feat: use authz permissions on xblock handler when enabled by wgu-taylor-payne · Pull Request #38179 · openedx/openedx-platform

wgu-taylor-payne · 2026-03-17T00:07:25Z

Description

Use openedx-authz permissions for the /xblock/ endpoint, when the AUTHZ_COURSE_AUTHORING_FLAG is enabled for the given course. The mapping between actions in the CMS and the associated permission is found in this document.

If the AUTHZ_COURSE_AUTHORING_FLAG is disabled then the legacy permission checks will occur.

Supporting information

Closes #37925.

Testing instructions

Run pytest on the new test module cms/djangoapps/contentstore/tests/test_xblock_handler_permissions.py.

To test manually, make sure that the AUTHZ_COURSE_AUTHORING_FLAG is enabled for the course you are testing, and that openedx-platform is using openedx-authz >= 0.22.0. Run manage.py cms load_policies to ensure latest casbin policies have been loaded and then assign course related roles to the users you are testing. Go though the actions outlined in the document linked above and verify that the correct permissions are checked and applied for the given user.

Deadline

Verawood.

openedx-webhooks · 2026-03-17T00:07:33Z

Thanks for the pull request, @wgu-taylor-payne!

This repository is currently maintained by @openedx/wg-maintenance-openedx-platform.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
- This process (including the steps you'll need to take) is documented here.
If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

Dependencies

This PR must be merged before / after / at the same time as ...
Blockers

This PR is waiting for OEP-1234 to be accepted.
Timeline information

This PR must be merged by XX date because ...
Partner information

This is for a course on edx.org.
Supporting documentation
Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

Details

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

The size and impact of the changes that it introduces
The need for product review
Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

rodmgwgu

Tested a couple of use cases in my local and works as expected, looks good, thanks!

bmtcril

Just one optional comment, otherwise looks good to me and works locally 👍

bmtcril · 2026-03-19T16:36:05Z

cms/djangoapps/contentstore/xblock_storage_handlers/view_handlers.py

+        str: The permission identifier (e.g., 'courses.view_course'), or None if authz should be skipped
    """
-    if usage_key_string:
+    # Skip authz for library context


Can you add more context about where enforcement is handled in content libraries here?

Sure, I've added more context.

dwong2708

Looks good! Just one non-blocking suggestion and one question.

When I worked on Instructor Dashboard V2, I noticed that ORA2 (a custom XBlock) internally calls an endpoint via a custom XBlock handler:

http://local.openedx.io:8000/courses/course-v1:WGU+CS002+2025_T1/xblock/block-v1:WGU+CS002+2025_T1+type@openassessment+block@ff4f5fddf42d4b9787e69c1a8cbeb058/handler/get_ora2_responses

This points to cms/djangoapps/contentstore/views/component.py (component_handler).

This made me wonder whether we should also take this endpoint into account.

dwong2708 · 2026-03-19T18:46:55Z

cms/djangoapps/contentstore/xblock_storage_handlers/view_handlers.py

+    elif request.method == "DELETE":
+        if block_type == "static_tab":
+            return COURSES_MANAGE_PAGES_AND_RESOURCES.action.external_key
+        return COURSES_EDIT_COURSE_CONTENT.action.external_key


It would be nice to standardize the use of the identifier. As I’ve seen, in other places the <AUTHZ_PERM>.identifier style is more commonly used and shorter

Thanks, I've changed those.

wgu-taylor-payne · 2026-03-19T19:58:27Z

This made me wonder whether we should also take this endpoint into account.

@dwong2708 I scoped this PR to just the /xblock/ endpoint (specifically the cms.djangoapps.contentstore.views.block.xblock_handler view) based on the GitHub issue and the Spike issue. This endpoint has several different use cases.

As you have brought up, there are other xblock related endpoints that are called in different course related pages/contexts in the CMS, but I was thinking that those would be implemented as part of the existing M1 tasks. So, as we implement our tickets, we just need to be aware that only this specific xblock view has been covered and the others will need to be addressed as we go along. Does that sound right @rodmgwgu? Or should I look at more xblock endpoints here?

Co-authored-by: Kiro <noreply@kiro.dev>

dwong2708 · 2026-03-20T04:02:21Z

This made me wonder whether we should also take this endpoint into account.

