Only show published runs of courses in /items/ endpoint

learning_resources/views.py

@@ -6,7 +6,7 @@
 import rapidjson
 from django.conf import settings
 from django.db import transaction
-from django.db.models import Count, F, Q, QuerySet
+from django.db.models import Count, F, Prefetch, Q, QuerySet
 from django.http import Http404, HttpResponse
 from django.utils.decorators import method_decorator
 from django.views.decorators.cache import cache_page
@@ -545,7 +545,29 @@ class ResourceListItemsViewSet(NestedViewSetMixin, viewsets.ReadOnlyModelViewSet
     queryset = (
         LearningResourceRelationship.objects.select_related("child")
         .prefetch_related(
-            "child__runs", "child__runs__instructors", "child__runs__resource_prices"
+            Prefetch(
+                "child__topics",
+                queryset=LearningResourceTopic.objects.for_serialization(),
+            ),
+            Prefetch(
+                "child__offered_by",
+                queryset=LearningResourceOfferor.objects.for_serialization(),
+            ),
+            Prefetch(
+                "child__departments",
+                queryset=LearningResourceDepartment.objects.for_serialization(
+                    prefetch_school=True
+                ).select_related("school"),
+            ),
+            Prefetch(
+                "child__runs",
+                queryset=LearningResourceRun.objects.filter(
+                    published=True
+                ).for_serialization(),
+            ),
+            "child__runs__instructors",
+            "child__runs__resource_prices",
+            "child__topics",
         )
         .filter(child__published=True)
     )

learning_resources/views_test.py

@@ -1521,3 +1521,52 @@ def test_course_run_problems_endpoint(client, user_role, django_user_model):
             "detail": "Authentication credentials were not provided.",
             "error_type": "NotAuthenticated",
         }
+
+
+def test_resource_items_only_shows_published_runs(client, user):
+    """Test that ResourceListItemsViewSet only returns published runs for child resources"""
+
+    program = LearningResourceFactory.create(
+        resource_type=LearningResourceType.program.name,
+        published=True,
+    )
+    course = LearningResourceFactory.create(
+        resource_type=LearningResourceType.course.name,
+        published=True,
+        create_runs=False,
+    )
+    program.resources.set(
+        [course], through_defaults={"relation_type": "program_courses"}
+    )
+
+    published_run = LearningResourceRunFactory.create(
+        published=True,
+        learning_resource=course,
+    )
+    unpublished_run = LearningResourceRunFactory.create(
+        learning_resource=course,
+        published=False,
+    )
+    course.runs.set(
+        [
+            published_run,
+            unpublished_run,
+        ]
+    )
+    assert course.runs.count() == 2
+
+    client.force_login(user)
+    url = reverse(
+        "lr:v1:learning_resource_items_api-list",
+        kwargs={"learning_resource_id": program.id},
+    )
+    resp = client.get(url)
+
+    results = resp.json()["results"]
+    assert len(results) == 1
+    child_data = results[0]["resource"]
+    assert child_data["id"] == course.id
+    run_ids = [run["id"] for run in child_data["runs"]]
+    assert published_run.id in run_ids
+    assert unpublished_run.id not in run_ids
+    assert len(child_data["runs"]) == 1