django-email-learning 2.2.0__tar.gz → 2.3.0__tar.gz

{django_email_learning-2.2.0 → django_email_learning-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-email-learning
-Version: 2.2.0
+Version: 2.3.0
 Summary: A platform for creating and delivering  learning materials via email within a Django application. It provides tools for content management, user role-based administration, and scheduler integration for automated content delivery.
 License-Expression: BSD-3-Clause
 License-File: LICENSE

{django_email_learning-2.2.0 → django_email_learning-2.3.0}/django_email_learning/jobs/send_newsletters_job.py

@@ -180,6 +180,7 @@ class SendNewslettersJob:
             "body": sendout.body,
             "newsletter_title": sendout.newsletter.title,
             "unsubscribe_url": full_unsubscribe_url,
+            "social_links": sendout.newsletter.organization.social_links.all(),
         }
 
         msg = EmailMultiAlternatives(

django_email_learning-2.3.0/django_email_learning/management/commands/generate_embed_token.py

@@ -0,0 +1,28 @@
+from django.core.management.base import BaseCommand, CommandParser
+
+from django_email_learning.models import Organization
+
+
+class Command(BaseCommand):
+    help = (
+        "Generate (or rotate) the embed_token for an organization, used to authorize the "
+        "cross-origin embeddable enroll/newsletter-subscribe API. Rotating overwrites the "
+        "existing token, immediately invalidating it for anyone still using the old value."
+    )
+
+    def add_arguments(self, parser: CommandParser) -> None:
+        parser.add_argument("organization_id", type=int, help="ID of the organization to generate a token for")
+
+    def handle(self, *args, **options) -> None:  # type: ignore[no-untyped-def]
+        organization_id = options["organization_id"]
+        try:
+            organization = Organization.objects.get(id=organization_id)
+        except Organization.DoesNotExist:
+            self.stdout.write(self.style.ERROR(f"Organization {organization_id} does not exist."))
+            return
+
+        organization.embed_token = Organization.generate_embed_token()
+        organization.save(update_fields=["embed_token"])
+
+        self.stdout.write(self.style.SUCCESS(f"Embed token for organization {organization_id} ({organization.name}):"))
+        self.stdout.write(organization.embed_token)

django_email_learning-2.3.0/django_email_learning/migrations/0010_organization_embed_token.py

@@ -0,0 +1,17 @@
+# Generated by Django 6.0.6 on 2026-07-19 13:15
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("django_email_learning", "0009_add_more_social_link_platforms"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="organization",
+            name="embed_token",
+            field=models.CharField(blank=True, editable=False, max_length=64, null=True, unique=True),
+        ),
+    ]

{django_email_learning-2.2.0 → django_email_learning-2.3.0}/django_email_learning/models/organizations.py

@@ -1,3 +1,5 @@
+import base64
+import uuid
 from typing import Any
 
 from django.conf import settings
@@ -19,10 +21,32 @@ class Organization(models.Model):
     is_public = models.BooleanField(default=True)
     created_at = models.DateTimeField(auto_now_add=True, null=True)
     updated_at = models.DateTimeField(auto_now=True, null=True)
+    embed_token = models.CharField(max_length=64, unique=True, null=True, blank=True, editable=False)
 
     def __str__(self) -> str:
         return self.name
 
+    @staticmethod
+    def generate_embed_token() -> str:
+        """Generates an opaque, publishable identifier for the embeddable enroll/
+        newsletter-subscribe API (see EMBEDDABLE_ENROLLMENT_ENABLED).
+
+        Unlike ApiKey.key, this is not a secret - it's designed to sit in a
+        third-party site's public page source - so it's stored unencrypted and
+        looked up by direct equality rather than decrypted per-row.
+        """
+        return base64.urlsafe_b64encode(uuid.uuid4().bytes + uuid.uuid4().bytes).decode().rstrip("=")
+
+    def get_or_create_embed_token(self) -> str:
+        """Returns the organization's embed_token, generating and persisting one
+        on first use so features built on it (e.g. the course embed snippet)
+        work without requiring an admin to run generate_embed_token first.
+        """
+        if not self.embed_token:
+            self.embed_token = self.generate_embed_token()
+            self.save(update_fields=["embed_token"])
+        return self.embed_token
+
     @property
     def public_url(self) -> str | None:
         if not self.is_public:

