Merge pull request #2156 from edx/flowerhack/feature/basic-reverify-flow

Follow-On Verification

cms/envs/common.py

@@ -454,6 +454,8 @@ INSTALLED_APPS = (
 
     # Dark-launching languages
     'dark_lang',
+    # Student identity reverification
+    'reverification',
 )
 
 

common/djangoapps/reverification/admin.py

+"""
+Reverification admin
+"""
+
+from ratelimitbackend import admin
+from reverification.models import MidcourseReverificationWindow
+
+admin.site.register(MidcourseReverificationWindow)

common/djangoapps/reverification/migrations/0001_initial.py

+# -*- coding: utf-8 -*-
+import datetime
+from south.db import db
+from south.v2 import SchemaMigration
+from django.db import models
+
+
+class Migration(SchemaMigration):
+
+    def forwards(self, orm):
+        # Adding model 'MidcourseReverificationWindow'
+        db.create_table('reverification_midcoursereverificationwindow', (
+            ('id', self.gf('django.db.models.fields.AutoField')(primary_key=True)),
+            ('course_id', self.gf('django.db.models.fields.CharField')(max_length=255, db_index=True)),
+            ('start_date', self.gf('django.db.models.fields.DateTimeField')(default=None, null=True, blank=True)),
+            ('end_date', self.gf('django.db.models.fields.DateTimeField')(default=None, null=True, blank=True)),
+        ))
+        db.send_create_signal('reverification', ['MidcourseReverificationWindow'])
+
+
+    def backwards(self, orm):
+        # Deleting model 'MidcourseReverificationWindow'
+        db.delete_table('reverification_midcoursereverificationwindow')
+
+
+    models = {
+        'reverification.midcoursereverificationwindow': {
+            'Meta': {'object_name': 'MidcourseReverificationWindow'},
+            'course_id': ('django.db.models.fields.CharField', [], {'max_length': '255', 'db_index': 'True'}),
+            'end_date': ('django.db.models.fields.DateTimeField', [], {'default': 'None', 'null': 'True', 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'start_date': ('django.db.models.fields.DateTimeField', [], {'default': 'None', 'null': 'True', 'blank': 'True'})
+        }
+    }
+
+    complete_apps = ['reverification']
\ No newline at end of file

common/djangoapps/reverification/models.py

+"""
+Models for reverification features common to both lms and studio
+"""
+from datetime import datetime
+import pytz
+
+from django.core.exceptions import ValidationError
+from django.db import models
+from util.validate_on_save import ValidateOnSaveMixin
+
+
+class MidcourseReverificationWindow(ValidateOnSaveMixin, models.Model):
+    """
+    Defines the start and end times for midcourse reverification for a particular course.
+
+    There can be many MidcourseReverificationWindows per course, but they cannot have
+    overlapping time ranges.  This is enforced by this class's clean() method.
+    """
+    # the course that this window is attached to
+    course_id = models.CharField(max_length=255, db_index=True)
+    start_date = models.DateTimeField(default=None, null=True, blank=True)
+    end_date = models.DateTimeField(default=None, null=True, blank=True)
+
+    def clean(self):
+        """
+        Gives custom validation for the MidcourseReverificationWindow model.
+        Prevents overlapping windows for any particular course.
+        """
+        query = MidcourseReverificationWindow.objects.filter(
+            course_id=self.course_id,
+            end_date__gte=self.start_date,
+            start_date__lte=self.end_date
+        )
+        if query.count() > 0:
+            raise ValidationError('Reverification windows cannot overlap for a given course.')
+
+    @classmethod
+    def window_open_for_course(cls, course_id):
+        """
+        Returns a boolean, True if the course is currently asking for reverification, else False.
+        """
+        now = datetime.now(pytz.UTC)
+        return cls.get_window(course_id, now) is not None
+
+    @classmethod
+    def get_window(cls, course_id, date):
+        """
+        Returns the window that is open for a particular course for a particular date.
+        If no such window is open, or if more than one window is open, returns None.
+        """
+        try:
+            return cls.objects.get(course_id=course_id, start_date__lte=date, end_date__gte=date)
+        except cls.DoesNotExist:
+            return None

common/djangoapps/reverification/tests/factories.py

+"""
+verify_student factories
+"""
+from reverification.models import MidcourseReverificationWindow
+from factory.django import DjangoModelFactory
+import pytz
+from datetime import timedelta, datetime
+
+
+# Factories don't have __init__ methods, and are self documenting
+# pylint: disable=W0232
+class MidcourseReverificationWindowFactory(DjangoModelFactory):
+    """ Creates a generic MidcourseReverificationWindow. """
+    FACTORY_FOR = MidcourseReverificationWindow
+
+    course_id = u'MITx/999/Robot_Super_Course'
+    # By default this factory creates a window that is currently open
+    start_date = datetime.now(pytz.UTC) - timedelta(days=100)
+    end_date = datetime.now(pytz.UTC) + timedelta(days=100)

common/djangoapps/reverification/tests/test_models.py

+"""
+Tests for Reverification models
+"""
+from datetime import timedelta, datetime
+import pytz
+
+from django.core.exceptions import ValidationError
+from django.test import TestCase
+from django.test.utils import override_settings
+
+from courseware.tests.tests import TEST_DATA_MONGO_MODULESTORE
+from reverification.models import MidcourseReverificationWindow
+from reverification.tests.factories import MidcourseReverificationWindowFactory
+from xmodule.modulestore.tests.factories import CourseFactory
+
+
+@override_settings(MODULESTORE=TEST_DATA_MONGO_MODULESTORE)
+class TestMidcourseReverificationWindow(TestCase):
+    """ Tests for MidcourseReverificationWindow objects """
+    def setUp(self):
+        course = CourseFactory.create()
+        self.course_id = course.id
+
+    def test_window_open_for_course(self):
+        # Should return False if no windows exist for a course
+        self.assertFalse(MidcourseReverificationWindow.window_open_for_course(self.course_id))
+
+        # Should return False if a window exists, but it's not in the current timeframe
+        MidcourseReverificationWindowFactory(
+            course_id=self.course_id,
+            start_date=datetime.now(pytz.utc) - timedelta(days=10),
+            end_date=datetime.now(pytz.utc) - timedelta(days=5)
+        )
+        self.assertFalse(MidcourseReverificationWindow.window_open_for_course(self.course_id))
+
+        # Should return True if a non-expired window exists
+        MidcourseReverificationWindowFactory(
+            course_id=self.course_id,
+            start_date=datetime.now(pytz.utc) - timedelta(days=3),
+            end_date=datetime.now(pytz.utc) + timedelta(days=3)
+        )
+        self.assertTrue(MidcourseReverificationWindow.window_open_for_course(self.course_id))
+
+    def test_get_window(self):
+        # if no window exists, returns None
+        self.assertIsNone(MidcourseReverificationWindow.get_window(self.course_id, datetime.now(pytz.utc)))
+
+        # we should get the expected window otherwise
+        window_valid = MidcourseReverificationWindowFactory(
+            course_id=self.course_id,
+            start_date=datetime.now(pytz.utc) - timedelta(days=3),
+            end_date=datetime.now(pytz.utc) + timedelta(days=3)
+        )
+        self.assertEquals(
+            window_valid,
+            MidcourseReverificationWindow.get_window(self.course_id, datetime.now(pytz.utc))
+        )
+
+    def test_no_overlapping_windows(self):
+        window_valid = MidcourseReverificationWindow(
+            course_id=self.course_id,
+            start_date=datetime.now(pytz.utc) - timedelta(days=3),
+            end_date=datetime.now(pytz.utc) + timedelta(days=3)
+        )
+        window_valid.save()
+
+        with self.assertRaises(ValidationError):
+            window_invalid = MidcourseReverificationWindow(
+                course_id=self.course_id,
+                start_date=datetime.now(pytz.utc) - timedelta(days=2),
+                end_date=datetime.now(pytz.utc) + timedelta(days=4)
+            )
+            window_invalid.save()

