From 744219afc9a566098b2e303c17960133ebded033 Mon Sep 17 00:00:00 2001
From: Braden MacDonald <braden@opencraft.com>
Date: Tue, 10 Sep 2024 17:00:09 -0700
Subject: [PATCH 1/3] feat: new URL to render a v2 xblock in an iframe

---
 .../content_libraries/xblock_iframe.html      |  7 ++-
 lms/templates/xblock_v2/xblock_iframe.html    |  1 +
 .../core/djangoapps/xblock/rest_api/urls.py   |  4 ++
 .../core/djangoapps/xblock/rest_api/views.py  | 45 ++++++++++++++++++-
 4 files changed, 54 insertions(+), 3 deletions(-)
 create mode 120000 lms/templates/xblock_v2/xblock_iframe.html

diff --git a/cms/templates/content_libraries/xblock_iframe.html b/cms/templates/content_libraries/xblock_iframe.html
index e8eb4c96ead0..b6e455f78515 100644
--- a/cms/templates/content_libraries/xblock_iframe.html
+++ b/cms/templates/content_libraries/xblock_iframe.html
@@ -6,7 +6,12 @@
   <base target="_blank">
   <meta charset="UTF-8">
   <!-- gettext & XBlock JS i18n code -->
-  <script type="text/javascript" src="{{ lms_root_url }}/static/js/i18n/en/djangojs.js"></script>
+  {% if is_development %}
+    <!-- in development, the djangojs file isn't available so use fallback-->
+    <script type="text/javascript" src="{{ lms_root_url }}/static/js/src/gettext_fallback.js"></script>
+  {% else %}
+    <script type="text/javascript" src="{{ lms_root_url }}/static/js/i18n/en/djangojs.js"></script>
+  {% endif %}
   <!-- Most XBlocks require jQuery: -->
   <script src="https://code.jquery.com/jquery-2.2.4.min.js"></script>
   <!-- The Video XBlock requires "ajaxWithPrefix" -->
diff --git a/lms/templates/xblock_v2/xblock_iframe.html b/lms/templates/xblock_v2/xblock_iframe.html
new file mode 120000
index 000000000000..7264c253466d
--- /dev/null
+++ b/lms/templates/xblock_v2/xblock_iframe.html
@@ -0,0 +1 @@
+../../../cms/templates/content_libraries/xblock_iframe.html
\ No newline at end of file
diff --git a/openedx/core/djangoapps/xblock/rest_api/urls.py b/openedx/core/djangoapps/xblock/rest_api/urls.py
index 034d490aa3a8..2d88b1531f22 100644
--- a/openedx/core/djangoapps/xblock/rest_api/urls.py
+++ b/openedx/core/djangoapps/xblock/rest_api/urls.py
@@ -29,4 +29,8 @@
             ),
         ])),
     ])),
+    path('xblocks/v2/<str:usage_key_str>/', include([
+        # render one of this XBlock's views (e.g. student_view) for embedding in an iframe
+        re_path(r'^embed/(?P<view_name>[\w\-]+)/$', views.embed_block_view),
+    ])),
 ]
diff --git a/openedx/core/djangoapps/xblock/rest_api/views.py b/openedx/core/djangoapps/xblock/rest_api/views.py
index 9972e7463b23..5a4243e45747 100644
--- a/openedx/core/djangoapps/xblock/rest_api/views.py
+++ b/openedx/core/djangoapps/xblock/rest_api/views.py
@@ -1,12 +1,16 @@
 """
 Views that implement a RESTful API for interacting with XBlocks.
 """
+import itertools
+import json
 
 from common.djangoapps.util.json_request import JsonResponse
 from corsheaders.signals import check_request_enabled
+from django.conf import settings
 from django.contrib.auth import get_user_model
 from django.db.transaction import atomic
 from django.http import Http404
+from django.shortcuts import render
 from django.utils.translation import gettext as _
 from django.views.decorators.clickjacking import xframe_options_exempt
 from django.views.decorators.csrf import csrf_exempt
@@ -21,6 +25,7 @@
 
 from opaque_keys import InvalidKeyError
 from opaque_keys.edx.keys import UsageKey
+import openedx.core.djangoapps.site_configuration.helpers as configuration_helpers
 from openedx.core.djangoapps.xblock.learning_context.manager import get_learning_context_impl
 from openedx.core.lib.api.view_utils import view_auth_classes
 from ..api import (
@@ -87,6 +92,42 @@ def render_block_view(request, usage_key_str, view_name):
     return Response(response_data)
 
