[BB-10699] Add configurable Qualtrics query params

[pkulkark]

Description

This PR adds settings-based user query parameter support to the qualtricssurvey XBlock. It adds extra_params as a per-block additional key-value query param field, preserves legacy param_name compatibility for existing blocks, and updates tests and documentation.

Supporting Information

OpenCraft Internal Jira task: BB-10699

Testing Instructions

1. In your Open edX environment, configure the XBLOCK_SETTINGS["QualtricsSurvey"] settings as described in the README with the desired config values.
2. Add a QualtricsSurvey block in Studio and create a new survey component.
3. Verify the rendered Qualtrics link includes both the configured query params and the extra_params values in a single encoded query string.
4. Verify that if USER_QUERY_PARAMS is unset and a legacy block has param_name populated, the link still includes the anonymous ID under that parameter name.
5. Verify that if USER_QUERY_PARAMS is unset and param_name is blank, no user-identifying query params are added to the link.

[openedx-webhooks]

Thanks for the pull request, @pkulkark!

This repository is currently maintained by @openedx/axim-engineering.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

• If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
  • This process (including the steps you'll need to take) is documented here.
• If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

• Dependencies

  This PR must be merged before / after / at the same time as ...

• Blockers

  This PR is waiting for OEP-1234 to be accepted.

• Timeline information

  This PR must be merged by XX date because ...

• Partner information

  This is for a course on edx.org.

• Supporting documentation
• Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

Details

---

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

• Overview of Review Process for Community Contributions
• Pull Request Status Guide
• Making changes to your pull request

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

• The size and impact of the changes that it introduces
• The need for product review
• Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

[codecov]

Codecov Report

❌ Patch coverage is 96.29630% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.68%. Comparing base (7acd072) to head (34029ee).

Files with missing lines	Patch %	Lines
src/qualtricssurvey/views.py	95.83%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #29      +/-   ##
==========================================
+ Coverage   82.17%   82.68%   +0.51%     
==========================================
  Files          48       48              
  Lines        1419     1461      +42     
  Branches      110      117       +7     
==========================================
+ Hits         1166     1208      +42     
+ Misses        221      220       -1     
- Partials       32       33       +1     

Flag	Coverage Δ
unittests	82.68% <96.29%> (+0.51%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Kelketek]

@pkulkark Code coverage has fallen under. Can you take a look?

These changes are breaking from an operator perspective-- if someone has the param field blank, but relied on it providing the a=student_id as a default, this will stop working unless they configure their platform-wide XBlock settings like so:

XBLOCK_SETTINGS["QualtricsSurvey"] = {
    "DEFAULT_UNIVERSITY": "universitynamehere",
    "USER_QUERY_PARAMS": {
        "a": "user_id",
    },
}

Stanford especially will need to be notified, as they'll no longer be able to rely on the default university name to be their university name.

I do think these changes are important and worth it, but I want to make sure these changes are documented in the release notes somewhere, so anyone using the block knows they need to set these settings. @kdmccormick I know these blocks aren't installed by default, so I'm not sure if the best place to put these is in the standard release notes, or if we should just include some notice of the breaking change in the README, and increment the major version number. Do you have any thoughts here?

Right now this PR document the right settings to use, but not necessarily that someone NEEDS to set them when they hadn't previously.

[Kelketek]

@pkulkark I'm happy with these changes now. The CI passes, it works for me, the code looks good, and I can see the README at least talks about the fact these settings need to be set for user data to be sent over.

So this is 👍 from me.

There doesn't appear to be a need to manually bump any version-- the version is picked up from the SCM tag, so I think this is good to merge. However, I don't have merge rights.

@farhan , it looks like you do. Would you be willing to merge and release this? Or is there anything else you'd need before doing so?

I'd recommend a major version bump for this one based on this comment. I'm also curious about your thoughts re: documentation of the changes there.

Thanks!

[farhan]

Code review details:

Note:
This review was produced agentically (AI-assisted) and has not been manually verified by me. Treat each point as something to confirm, and address the ones you agree with.

Findings, by severity:

1. [Medium] PII in the URL query string. USER_QUERY_PARAMS can emit email / username / real user_id to Qualtrics via a bare query string, which persists in server/proxy logs, browser history, and referrer headers. It's operator-gated through XBLOCK_SETTINGS, but unlike lti_consumer there's no per-course/per-learner consent. Worth documenting the exposure, and/or defaulting to anonymous_id.

2. [Low] your_university default reset can break existing blocks. "stanforduniversity" → "" means a block that never set the field renders https://.qualtrics.com/... unless DEFAULT_UNIVERSITY is configured. Narrow blast radius, but consider restoring the default (keeping the settings fallback) or noting it in the release notes.

3. [Low] Scope isn't tied to a stated use case. The breadth of USER_QUERY_PARAMS + extra_params has no rationale in the PR. A one-line "why" would help future maintainers.

Verified fine: switching to opt_attrs["edx-platform.anonymous_user_id"] is value-equivalent to the old anonymous_student_id — a correct migration off a deprecated shim.

[farhan]

@farhan , it looks like you do. Would you be willing to merge and release this? Or is there anything else you'd need before doing so?

I'd recommend a major version bump for this one based on this comment. I'm also curious about your thoughts re: documentation of the changes there.

@Kelketek thanks for the review, and @pkulkark for the PR.
Please look into agentic review above if it's helpful
Happy to merge and release — one thing to sort first.

With PSR, the release type comes from the Conventional Commit prefixes, not a manual bump. The commits here are feat: + fix:, which cut a minor. The param_name default change ("a" → "") is a deliberate opt-in break for existing blocks, so to land the major we want, it has to be marked — either feat!: or a BREAKING CHANGE: footer.

fyi @feanil @openedx/axim-aximprovements ^

[pkulkark]

@farhan Thanks. I've added a Privacy section to the README spelling out that query-string values end up in server logs, browser history and Referer headers, and an Upgrading section documenting the two changed defaults (param_name from "a" to "", your_university from "stanforduniversity" to "") with the exact XBLOCK_SETTINGS that restore the previous behaviour. Also the feature commit is reworded to feat!: with a BREAKING CHANGE: footer.