feat: add PoC permission and role #209

dwong2708 · 2026-01-30T23:16:02Z

Resolves: #203

As part of implementing PoC permissions and roles for the advanced settings section, this PR is intended to introduce only the definitions of the mentioned roles and permissions.

Merge checklist:
Check off if complete or not applicable:

Version bumped
Changelog record added
Documentation updated (not only docstrings)
Fixup commits are squashed away
Unit tests added/updated
Manual testing instructions provided
Noted any: Concerns, dependencies, migration issues, deadlines, tickets

openedx-webhooks · 2026-01-30T23:16:07Z

Thanks for the pull request, @dwong2708!

This repository is currently maintained by @openedx/committers-openedx-authz.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
- This process (including the steps you'll need to take) is documented here.
If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

Dependencies

This PR must be merged before / after / at the same time as ...
Blockers

This PR is waiting for OEP-1234 to be accepted.
Timeline information

This PR must be merged by XX date because ...
Partner information

This is for a course on edx.org.
Supporting documentation
Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

Details

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

The size and impact of the changes that it introduces
The need for product review
Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

openedx_authz/engine/config/authz.policy

rodmgwgu

Adding some initial comments, I'm still investigating the error you are seeing.

openedx_authz/tests/stubs/models.py

wgu-taylor-payne

I'm having some issues mounting this branch to my local dev environment. One issue was which app name for CourseOverview being used by default (content vs course_overviews), as I point out in the comments here. The other errors showing up I've documented in #215, which don't seem to be related to the changes you are introducing.

openedx_authz/models/scopes.py

openedx_authz/settings/common.py

dwong2708 · 2026-02-10T23:03:28Z

I'm having some issues mounting this branch to my local dev environment. One issue was which app name for CourseOverview being used by default (content vs course_overviews), as I point out in the comments here. The other errors showing up I've documented in #215, which don't seem to be related to the changes you are introducing.

Good catch, @wgu-taylor-payne. Those comments were very helpful — thanks!

wgu-taylor-payne

Okay, it looks like I found what triggered the errors I came across in #215 as it relates to the changes in this PR.

openedx_authz/api/data.py

openedx_authz/migrations/0007_coursescope.py

wgu-taylor-payne

Sorry to keep reviewing this in small pieces, but I'm wanting to bring up issues I'm running into while testing this branch locally on my machine.

One other general suggestion would be to look to see if we can add more tests for the common ways these new additions will be used. One example, for instance, is it would be nice to see course data used in the test_is_user_allowed test in the test_users.py module.

wgu-taylor-payne · 2026-02-11T01:04:17Z

openedx_authz/api/data.py

+        NAMESPACE: 'course' for course scopes.
+        external_key: The course identifier (e.g., 'course-v1:TestOrg+TestCourse+2024_T1').
+            Must be a valid CourseKey format.
+        namespaced_key: The course identifier with namespace (e.g., 'course^course-v1:TestOrg+TestCourse+2024_T1').


ScopeMeta.get_subclass_by_external_key assumes what is before the first ':' is the namespace, so in our case, if we do something like ScopeData(external_key='course-v1:TestOrg+TestCourse+2024_T1'), ScopeMeta will assume that course-v1 is the namespace, but we set the namespace to be 'course', so it will fail to find this subclass. We will need to analyze how to handle this difference between course keys and library keys.

I think we could explore using the course-v1 namespace. That would mean creating a new scope for each new version, which actually sounds reasonable to me.
Otherwise, we’d need to handle versioning within our Scope model.
I updated the tests to use course-v1, and if that approach looks good to you, we can keep it that way.
What do you think? @rodmgwgu @wgu-taylor-payne @bmtcril

Yes that makes sense to me, and I think is what we were planning on. Given the way different opaque keys work it makes scoping by the different types easier. I think you'll need to change it at line 483 here too?

Correct. However, on second thought, there could be side effects depending on what we want. I’d like to ask:

What should the expected namespaced_key be?

A) course^course-v1:TestOrg+TestCourse+2024_T1

Implications:

Update get_subclass_by_external_key to retrieve it based on the ScopeModel namespace instead of the - ScopeData namespace (somehow).

The policy remains as is:
p, role^course_staff, act^courses.manage_advanced_settings, course^*, allow

B) course-v1^course-v1:TestOrg+TestCourse+2024_T1
Implications:

Keep get_subclass_by_external_key as is.

Update the policy to:
p, role^course_staff, act^courses.manage_advanced_settings, course-v1^*, allow

What do you think is the better option?

I think both should match course-v1 so it should be like course-v1^course-v1:TestOrg+TestCourse+2024_T1.

If we are all aligned with this, I'll also change this on my frontend PR, where I'm referring to these permissions.

Yeah I agree with @rodmgwgu

Changes applied. Thanks.

FYI: With option B, I had to update the policy to p, role^course_staff, act^courses.manage_advanced_settings, course-v1^*, allow

openedx_authz/engine/matcher.py

CHANGELOG.rst

bmtcril

This looks good to me, is there a companion edx-platform PR that's testing this in-context yet?

openedx_authz/engine/matcher.py

openedx_authz/models/scopes.py

openedx_authz/__init__.py

dwong2708 · 2026-02-11T23:17:32Z

Sorry to keep reviewing this in small pieces, but I'm wanting to bring up issues I'm running into while testing this branch locally on my machine.