django_email_learning-2.3.0/django_email_learning/platform/api/embed_snippet.py

@@ -0,0 +1,30 @@
+from django.utils.html import escape
+
+
+def build_embed_script_tag(script_url: str) -> str:
+    """The one-time <script> tag that loads the shared, deployment-generic
+    del-enroll-form custom element definition (django_email_learning.public.embed_script).
+    Goes once anywhere on the page (e.g. a shared footer/header template).
+    """
+    return f'<script src="{escape(script_url)}"></script>'
+
+
+def build_embed_widget_tag(*, token: str, course_slug: str, newsletter_title: str | None) -> str:
+    """Builds the <del-enroll-form> placeholder tag that pairs with
+    build_embed_script_tag(). Meant to be placed wherever the organization
+    wants the enrollment form to appear, and repeated for multiple placements
+    (each with its own course_id).
+
+    All values land in HTML attributes/text, escaped via Django's escape() -
+    the only encoding needed since (unlike the old inline-script design) none
+    of this is embedded in JS anymore.
+    """
+    attrs = [
+        f'token="{escape(token)}"',
+        f'course_id="{escape(course_slug)}"',
+    ]
+    if newsletter_title:
+        attrs.append("news_letter_check")
+        attrs.append(f'newsletter_title="{escape(newsletter_title)}"')
+
+    return f"<del-enroll-form {' '.join(attrs)}></del-enroll-form>"

{django_email_learning-2.2.0 → django_email_learning-2.3.0}/django_email_learning/platform/api/urls.py

@@ -5,6 +5,7 @@ from django_email_learning.platform.api.views import (
     ApiKeyView,
     CourseContentView,
     CourseView,
+    EmbedSnippetView,
     EnrollmentsStatisticsView,
     EnrollmentsView,
     EnrollmentView,
@@ -102,6 +103,11 @@ urlpatterns = [
         SingleCourseView.as_view(),
         name="courses_detail",
     ),
+    path(
+        "organizations/<int:organization_id>/courses/<int:course_id>/embed_snippet/",
+        EmbedSnippetView.as_view(),
+        name="course_embed_snippet",
+    ),
     path(
         "organizations/<int:organization_id>/courses/<int:course_id>/contents/",
         CourseContentView.as_view(),

{django_email_learning-2.2.0 → django_email_learning-2.3.0}/django_email_learning/platform/api/views/__init__.py

@@ -7,6 +7,7 @@ from django_email_learning.platform.api.views.courses import (
     CourseContentView,
     CourseCreationMixin,
     CourseView,
+    EmbedSnippetView,
     ReorderCourseContentView,
     SendLessonToPlatformUser,
     SingleCourseContentView,
@@ -56,6 +57,7 @@ __all__ = [
     "CourseCreationMixin",
     "CourseView",
     "CourseContentView",
+    "EmbedSnippetView",
     "ReorderCourseContentView",
     "SingleCourseContentView",
     "SingleCourseView",

{django_email_learning-2.2.0 → django_email_learning-2.3.0}/django_email_learning/platform/api/views/courses.py

@@ -1,10 +1,12 @@
 import json
 import logging
 
+from django.conf import settings
 from django.core.exceptions import ValidationError as DjangoValidationError
 from django.db import models, transaction
 from django.db.utils import IntegrityError
 from django.http import HttpRequest, JsonResponse
+from django.urls import reverse
 from django.utils.decorators import method_decorator
 from django.views import View
 from django.views.decorators.csrf import ensure_csrf_cookie
@@ -17,6 +19,11 @@ from django_email_learning.models import (
     CourseContentType,
 )
 from django_email_learning.platform.api import serializers
+from django_email_learning.platform.api.embed_snippet import (
+    build_embed_script_tag,
+    build_embed_widget_tag,
+)
+from django_email_learning.public.api.views import embeddable_enrollment_enabled
 from django_email_learning.services.command_models.send_lesson_command import (
     SendLessonCommand,
 )
@@ -379,6 +386,35 @@ class SingleCourseView(CourseCreationMixin, View):
             return JsonResponse({"error": str(e)}, status=409)
 
