Skip to content

feat: Implement courses roles and permissions mappings #217

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rodmgwgu merged 1 commit into from
Feb 19, 2026
Merged

feat: Implement courses roles and permissions mappings #217

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion CHANGELOG.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,12 @@ Unreleased
Added
=====

0.22.0 - 2026-02-19
********************

* ADR on the AuthZ for Course Authoring implementation plan.
* ADR on the AuthZ for Course Authoring Feature Flag Implementation Details.

* Defined courses roles and permissions mappings, including legacy compatible permissions.

0.21.0 - 2026-02-12
********************
Expand Down
2 changes: 1 addition & 1 deletion openedx_authz/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,6 @@

import os

__version__ = "0.21.0"
__version__ = "0.22.0"

ROOT_DIRECTORY = os.path.dirname(os.path.abspath(__file__))
172 changes: 171 additions & 1 deletion openedx_authz/constants/permissions.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,177 @@

COURSES_NAMESPACE = "courses"

MANAGE_ADVANCED_SETTINGS = PermissionData(
COURSES_VIEW_COURSE = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.view_course"),
effect="allow",
)

COURSES_CREATE_COURSE = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.create_course"),
effect="allow",
)

COURSES_EDIT_COURSE_CONTENT = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.edit_course_content"),
effect="allow",
)

COURSES_PUBLISH_COURSE_CONTENT = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.publish_course_content"),
effect="allow",
)

COURSES_MANAGE_LIBRARY_UPDATES = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.manage_library_updates"),
effect="allow",
)

COURSES_VIEW_COURSE_UPDATES = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.view_course_updates"),
effect="allow",
)

COURSES_MANAGE_COURSE_UPDATES = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.manage_course_updates"),
effect="allow",
)

COURSES_VIEW_PAGES_AND_RESOURCES = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.view_pages_and_resources"),
effect="allow",
)

COURSES_MANAGE_PAGES_AND_RESOURCES = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.manage_pages_and_resources"),
effect="allow",
)

COURSES_VIEW_FILES = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.view_files"),
effect="allow",
)

COURSES_CREATE_FILES = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.create_files"),
effect="allow",
)

COURSES_DELETE_FILES = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.delete_files"),
effect="allow",
)

COURSES_EDIT_FILES = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.edit_files"),
effect="allow",
)

COURSES_VIEW_SCHEDULE_AND_DETAILS = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.view_schedule_and_details"),
effect="allow",
)

COURSES_EDIT_SCHEDULE = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.edit_schedule"),
effect="allow",
)

COURSES_EDIT_DETAILS = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.edit_details"),
effect="allow",
)

COURSES_VIEW_GRADING_SETTINGS = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.view_grading_settings"),
effect="allow",
)

COURSES_EDIT_GRADING_SETTINGS = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.edit_grading_settings"),
effect="allow",
)

COURSES_VIEW_COURSE_TEAM = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.view_course_team"),
effect="allow",
)

COURSES_MANAGE_COURSE_TEAM = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.manage_course_team"),
effect="allow",
)

COURSES_MANAGE_GROUP_CONFIGURATIONS = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.manage_group_configurations"),
effect="allow",
)

COURSES_MANAGE_ADVANCED_SETTINGS = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.manage_advanced_settings"),
effect="allow",
)

COURSES_MANAGE_CERTIFICATES = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.manage_certificates"),
effect="allow",
)

COURSES_IMPORT_COURSE = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.import_course"),
effect="allow",
)

COURSES_EXPORT_COURSE = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.export_course"),
effect="allow",
)

COURSES_EXPORT_TAGS = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.export_tags"),
effect="allow",
)

COURSES_VIEW_CHECKLISTS = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.view_checklists"),
effect="allow",
)

COURSES_MANAGE_TAGS = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.manage_tags"),
effect="allow",
)

COURSES_MANAGE_TAXONOMIES = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.manage_taxonomies"),
effect="allow",
)

# Legacy Course permissions
# These permissions allow backwards compatibility with legacy code that depends on the old roles system
# These relate to legacy roles, if a openedx-authz role has one of these permissions,
# it will have the same permissions as the equivalent legacy roles on code that has not been updated to the new system.

COURSES_LEGACY_INSTRUCTOR_ROLE_PERMISSIONS = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.legacy_instructor_role_permissions"),
effect="allow",
)

COURSES_LEGACY_STAFF_ROLE_PERMISSIONS = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.legacy_staff_role_permissions"),
effect="allow",
)

COURSES_LEGACY_LIMITED_STAFF_ROLE_PERMISSIONS = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.legacy_limited_staff_role_permissions"),
effect="allow",
)

COURSES_LEGACY_DATA_RESEARCHER_PERMISSIONS = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.legacy_data_researcher_permissions"),
effect="allow",
)

