[alezconsultant]

Description

Implements openedx#796: a read-only endpoint that lists the courses where a competency
can't get a new CompetencyCriterion, because a taxonomy ancestor or descendant of it already has
one there.

GET /api/cbe/v1/competencies/<int:tag_id>/blocked-courses/[?course_keys=<key>,<key>]

Each row carries the blocked course's key and the conflicting tag's id and value:

{"count": 1, "next": null, "previous": null, "results": [
  {"course_key": "course-v1:Org+Course+Run", "conflicting_tag_id": 12, "conflicting_tag_value": "Critical Thinking"}
]}

This PR is built on top of openedx#875 (pr), which provides get_courses_with_relative_criteria and the
tagging hierarchy helpers.

CompetencyReadPermission is copied verbatim from openedx#878 (openedx#681), so this PR doesn't depend on
openedx#878. The two copies are identical, so whichever PR merges second reuses the class from the
first, and the merge conflict there resolves to the same lines.

Changes

• src/openedx_learning/applets/cbe/api.py: adds get_blocked_courses(tag, course_keys=None)
  (UNSTABLE) and the BlockedCourse dataclass. It calls [BE] Add Competency hierarchy dominance validation to Competency Criteria Creation openedx/openedx-core#666's get_courses_with_relative_criteria
  without a course, so the read and the write-side rejection share one query and always agree on
  which courses are blocked and which tag is named. That includes feat: enforce competency-hierarchy dominance for criteria openedx/openedx-core#875's handling of archived rows:
  an archived criterion, or one under an archived group, blocks nothing in either place.
• rest_api/v1/views.py, serializers.py, urls.py, rest_api/paginators.py: adds
  CompetencyBlockedCoursesView, BlockedCourseSerializer,
  CompetencyBlockedCoursesQueryParamsSerializer, and CompetencyBlockedCoursesPagination
  (page size 100, max 500, pinned like CompetencyRuleProfilePagination). Authentication and
  permission match feat: add GET competency criteria-groups endpoint openedx/openedx-core#878's criteria-groups view.
• rest_api/v1/permissions.py: adds CompetencyReadPermission, identical to feat: add GET competency criteria-groups endpoint openedx/openedx-core#878's.
• Tests: one endpoint test per acceptance-criteria scenario, including both the grandparent and the
  grandchild direction, plus API-level tests and the edge cases listed below.

Testing instructions

Automated: pytest tests/openedx_learning/applets/cbe tests/openedx_tagging/test_api.py --no-cov.

Manual, against a Tutor devstack with this branch's openedx-core mounted. Mount the CBE API in
your local cms/urls.py with path('api/cbe/', include('openedx_learning.urls')), run
tutor dev exec cms ./manage.py cms migrate, and restart CMS. Log in as a staff user and get a JWT
Authorization header, then use three real course keys as Course X, Y and Z.

1. Create a competency taxonomy (POST /api/content_tagging/v1/taxonomies/ with
   "taxonomy_type": "competency") with the tags "Cognitive Skills" > "Critical Thinking" >
   "Inference", plus "Analysis" under "Critical Thinking" as a sibling of "Inference".
2. Create criteria with POST /api/cbe/v1/competencies/<tag_id>/criteria/: "Critical Thinking" in
   Course X, "Cognitive Skills" in Course Y, "Analysis" in Course Z.
3. GET /api/cbe/v1/competencies/<inference_id>/blocked-courses/. Expect 200 with Course X naming
   "Critical Thinking" and Course Y naming "Cognitive Skills". Course Z doesn't appear, because
   "Analysis" is a sibling of "Inference".
4. GET the same endpoint for "Critical Thinking". Expect Course Y naming "Cognitive Skills" and
   Course Z naming "Analysis". Course X doesn't appear, because a tag's own criterion doesn't
   block it.
5. Repeat step 3 with ?course_keys=<Course X>. Expect only Course X, with count 1.
6. Repeat step 3 with ?page_size=1. Expect count 2, one row, and a next link that returns
   the other course.
7. Repeat step 3 with ?course_keys=not-a-key and with ?course_keys=. Expect 400 for both.
8. GET the endpoint for tag_id=999999. Expect 404.
9. Disable the taxonomy and GET the endpoint as a non-staff user. Expect 403.

Other information

• Public API: one new UNSTABLE function on openedx_learning.api. The change is purely additive.
• BlockedCourseSerializer and the query-params serializer carry
  # pylint: disable=abstract-method, the same as the plain Serializer subclasses in
  openedx_tagging and openedx_content.
• AI usage: implemented with Claude Code (Claude Opus 5.5), then reviewed and tested by the author.

Related to openedx#796

🤖 Generated with the help of Claude Code