One other general suggestion would be to look to see if we can add more tests for the common ways these new additions will be used. One example, for instance, is it would be nice to see course data used in the test_is_user_allowed test in the test_users.py module.

No worries. I expected this flow to happen while you were testing, which is good. I’ve updated test_is_user_allowed to account for the new permission. Thank you

rodmgwgu

Tested in my local, it's looking good, thanks!

wgu-taylor-payne

The changelog needs to be updated, but other than that this looks good to go.

CHANGELOG.rst

feat: add PoC permission and role

bbeec5d

openedx-webhooks added the open-source-contribution PR author is not from Axim or 2U label Jan 30, 2026

openedx-webhooks added this to Contributions Jan 30, 2026

github-project-automation bot moved this to Needs Triage in Contributions Jan 30, 2026

mphilbrick211 added the mao-onboarding Reviewing this will help onboard devs from an Axim mission-aligned organization (MAO). label Feb 3, 2026

mphilbrick211 moved this from Needs Triage to Waiting on Author in Contributions Feb 3, 2026

fixup! feat: add PoC permission and role

be420c4

dwong2708 marked this pull request as ready for review February 4, 2026 02:35

dwong2708 requested review from bmtcril and rodmgwgu February 4, 2026 02:35

wgu-taylor-payne reviewed Feb 4, 2026

View reviewed changes

openedx_authz/engine/config/authz.policy Outdated Show resolved Hide resolved

bmtcril requested review from BryanttV and mariajgrimaldi February 4, 2026 17:39

fixup! feat: add PoC permission and role

f004d5d

rodmgwgu requested changes Feb 6, 2026

View reviewed changes

openedx_authz/tests/stubs/models.py Outdated Show resolved Hide resolved

openedx_authz/tests/stubs/models.py Outdated Show resolved Hide resolved

rodmgwgu requested changes Feb 6, 2026

View reviewed changes

openedx_authz/tests/stubs/models.py Outdated Show resolved Hide resolved

dwong2708 added 3 commits February 9, 2026 12:24

fixup! feat: add PoC permission and role

d7da43b

fixup! feat: add PoC permission and role

96ac10f

fixup! feat: add PoC permission and role

861e5de

dwong2708 requested review from rodmgwgu and wgu-taylor-payne February 9, 2026 18:41

mphilbrick211 moved this from Waiting on Author to In Eng Review in Contributions Feb 10, 2026

rodmgwgu mentioned this pull request Feb 10, 2026

feat: Add validation for Advanced Settings permissions using openedx-authz openedx/frontend-app-authoring#2869

Open

7 tasks

wgu-taylor-payne reviewed Feb 10, 2026

View reviewed changes

openedx_authz/models/scopes.py Outdated Show resolved Hide resolved

openedx_authz/settings/common.py Outdated Show resolved Hide resolved

fixup! feat: add PoC permission and role

bcf703d

wgu-taylor-payne reviewed Feb 10, 2026

View reviewed changes

openedx_authz/api/data.py Outdated Show resolved Hide resolved

openedx_authz/migrations/0007_coursescope.py Outdated Show resolved Hide resolved

fixup! feat: add PoC permission and role

892bfda

dwong2708 requested a review from wgu-taylor-payne February 10, 2026 23:39

wgu-taylor-payne reviewed Feb 11, 2026

View reviewed changes

bmtcril approved these changes Feb 11, 2026

View reviewed changes

openedx_authz/engine/matcher.py Outdated Show resolved Hide resolved

openedx_authz/models/scopes.py Show resolved Hide resolved

openedx_authz/__init__.py Outdated Show resolved Hide resolved

dwong2708 added 2 commits February 11, 2026 12:09

fixup! feat: add PoC permission and role

9761639

fixup! feat: add PoC permission and role

74245c8

dwong2708 requested a review from wgu-taylor-payne February 11, 2026 22:12

fixup! feat: add PoC permission and role

7b99812

rodmgwgu approved these changes Feb 12, 2026

View reviewed changes

rodmgwgu mentioned this pull request Feb 12, 2026

Task - RBAC AuthZ - Implement automatic policy cleanup when a scope is deleted #211

Closed

wgu-taylor-payne approved these changes Feb 12, 2026

View reviewed changes

CHANGELOG.rst Outdated Show resolved Hide resolved

fixup! feat: add PoC permission and role

ad7e36c

rodmgwgu merged commit dc99738 into openedx:main Feb 12, 2026
14 checks passed

github-project-automation bot moved this from In Eng Review to Done in Contributions Feb 12, 2026

feat: add PoC permission and role #209

feat: add PoC permission and role #209

Conversation

dwong2708 commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openedx-webhooks commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

rodmgwgu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wgu-taylor-payne left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

dwong2708 commented Feb 10, 2026

Uh oh!

wgu-taylor-payne left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

wgu-taylor-payne left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wgu-taylor-payne Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

dwong2708 Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

bmtcril Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

dwong2708 Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

rodmgwgu Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bmtcril Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

dwong2708 Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

dwong2708 Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

bmtcril left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dwong2708 commented Feb 11, 2026

Uh oh!

rodmgwgu left a comment

Choose a reason for hiding this comment

Uh oh!

wgu-taylor-payne left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

dwong2708 commented Jan 30, 2026 •

edited

Loading

openedx-webhooks commented Jan 30, 2026 •

edited

Loading

wgu-taylor-payne left a comment •

edited

Loading

rodmgwgu Feb 11, 2026 •

edited

Loading