COURSES_LEGACY_BETA_TESTER_PERMISSIONS = PermissionData(
action=ActionData(external_key=f"{COURSES_NAMESPACE}.legacy_beta_tester_permissions"),
effect="allow",
)
126 changes: 125 additions & 1 deletion openedx_authz/constants/roles.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,9 +60,133 @@

# Course Roles and Permissions

COURSE_AUDITOR_PERMISSIONS = [
permissions.COURSES_VIEW_COURSE,
permissions.COURSES_VIEW_COURSE_UPDATES,
permissions.COURSES_VIEW_PAGES_AND_RESOURCES,
permissions.COURSES_VIEW_FILES,
permissions.COURSES_VIEW_GRADING_SETTINGS,
permissions.COURSES_VIEW_CHECKLISTS,
permissions.COURSES_VIEW_COURSE_TEAM,
permissions.COURSES_VIEW_SCHEDULE_AND_DETAILS,
]

COURSE_AUDITOR = RoleData(external_key="course_auditor", permissions=COURSE_AUDITOR_PERMISSIONS)

COURSE_EDITOR_PERMISSIONS = [
permissions.COURSES_VIEW_COURSE,
permissions.COURSES_VIEW_COURSE_UPDATES,
permissions.COURSES_VIEW_PAGES_AND_RESOURCES,
permissions.COURSES_VIEW_FILES,
permissions.COURSES_VIEW_GRADING_SETTINGS,
permissions.COURSES_VIEW_CHECKLISTS,
permissions.COURSES_VIEW_COURSE_TEAM,
permissions.COURSES_VIEW_SCHEDULE_AND_DETAILS,
permissions.COURSES_EDIT_COURSE_CONTENT,
permissions.COURSES_MANAGE_LIBRARY_UPDATES,
permissions.COURSES_MANAGE_COURSE_UPDATES,
permissions.COURSES_MANAGE_PAGES_AND_RESOURCES,
permissions.COURSES_CREATE_FILES,
permissions.COURSES_EDIT_FILES,
permissions.COURSES_EDIT_GRADING_SETTINGS,
permissions.COURSES_MANAGE_GROUP_CONFIGURATIONS,
permissions.COURSES_EDIT_DETAILS,
permissions.COURSES_MANAGE_TAGS,
]

COURSE_EDITOR = RoleData(external_key="course_editor", permissions=COURSE_EDITOR_PERMISSIONS)

COURSE_ADMIN_PERMISSIONS = [
permissions.COURSES_LEGACY_INSTRUCTOR_ROLE_PERMISSIONS,
permissions.COURSES_VIEW_COURSE,
permissions.COURSES_VIEW_COURSE_UPDATES,
permissions.COURSES_VIEW_PAGES_AND_RESOURCES,
permissions.COURSES_VIEW_FILES,
permissions.COURSES_VIEW_GRADING_SETTINGS,
permissions.COURSES_VIEW_CHECKLISTS,
permissions.COURSES_VIEW_COURSE_TEAM,
permissions.COURSES_VIEW_SCHEDULE_AND_DETAILS,
permissions.COURSES_EDIT_COURSE_CONTENT,
permissions.COURSES_MANAGE_LIBRARY_UPDATES,
permissions.COURSES_MANAGE_COURSE_UPDATES,
permissions.COURSES_MANAGE_PAGES_AND_RESOURCES,
permissions.COURSES_CREATE_FILES,
permissions.COURSES_EDIT_FILES,
permissions.COURSES_EDIT_GRADING_SETTINGS,
permissions.COURSES_MANAGE_GROUP_CONFIGURATIONS,
permissions.COURSES_EDIT_DETAILS,
permissions.COURSES_MANAGE_TAGS,
permissions.COURSES_PUBLISH_COURSE_CONTENT,
permissions.COURSES_DELETE_FILES,
permissions.COURSES_EDIT_SCHEDULE,
permissions.COURSES_MANAGE_ADVANCED_SETTINGS,
permissions.COURSES_MANAGE_CERTIFICATES,
permissions.COURSES_IMPORT_COURSE,
permissions.COURSES_EXPORT_COURSE,
permissions.COURSES_EXPORT_TAGS,
permissions.COURSES_MANAGE_COURSE_TEAM,
permissions.COURSES_MANAGE_TAXONOMIES,
]

COURSE_ADMIN = RoleData(external_key="course_admin", permissions=COURSE_ADMIN_PERMISSIONS)