 
+@method_decorator(accessible_for(roles={"admin", "editor", "instructor", "viewer"}), name="get")
+class EmbedSnippetView(View):
+    def get(self, request, *args, **kwargs) -> JsonResponse:  # type: ignore[no-untyped-def]
+        if not embeddable_enrollment_enabled():
+            return JsonResponse({"error": "Embeddable enrollment is not enabled for this deployment."}, status=404)
+
+        try:
+            course = Course.objects.select_related("organization", "newsletter").get(
+                id=kwargs["course_id"], organization_id=kwargs["organization_id"]
+            )
+        except Course.DoesNotExist:
+            return JsonResponse({"error": "Course not found"}, status=404)
+
+        if not course.public_url:
+            return JsonResponse({"error": "Course must be public and enabled to be embeddable."}, status=409)
+
+        token = course.organization.get_or_create_embed_token()
+        script_path = reverse("django_email_learning:public:embed_script")
+        script_url = f"{settings.DJANGO_EMAIL_LEARNING['SITE_BASE_URL']}{script_path}"
+
+        script_html = build_embed_script_tag(script_url)
+        widget_html = build_embed_widget_tag(
+            token=token,
+            course_slug=course.slug,
+            newsletter_title=course.newsletter.title if course.newsletter else None,
+        )
+        return JsonResponse({"script_html": script_html, "widget_html": widget_html}, status=200)
+
+
 @method_decorator(accessible_for(roles={"admin", "editor", "instructor"}), name="post")
 class SendLessonToPlatformUser(View):
     def post(self, request, *args, **kwargs) -> JsonResponse:  # type: ignore[no-untyped-def]

{django_email_learning-2.2.0 → django_email_learning-2.3.0}/django_email_learning/platform/views/courses.py

@@ -14,6 +14,7 @@ from django_email_learning.platform.views.base import (
     QUIZ_DEFAULTS,
     BasePlatformView,
 )
+from django_email_learning.public.api.views import embeddable_enrollment_enabled
 
 
 @method_decorator(login_required, name="dispatch")
@@ -167,6 +168,7 @@ class CourseView(BasePlatformView):
         context["appContext"]["courseEnabled"] = course.enabled
         context["appContext"]["coursePublicUrl"] = course.public_url
         context["appContext"]["courseHasContent"] = CourseContent.objects.filter(course=course).exists()
+        context["appContext"]["embeddableEnrollmentEnabled"] = embeddable_enrollment_enabled()
         context["appContext"]["customComponent"] = None
         context["appContext"]["quizDefaults"] = {
             "limitedAttempts": QUIZ_DEFAULTS.get("LIMITED_ATTEMPTS", True),
@@ -191,6 +193,19 @@ class CourseView(BasePlatformView):
             "view_public_course_page": _("Public page"),
             "copy_public_course_link": _("Copy public course link"),
             "public_course_link_copied": _("Link copied!"),
+            "add_to_your_site": _("Add to your site"),
+            "embed_code_dialog_title": _("Embed on your site"),
+            "embed_code_dialog_description": _(
+                "Paste these snippets into your own website's HTML to let visitors enroll directly from your site."
+            ),
+            "embed_script_step_title": _("1. Add this once to your site (e.g. in your footer)"),
+            "embed_widget_step_title": _("2. Place this wherever you want the enrollment form to appear"),
+            "embed_code_loading": _("Loading embed code..."),
+            "embed_code_error": _("Couldn't load the embed code. Please try again."),
+            "copy_embed_script": _("Copy script"),
+            "copy_embed_widget": _("Copy widget tag"),
+            "embed_code_copied": _("Copied!"),
+            "close": _("Close"),
             "enable_course": _("Enable COURSE_NAME"),
             "course_enable_confirmation": _("Are you sure you want to enable the course COURSE_NAME?"),
             "continue": _("Continue"),

django_email_learning-2.3.0/django_email_learning/public/api/rate_limiting.py

@@ -0,0 +1,29 @@
+from django.core.cache import cache
+from django.http import HttpRequest
+
+
+def get_client_ip(request: HttpRequest) -> str:
+    return request.META.get("REMOTE_ADDR", "unknown")
+
+
+def is_rate_limited(key: str, *, limit: int, window_seconds: int) -> bool:
+    """Fixed-window request counter backed by Django's cache framework.
+
+    Returns True once `limit` calls for `key` have been seen within the
+    current `window_seconds` window. Relies on whatever CACHES backend is
+    configured; a per-process LocMemCache under-counts across multiple
+    worker processes, so a shared backend (e.g. Redis) is recommended in
+    production for this to be effective.
+    """
+    count = cache.get(key)
+    if count is None:
+        cache.set(key, 1, timeout=window_seconds)
+        return False
+    if count >= limit:
+        return True
+    try:
+        cache.incr(key)
+    except ValueError:
+        # Key expired between the get() and incr() calls above; start over.
+        cache.set(key, 1, timeout=window_seconds)
+    return False