common/djangoapps/student/forms.py

+"""
+Utility functions for validating forms
+"""
 from django import forms
 from django.contrib.auth.models import User
 from django.contrib.auth.forms import PasswordResetForm

common/djangoapps/student/views.py

@@ -10,6 +10,8 @@ import string       # pylint: disable=W0402
 import urllib
 import uuid
 import time
+from collections import defaultdict
+from pytz import UTC
 
 from django.conf import settings
 from django.contrib.auth import logout, authenticate, login
@@ -45,7 +47,7 @@ from student.models import (
 )
 from student.forms import PasswordResetFormNoActive
 
-from verify_student.models import SoftwareSecurePhotoVerification
+from verify_student.models import SoftwareSecurePhotoVerification, MidcourseReverificationWindow
 from certificates.models import CertificateStatuses, certificate_status_for_student
 
 from xmodule.course_module import CourseDescriptor
@@ -82,6 +84,7 @@ log = logging.getLogger("edx.student")
 AUDIT_LOG = logging.getLogger("audit")
 
 Article = namedtuple('Article', 'title url author image deck publication publish_date')
+ReverifyInfo = namedtuple('ReverifyInfo', 'course_id course_name course_number date status display')  # pylint: disable=C0103
 
 
 def csrf_token(context):
@@ -181,6 +184,88 @@ def cert_info(user, course):
     return _cert_info(user, course, certificate_status_for_student(user, course.id))
 
 
+def reverification_info(course_enrollment_pairs, user, statuses):
+    """
+    Returns reverification-related information for *all* of user's enrollments whose
+    reverification status is in status_list
+
+    Args:
+        course_enrollment_pairs (list): list of (course, enrollment) tuples
+        user (User): the user whose information we want
+        statuses (list): a list of reverification statuses we want information for
+            example: ["must_reverify", "denied"]
+
+    Returns:
+        dictionary of lists: dictionary with one key per status, e.g.
+            dict["must_reverify"] = []
+            dict["must_reverify"] = [some information]
+    """
+    reverifications = defaultdict(list)
+    for (course, enrollment) in course_enrollment_pairs:
+        info = single_course_reverification_info(user, course, enrollment)
+        if info:
+            reverifications[info.status].append(info)
+
+    # Sort the data by the reverification_end_date
+    for status in statuses:
+        if reverifications[status]:
+            reverifications[status].sort(key=lambda x: x.date)
+    return reverifications
+
+
+def single_course_reverification_info(user, course, enrollment):  # pylint: disable=invalid-name
+    """Returns midcourse reverification-related information for user with enrollment in course.
+
+    If a course has an open re-verification window, and that user has a verified enrollment in
+    the course, we return a tuple with relevant information. Returns None if there is no info..
+
+    Args:
+        user (User): the user we want to get information for
+        course (Course): the course in which the student is enrolled
+        enrollment (CourseEnrollment): the object representing the type of enrollment user has in course
+
+    Returns:
+        ReverifyInfo: (course_id, course_name, course_number, date, status)
+        OR, None: None if there is no re-verification info for this enrollment
+    """
+    window = MidcourseReverificationWindow.get_window(course.id, datetime.datetime.now(UTC))
+
+    # If there's no window OR the user is not verified, we don't get reverification info
+    if (not window) or (enrollment.mode != "verified"):
+        return None
+    return ReverifyInfo(
+        course.id, course.display_name, course.number,
+        window.end_date.strftime('%B %d, %Y %X %p'),
+        SoftwareSecurePhotoVerification.user_status(user, window)[0],
+        SoftwareSecurePhotoVerification.display_status(user, window),
+    )
+
+
+def get_course_enrollment_pairs(user, course_org_filter, org_filter_out_set):
+    """
+    Get the relevant set of (Course, CourseEnrollment) pairs to be displayed on
+    a student's dashboard.
+    """
+    for enrollment in CourseEnrollment.enrollments_for_user(user):
+        try:
+            course = course_from_id(enrollment.course_id)
+
+            # if we are in a Microsite, then filter out anything that is not
+            # attributed (by ORG) to that Microsite
+            if course_org_filter and course_org_filter != course.location.org:
+                continue
+            # Conversely, if we are not in a Microsite, then let's filter out any enrollments
+            # with courses attributed (by ORG) to Microsites
+            elif course.location.org in org_filter_out_set:
+                continue
+
+            yield (course, enrollment)
+        except ItemNotFoundError:
+            log.error("User {0} enrolled in non-existent course {1}"
+                      .format(user.username, enrollment.course_id))
+
+
+
 def _cert_info(user, course, cert_status):
     """
     Implements the logic for cert_info -- split out for testing.
@@ -321,11 +406,6 @@ def complete_course_mode_info(course_id, enrollment):
 def dashboard(request):
     user = request.user
 
-    # Build our (course, enrollment) list for the user, but ignore any courses that no
-    # longer exist (because the course IDs have changed). Still, we don't delete those
-    # enrollments, because it could have been a data push snafu.
-    course_enrollment_pairs = []
-
     # for microsites, we want to filter and only show enrollments for courses within
     # the microsites 'ORG'
     course_org_filter = MicrositeConfiguration.get_microsite_configuration_value('course_org_filter')
@@ -338,23 +418,10 @@ def dashboard(request):
     if course_org_filter:
         org_filter_out_set.remove(course_org_filter)
 
