feat: make marketing_emails_opt_in optional

We want to support a flow for SSO-enabled Enterprise customers who have
agreed off-platform that none of their learners will opt-in to marketing emails
or sharing research data. This change proposes to do so by
adding an optional field that, when enabled, disables the presence of
the two checkboxes on this registration form and sets their values to false.

ENT-11401

Author: iloveagent57

.gitignore

@@ -13,6 +13,7 @@ lms/envs/private.py
 cms/envs/private.py
 .venv/
 CLAUDE.md
+.claude/
 AGENTS.md
 # end-noclean
 

common/djangoapps/third_party_auth/migrations/0014_samlproviderconfig_optional_email_checkboxes.py

@@ -0,0 +1,26 @@
+# Generated migration for adding optional email checkbox configuration fields
+
+from django.db import migrations, models
+import django.utils.translation
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('third_party_auth', '0013_default_site_id_wrapper_function'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='samlproviderconfig',
+            name='marketing_emails_opt_in_optional',
+            field=models.BooleanField(
+                default=False,
+                help_text=django.utils.translation.gettext_lazy(
+                    "If enabled, the marketing emails opt-in checkbox will be optional for users "
+                    "registering via this provider instead of required. When disabled, marketing email opt-in "
+                    "is determined by the global MARKETING_EMAILS_OPT_IN setting."
+                ),
+            ),
+        ),
+    ]

common/djangoapps/third_party_auth/models.py

@@ -745,6 +745,14 @@ class SAMLProviderConfig(ProviderConfig):
             "immediately after authenticating with the third party instead of the login page."
         ),
     )
+    marketing_emails_opt_in_optional = models.BooleanField(
+        default=False,
+        help_text=_(
+            "If enabled, the marketing emails opt-in checkbox will be optional for users "
+            "registering via this provider instead of required. When disabled, marketing email opt-in "
+            "is determined by the global MARKETING_EMAILS_OPT_IN setting."
+        ),
+    )
     other_settings = models.TextField(
         verbose_name="Advanced settings", blank=True,
         help_text=(

openedx/core/djangoapps/user_authn/views/registration_form.py

@@ -3,6 +3,7 @@
 """
 
 import copy
+import logging
 import re
 from importlib import import_module
 
@@ -18,6 +19,7 @@
 from eventtracking import tracker
 
 from common.djangoapps import third_party_auth
+from common.djangoapps.third_party_auth.models import SAMLProviderConfig
 from common.djangoapps.edxmako.shortcuts import marketing_link
 from common.djangoapps.student.models import CourseEnrollmentAllowed, UserProfile, email_exists_or_retired
 from common.djangoapps.util.password_policy_validators import (
@@ -36,6 +38,9 @@
 from openedx.features.enterprise_support.api import enterprise_customer_for_request
 
 
+log = logging.getLogger(__name__)
+
+
 class TrueCheckbox(widgets.CheckboxInput):
     """
     A checkbox widget that only accepts "true" (case-insensitive) as true.
@@ -410,6 +415,7 @@ def __init__(self):
             field_order.extend(sorted(difference))
 
         self.field_order = field_order
+        self.request = None  # Will be set by get_registration_form
 
     def get_registration_form(self, request):
         """Return a description of the registration form.
@@ -426,6 +432,7 @@ def get_registration_form(self, request):
         Returns:
             HttpResponse
         """
+        self.request = request
         form_desc = FormDescription("post", self._get_registration_submit_url(request))
         self._apply_third_party_auth_overrides(request, form_desc)
 
@@ -703,13 +710,65 @@ def _add_marketing_emails_opt_in_field(self, form_desc, required=False):
             platform_name=configuration_helpers.get_value('PLATFORM_NAME', settings.PLATFORM_NAME),
         )
 
