[shanbady]

What are the relevant tickets?

Closes https://github.com/mitodl/hq/issues/14133

Description (What does it do?)

This PR ensures we have a "is_revoked" flag for program certificates which gets used to determine if a program letter is available to user in learn

How can this be tested?

1. checkout this branch
2. run the migrations docker compose run --rm web python manage.py migrate
3. drop the attached management command into profiles/management/commands
4. run the following (adjust the values ) docker compose run --rm web python manage.py seed_program_letter --email you@example.com --micromasters-program-id 1 --mitxonline-program-id <program id you're enrolled in>
5. (as a logged in user) view the program letter api http://api.open.odl.local:8065/api/v0/program_certificates/
6. in the api response you should see a display link in the format http://open.odl.local:8062/program_letter/<uuid>/view -> visiting it should render a letter as expected.
7. run the following to manually revoke a certificate (adjust values as needed): docker compose run --rm web python manage.py shell -c "from profiles.models import ProgramCertificate, ProgramLetter; print(ProgramCertificate.objects.filter(user_email='you@example.com').update(is_revoked=True), ProgramLetter.objects.count())"
8. re-visit the api endpoint http://api.open.odl.local:8065/api/v0/program_certificates/ - note the certificate is no longer shown
9. revisit the previously visited display link and it should 404
10. re-run the command in step 7 except with is_revoked=False
11. note the letter and items in the api response re-appear

Additional Context

This will be followed up with a data platform change to actually sync the new field

[github-actions]

OpenAPI Changes

No changes detected

View full changelog

Unexpected changes? Ensure your branch is up-to-date with main (consider rebasing).

[Copilot]

🟡 Changes recommended

The ETL refresh can undo manual revocations and re-expose letters when the warehouse lacks revoked, while the display page renders an empty letter instead of handling API 404 responses.

2 open issues

• Preserve certificate revocations when revoked column is unavailable · New
• Handle 404 letter responses instead of rendering an empty letter · New

What changed in this PR

Adds revocation support to program certificates so MIT Learn can hide revoked certificates and block access to their letters while preserving links for later reinstatement.

Changes:

• Adds a revoked field, migration, and warehouse import mapping.
• Filters revoked certificates from listings, letter retrieval, and redirects without exposing the flag in API responses.
• Adds tests for revocation, reinstatement, and preservation of existing letters.

File	Description
profiles/​views.py	Filters revoked certificates from certificate and letter endpoints.
profiles/​views_test.py	Tests revoked access restrictions and letter reinstatement.
profiles/​serializers.py	Excludes the revocation flag from serialized certificates.
profiles/​models.py	Adds revocation state and a valid-certificate query helper.
profiles/​migrations/​0040_programcertificate_revoked.py	Adds the database field with a false default.
profiles/​etl.py	Maps warehouse revocation data into certificate updates.
profiles/​etl_test.py	Tests revocation mapping and in-place updates that preserve letters.

_{Review effort: Balanced}

[shanbady]

Closing in favor of #4182, which covers the same backend change. The frontend 404 fix from this PR is now #4196, stacked on #4182.