 
+@api_view(['GET'])
+@view_auth_classes(is_authenticated=False)
+@permission_classes((permissions.AllowAny, ))  # Permissions are handled at a lower level, by the learning context
+@xframe_options_exempt
+def embed_block_view(request, usage_key_str, view_name):
+    """
+    Render the given XBlock in an <iframe>
+    """
+    try:
+        usage_key = UsageKey.from_string(usage_key_str)
+    except InvalidKeyError as e:
+        raise NotFound(invalid_not_found_fmt.format(usage_key=usage_key_str)) from e
+
+    try:
+        block = load_block(usage_key, request.user)
+    except NoSuchUsage as exc:
+        raise NotFound(f"{usage_key} not found") from exc
+
+    fragment = _render_block_view(block, view_name, request.user)
+    handler_urls = {
+        str(key): _get_handler_url(key, 'handler_name', request.user)
+        for key in itertools.chain([block.scope_ids.usage_id], getattr(block, 'children', []))
+    }
+    lms_root_url = configuration_helpers.get_value('LMS_ROOT_URL', settings.LMS_ROOT_URL)
+    context = {
+        'fragment': fragment,
+        'handler_urls_json': json.dumps(handler_urls),
+        'lms_root_url': lms_root_url,
+        'is_development': settings.DEBUG,
+    }
+    response = render(request, 'xblock_v2/xblock_iframe.html', context, content_type='text/html')
+    # TODO: add the course authoring MFE and learner MFE URLs to CSP frame-ancestors
+    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors
+    return response
+
+
 @api_view(['GET'])
 @view_auth_classes(is_authenticated=False)
 def get_handler_url(request, usage_key_str, handler_name):
@@ -185,8 +226,8 @@ class BlockFieldsView(APIView):
     View to get/edit the field values of an XBlock as JSON (in the v2 runtime)
 
     This class mimics the functionality of xblock_handler in block.py (for v1 xblocks), but for v2 xblocks.
-    However, it only implements the exact subset of functionality needed to support the v2 editors (from
-    the frontend-lib-content-components project). As such, it only supports GET and POST, and only the
+    However, it only implements the exact subset of functionality needed to support the v2 editors (in
+    the Course Authoring MFE). As such, it only supports GET and POST, and only the
     POSTing of data/metadata fields.
     """
 

From 254384cb229201c6af51c46e5c719c3e1bc03ab6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=B4mulo=20Penido?= <romulo.penido@gmail.com>
Date: Wed, 11 Sep 2024 16:54:50 -0300
Subject: [PATCH 2/3] fix: add CSP

---
 openedx/core/djangoapps/xblock/rest_api/views.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/openedx/core/djangoapps/xblock/rest_api/views.py b/openedx/core/djangoapps/xblock/rest_api/views.py
index 5a4243e45747..c6fc9f42ec1f 100644
--- a/openedx/core/djangoapps/xblock/rest_api/views.py
+++ b/openedx/core/djangoapps/xblock/rest_api/views.py
@@ -123,8 +123,11 @@ def embed_block_view(request, usage_key_str, view_name):
         'is_development': settings.DEBUG,
     }
     response = render(request, 'xblock_v2/xblock_iframe.html', context, content_type='text/html')
-    # TODO: add the course authoring MFE and learner MFE URLs to CSP frame-ancestors
-    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors
+
+    # Only allow this iframe be embedded if the parent is in the CORS_ORIGIN_WHITELIST
+    cors_origin_whitelist = configuration_helpers.get_value('CORS_ORIGIN_WHITELIST', settings.CORS_ORIGIN_WHITELIST)
+    response["Content-Security-Policy"] = f"frame-ancestors 'self' {' '.join(cors_origin_whitelist)};"
+
     return response
 
 

From eb1a0f303ee78291c55d21a633e8954d93672f8a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=B4mulo=20Penido?= <romulo.penido@gmail.com>
Date: Fri, 13 Sep 2024 15:13:23 -0300
Subject: [PATCH 3/3] docs: mark view and url as unstable

---
 openedx/core/djangoapps/xblock/rest_api/urls.py  | 1 +
 openedx/core/djangoapps/xblock/rest_api/views.py | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/openedx/core/djangoapps/xblock/rest_api/urls.py b/openedx/core/djangoapps/xblock/rest_api/urls.py
index 2d88b1531f22..dec2fc562fee 100644
--- a/openedx/core/djangoapps/xblock/rest_api/urls.py
+++ b/openedx/core/djangoapps/xblock/rest_api/urls.py
@@ -31,6 +31,7 @@
     ])),
     path('xblocks/v2/<str:usage_key_str>/', include([
         # render one of this XBlock's views (e.g. student_view) for embedding in an iframe
+        # NOTE: this endpoint is **unstable** and subject to changes after Sumac
         re_path(r'^embed/(?P<view_name>[\w\-]+)/$', views.embed_block_view),
     ])),
 ]
diff --git a/openedx/core/djangoapps/xblock/rest_api/views.py b/openedx/core/djangoapps/xblock/rest_api/views.py
index c6fc9f42ec1f..7934e24bd2db 100644
--- a/openedx/core/djangoapps/xblock/rest_api/views.py
+++ b/openedx/core/djangoapps/xblock/rest_api/views.py
@@ -99,6 +99,8 @@ def render_block_view(request, usage_key_str, view_name):
 def embed_block_view(request, usage_key_str, view_name):
     """
     Render the given XBlock in an <iframe>
+
+    Unstable - may change after Sumac
     """
     try:
         usage_key = UsageKey.from_string(usage_key_str)