-    for enrollment in CourseEnrollment.enrollments_for_user(user):
-        try:
-            course = course_from_id(enrollment.course_id)
-
-            # if we are in a Microsite, then filter out anything that is not
-            # attributed (by ORG) to that Microsite
-            if course_org_filter and course_org_filter != course.location.org:
-                continue
-            # Conversely, if we are not in a Microsite, then let's filter out any enrollments
-            # with courses attributed (by ORG) to Microsites
-            elif course.location.org in org_filter_out_set:
-                continue
-
-            course_enrollment_pairs.append((course, enrollment))
-        except ItemNotFoundError:
-            log.error(u"User {0} enrolled in non-existent course {1}"
-                      .format(user.username, enrollment.course_id))
+    # Build our (course, enrollment) list for the user, but ignore any courses that no
+    # longer exist (because the course IDs have changed). Still, we don't delete those
+    # enrollments, because it could have been a data push snafu.
+    course_enrollment_pairs = list(get_course_enrollment_pairs(user, course_org_filter, org_filter_out_set))
 
     course_optouts = Optout.objects.filter(user=user).values_list('course_id', flat=True)
 
@@ -386,8 +453,13 @@ def dashboard(request):
     )
 
     # Verification Attempts
+    # Used to generate the "you must reverify for course x" banner
     verification_status, verification_msg = SoftwareSecurePhotoVerification.user_status(user)
 
+    # Gets data for midcourse reverifications, if any are necessary or have failed
+    statuses = ["approved", "denied", "pending", "must_reverify"]
+    reverifications = reverification_info(course_enrollment_pairs, user, statuses)
+
     show_refund_option_for = frozenset(course.id for course, _enrollment in course_enrollment_pairs
                                        if _enrollment.refundable())
 
@@ -398,6 +470,10 @@ def dashboard(request):
     except ExternalAuthMap.DoesNotExist:
         pass
 
+    # If there are *any* denied reverifications that have not been toggled off,
+    # we'll display the banner
+    denied_banner = any(item.display for item in reverifications["denied"])
+
     context = {'course_enrollment_pairs': course_enrollment_pairs,
                'course_optouts': course_optouts,
                'message': message,
@@ -408,9 +484,12 @@ def dashboard(request):
                'all_course_modes': course_modes,
                'cert_statuses': cert_statuses,
                'show_email_settings_for': show_email_settings_for,
+               'reverifications': reverifications,
                'verification_status': verification_status,
                'verification_msg': verification_msg,
                'show_refund_option_for': show_refund_option_for,
+               'denied_banner': denied_banner,
+               'billing_email': settings.PAYMENT_SUPPORT_EMAIL,
                }
 
     return render_to_response('dashboard.html', context)

common/djangoapps/util/validate_on_save.py

+""" Utility mixin; forces models to validate *before* saving to db """
+
+
+class ValidateOnSaveMixin(object):
+    """
+    Forces models to call their full_clean method prior to saving
+    """
+    def save(self, force_insert=False, force_update=False, **kwargs):
+        """
+        Modifies the save method to call full_clean
+        """
+        if not (force_insert or force_update):
+            self.full_clean()
+        super(ValidateOnSaveMixin, self).save(force_insert, force_update, **kwargs)

lms/djangoapps/certificates/queue.py

@@ -176,14 +176,16 @@ class XQueueCertInterface(object):
             is_whitelisted = self.whitelist.filter(
                 user=student, course_id=course_id, whitelist=True).exists()
             enrollment_mode = CourseEnrollment.enrollment_mode_for_user(student, course_id)
+            mode_is_verified = (enrollment_mode == GeneratedCertificate.MODES.verified)
+            user_is_verified = SoftwareSecurePhotoVerification.user_is_verified(student)
+            user_is_reverified = SoftwareSecurePhotoVerification.user_is_reverified_for_all(course_id, student)
             org = course_id.split('/')[0]
             course_num = course_id.split('/')[1]
             cert_mode = enrollment_mode
-            if enrollment_mode == GeneratedCertificate.MODES.verified and SoftwareSecurePhotoVerification.user_is_verified(student):
+            if (mode_is_verified and user_is_verified and user_is_reverified):
                 template_pdf = "certificate-template-{0}-{1}-verified.pdf".format(
                     org, course_num)
-            elif (enrollment_mode == GeneratedCertificate.MODES.verified and not
-                    SoftwareSecurePhotoVerification.user_is_verified(student)):
+            elif (mode_is_verified and not (user_is_verified and user_is_reverified)):
                 template_pdf = "certificate-template-{0}-{1}.pdf".format(
                     org, course_num)
                 cert_mode = GeneratedCertificate.MODES.honor

lms/djangoapps/courseware/views.py

@@ -2,6 +2,7 @@ import logging
 import urllib
 
 from functools import partial
+from collections import defaultdict
 
 from django.conf import settings
 from django.core.context_processors import csrf
@@ -29,6 +30,7 @@ from courseware.models import StudentModule, StudentModuleHistory
 from course_modes.models import CourseMode
 
 from student.models import UserTestGroup, CourseEnrollment
+from student.views import course_from_id, single_course_reverification_info
 from util.cache import cache, cache_if_anonymous
 from xblock.fragment import Fragment
 from xmodule.modulestore import Location
@@ -265,7 +267,8 @@ def index(request, course_id, chapter=None, section=None,
             'fragment': Fragment(),
             'staff_access': staff_access,
             'masquerade': masq,
-            'xqa_server': settings.FEATURES.get('USE_XQA_SERVER', 'http://xqa:server@content-qa.mitx.mit.edu/xqa')
+            'xqa_server': settings.FEATURES.get('USE_XQA_SERVER', 'http://xqa:server@content-qa.mitx.mit.edu/xqa'),
+            'reverifications': fetch_reverify_banner_info(request, course_id),
             }
 
         # Only show the chat if it's enabled by the course and in the
@@ -451,9 +454,19 @@ def course_info(request, course_id):
     course = get_course_with_access(request.user, course_id, 'load')
     staff_access = has_access(request.user, course, 'staff')
     masq = setup_masquerade(request, staff_access)    # allow staff to toggle masquerade on info page
+    reverifications = fetch_reverify_banner_info(request, course_id)
 
-    return render_to_response('courseware/info.html', {'request': request, 'course_id': course_id, 'cache': None,
-            'course': course, 'staff_access': staff_access, 'masquerade': masq})
+    context = {
+        'request': request,
+        'course_id': course_id,
+        'cache': None,
+        'course': course,
+        'staff_access': staff_access,
+        'masquerade': masq,
+        'reverifications': reverifications,
+    }
+
+    return render_to_response('courseware/info.html', context)
 
