Skip to content

Instructor v2 special-exam allowance DELETE ignores numeric user_ids that its API spec allows #39228

Open

Description

@bmtcril

DELETE /api/instructor/v2/courses/<key>/special_exams/<exam_id>/allowance doesn't accept numeric user ids, although its API spec says it does.

  • lms/djangoapps/instructor/docs/references/instructor-v2-special-exams-api-spec.yaml, ExamAllowanceDeleteRequest.user_ids: "List of usernames, emails, or numeric user IDs".
  • The view (api_v2.py, delete(self, request, course_id, exam_id)) resolves each entry with get_user_by_username_or_email(str(user_identifier)). A numeric id is never found, and the row reports {"identifier": 10219, "success": false, "error": "User not found"}. The response is still 200.

The instructor-dashboard MFE sends exactly that: its Delete confirmation posts {"exam_id": 2, "user_ids": [10219], "allowance_type": "additional_time_granted"}. So deleting an allowance from the MFE never removes it, and it's still listed by GET …/special_exams/allowances afterwards. Add and Edit send usernames and work.

Expected: honor the documented contract by resolving numeric identifiers as user ids, for example by trying User.objects.get(id=…) for integer values. Otherwise, change the spec and reject numeric ids with a 400. Answering 200 when every row failed also hides the problem from clients; a 4xx (or 207) when nothing was deleted would surface it.

Environment: Tutor main with ENABLE_SPECIAL_EXAMS, a timed exam, 2026-09-24. Code as on master 2026-10-13. Found by the Open edX end-to-end test suite (BTR TC-00541).

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions