feat!: remove the ENABLE_MFE_CONFIG_API toggle [DEPR] - #39019
Draft
feanil wants to merge 2 commits into
Draft
Conversation
The LMS setting ENABLE_MFE_CONFIG_API (default False) gated two read-only endpoints used by frontends: GET /api/mfe_config/v1 GET /api/frontend_site_config/v1/ Both return only non-sensitive frontend configuration, and both are empty unless an operator populates MFE_CONFIG, MFE_CONFIG_OVERRIDES, or FRONTEND_SITE_CONFIG. There was no reason to keep them off by default, so the toggle is gone and both endpoints now respond unconditionally. The data settings (MFE_CONFIG, MFE_CONFIG_OVERRIDES, FRONTEND_SITE_CONFIG) are unchanged and remain how operators control what these endpoints return. The toggle was LMS-only; there was no CMS equivalent. Removes: - the toggle definition and annotation in lms/envs/common.py - the `if not settings.ENABLE_MFE_CONFIG_API` guards in MFEConfigView.get and FrontendSiteConfigView.get, plus the HttpResponseNotFound / NotFound imports they were the only users of - the ENABLE_MFE_CONFIG_API overrides in lms/envs/test.py and lms/envs/mock.yml - the two "returns 404 when disabled" tests, which no longer describe any reachable behaviour See DEPR ticket: #38959 BREAKING CHANGE: Operators who set ENABLE_MFE_CONFIG_API in their LMS_CFG yaml or a private settings module should drop the line; the key is now ignored. If you set it to True, deleting it is all that is needed -- that is the new default. If you set it to False *and* populated MFE_CONFIG, MFE_CONFIG_OVERRIDES, or FRONTEND_SITE_CONFIG, that configuration is now served publicly by the two endpoints above; review or clear it if it should not be public. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ADR 0001 recorded the decision to gate the MFE config API behind ENABLE_MFE_CONFIG_API. That decision has been reversed, so replace the bullet with the current state -- the API is always available -- while keeping the history and linking the DEPR ticket that removed the toggle. See DEPR ticket: #38959 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removes the LMS
ENABLE_MFE_CONFIG_APItoggle so that both MFE configendpoints respond unconditionally:
GET /api/mfe_config/v1GET /api/frontend_site_config/v1/Both return only non-sensitive frontend configuration, and both are empty unless
an operator populates
MFE_CONFIG,MFE_CONFIG_OVERRIDES, orFRONTEND_SITE_CONFIG. Those data settings are unchanged and remain the wayoperators control what the endpoints return. The toggle was LMS-only; there was
no CMS equivalent.
Breaking changes for this DEPR were unblocked on 2026-08-19.
DEPR: #38959
Task list from the DEPR ticket
ENABLE_MFE_CONFIG_APItoggle definition + annotation inlms/envs/common.py.if not settings.ENABLE_MFE_CONFIG_APIguards inlms/djangoapps/mfe_config_api/views.pyso both endpoints respond unconditionally.ENABLE_MFE_CONFIG_APIoverrides inlms/envs/test.pyandlms/envs/mock.yml, and update the "returns 404 when disabled" tests.lms/djangoapps/mfe_config_api/docs/decisions/0001-mfe-config-api.rstand update as needed.On the last item:
CHANGELOG.rstin this repo explicitly says we don't maintaina detailed changelog, so the operator-facing note lives in the
BREAKING CHANGEfooter of the first commit (matching what was done for
DCS_SESSION_COOKIE_SAMESITEin 0bd95e7).Operator transition
True? Drop the line — that is now the default.Falseand populatedMFE_CONFIG,MFE_CONFIG_OVERRIDES, orFRONTEND_SITE_CONFIG? That configuration is now served publicly by the twoendpoints above. Review or clear it if it should not be public.
LMS_CFGyaml or a private settingsmodule.
tutor-mfesets this toggle via a patch. Now that upstream ignores it the patchis harmless, so no lockstep change is required.