 
 @ensure_csrf_cookie
@@ -654,6 +667,7 @@ def _progress(request, course_id, student_id):
         'grade_summary': grade_summary,
         'staff_access': staff_access,
         'student': student,
+        'reverifications': fetch_reverify_banner_info(request, course_id)
     }
 
     with grades.manual_transaction():
@@ -662,6 +676,21 @@ def _progress(request, course_id, student_id):
     return response
 
 
+def fetch_reverify_banner_info(request, course_id):
+    """
+    Fetches needed context variable to display reverification banner in courseware
+    """
+    reverifications = defaultdict(list)
+    user = request.user
+    if not user.id:
+        return reverifications
+    enrollment = CourseEnrollment.get_or_create_enrollment(request.user, course_id)
+    course = course_from_id(course_id)
+    info = single_course_reverification_info(user, course, enrollment)
+    if info:
+        reverifications[info.status].append(info)
+    return reverifications
+
 @login_required
 def submission_history(request, course_id, student_username, location):
     """Render an HTML fragment (meant for inclusion elsewhere) that renders a

lms/djangoapps/dashboard/sysadmin.py

@@ -47,7 +47,6 @@ from xmodule.modulestore.xml import XMLModuleStore
 log = logging.getLogger(__name__)
 
 
-
 class SysadminDashboardView(TemplateView):
     """Base class for sysadmin dashboard views with common methods"""
 
@@ -675,7 +674,7 @@ class GitLogs(TemplateView):
                 mdb = mongoengine.connect(mongo_db['db'], host=mongo_db['host'])
         except mongoengine.connection.ConnectionError:
             log.exception('Unable to connect to mongodb to save log, '
-                              'please check MONGODB_LOG settings.')
+                          'please check MONGODB_LOG settings.')
 
         if course_id is None:
             # Require staff if not going to specific course

lms/djangoapps/verify_student/exceptions.py

+"""
+Exceptions for the verify student app
+"""
+# (Exception Class Names are sort of self-explanatory, so skipping docstring requirement)
+# pylint: disable=C0111
+
+
+class WindowExpiredException(Exception):
+    pass

lms/djangoapps/verify_student/migrations/0002_auto__add_field_softwaresecurephotoverification_window.py

+# -*- coding: utf-8 -*-
+import datetime
+from south.db import db
+from south.v2 import SchemaMigration
+from django.db import models
+
+
+class Migration(SchemaMigration):
+
+    def forwards(self, orm):
+        # Adding field 'SoftwareSecurePhotoVerification.window'
+        db.add_column('verify_student_softwaresecurephotoverification', 'window',
+                      self.gf('django.db.models.fields.related.ForeignKey')(to=orm['reverification.MidcourseReverificationWindow'], null=True),
+                      keep_default=False)
+
+
+    def backwards(self, orm):
+        # Deleting field 'SoftwareSecurePhotoVerification.window'
+        db.delete_column('verify_student_softwaresecurephotoverification', 'window_id')
+
+
+    models = {
+        'auth.group': {
+            'Meta': {'object_name': 'Group'},
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'name': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '80'}),
+            'permissions': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Permission']", 'symmetrical': 'False', 'blank': 'True'})
+        },
+        'auth.permission': {
+            'Meta': {'ordering': "('content_type__app_label', 'content_type__model', 'codename')", 'unique_together': "(('content_type', 'codename'),)", 'object_name': 'Permission'},
+            'codename': ('django.db.models.fields.CharField', [], {'max_length': '100'}),
+            'content_type': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['contenttypes.ContentType']"}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'name': ('django.db.models.fields.CharField', [], {'max_length': '50'})
+        },
+        'auth.user': {
+            'Meta': {'object_name': 'User'},
+            'date_joined': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.now'}),
+            'email': ('django.db.models.fields.EmailField', [], {'max_length': '75', 'blank': 'True'}),
+            'first_name': ('django.db.models.fields.CharField', [], {'max_length': '30', 'blank': 'True'}),
+            'groups': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Group']", 'symmetrical': 'False', 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'is_active': ('django.db.models.fields.BooleanField', [], {'default': 'True'}),
+            'is_staff': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'is_superuser': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'last_login': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.now'}),
+            'last_name': ('django.db.models.fields.CharField', [], {'max_length': '30', 'blank': 'True'}),
+            'password': ('django.db.models.fields.CharField', [], {'max_length': '128'}),
+            'user_permissions': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Permission']", 'symmetrical': 'False', 'blank': 'True'}),
+            'username': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '30'})
+        },
+        'contenttypes.contenttype': {
+            'Meta': {'ordering': "('name',)", 'unique_together': "(('app_label', 'model'),)", 'object_name': 'ContentType', 'db_table': "'django_content_type'"},
+            'app_label': ('django.db.models.fields.CharField', [], {'max_length': '100'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'model': ('django.db.models.fields.CharField', [], {'max_length': '100'}),
+            'name': ('django.db.models.fields.CharField', [], {'max_length': '100'})
+        },
+        'reverification.midcoursereverificationwindow': {
+            'Meta': {'object_name': 'MidcourseReverificationWindow'},
+            'course_id': ('django.db.models.fields.CharField', [], {'max_length': '255', 'db_index': 'True'}),
+            'end_date': ('django.db.models.fields.DateTimeField', [], {'default': 'None', 'null': 'True', 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'start_date': ('django.db.models.fields.DateTimeField', [], {'default': 'None', 'null': 'True', 'blank': 'True'})
+        },
+        'verify_student.softwaresecurephotoverification': {
+            'Meta': {'ordering': "['-created_at']", 'object_name': 'SoftwareSecurePhotoVerification'},
+            'created_at': ('django.db.models.fields.DateTimeField', [], {'auto_now_add': 'True', 'db_index': 'True', 'blank': 'True'}),
+            'error_code': ('django.db.models.fields.CharField', [], {'max_length': '50', 'blank': 'True'}),
+            'error_msg': ('django.db.models.fields.TextField', [], {'blank': 'True'}),
+            'face_image_url': ('django.db.models.fields.URLField', [], {'max_length': '255', 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'name': ('django.db.models.fields.CharField', [], {'max_length': '255', 'blank': 'True'}),
+            'photo_id_image_url': ('django.db.models.fields.URLField', [], {'max_length': '255', 'blank': 'True'}),
+            'photo_id_key': ('django.db.models.fields.TextField', [], {'max_length': '1024'}),
+            'receipt_id': ('django.db.models.fields.CharField', [], {'default': "'<function uuid4 at 0x21d4398>'", 'max_length': '255', 'db_index': 'True'}),
+            'reviewing_service': ('django.db.models.fields.CharField', [], {'max_length': '255', 'blank': 'True'}),
+            'reviewing_user': ('django.db.models.fields.related.ForeignKey', [], {'default': 'None', 'related_name': "'photo_verifications_reviewed'", 'null': 'True', 'to': "orm['auth.User']"}),
+            'status': ('model_utils.fields.StatusField', [], {'default': "'created'", 'max_length': '100', u'no_check_for_status': 'True'}),
+            'status_changed': ('model_utils.fields.MonitorField', [], {'default': 'datetime.datetime.now', u'monitor': "u'status'"}),
+            'submitted_at': ('django.db.models.fields.DateTimeField', [], {'null': 'True', 'db_index': 'True'}),
+            'updated_at': ('django.db.models.fields.DateTimeField', [], {'auto_now': 'True', 'db_index': 'True', 'blank': 'True'}),
+            'user': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['auth.User']"}),
+            'window': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['reverification.MidcourseReverificationWindow']", 'null': 'True'})
+        }
+    }
+
+    complete_apps = ['verify_student']
\ No newline at end of file

lms/djangoapps/verify_student/migrations/0003_auto__add_field_softwaresecurephotoverification_display.py

