feat: Implement courses roles and permissions mappings by rodmgwgu · Pull Request #217 · openedx/openedx-authz

rodmgwgu · 2026-02-16T16:02:15Z

Implemented courses roles and permissions mappings, including legacy compatible permissions and role equivalences.

Permissions implemented as specified here: https://openedx.atlassian.net/wiki/spaces/OEPM/pages/5528715266/openedx-authz+permission+list

Roles implemented as specified here: https://openedx.atlassian.net/wiki/spaces/OEPM/pages/5638619138/Authoring+Roles+and+Permissions

Equivalent legacy roles implemented as specified here: https://github.com/rodmgwgu/openedx-authz/blob/385e76d4e95381bb6533df5272ecff6593e09156/docs/decisions/0011-course-authoring-migration-process.rst

Closes: #189

Required for: openedx/openedx-platform#38013

Merge checklist:
Check off if complete or not applicable:

Version bumped
Changelog record added
Documentation updated (not only docstrings)
Fixup commits are squashed away
Unit tests added/updated
Manual testing instructions provided
Noted any: Concerns, dependencies, migration issues, deadlines, tickets

openedx-webhooks · 2026-02-16T16:02:20Z

Thanks for the pull request, @rodmgwgu!

This repository is currently maintained by @openedx/committers-openedx-authz.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
- This process (including the steps you'll need to take) is documented here.
If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

Dependencies

This PR must be merged before / after / at the same time as ...
Blockers

This PR is waiting for OEP-1234 to be accepted.
Timeline information

This PR must be merged by XX date because ...
Partner information

This is for a course on edx.org.
Supporting documentation
Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

Details

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

The size and impact of the changes that it introduces
The need for product review
Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

wgu-taylor-payne

This looks good. Just one comment regarding the version number.

openedx_authz/__init__.py

dwong2708

LGTM, just one suggestion in the legacy roles mapping.

dwong2708 · 2026-02-19T16:12:57Z

openedx_authz/constants/roles.py

+COURSE_BETA_TESTER = RoleData(external_key="course_beta_tester", permissions=COURSE_BETA_TESTER_PERMISSIONS)
+
+# Map of legacy course role names to their equivalent new roles
+LEGACY_COURSE_ROLE_EQUIVALENCES = {


Is it possible to reverse the mapping order?

For example:

{ COURSE_ADMIN.external_key: "instructor", ... }

Reason: while working on the migration, during rollback (authz → legacy), I only have access to new_role.key, so I need a way to map it back to the corresponding legacy role.

This is how I'm doing it in openedx-platform: https://github.com/WGU-Open-edX/openedx-platform/blob/5dc65a27a4cfc9f8045ab71fca19965f7127f488/common/djangoapps/student/roles.py#L39

I also need it both ways there, I did it that way to avoid having to maintain two maps, what do you think?

Sounds good, just one consideration.

If we have a mapping like:

{ "instructor": "admin", "staff": "admin", }

get_legacy_role_from_authz_role would just pick the first match. Not sure if this case is expected, but maybe we should add a comment here or in the function to clarify the behavior.

mmm where do you see that? instructor is "admin" but staff should be "staff" as documented here: https://github.com/rodmgwgu/openedx-authz/blob/385e76d4e95381bb6533df5272ecff6593e09156/docs/decisions/0011-course-authoring-migration-process.rst (Role Mapping table)

The mapping above is just an example in case this situation occurs. What I’m trying to highlight is that if an authz role maps to multiple legacy roles, get_legacy_role_from_authz_role will pick the first one. For this reason, a comment like the following could help prevent unexpected results:

"This mapping must be unique in both directions, since it may be used as a reverse lookup (value → key). If multiple keys share the same value, it will lead to collisions."

oh ok, I'll add that comment, thanks!

done, comment added, thanks!

openedx_authz/constants/permissions.py

wgu-taylor-payne · 2026-02-19T17:03:22Z

openedx_authz/constants/permissions.py

+    effect="allow",
+)
+
+EDIT_DETAILS = PermissionData(


Something else came to mind. I think that some of these constant names could be more descriptive. Since we have library related permissions, course permissions, and in the future other permissions in this file, it would be good to rename some of these like EDIT_DETAILS, VIEW_FILES, etc. to show somehow that they are course related. Another option would be to scope the various permission namespaces to their own modules (e.g. course_permissions.py, library_permissions.py).

+1 on more descriptive constant names. I think the long term plan is still to move these to plugin-style implementations closer to the code that uses them once we have that functionality in place so I'm a little less worried about getting them in the right place in this repo right now.

I'm adding the "COURSES_" prefix to all course-related permissions, I won't change Library permissions to avoid breaking stuff.

bmtcril

I think this is good to go once the remaining feedback is addressed. Approving now so I'm not blocking while I'm out.

…acy compat permissions

openedx-webhooks added open-source-contribution PR author is not from Axim or 2U core contributor PR author is a Core Contributor (who may or may not have write access to this repo). labels Feb 16, 2026

openedx-webhooks added this to Contributions Feb 16, 2026

github-project-automation bot moved this to Needs Triage in Contributions Feb 16, 2026

mphilbrick211 moved this from Needs Triage to Waiting on Author in Contributions Feb 18, 2026

mphilbrick211 added the mao-onboarding Reviewing this will help onboard devs from an Axim mission-aligned organization (MAO). label Feb 18, 2026

rodmgwgu marked this pull request as ready for review February 18, 2026 23:01

rodmgwgu mentioned this pull request Feb 18, 2026

feat: AuthZ for course authoring compatibility layer openedx/openedx-platform#38013

Open

wgu-taylor-payne reviewed Feb 19, 2026

View reviewed changes

openedx_authz/__init__.py Outdated Show resolved Hide resolved

rodmgwgu requested review from dwong2708 and wgu-taylor-payne February 19, 2026 15:31

wgu-taylor-payne approved these changes Feb 19, 2026

View reviewed changes

rodmgwgu requested a review from bmtcril February 19, 2026 15:48

dwong2708 suggested changes Feb 19, 2026

View reviewed changes

dwong2708 reviewed Feb 19, 2026

View reviewed changes

openedx_authz/constants/permissions.py Outdated Show resolved Hide resolved

wgu-taylor-payne reviewed Feb 19, 2026

View reviewed changes

bmtcril approved these changes Feb 19, 2026

View reviewed changes

feat: Implement courses roles and permissions mappings, including leg…

fb491c3

…acy compat permissions

rodmgwgu force-pushed the rod/compat-layer branch from 16e67e8 to fb491c3 Compare February 19, 2026 17:36

dwong2708 approved these changes Feb 19, 2026

View reviewed changes

rodmgwgu merged commit f284f1c into openedx:main Feb 19, 2026
14 checks passed

github-project-automation bot moved this from Waiting on Author to Done in Contributions Feb 19, 2026

Comments

Conversation

rodmgwgu commented Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openedx-webhooks commented Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wgu-taylor-payne left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

dwong2708 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dwong2708 Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bmtcril left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

rodmgwgu commented Feb 16, 2026 •

edited

Loading

openedx-webhooks commented Feb 16, 2026 •

edited

Loading

dwong2708 Feb 19, 2026 •

edited

Loading