Random instructors in new course roster

[droh]

Every course I look at on production has about 20 people labeled as instructors who don't belong there: all of the devs, people from shlomo's group, people from judy's group. I'm sure that these people didn't visit the page, so they appear to be added automatically.

[zyx-billy]

This problem also puzzled me for quite a while but I think I've found the source: The UB changes we brought in as part of Autolab 2.0 modified a function called find_cud_for_course. The function was supposed to do lookup only (as the name suggests), but the change made it so that it creates a new course-user record if the user is an admin. This function is called for every course when rendering the home page (used for the badges that indicate 'instructor' on the course cards), so as long as an admin visits the home page once, he/she will be registered in all courses.

Interestingly, the home page is the only place that calls this function, so to fix it we just need to revert the changes to find_cud_for_course.

However, fixing this won't remove the admins from the courses they're already added to. That would likely need to be a manual process, since there's no programmatic way of telling if a student admin is an actual student of the course or not.

Even if we went through and removed the admins, though, it would't fix the central problem: they would still be added again when they visit the course. So I'm wondering if we should instead find a way to distinguish admins from regular users so the roster simply excludes the admins who are not part of the actual course (doing so also makes sure student admins don't have access to privileged functionalities of courses they're taking). Some possible solutions could be

• add a 'student' type in addition to the instructor & CA types in cud, or
• add an 'admin' type to cuds

(Related issue: #820)