{django_email_learning-2.2.0 → django_email_learning-2.3.0}/django_email_learning/public/api/serializers.py

@@ -4,11 +4,8 @@ from typing import List
 from pydantic import BaseModel, Field, field_validator
 
 
-class EnrollmentRequest(BaseModel):
-    organization_id: int
+class EmailValidatedRequest(BaseModel):
     email: str
-    course_slug: str = Field(min_length=1)
-    subscribe_to_newsletter: bool = False
 
     @field_validator("email")
     def validate_email(cls, v: str) -> str:
@@ -18,13 +15,21 @@ class EnrollmentRequest(BaseModel):
         return v
 
 
-class NewsletterSubscribeRequest(BaseModel):
-    email: str
-    newsletter_ids: List[int] = Field(min_length=1)
+class EnrollmentRequest(EmailValidatedRequest):
+    organization_id: int
+    course_slug: str = Field(min_length=1)
+    subscribe_to_newsletter: bool = False
 
-    @field_validator("email")
-    def validate_email(cls, v: str) -> str:
-        email_regex = r"^[\w\.-]+@[\w\.-]+\.\w+$"
-        if not re.match(email_regex, v):
-            raise ValueError("Invalid email format")
-        return v
+
+class EmbeddableEnrollmentRequest(EmailValidatedRequest):
+    """Same as EnrollmentRequest but without organization_id: the embed API
+    resolves the organization from the embed_token in the URL instead of
+    trusting a caller-supplied id.
+    """
+
+    course_slug: str = Field(min_length=1)
+    subscribe_to_newsletter: bool = False
+
+
+class NewsletterSubscribeRequest(EmailValidatedRequest):
+    newsletter_ids: List[int] = Field(min_length=1)

django_email_learning-2.3.0/django_email_learning/public/api/urls.py

@@ -0,0 +1,25 @@
+from django.urls import path
+
+from django_email_learning.public.api.views import (
+    EmbeddableEnrollView,
+    EmbeddableNewsletterSubscribeView,
+    EnrollView,
+    NewsletterSubscribeView,
+)
+
+app_name = "django_email_learning"
+
+urlpatterns = [
+    path("enrollments/", EnrollView.as_view(), name="enroll"),
+    path(
+        "organizations/<int:organization_id>/newsletters/subscribe/",
+        NewsletterSubscribeView.as_view(),
+        name="newsletter_subscribe",
+    ),
+    path("embed/<str:token>/enrollments/", EmbeddableEnrollView.as_view(), name="embed_enroll"),
+    path(
+        "embed/<str:token>/newsletters/subscribe/",
+        EmbeddableNewsletterSubscribeView.as_view(),
+        name="embed_newsletter_subscribe",
+    ),
+]

