feat(authz): add tag management permissions within course scope

[dcoa]

Description

Part of the integration of RBAC permission system to course authoring workflow. Adds the courses.manage_tags permission check to every place in Studio where a Course Roles can view or edit taxonomy tags on course content.

Implemented changes

• Card header (CardHeader.tsx): the tag-count badge and the "Manage tags" dropdown item are
  hidden when the user cannot manage tags.
• Align sidebar (OutlineAlignSidebar.tsx) and Unit align sidebar
  (UnitAlignSidebar.tsx): pass readOnly={!canManageTags} down to AlignSidebar, which forwards it to ContentTagsDrawer. AlignSidebar gains an optional readOnly prop (default false), so existing callers are unaffected.
• Course info sidebar (CourseInfoSidebar.tsx): the "Taxonomy Alignments" section renders no
  actions menu at all when the user cannot manage tags, instead of showing a "Manage tags" action
  they cannot use.

Testing instructions

1. Enable the enable_authz_course_authoring waffle flag.
2. Assign a user a role that grants `does not have manage permissions, and log in as that user:
   • Use the API http://local.openedx.io:8000/api/authz/v1/roles/users/
   • Assign course_auditor as role
3. Open the course and verify:
   • In the info sidebar the tags are visible but actions are not displayed.
   • Enter a unit and the tags are visible but actions are not available.
4. Now log in as a user with manage_tags (Editor, Admin o Staff) and repeat steps 3: the manage tag button should be displayed and the user can add/remove tags.
5. Turn the waffle flag off and confirm the legacy behavior is unchanged for all users.

Manage Tags	No Permission
Course Outline
Course Unit

Other information

Design link

Closes openedx/openedx-authz#314

The refinement identify some UI bugs

• Bug A — canTagObject hardcoded to false for otherTaxonomies (ContentTagsDrawerHelper.jsx). The can_tag_object field from object_tags was available but unused.

• Bug B — The merge useEffect in ContentTagsDrawerHelper.jsx only merged staged tags into fetchedTaxonomies entries. When a taxonomy was in otherTaxonomies (taxonomy list empty), staged tags were discarded and never reached appliedContentTagsTree → "Add" appeared to work but nothing appeared on screen.

• Bug C — The tag selector <Select> in ContentTagsCollapsible.jsx was gated only on isEditMode, not on canTagObject. This showed an interactive selector for taxonomies where the user has no permission.

Best Practices Checklist

We're trying to move away from some deprecated patterns in this codebase. Please
check if your PR meets these recommendations before asking for a review:

• Any new files are using TypeScript (.ts, .tsx).
• Avoid propTypes and defaultProps in any new or modified code.
• Tests should use the helpers in src/testUtils.tsx (specifically initializeMocks)
• Do not add new fields to the Redux state/store. Use React Context to share state among multiple components.
• Use React Query to load data from REST APIs. See any apiHooks.ts in this repo for examples.
• All new i18n messages in messages.ts files have a description for translators to use.
• Avoid using ../ in import paths. To import from parent folders, use @src, e.g. import { initializeMocks } from '@src/testUtils'; instead of from '../../../../testUtils'

[openedx-webhooks]

Thanks for the pull request, @dcoa!

This repository is currently maintained by @bradenmacdonald.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

• If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
  • This process (including the steps you'll need to take) is documented here.
• If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

• Dependencies

  This PR must be merged before / after / at the same time as ...

• Blockers

  This PR is waiting for OEP-1234 to be accepted.

• Timeline information

  This PR must be merged by XX date because ...

• Partner information

  This is for a course on edx.org.

• Supporting documentation
• Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

Details

---

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

• Overview of Review Process for Community Contributions
• Pull Request Status Guide
• Making changes to your pull request

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

• The size and impact of the changes that it introduces
• The need for product review
• Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

[codecov]

Codecov Report

❌ Patch coverage is 98.90110% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 95.95%. Comparing base (2c14cef) to head (6344ff5).
⚠️ Report is 2 commits behind head on master.

Files with missing lines	Patch %	Lines
src/content-tags-drawer/ContentTagsDrawerHelper.ts	96.87%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3224      +/-   ##
==========================================
+ Coverage   95.93%   95.95%   +0.02%     
==========================================
  Files        1397     1397              
  Lines       33603    33683      +80     
  Branches     7687     7975     +288     
==========================================
+ Hits        32237    32321      +84     
+ Misses       1323     1319       -4     
  Partials       43       43              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[jacobo-dominguez-wgu]

Lets use userEvent instead of fireEvent for new tests

[jacobo-dominguez-wgu]

There are some testing utils that can be used to mock the permissions:

frontend-app-authoring/src/testUtils.tsx

Line 211 in 0c864d9

validateUserPermissionsMock = jest.spyOn(authzApi, 'validateUserPermissions').mockResolvedValue({});

So you could do something like:

const mocks = initializeMocks();
validateUserPermissionsMock = mocks.validateUserPermissionsMock;
validateUserPermissionsMock.mockResolvedValue({
      isLoading: false,
      canManageTags: true,
      isAuthzEnabled: false,
});

[dcoa]

thank you for point this out, done!!

[BryanttV]

Hi @dcoa, thanks!

I was testing these changes and noticed that when I click 'Align', even though the tags are listed correctly, a message still pops up saying that taxonomies must be enabled (even when they already are). I'm seeing this happen with both the Course Auditor and Course Editor roles.

[dcoa]

I was testing these changes and noticed that when I click 'Align', even though the tags are listed correctly, a message still pops up saying that taxonomies must be enabled (even when they already are). I'm seeing this happen with both the Course Auditor and Course Editor roles.

Yep @BryanttV , I mentioning and reporting the reason of this here openedx/openedx-authz#286. But in summary this is one of those cases when limits between one permission and the other gets diffuse, in this case tags and taxonomies (that is out of the scope for know because has not been implemented at the backend side).

The reason why that message is displayed is because we are getting the tags but not the taxonomies.