COURSE_STAFF_PERMISSIONS = [
permissions.MANAGE_ADVANCED_SETTINGS,
permissions.COURSES_LEGACY_STAFF_ROLE_PERMISSIONS,
permissions.COURSES_VIEW_COURSE,
permissions.COURSES_VIEW_COURSE_UPDATES,
permissions.COURSES_VIEW_PAGES_AND_RESOURCES,
permissions.COURSES_VIEW_FILES,
permissions.COURSES_VIEW_GRADING_SETTINGS,
permissions.COURSES_VIEW_CHECKLISTS,
permissions.COURSES_VIEW_COURSE_TEAM,
permissions.COURSES_VIEW_SCHEDULE_AND_DETAILS,
permissions.COURSES_EDIT_COURSE_CONTENT,
permissions.COURSES_MANAGE_LIBRARY_UPDATES,
permissions.COURSES_MANAGE_COURSE_UPDATES,
permissions.COURSES_MANAGE_PAGES_AND_RESOURCES,
permissions.COURSES_CREATE_FILES,
permissions.COURSES_EDIT_FILES,
permissions.COURSES_EDIT_GRADING_SETTINGS,
permissions.COURSES_MANAGE_GROUP_CONFIGURATIONS,
permissions.COURSES_EDIT_DETAILS,
permissions.COURSES_MANAGE_TAGS,
permissions.COURSES_PUBLISH_COURSE_CONTENT,
permissions.COURSES_DELETE_FILES,
permissions.COURSES_EDIT_SCHEDULE,
permissions.COURSES_MANAGE_ADVANCED_SETTINGS,
permissions.COURSES_MANAGE_CERTIFICATES,
permissions.COURSES_IMPORT_COURSE,
permissions.COURSES_EXPORT_COURSE,
permissions.COURSES_EXPORT_TAGS,
]

COURSE_STAFF = RoleData(external_key="course_staff", permissions=COURSE_STAFF_PERMISSIONS)

COURSE_LIMITED_STAFF_PERMISSIONS = [
permissions.COURSES_LEGACY_LIMITED_STAFF_ROLE_PERMISSIONS,
]

COURSE_LIMITED_STAFF = RoleData(external_key="course_limited_staff", permissions=COURSE_LIMITED_STAFF_PERMISSIONS)

COURSE_DATA_RESEARCHER_PERMISSIONS = [
permissions.COURSES_LEGACY_DATA_RESEARCHER_PERMISSIONS,
]

COURSE_DATA_RESEARCHER = RoleData(external_key="course_data_researcher", permissions=COURSE_DATA_RESEARCHER_PERMISSIONS)

COURSE_BETA_TESTER_PERMISSIONS = [
permissions.COURSES_LEGACY_BETA_TESTER_PERMISSIONS,
]

COURSE_BETA_TESTER = RoleData(external_key="course_beta_tester", permissions=COURSE_BETA_TESTER_PERMISSIONS)

# Map of legacy course role names to their equivalent new roles
# This mapping must be unique in both directions, since it may be used as a reverse lookup (value → key).
# If multiple keys share the same value, it will lead to collisions.
LEGACY_COURSE_ROLE_EQUIVALENCES = {
Copy link
Contributor

@dwong2708 dwong2708 Feb 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it possible to reverse the mapping order?

For example:

{
    COURSE_ADMIN.external_key: "instructor",
    ...
}

Reason: while working on the migration, during rollback (authz → legacy), I only have access to new_role.key, so I need a way to map it back to the corresponding legacy role.

Copy link
Contributor Author

@rodmgwgu rodmgwgu Feb 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is how I'm doing it in openedx-platform: https://github.com/WGU-Open-edX/openedx-platform/blob/5dc65a27a4cfc9f8045ab71fca19965f7127f488/common/djangoapps/student/roles.py#L39

I also need it both ways there, I did it that way to avoid having to maintain two maps, what do you think?

Copy link
Contributor

@dwong2708 dwong2708 Feb 19, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sounds good, just one consideration.

If we have a mapping like:

{
    "instructor": "admin",
    "staff": "admin",
}

get_legacy_role_from_authz_role would just pick the first match. Not sure if this case is expected, but maybe we should add a comment here or in the function to clarify the behavior.

Copy link
Contributor Author

@rodmgwgu rodmgwgu Feb 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

mmm where do you see that? instructor is "admin" but staff should be "staff" as documented here: https://github.com/rodmgwgu/openedx-authz/blob/385e76d4e95381bb6533df5272ecff6593e09156/docs/decisions/0011-course-authoring-migration-process.rst (Role Mapping table)

Copy link
Contributor

@dwong2708 dwong2708 Feb 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The mapping above is just an example in case this situation occurs. What I’m trying to highlight is that if an authz role maps to multiple legacy roles, get_legacy_role_from_authz_role will pick the first one. For this reason, a comment like the following could help prevent unexpected results:

"This mapping must be unique in both directions, since it may be used as a reverse lookup (value → key). If multiple keys share the same value, it will lead to collisions."

Copy link
Contributor Author

@rodmgwgu rodmgwgu Feb 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh ok, I'll add that comment, thanks!

Copy link
Contributor Author

@rodmgwgu rodmgwgu Feb 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done, comment added, thanks!

"instructor": COURSE_ADMIN.external_key,
"staff": COURSE_STAFF.external_key,
"limited_staff": COURSE_LIMITED_STAFF.external_key,
"data_researcher": COURSE_DATA_RESEARCHER.external_key,
"beta_testers": COURSE_BETA_TESTER.external_key,
}
Loading