Someone at edx was able to quickly send a few texts to himself using the tool.
Each text came from a different number and there was no message about the ability to unsubscribe or stop.
This could potentially be used to spam users as well as potentially result in charges to edX for high volume.

page url https://courses.edx.org/text-me-the-app
LEARNER-8286

MICROBA-1039

fix: AA-724: Updating the HiddenContentTransformer

[Support Tool] Update the Enrollments to take Entitlements into account

bump edx-enterprise back down to 3.20.1

fix: don't count hierarchy blocks as complete for assignments

When considering whether a subsection is complete as an assignment,
skip any "hierarchy" types (sequential, vertical, etc) that don't
have children. If the user can't see the content, don't risk
marking it as complete.

AA-726

fix: use github version of py2neo

Python Requirements Update

The version of Py2neo we depend on has been removed from PyPI.  This is
a stop-gap until we can upgrade it

bump edx-enterprise to 3.20.2

We heard about a bug where learners granted extensions would still
lose access to content if it was marked as "hidden after due date".
This was caused by the HiddenContentTransformer using the due date
from collection time (publish time) rather than the user date returned
from the edx-when DateOverrideTransformer.

A small subtletly of this PR is that Transformers with the
FilteringTransformerMixin are executed before those without it so
part of the fix was to make the HiddenContentTransformer not use the
FilteringTransformerMixin to ensure the DateOverrideTransformer had
run first.

Part 3/3 - Removing old collect code with merged due date

fix: AA-724: Updating the HiddenContentTransformer

Adds a command to create an API connection to credentials for testing
program certificates on devstack. This command is not meant to be ran
manually, and will be included in a provisioning type script that will
be added later.

MICROBA-1039

We heard about a bug where learners granted extensions would still
lose access to content if it was marked as "hidden after due date".
This was caused by the HiddenContentTransformer using the due date
from collection time (publish time) rather than the user date returned
from the edx-when DateOverrideTransformer.

A small subtletly of these PRs is that Transformers with the
FilteringTransformerMixin are executed before those without it so
part of the fix was to make the HiddenContentTransformer not use the
FilteringTransformerMixin to ensure the DateOverrideTransformer had
run first.

Part 2/3 - Updating transform method + updating Read version

fix: AA-724: Updating the HiddenContentTransformer

fix: Don't make request change logging a waffle flag.

Waffle flags are useful for gradual rollout but that's not possible this
high in the middleware because a lot of the data needed (request.user)
to partition incoming requests is not availabale this high in the
middleware.

Convert this to a WaffleSwitch which will be safer to operate.

Also increase the number of frames in the stack to print per change.
Printing just 1 did not provide enough info because DRF requests wrap
WSGI requests and have a setter proxy.  It will be useful to figure out
how they do this in case it's better that what we're doing in the safe
sessions middleware.

Ticket: https://openedx.atlassian.net/browse/ARCHBOM-1718

We heard about a bug where learners granted extensions would still
lose access to content if it was marked as "hidden after due date".
This was caused by the HiddenContentTransformer using the due date
from collection time (publish time) rather than the user date returned
from the edx-when DateOverrideTransformer.

A small subtletly of these PRs is that Transformers with the
FilteringTransformerMixin are executed before those without it so
part of the fix was to make the HiddenContentTransformer not use the
FilteringTransformerMixin to ensure the DateOverrideTransformer had
run first.

Part 1/3

feat: bump edx-ace to 1.1.0

This gives us the ability to set a Braze-specific from-address via
configuration settings.

fix: surface assignment type short_label in Progress Tab MFE API

[TNL-7971] - Correct filename for anonymized id report.

 feat: Add more detailed request user change logging.

The function under test by the StrftimeLocalizedHtmlTest checks the
timezone in the user preferences of the user making the request.  If we
don't explicitly set a request here, it will simply use the last Request
that `crum` cached in the thread local cache.  This broke now
that we sometimes set the crum request.user to an invalid user in other
tests.

This change ensures that we have a valid request for these tests as a
part of the setup of this test class.