+# -*- coding: utf-8 -*-
+import datetime
+from south.db import db
+from south.v2 import SchemaMigration
+from django.db import models
+
+
+class Migration(SchemaMigration):
+
+    def forwards(self, orm):
+        # Adding field 'SoftwareSecurePhotoVerification.display'
+        db.add_column('verify_student_softwaresecurephotoverification', 'display',
+                      self.gf('django.db.models.fields.BooleanField')(default=True, db_index=True),
+                      keep_default=False)
+
+
+    def backwards(self, orm):
+        # Deleting field 'SoftwareSecurePhotoVerification.display'
+        db.delete_column('verify_student_softwaresecurephotoverification', 'display')
+
+
+    models = {
+        'auth.group': {
+            'Meta': {'object_name': 'Group'},
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'name': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '80'}),
+            'permissions': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Permission']", 'symmetrical': 'False', 'blank': 'True'})
+        },
+        'auth.permission': {
+            'Meta': {'ordering': "('content_type__app_label', 'content_type__model', 'codename')", 'unique_together': "(('content_type', 'codename'),)", 'object_name': 'Permission'},
+            'codename': ('django.db.models.fields.CharField', [], {'max_length': '100'}),
+            'content_type': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['contenttypes.ContentType']"}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'name': ('django.db.models.fields.CharField', [], {'max_length': '50'})
+        },
+        'auth.user': {
+            'Meta': {'object_name': 'User'},
+            'date_joined': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.now'}),
+            'email': ('django.db.models.fields.EmailField', [], {'max_length': '75', 'blank': 'True'}),
+            'first_name': ('django.db.models.fields.CharField', [], {'max_length': '30', 'blank': 'True'}),
+            'groups': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Group']", 'symmetrical': 'False', 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'is_active': ('django.db.models.fields.BooleanField', [], {'default': 'True'}),
+            'is_staff': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'is_superuser': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'last_login': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.now'}),
+            'last_name': ('django.db.models.fields.CharField', [], {'max_length': '30', 'blank': 'True'}),
+            'password': ('django.db.models.fields.CharField', [], {'max_length': '128'}),
+            'user_permissions': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Permission']", 'symmetrical': 'False', 'blank': 'True'}),
+            'username': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '30'})
+        },
+        'contenttypes.contenttype': {
+            'Meta': {'ordering': "('name',)", 'unique_together': "(('app_label', 'model'),)", 'object_name': 'ContentType', 'db_table': "'django_content_type'"},
+            'app_label': ('django.db.models.fields.CharField', [], {'max_length': '100'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'model': ('django.db.models.fields.CharField', [], {'max_length': '100'}),
+            'name': ('django.db.models.fields.CharField', [], {'max_length': '100'})
+        },
+        'reverification.midcoursereverificationwindow': {
+            'Meta': {'object_name': 'MidcourseReverificationWindow'},
+            'course_id': ('django.db.models.fields.CharField', [], {'max_length': '255', 'db_index': 'True'}),
+            'end_date': ('django.db.models.fields.DateTimeField', [], {'default': 'None', 'null': 'True', 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'start_date': ('django.db.models.fields.DateTimeField', [], {'default': 'None', 'null': 'True', 'blank': 'True'})
+        },
+        'verify_student.softwaresecurephotoverification': {
+            'Meta': {'ordering': "['-created_at']", 'object_name': 'SoftwareSecurePhotoVerification'},
+            'created_at': ('django.db.models.fields.DateTimeField', [], {'auto_now_add': 'True', 'db_index': 'True', 'blank': 'True'}),
+            'display': ('django.db.models.fields.BooleanField', [], {'default': 'True', 'db_index': 'True'}),
+            'error_code': ('django.db.models.fields.CharField', [], {'max_length': '50', 'blank': 'True'}),
+            'error_msg': ('django.db.models.fields.TextField', [], {'blank': 'True'}),
+            'face_image_url': ('django.db.models.fields.URLField', [], {'max_length': '255', 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'name': ('django.db.models.fields.CharField', [], {'max_length': '255', 'blank': 'True'}),
+            'photo_id_image_url': ('django.db.models.fields.URLField', [], {'max_length': '255', 'blank': 'True'}),
+            'photo_id_key': ('django.db.models.fields.TextField', [], {'max_length': '1024'}),
+            'receipt_id': ('django.db.models.fields.CharField', [], {'default': "'<function uuid4 at 0x3176410>'", 'max_length': '255', 'db_index': 'True'}),
+            'reviewing_service': ('django.db.models.fields.CharField', [], {'max_length': '255', 'blank': 'True'}),
+            'reviewing_user': ('django.db.models.fields.related.ForeignKey', [], {'default': 'None', 'related_name': "'photo_verifications_reviewed'", 'null': 'True', 'to': "orm['auth.User']"}),
+            'status': ('model_utils.fields.StatusField', [], {'default': "'created'", 'max_length': '100', u'no_check_for_status': 'True'}),
+            'status_changed': ('model_utils.fields.MonitorField', [], {'default': 'datetime.datetime.now', u'monitor': "u'status'"}),
+            'submitted_at': ('django.db.models.fields.DateTimeField', [], {'null': 'True', 'db_index': 'True'}),
+            'updated_at': ('django.db.models.fields.DateTimeField', [], {'auto_now': 'True', 'db_index': 'True', 'blank': 'True'}),
+            'user': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['auth.User']"}),
+            'window': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['reverification.MidcourseReverificationWindow']", 'null': 'True'})
+        }
+    }
+
+    complete_apps = ['verify_student']
\ No newline at end of file

lms/djangoapps/verify_student/models.py

@@ -35,9 +35,16 @@ from verify_student.ssencrypt import (
     generate_signed_message, rsa_encrypt
 )
 