django_email_learning-2.3.0/django_email_learning/public/api/views.py

@@ -0,0 +1,288 @@
+import json
+import logging
+from typing import List
+
+from django.conf import settings
+from django.http import HttpRequest, HttpResponse, JsonResponse
+from django.utils.decorators import method_decorator
+from django.views import View
+from django.views.decorators.csrf import csrf_exempt
+from pydantic import ValidationError
+
+from django_email_learning.models import Course, Newsletter, NewsletterSubscriber, Organization
+from django_email_learning.public.api.rate_limiting import get_client_ip, is_rate_limited
+from django_email_learning.public.api.serializers import (
+    EmbeddableEnrollmentRequest,
+    EnrollmentRequest,
+    NewsletterSubscribeRequest,
+)
+from django_email_learning.services.command_models.enroll_command import EnrollCommand
+from django_email_learning.services.command_models.exceptions.blocked_email_error import (
+    BlockedEmailError,
+)
+from django_email_learning.services.command_models.exceptions.enrollment_already_exists_error import (
+    EnrollmentAlreadyExistsError,
+)
+from django_email_learning.services.command_models.exceptions.learner_cap_exceeded_error import (
+    LearnerCapExceededError,
+)
+from django_email_learning.services.utils import mask_email
+
+logger = logging.getLogger(__name__)
+
+DEFAULT_RATE_LIMITS = {
+    "PER_IP_LIMIT": 20,
+    "PER_IP_WINDOW_SECONDS": 300,
+    "PER_EMAIL_LIMIT": 5,
+    "PER_EMAIL_WINDOW_SECONDS": 3600,
+    "PER_TOKEN_LIMIT": 60,
+    "PER_TOKEN_WINDOW_SECONDS": 300,
+}
+
+TOO_MANY_REQUESTS_MESSAGE = "Too many requests. Please try again later."
+NOT_FOUND_MESSAGE = "Not found"
+INVALID_JSON_MESSAGE = "Invalid JSON payload"
+
+
+def embeddable_enrollment_enabled() -> bool:
+    return bool(getattr(settings, "DJANGO_EMAIL_LEARNING", {}).get("EMBEDDABLE_ENROLLMENT_ENABLED", False))
+
+
+def get_rate_limit_settings() -> dict:
+    configured = getattr(settings, "DJANGO_EMAIL_LEARNING", {}).get("EMBEDDABLE_ENROLLMENT_RATE_LIMITS", {})
+    return {**DEFAULT_RATE_LIMITS, **configured}
+
+
+def _default_max_subscribers() -> int:
+    return (
+        getattr(settings, "DJANGO_EMAIL_LEARNING", {}).get("NEWSLETTERS", {}).get("MAX_SUBSCRIBER_PER_NEWSLETTER", 500)
+    )
+
+
+def _perform_enrollment(
+    *, organization_id: int, email: str, course_slug: str, subscribe_to_newsletter: bool
+) -> JsonResponse:
+    try:
+        course = Course.objects.get(slug=course_slug, organization_id=organization_id, is_public=True)
+    except Course.DoesNotExist:
+        return JsonResponse({"error": "Course not found"}, status=404)
+
+    command = EnrollCommand(email=email, course_slug=course_slug, organization_id=organization_id)
+    try:
+        command.execute()
+    except EnrollmentAlreadyExistsError as e:
+        logger.info(f"Enrollment already exists: {e}")
+        return JsonResponse({"status": "already_enrolled"}, status=200)
+    except BlockedEmailError as e:
+        logger.error(f"Blocked email error: {e}")
+        return JsonResponse({"error": str(e)}, status=403)
+    except LearnerCapExceededError as e:
+        logger.info(f"Learner cap exceeded: {e}")
+        return JsonResponse({"error": str(e)}, status=403)
+
+    if subscribe_to_newsletter and course.newsletter_id:
+        NewsletterSubscriber.objects.get_or_create(newsletter_id=course.newsletter_id, email=email)
+
+    return JsonResponse({"status": "enrolled"}, status=200)
+
+
+def _perform_newsletter_subscribe(
+    *, organization_id: int, email: str, newsletter_ids: List[int], max_subscribers: int
+) -> JsonResponse:
+    newsletters = {n.id: n for n in Newsletter.objects.filter(id__in=newsletter_ids, organization_id=organization_id)}
+
+    invalid = set(newsletter_ids) - set(newsletters)
+    if invalid:
+        return JsonResponse({"error": "One or more newsletter IDs are invalid."}, status=400)
+
+    for newsletter in newsletters.values():
+        already_subscribed = NewsletterSubscriber.objects.filter(newsletter=newsletter, email=email).exists()
+        if not already_subscribed and newsletter.subscribers.count() >= max_subscribers:
+            return JsonResponse(
+                {"error": f'Newsletter "{newsletter.title}" has reached its maximum number of subscribers.'},