@dwong2708 I scoped this PR to just the /xblock/ endpoint (specifically the cms.djangoapps.contentstore.views.block.xblock_handler view) based on the GitHub issue and the Spike issue. This endpoint has several different use cases.

As you have brought up, there are other xblock related endpoints that are called in different course related pages/contexts in the CMS, but I was thinking that those would be implemented as part of the existing M1 tasks. So, as we implement our tickets, we just need to be aware that only this specific xblock view has been covered and the others will need to be addressed as we go along. Does that sound right @rodmgwgu? Or should I look at more xblock endpoints here?

Makes sense. Whether we decide to address the other XBlock endpoints or not, I think scoping this task to the XBlock handler sounds good to me. Thanks.

openedx-webhooks added open-source-contribution PR author is not from Axim or 2U core contributor PR author is a Core Contributor (who may or may not have write access to this repo). labels Mar 17, 2026

openedx-webhooks added this to Contributions Mar 17, 2026

github-project-automation bot moved this to Needs Triage in Contributions Mar 17, 2026

wgu-taylor-payne marked this pull request as draft March 17, 2026 00:07

wgu-taylor-payne force-pushed the tpayne/xblock-authoring-authz branch 4 times, most recently from eb5b8b6 to cfa5592 Compare March 17, 2026 19:44

wgu-taylor-payne marked this pull request as ready for review March 17, 2026 21:06

wgu-taylor-payne requested review from bmtcril, dwong2708 and rodmgwgu March 17, 2026 21:07

rodmgwgu mentioned this pull request Mar 18, 2026

docs: add ADR for standardizing permissions usage #38187

Open

rodmgwgu approved these changes Mar 18, 2026

View reviewed changes

bmtcril approved these changes Mar 19, 2026

View reviewed changes

dwong2708 reviewed Mar 19, 2026

View reviewed changes

feat: use authz permissions on xblock handler when enabled

508e85d

Co-authored-by: Kiro <noreply@kiro.dev>

wgu-taylor-payne force-pushed the tpayne/xblock-authoring-authz branch from cfa5592 to 508e85d Compare March 19, 2026 22:41

wgu-taylor-payne requested review from bmtcril and dwong2708 March 19, 2026 22:51

dwong2708 approved these changes Mar 20, 2026

View reviewed changes

wgu-taylor-payne merged commit 82b5675 into openedx:master Mar 20, 2026
48 checks passed

github-project-automation bot moved this from Needs Triage to Done in Contributions Mar 20, 2026

wgu-taylor-payne mentioned this pull request Mar 20, 2026

feat: use granular permissions on course updates if authz authoring flag set #38198

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: use authz permissions on xblock handler when enabled#38179

feat: use authz permissions on xblock handler when enabled#38179
wgu-taylor-payne merged 1 commit intoopenedx:masterfrom
WGU-Open-edX:tpayne/xblock-authoring-authz

wgu-taylor-payne commented Mar 17, 2026 •

edited

Loading

Uh oh!

openedx-webhooks commented Mar 17, 2026 •

edited

Loading

Uh oh!

rodmgwgu left a comment

Uh oh!

bmtcril left a comment

Uh oh!

bmtcril Mar 19, 2026

Uh oh!

wgu-taylor-payne Mar 19, 2026

Uh oh!

dwong2708 left a comment

Uh oh!

dwong2708 Mar 19, 2026

Uh oh!

wgu-taylor-payne Mar 19, 2026

Uh oh!

wgu-taylor-payne commented Mar 19, 2026 •

edited

Loading

Uh oh!

dwong2708 commented Mar 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

wgu-taylor-payne commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Supporting information

Testing instructions

Deadline

Uh oh!

openedx-webhooks commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rodmgwgu left a comment

Choose a reason for hiding this comment

Uh oh!

bmtcril left a comment

Choose a reason for hiding this comment

Uh oh!

bmtcril Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

wgu-taylor-payne Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

dwong2708 left a comment

Choose a reason for hiding this comment

Uh oh!

dwong2708 Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

wgu-taylor-payne Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

wgu-taylor-payne commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dwong2708 commented Mar 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

wgu-taylor-payne commented Mar 17, 2026 •

edited

Loading

openedx-webhooks commented Mar 17, 2026 •

edited

Loading

wgu-taylor-payne commented Mar 19, 2026 •

edited

Loading