+from reverification.models import MidcourseReverificationWindow
+
 log = logging.getLogger(__name__)
 
 
+def generateUUID():  # pylint: disable=C0103
+    """ Utility function; generates UUIDs """
+    return str(uuid.uuid4)
+
+
 class VerificationException(Exception):
     pass
 
@@ -135,13 +142,18 @@ class PhotoVerification(StatusModel):
     # user IDs or something too easily guessable.
     receipt_id = models.CharField(
         db_index=True,
-        default=uuid.uuid4,
+        default=generateUUID,
         max_length=255,
     )
 
     created_at = models.DateTimeField(auto_now_add=True, db_index=True)
     updated_at = models.DateTimeField(auto_now=True, db_index=True)
 
+    # Indicates whether or not a user wants to see the verification status
+    # displayed on their dash.  Right now, only relevant for allowing students
+    # to "dismiss" a failed midcourse reverification message
+    display = models.BooleanField(db_index=True, default=True)
+
     ######################## Fields Set When Submitting ########################
     submitted_at = models.DateTimeField(null=True, db_index=True)
 
@@ -185,52 +197,67 @@ class PhotoVerification(StatusModel):
         return allowed_date
 
     @classmethod
-    def user_is_verified(cls, user, earliest_allowed_date=None):
+    def user_is_verified(cls, user, earliest_allowed_date=None, window=None):
         """
-        Return whether or not a user has satisfactorily proved their
-        identity. Depending on the policy, this can expire after some period of
-        time, so a user might have to renew periodically.
+        Return whether or not a user has satisfactorily proved their identity.
+        Depending on the policy, this can expire after some period of time, so
+        a user might have to renew periodically.
+
+        If window=None, then this will check for the user's *initial* verification.
+        If window is set to anything else, it will check for the reverification
+        associated with that window.
         """
         return cls.objects.filter(
             user=user,
             status="approved",
             created_at__gte=(earliest_allowed_date
-                             or cls._earliest_allowed_date())
+                             or cls._earliest_allowed_date()),
+            window=window
         ).exists()
 
     @classmethod
-    def user_has_valid_or_pending(cls, user, earliest_allowed_date=None):
+    def user_has_valid_or_pending(cls, user, earliest_allowed_date=None, window=None):
         """
         Return whether the user has a complete verification attempt that is or
         *might* be good. This means that it's approved, been submitted, or would
         have been submitted but had an non-user error when it was being
         submitted. It's basically any situation in which the user has signed off
         on the contents of the attempt, and we have not yet received a denial.
+
+        If window=None, this will check for the user's *initial* verification.  If
+        window is anything else, this will check for the reverification associated
+        with that window.
         """
-        valid_statuses = ['must_retry', 'submitted', 'approved']
+        valid_statuses = ['submitted', 'approved']
+        if not window:
+            valid_statuses.append('must_retry')
         return cls.objects.filter(
             user=user,
             status__in=valid_statuses,
             created_at__gte=(earliest_allowed_date
-                             or cls._earliest_allowed_date())
+                             or cls._earliest_allowed_date()),
+            window=window,
         ).exists()
 
     @classmethod
-    def active_for_user(cls, user):
+    def active_for_user(cls, user, window=None):
         """
         Return the most recent PhotoVerification that is marked ready (i.e. the
         user has said they're set, but we haven't submitted anything yet).
+
+        If window=None, this checks for the original verification.  If window is set to
+        anything else, this will check for the reverification associated with that window.
         """
         # This should only be one at the most, but just in case we create more
         # by mistake, we'll grab the most recently created one.
-        active_attempts = cls.objects.filter(user=user, status='ready').order_by('-created_at')
+        active_attempts = cls.objects.filter(user=user, status='ready', window=window).order_by('-created_at')
         if active_attempts:
             return active_attempts[0]
         else:
             return None
 
     @classmethod
-    def user_status(cls, user):
+    def user_status(cls, user, window=None):
         """
         Returns the status of the user based on their past verification attempts
 
@@ -239,36 +266,53 @@ class PhotoVerification(StatusModel):
         If the verification has been approved, returns 'approved'
         If the verification process is still ongoing, returns 'pending'
         If the verification has been denied and the user must resubmit photos, returns 'must_reverify'
+
+        If window=None, this checks initial verifications
+        If window is set, this checks for the reverification associated with that window
         """
         status = 'none'
         error_msg = ''
 
-        if cls.user_is_verified(user):
+        if cls.user_is_verified(user, window=window):
             status = 'approved'
-        elif cls.user_has_valid_or_pending(user):
+
+        elif cls.user_has_valid_or_pending(user, window=window):
             # user_has_valid_or_pending does include 'approved', but if we are
             # here, we know that the attempt is still pending
             status = 'pending'
+
         else:
             # we need to check the most recent attempt to see if we need to ask them to do
             # a retry
             try:
-                attempts = cls.objects.filter(user=user).order_by('-updated_at')
+                attempts = cls.objects.filter(user=user, window=window).order_by('-updated_at')
                 attempt = attempts[0]
             except IndexError:
-                return ('none', error_msg)
+
+                # If no verification exists for a *midcourse* reverification, then that just
+                # means the student still needs to reverify.  For *original* verifications,
+                # we return 'none'
+                if(window):
+                    return('must_reverify', error_msg)
+                else:
+                    return ('none', error_msg)
+
             if attempt.created_at < cls._earliest_allowed_date():
                 return ('expired', error_msg)
 
-            # right now, this is the only state at which they must reverify. It
-            # may change later
+            # If someone is denied their original verification attempt, they can try to reverify.
+            # However, if a midcourse reverification is denied, that denial is permanent.
             if attempt.status == 'denied':
-                status = 'must_reverify'
+                if window is None:
+                    status = 'must_reverify'
+                else:
+                    status = 'denied'
             if attempt.error_msg:
                 error_msg = attempt.parsed_error_msg()
 
         return (status, error_msg)
 
+
     def parsed_error_msg(self):
         """
         Sometimes, the error message we've received needs to be parsed into
@@ -320,10 +364,6 @@ class PhotoVerification(StatusModel):
         self.status = "ready"
         self.save()
 
-    @status_before_must_be("must_retry", "ready", "submitted")
-    def submit(self):
-        raise NotImplementedError
-
     @status_before_must_be("must_retry", "submitted", "approved", "denied")
     def approve(self, user_id=None, service=""):
         """
@@ -429,6 +469,28 @@ class PhotoVerification(StatusModel):
         self.status = "must_retry"
         self.save()
 
