meilisearch). Before the conftest fix, those tests failed with 403s, as in CI.

Devstack: LMS on edx-platform release-ulmo, with this branch installed editable.

FORUM_ENABLE_HTTP_API	Anonymous	Learner	Staff
True	401	403	200
False (default)	404	404	404

With the setting False, I ran discussions through the discussion API the MFE uses (/api/discussion/v1/): create, edit and read a post; reply and nested comment; upvote; follow; pin/unpin; close/reopen; learner flag/unflag; ban, list banned and unban; search; delete. All 29 checks passed.

Manual testing

1. Install this branch in the LMS and restart.
2. curl -i http://localhost:18000/forum/api/v1/commentables/<course_id>/counts should return 404.
3. In the discussions MFE, post, reply, vote, flag, pin, and ban/unban a learner (ban needs the discussions.enable_discussion_ban course flag).

Merge checklist:

• Version bumped (not applicable: kept the fork's 0.7.4)
• Changelog record added
• Documentation updated (not only docstrings) (the setting is documented in forum/settings/common.py as a toggle annotation)
• Fixup commits are squashed away
• Unit tests added/updated
• Manual testing instructions provided
• Noted any: Concerns, dependencies, migration issues, deadlines, tickets (no migrations)

[abhalsod-sonata]

Approving. Checked against upstream 91d9b9f: permissions.py, views/base.py, both new test modules and the FORUM_ENABLE_HTTP_API toggle block are identical, and urls.py differs only by the fork's ban routes. No view under forum/ is left on plain APIView, AllowAny or a function view: all 27 routed views, including the four fork-only ban views, now inherit ForumAPIView, so a new view is protected by default. Routing defaults to off when the setting is absent, which is the right failure mode.