.. _backend_modes:

Open edX Backend: Panorama modes
================================

.. contents:: On this page
   :local:
   :depth: 2

The backend runs in one of four **modes**, selected by the ``PANORAMA_MODE`` Django setting.
The mode determines where dashboards come from, who can see them, and whether the Django
admin models are registered. The MFE reads the mode (via ``get-panorama-mode``) to choose the
matching home page.

The four modes
--------------

.. list-table::
   :header-rows: 1
   :widths: 14 44 42

   * - Mode
     - Dashboard source
     - Access
   * - ``DEMO``
     - Demo dashboards fetched from Aulasneo's demo API. This is the default when
       ``PANORAMA_MODE`` is unset.
     - Only **superusers** can access Panorama. The admin models are **not** registered.
   * - ``FREE``
     - Free dashboards fetched from Aulasneo's Panorama API using **AWS SigV4-signed**
       requests.
     - Only **superusers** can access Panorama. The admin models are **not** registered.
   * - ``SAAS``
     - SaaS dashboards fetched from Aulasneo's Panorama API using signed requests.
     - Managed through the Django admin models. The admin interface **is** registered.
   * - ``CUSTOM``
     - Your own Amazon QuickSight dashboards, embedded with your AWS credentials.
     - Managed through the Django admin models. The admin interface **is** registered.

These correspond to the :ref:`delivery modes <introduction>`: ``DEMO`` and ``FREE`` are
zero-configuration previews for superusers, ``SAAS`` is the managed Aulasneo service, and
``CUSTOM`` is a fully self-hosted data lake and QuickSight account.

Access rules in detail
----------------------

Whether a user can access Panorama (the ``get-user-access`` endpoint) depends on the mode:

* **DEMO / FREE** — the backend may not be initialized, so **only superusers** have access.
* **SAAS / CUSTOM** — a user has access if **any** of the following is true:

  * the student view is enabled (``PANORAMA_ENABLE_STUDENT_VIEW``), or
  * the user has a :ref:`UserAccessConfiguration <backend_administration>` record, or
  * the user is a superuser.

Roles
-----

The ``get-user-role`` endpoint returns the user's role, which the MFE uses to decide what to
show (for example, the **Studio** tab is only shown to ``AUTHOR`` users, and ``STUDENT`` users
get parameterized student dashboards):

* **DEMO / FREE** — ``READER`` for superusers, otherwise no role.
* **SAAS / CUSTOM** — the role from the user's ``UserAccessConfiguration`` (``READER`` or
  ``AUTHOR``). If the user has no record, superusers get ``READER`` and everyone else gets
  ``STUDENT``.

The student view
----------------

When ``PANORAMA_ENABLE_STUDENT_VIEW`` is on, users without an explicit configuration see the
**student dashboards**: every dashboard belonging to a :ref:`DashboardType <backend_administration>`
marked *Available to students*. Student dashboards are launched with extra parameters
(``userId``, ``userFullName``, ``lms``) so QuickSight can filter every visual down to that
single learner.

.. important::

   For a dashboard to work safely as a student view it must include the ``userId`` and ``lms``
   parameters, apply filters using those parameters to **all** visuals, and be shared with
   users unable to change any filter. Otherwise a student could see other students' data.

Choosing a mode
---------------

* Trying Panorama for the first time? ``DEMO`` needs no configuration; log in as a superuser
  and open the MFE.
* Using Aulasneo's managed service? Use ``SAAS`` (Aulasneo provisions the data lake,
  dashboards, and QuickSight for you).
* Running your own data lake and QuickSight account? Use ``CUSTOM`` and manage dashboards and
  access through the Django admin (:ref:`backend_administration`).

The mode and its supporting settings (AWS keys, account, region, default ARN, student view)
are configured through Django settings, normally supplied by the Tutor plugin. See
:ref:`backend_configuration`.

`Back to Home <index.html>`_