+    @classmethod
+    def display_off(cls, user_id):
+        """
+        Find all failed PhotoVerifications for a user, and sets those verifications' `display`
+        property to false, so the notification banner can be switched off.
+        """
+        user = User.objects.get(id=user_id)
+        cls.objects.filter(user=user, status="denied").exclude(window=None).update(display=False)
+
+    @classmethod
+    def display_status(cls, user, window):
+        """
+        Finds the `display` property for the PhotoVerification associated with
+        (user, window). Default is True
+        """
+        attempts = cls.objects.filter(user=user, window=window).order_by('-updated_at')
+        try:
+            attempt = attempts[0]
+            return attempt.display
+        except IndexError:
+            return True
+
 
 class SoftwareSecurePhotoVerification(PhotoVerification):
     """
@@ -454,6 +516,12 @@ class SoftwareSecurePhotoVerification(PhotoVerification):
 
     3. The encrypted photos are base64 encoded and stored in an S3 bucket that
        edx-platform does not have read access to.
+
+    Note: this model handles both *inital* verifications (which you must perform
+    at the time you register for a verified cert), and *midcourse reverifications*.
+    To distinguish between the two, check the value of the property window:
+    intial verifications of a window of None, whereas midcourse reverifications
+    * must always be linked to a specific window*.
     """
     # This is a base64.urlsafe_encode(rsa_encrypt(photo_id_aes_key), ss_pub_key)
     # So first we generate a random AES-256 key to encrypt our photo ID with.
@@ -463,6 +531,43 @@ class SoftwareSecurePhotoVerification(PhotoVerification):
 
     IMAGE_LINK_DURATION = 5 * 60 * 60 * 24  # 5 days in seconds
 
+    window = models.ForeignKey(MidcourseReverificationWindow, db_index=True, null=True)
+
+    @classmethod
+    def user_is_reverified_for_all(cls, course_id, user):
+        """
+        Checks to see if the student has successfully reverified for all of the
+        mandatory re-verification windows associated with a course.
+
+        This is used primarily by the certificate generation code... if the user is
+        not re-verified for all windows, then they cannot receive a certificate.
+        """
+        all_windows = MidcourseReverificationWindow.objects.filter(course_id=course_id)
+        # if there are no windows for a course, then return True right off
+        if (not all_windows.exists()):
+            return True
+
+        for window in all_windows:
+            try:
+                # The status of the most recent reverification for each window must be "approved"
+                # for a student to count as completely reverified
+                attempts = cls.objects.filter(user=user, window=window).order_by('-updated_at')
+                attempt = attempts[0]
+                if attempt.status != "approved":
+                    return False
+            except Exception:  # pylint: disable=W0703
+                return False
+
+        return True
+
+    @classmethod
+    def original_verification(cls, user):
+        """
+        Returns the most current SoftwareSecurePhotoVerification object associated with the user.
+        """
+        query = cls.objects.filter(user=user, window=None).order_by('-updated_at')
+        return query[0]
+
     @status_before_must_be("created")
     def upload_face_image(self, img_data):
         """
@@ -483,9 +588,22 @@ class SoftwareSecurePhotoVerification(PhotoVerification):
         aes_key_str = settings.VERIFY_STUDENT["SOFTWARE_SECURE"]["FACE_IMAGE_AES_KEY"]
         aes_key = aes_key_str.decode("hex")
 
-        s3_key = self._generate_key("face")
+        s3_key = self._generate_s3_key("face")
         s3_key.set_contents_from_string(encrypt_and_encode(img_data, aes_key))
 
+    @status_before_must_be("created")
+    def fetch_photo_id_image(self):
+        """
+        Find the user's photo ID image, which was submitted with their original verification.
+        The image has already been encrypted and stored in s3, so we just need to find that
+        location
+        """
+        if settings.FEATURES.get('AUTOMATIC_VERIFY_STUDENT_IDENTITY_FOR_TESTING'):
+            return
+
+        self.photo_id_key = self.original_verification(self.user).photo_id_key
+        self.save()
+
     @status_before_must_be("created")
     def upload_photo_id_image(self, img_data):
         """
@@ -510,7 +628,7 @@ class SoftwareSecurePhotoVerification(PhotoVerification):
         rsa_encrypted_aes_key = rsa_encrypt(aes_key, rsa_key_str)
 
         # Upload this to S3
-        s3_key = self._generate_key("photo_id")
+        s3_key = self._generate_s3_key("photo_id")
         s3_key.set_contents_from_string(encrypt_and_encode(img_data, aes_key))
 
         # Update our record fields
@@ -580,11 +698,13 @@ class SoftwareSecurePhotoVerification(PhotoVerification):
         We dynamically generate this, since we want it the expiration clock to
         start when the message is created, not when the record is created.
         """
-        s3_key = self._generate_key(name)
+        s3_key = self._generate_s3_key(name)
         return s3_key.generate_url(self.IMAGE_LINK_DURATION)
 
-    def _generate_key(self, prefix):
+    def _generate_s3_key(self, prefix):
         """
+        Generates a key for an s3 bucket location
+
         Example: face/4dd1add9-6719-42f7-bea0-115c008c4fca
         """
         conn = S3Connection(
@@ -659,6 +779,7 @@ class SoftwareSecurePhotoVerification(PhotoVerification):
 
         return header_txt + "\n\n" + body_txt
 
+
     def send_request(self):
         """
         Assembles a submission to Software Secure and sends it via HTTPS.

lms/djangoapps/verify_student/tests/test_models.py

 # -*- coding: utf-8 -*-
-from datetime import timedelta
+from datetime import timedelta, datetime
 import json
+from xmodule.modulestore.tests.factories import CourseFactory
 from nose.tools import (
     assert_in, assert_is_none, assert_equals, assert_not_equals, assert_raises,
     assert_true, assert_false
 )
 from mock import MagicMock, patch
+import pytz
 from django.test import TestCase
+from courseware.tests.tests import TEST_DATA_MONGO_MODULESTORE
+from django.test.utils import override_settings
 from django.conf import settings
 import requests
 import requests.exceptions
 
 from student.tests.factories import UserFactory
-from verify_student.models import SoftwareSecurePhotoVerification, VerificationException
+from verify_student.models import (
+    SoftwareSecurePhotoVerification, VerificationException,
+)
+from reverification.tests.factories import MidcourseReverificationWindowFactory
 from util.testing import UrlResetMixin
 import verify_student.models
 
@@ -208,6 +215,23 @@ class TestPhotoVerification(TestCase):
 
         return attempt
 
+    def test_fetch_photo_id_image(self):
+        user = UserFactory.create()
+        orig_attempt = SoftwareSecurePhotoVerification(user=user, window=None)
+        orig_attempt.save()
+
+        old_key = orig_attempt.photo_id_key
+
+        window = MidcourseReverificationWindowFactory(
+            course_id="ponies",
+            start_date=datetime.now(pytz.utc) - timedelta(days=5),
+            end_date=datetime.now(pytz.utc) + timedelta(days=5)
+        )
+        new_attempt = SoftwareSecurePhotoVerification(user=user, window=window)
+        new_attempt.save()
+        new_attempt.fetch_photo_id_image()
+        assert_equals(new_attempt.photo_id_key, old_key)
+
     def test_submissions(self):
         """Test that we set our status correctly after a submission."""
         # Basic case, things go well.
@@ -339,6 +363,37 @@ class TestPhotoVerification(TestCase):
         status = SoftwareSecurePhotoVerification.user_status(user)
         self.assertEquals(status, ('must_reverify', "No photo ID was provided."))
 