+        # Check if marketing opt-in should be optional for this SAML provider
+        # If the SAML provider config says the field is optional, set default to False
+        # and clear any existing field overrides that may have been set by the TPA provider
+        default_value = True  # Default: checkbox is checked
+        field_required = required
+
+        # pylint: disable=too-many-nested-blocks
+        if self.request and third_party_auth.is_enabled():
+            running_pipeline = third_party_auth.pipeline.get(self.request)
+            if running_pipeline:
+                try:
+                    # idp_name can be in kwargs directly or in kwargs['details']
+                    saml_provider_name = running_pipeline.get('kwargs', {}).get('idp_name')
+                    if not saml_provider_name:
+                        saml_provider_name = running_pipeline.get('kwargs', {}).get('details', {}).get('idp_name')
+
+                    if saml_provider_name:
+                        try:
+                            # Query the SAML provider config
+                            saml_config = SAMLProviderConfig.objects.get(
+                                slug=saml_provider_name
+                            )
+
+                            if saml_config.marketing_emails_opt_in_optional:
+                                log.info(
+                                    "SAML provider %s has marketing_emails_opt_in_optional=True, "
+                                    "setting default to False and required to False",
+                                    saml_provider_name
+                                )
+                                default_value = False  # When optional, user opts out by default
+                                field_required = False  # Make field optional
+
+                                # Set field override to ensure our SAML-specific values are used
+                                # This will override any values set by the TPA provider, or create
+                                # a new override if one doesn't exist
+                                log.info(
+                                    "Setting field override for marketing_emails_opt_in to "
+                                    "defaultValue=False, required=False"
+                                )
+                                # pylint: disable=protected-access
+                                form_desc._field_overrides['marketing_emails_opt_in'] = {
+                                    'defaultValue': False,
+                                    'required': False
+                                }
+                        except SAMLProviderConfig.DoesNotExist:
+                            log.exception(
+                                "SAML provider config not found for idp_name: %s",
+                                saml_provider_name
+                            )
+                except Exception as exc:  # pylint: disable=broad-except
+                    log.exception("Error checking SAML provider config in field handler: %s", str(exc))
+
         form_desc.add_field(
             'marketing_emails_opt_in',
             label=opt_in_label,
             field_type="checkbox",
             exposed=True,
-            default=True,  # the checkbox will automatically be checked; meaning user has opted in
-            required=required,
+            default=default_value,
+            required=field_required,
         )
 
     def _add_field_with_configurable_select_options(self, field_name, field_label, form_desc, required=False):
@@ -1150,22 +1209,76 @@ def _apply_third_party_auth_overrides(self, request, form_desc):
 
                     for field_name in self.DEFAULT_FIELDS + self.EXTRA_FIELDS:
                         if field_name in field_overrides:
-                            form_desc.override_field_properties(
-                                field_name, default=field_overrides[field_name]
-                            )
-
-                            if (
-                                field_name not in ['terms_of_service', 'honor_code'] and
-                                field_overrides[field_name] and
-                                hide_registration_fields_except_tos
-                            ):
+                            # Special handling for marketing_emails_opt_in:
+                            # If SAML provider config has set marketing_emails_opt_in_optional=True,
+                            # don't let the provider's get_register_form_data override the default
+                            skip_override = False
+                            if field_name == 'marketing_emails_opt_in':
+                                try:
+                                    # idp_name can be in kwargs directly or in kwargs['details']
+                                    saml_provider_name = running_pipeline.get('kwargs', {}).get('idp_name')
+                                    if not saml_provider_name:
+                                        saml_provider_name = (
+                                            running_pipeline.get('kwargs', {})
+                                            .get('details', {})
+                                            .get('idp_name')
+                                        )
+                                    if saml_provider_name:
+                                        try:
+                                            # Try to find the SAML provider config
+                                            # First try with current_set(), then fall back to direct query
+                                            try:
+                                                saml_config = SAMLProviderConfig.objects.current_set().get(
+                                                    slug=saml_provider_name
+                                                )
+                                            except SAMLProviderConfig.DoesNotExist:
+                                                # Fallback to direct query without current_set()
+                                                saml_config = SAMLProviderConfig.objects.get(
+                                                    slug=saml_provider_name
+                                                )
+
+                                            if saml_config.marketing_emails_opt_in_optional:
+                                                log.debug(
+                                                    "Skipping provider override for marketing_emails_opt_in "
+                                                    "due to SAML config for provider: %s",
+                                                    saml_provider_name
+                                                )
+                                                skip_override = True
+                                        except SAMLProviderConfig.DoesNotExist:
+                                            log.exception(
+                                                "SAML provider config not found for idp_name: %s",
+                                                saml_provider_name
+                                            )
+                                except Exception as exc:  # pylint: disable=broad-except
+                                    log.exception("Error checking SAML provider config: %s", str(exc))
+
+                            if not skip_override:
                                 form_desc.override_field_properties(
-                                    field_name,
-                                    field_type="hidden",
-                                    label="",
-                                    instructions="",
+                                    field_name, default=field_overrides[field_name]
                                 )
 
+                                if (
+                                    field_name not in ['terms_of_service', 'honor_code'] and
+                                    field_overrides[field_name] and
+                                    hide_registration_fields_except_tos
+                                ):
+                                    # When hiding a field, set default to False for checkbox fields
+                                    # like marketing_emails_opt_in to avoid auto-opting users in
+                                    field_default = field_overrides[field_name]
+                                    if field_name == 'marketing_emails_opt_in':
+                                        field_default = False
+                                        log.info(
+                                            "Hiding marketing_emails_opt_in field and setting default to False"
+                                        )
+
+                                    form_desc.override_field_properties(
+                                        field_name,
+                                        field_type="hidden",
+                                        default=field_default,
+                                        label="",
+                                        instructions="",
+                                    )
+
                     # Hide the confirm_email field
                     form_desc.override_field_properties(
                         "confirm_email",