+                status=400,
+            )
+
+    for newsletter_id in newsletters:
+        NewsletterSubscriber.objects.get_or_create(newsletter_id=newsletter_id, email=email)
+
+    return JsonResponse({"status": "subscribed"}, status=200)
+
+
+class EnrollView(View):
+    def post(self, request, *args, **kwargs) -> JsonResponse:  # type: ignore[no-untyped-def]
+        try:
+            payload = EnrollmentRequest.model_validate(json.loads(request.body))
+        except ValidationError as e:
+            return JsonResponse({"error": str(e)}, status=400)
+
+        return _perform_enrollment(
+            organization_id=payload.organization_id,
+            email=payload.email,
+            course_slug=payload.course_slug,
+            subscribe_to_newsletter=payload.subscribe_to_newsletter,
+        )
+
+
+class NewsletterSubscribeView(View):
+    def get_max_subscribers(self) -> int:
+        return _default_max_subscribers()
+
+    def post(self, request, organization_id: int, *args, **kwargs) -> JsonResponse:  # type: ignore[no-untyped-def]
+        payload = json.loads(request.body)
+        try:
+            data = NewsletterSubscribeRequest.model_validate(payload)
+        except ValidationError as e:
+            return JsonResponse({"error": str(e)}, status=400)
+
+        return _perform_newsletter_subscribe(
+            organization_id=organization_id,
+            email=data.email,
+            newsletter_ids=data.newsletter_ids,
+            max_subscribers=self.get_max_subscribers(),
+        )
+
+
+class PublicCorsMixin:
+    """Adds a wide-open CORS policy on top of a view, for endpoints meant to be
+    called cross-origin from third-party sites embedding a widget. These take
+    no cookies/credentials, so an open origin policy carries no session-hijack
+    risk on its own; callers still go through EMBEDDABLE_ENROLLMENT_ENABLED, a
+    per-organization embed_token, and rate limiting below.
+    """
+
+    def dispatch(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:  # type: ignore[no-untyped-def]
+        if request.method == "OPTIONS":
+            response = HttpResponse(status=204)
+        else:
+            response = super().dispatch(request, *args, **kwargs)  # type: ignore[misc]
+        response["Access-Control-Allow-Origin"] = "*"
+        response["Access-Control-Allow-Methods"] = "POST, OPTIONS"
+        response["Access-Control-Allow-Headers"] = "Content-Type"
+        response["Access-Control-Max-Age"] = "86400"
+        return response
+
+
+class EmbedTokenResolverMixin:
+    """Resolves the Organization addressed by the embed_token URL segment
+    before dispatching to the view, and 404s if embedding is disabled
+    deployment-wide or the token doesn't match any organization. A bad token
+    is intentionally indistinguishable from a disabled feature, so callers
+    can't use this to enumerate valid tokens.
+    """
+
+    organization: Organization
+
+    def dispatch(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:  # type: ignore[no-untyped-def]
+        if not embeddable_enrollment_enabled():
+            return JsonResponse({"error": NOT_FOUND_MESSAGE}, status=404)
+        try:
+            self.organization = Organization.objects.get(embed_token=kwargs.get("token"))
+        except Organization.DoesNotExist:
+            return JsonResponse({"error": NOT_FOUND_MESSAGE}, status=404)
+        return super().dispatch(request, *args, **kwargs)  # type: ignore[misc]
+
+
+@method_decorator(csrf_exempt, name="dispatch")
+class EmbeddableEnrollView(EmbedTokenResolverMixin, PublicCorsMixin, View):
+    """Cross-origin counterpart to EnrollView for embedding on third-party
+    sites, addressed by a per-organization embed_token in the URL rather than
+    a caller-supplied organization_id (which would let anyone target any
+    organization). Disabled unless
+    DJANGO_EMAIL_LEARNING["EMBEDDABLE_ENROLLMENT_ENABLED"] is set, since
+    opening this up is a per-deployment decision, not a default.
+    """
+
+    def post(self, request, token: str, *args, **kwargs) -> JsonResponse:  # type: ignore[no-untyped-def]
+        rate_limits = get_rate_limit_settings()
+        client_ip = get_client_ip(request)