+        # test for correct status for reverifications
+        window = MidcourseReverificationWindowFactory()
+        reverify_status = SoftwareSecurePhotoVerification.user_status(user=user, window=window)
+        self.assertEquals(reverify_status, ('must_reverify', ''))
+
+        reverify_attempt = SoftwareSecurePhotoVerification(user=user, window=window)
+        reverify_attempt.status = 'approved'
+        reverify_attempt.save()
+
+        reverify_status = SoftwareSecurePhotoVerification.user_status(user=user, window=window)
+        self.assertEquals(reverify_status, ('approved', ''))
+
+        reverify_attempt.status = 'denied'
+        reverify_attempt.save()
+
+        reverify_status = SoftwareSecurePhotoVerification.user_status(user=user, window=window)
+        self.assertEquals(reverify_status, ('denied', ''))
+
+    def test_display(self):
+        user = UserFactory.create()
+        window = MidcourseReverificationWindowFactory()
+        attempt = SoftwareSecurePhotoVerification(user=user, window=window, status="denied")
+        attempt.save()
+
+        # We expect the verification to be displayed by default
+        self.assertEquals(SoftwareSecurePhotoVerification.display_status(user, window), True)
+
+        # Turn it off
+        SoftwareSecurePhotoVerification.display_off(user.id)
+        self.assertEquals(SoftwareSecurePhotoVerification.display_status(user, window), False)
+
     def test_parse_error_msg_success(self):
         user = UserFactory.create()
         attempt = SoftwareSecurePhotoVerification(user=user)
@@ -362,3 +417,101 @@ class TestPhotoVerification(TestCase):
             attempt.error_msg = msg
             parsed_error_msg = attempt.parsed_error_msg()
             self.assertEquals(parsed_error_msg, "There was an error verifying your ID photos.")
+
+
+@override_settings(MODULESTORE=TEST_DATA_MONGO_MODULESTORE)
+@patch.dict(settings.VERIFY_STUDENT, FAKE_SETTINGS)
+@patch('verify_student.models.S3Connection', new=MockS3Connection)
+@patch('verify_student.models.Key', new=MockKey)
+@patch('verify_student.models.requests.post', new=mock_software_secure_post)
+class TestMidcourseReverification(TestCase):
+    """ Tests for methods that are specific to midcourse SoftwareSecurePhotoVerification objects """
+    def setUp(self):
+        self.course_id = "MITx/999/Robot_Super_Course"
+        self.course = CourseFactory.create(org='MITx', number='999', display_name='Robot Super Course')
+        self.user = UserFactory.create()
+
+    def test_user_is_reverified_for_all(self):
+
+        # if there are no windows for a course, this should return True
+        self.assertTrue(SoftwareSecurePhotoVerification.user_is_reverified_for_all(self.course_id, self.user))
+
+        # first, make three windows
+        window1 = MidcourseReverificationWindowFactory(
+            course_id=self.course_id,
+            start_date=datetime.now(pytz.UTC) - timedelta(days=15),
+            end_date=datetime.now(pytz.UTC) - timedelta(days=13),
+        )
+
+        window2 = MidcourseReverificationWindowFactory(
+            course_id=self.course_id,
+            start_date=datetime.now(pytz.UTC) - timedelta(days=10),
+            end_date=datetime.now(pytz.UTC) - timedelta(days=8),
+        )
+
+        window3 = MidcourseReverificationWindowFactory(
+            course_id=self.course_id,
+            start_date=datetime.now(pytz.UTC) - timedelta(days=5),
+            end_date=datetime.now(pytz.UTC) - timedelta(days=3),
+        )
+
+        # make two SSPMidcourseReverifications for those windows
+        attempt1 = SoftwareSecurePhotoVerification(
+            status="approved",
+            user=self.user,
+            window=window1
+        )
+        attempt1.save()
+
+        attempt2 = SoftwareSecurePhotoVerification(
+            status="approved",
+            user=self.user,
+            window=window2
+        )
+        attempt2.save()
+
+        # should return False because only 2 of 3 windows have verifications
+        self.assertFalse(SoftwareSecurePhotoVerification.user_is_reverified_for_all(self.course_id, self.user))
+
+        attempt3 = SoftwareSecurePhotoVerification(
+            status="must_retry",
+            user=self.user,
+            window=window3
+        )
+        attempt3.save()
+
+        # should return False because the last verification exists BUT is not approved
+        self.assertFalse(SoftwareSecurePhotoVerification.user_is_reverified_for_all(self.course_id, self.user))
+
+        attempt3.status = "approved"
+        attempt3.save()
+
+        # should now return True because all windows have approved verifications
+        self.assertTrue(SoftwareSecurePhotoVerification.user_is_reverified_for_all(self.course_id, self.user))
+
+    def test_original_verification(self):
+        orig_attempt = SoftwareSecurePhotoVerification(user=self.user)
+        orig_attempt.save()
+        window = MidcourseReverificationWindowFactory(
+            course_id=self.course_id,
+            start_date=datetime.now(pytz.UTC) - timedelta(days=15),
+            end_date=datetime.now(pytz.UTC) - timedelta(days=13),
+        )
+        midcourse_attempt = SoftwareSecurePhotoVerification(user=self.user, window=window)
+        self.assertEquals(midcourse_attempt.original_verification(user=self.user), orig_attempt)
+
+    def test_user_has_valid_or_pending(self):
+        window = MidcourseReverificationWindowFactory(
+            course_id=self.course_id,
+            start_date=datetime.now(pytz.UTC) - timedelta(days=15),
+            end_date=datetime.now(pytz.UTC) - timedelta(days=13),
+        )
+
+        attempt = SoftwareSecurePhotoVerification(status="must_retry", user=self.user, window=window)
+        attempt.save()
+
+        assert_false(SoftwareSecurePhotoVerification.user_has_valid_or_pending(user=self.user, window=window))
+
+        attempt.status = "approved"
+        attempt.save()
+        assert_true(SoftwareSecurePhotoVerification.user_has_valid_or_pending(user=self.user, window=window))