+
+        if is_rate_limited(
+            f"public_api:embed_enroll:ip:{client_ip}",
+            limit=rate_limits["PER_IP_LIMIT"],
+            window_seconds=rate_limits["PER_IP_WINDOW_SECONDS"],
+        ):
+            logger.warning(f"Embedded enrollment rate limit exceeded for IP {client_ip}")
+            return JsonResponse({"error": TOO_MANY_REQUESTS_MESSAGE}, status=429)
+
+        if is_rate_limited(
+            f"public_api:embed_enroll:token:{token}",
+            limit=rate_limits["PER_TOKEN_LIMIT"],
+            window_seconds=rate_limits["PER_TOKEN_WINDOW_SECONDS"],
+        ):
+            logger.warning(f"Embedded enrollment rate limit exceeded for organization {self.organization.id}")
+            return JsonResponse({"error": TOO_MANY_REQUESTS_MESSAGE}, status=429)
+
+        try:
+            payload = EmbeddableEnrollmentRequest.model_validate(json.loads(request.body))
+        except json.JSONDecodeError:
+            return JsonResponse({"error": INVALID_JSON_MESSAGE}, status=400)
+        except ValidationError as e:
+            return JsonResponse({"error": str(e)}, status=400)
+
+        if is_rate_limited(
+            f"public_api:embed_enroll:email:{payload.email.lower()}",
+            limit=rate_limits["PER_EMAIL_LIMIT"],
+            window_seconds=rate_limits["PER_EMAIL_WINDOW_SECONDS"],
+        ):
+            logger.warning(f"Embedded enrollment rate limit exceeded for email {mask_email(payload.email)}")
+            return JsonResponse({"error": TOO_MANY_REQUESTS_MESSAGE}, status=429)
+
+        return _perform_enrollment(
+            organization_id=self.organization.id,
+            email=payload.email,
+            course_slug=payload.course_slug,
+            subscribe_to_newsletter=payload.subscribe_to_newsletter,
+        )
+
+
+@method_decorator(csrf_exempt, name="dispatch")
+class EmbeddableNewsletterSubscribeView(EmbedTokenResolverMixin, PublicCorsMixin, View):
+    """Cross-origin counterpart to NewsletterSubscribeView, gated by the same
+    embed_token/EMBEDDABLE_ENROLLMENT_ENABLED checks as EmbeddableEnrollView.
+    """
+
+    def get_max_subscribers(self) -> int:
+        return _default_max_subscribers()
+
+    def post(self, request, token: str, *args, **kwargs) -> JsonResponse:  # type: ignore[no-untyped-def]
+        rate_limits = get_rate_limit_settings()
+        client_ip = get_client_ip(request)
+
+        if is_rate_limited(
+            f"public_api:embed_newsletter_subscribe:ip:{client_ip}",
+            limit=rate_limits["PER_IP_LIMIT"],
+            window_seconds=rate_limits["PER_IP_WINDOW_SECONDS"],
+        ):
+            logger.warning(f"Embedded newsletter subscribe rate limit exceeded for IP {client_ip}")
+            return JsonResponse({"error": TOO_MANY_REQUESTS_MESSAGE}, status=429)
+
+        if is_rate_limited(
+            f"public_api:embed_newsletter_subscribe:token:{token}",
+            limit=rate_limits["PER_TOKEN_LIMIT"],
+            window_seconds=rate_limits["PER_TOKEN_WINDOW_SECONDS"],
+        ):
+            logger.warning(f"Embedded newsletter subscribe rate limit exceeded for organization {self.organization.id}")
+            return JsonResponse({"error": TOO_MANY_REQUESTS_MESSAGE}, status=429)
+
+        try:
+            data = NewsletterSubscribeRequest.model_validate(json.loads(request.body))
+        except json.JSONDecodeError:
+            return JsonResponse({"error": INVALID_JSON_MESSAGE}, status=400)
+        except ValidationError as e:
+            return JsonResponse({"error": str(e)}, status=400)
+
+        if is_rate_limited(
+            f"public_api:embed_newsletter_subscribe:email:{data.email.lower()}",
+            limit=rate_limits["PER_EMAIL_LIMIT"],
+            window_seconds=rate_limits["PER_EMAIL_WINDOW_SECONDS"],
+        ):
+            logger.warning(f"Embedded newsletter subscribe rate limit exceeded for email {mask_email(data.email)}")
+            return JsonResponse({"error": TOO_MANY_REQUESTS_MESSAGE}, status=429)
+
+        return _perform_newsletter_subscribe(
+            organization_id=self.organization.id,
+            email=data.email,
+            newsletter_ids=data.newsletter_ids,
+            max_subscribers=self.get_max_subscribers(),
+        )