Add CCX concepts, fix errors around CCX by bmtcril · Pull Request #247 · openedx/openedx-authz

bmtcril · 2026-04-02T14:12:54Z

This PR attempts to address the issues detailed in #235 . There are 4 overlapping sets of problems:

The CCX Coach role was occasionally being queried in RBAC, but didn't exist
CCX course identifiers were being passed into RBAC permission checks (as they are technically courses), but RBAC didn't have a scope for those keys. This will happen with any non-course-v1 course locator, see below.
It was possible to migrate / rollback permissions for CCX courses which would fail to do anything but report success. Migrating or rolling back the permissions on the parent course with --delete could cause the CCX course to be left in a state where there was no CCX Coach to run the course and rollback would not re-grant the role
It was possible to turn on the RBAC course override flag for a CCX course, which actually does nothing since all of the CCX checks are in the LMS

This PR addresses 1 and 2 by adding a CCXCourseOverviewData class and CCX_COACH that grant no permissions, but satisfy the checks for existence. This also allows the ccx_coach role to be migrated / rolled back without error.

It addresses 3 by not allowing CCX courses to be migrated / rolled back using the migration scripts, and by better surfacing those errors.

It does not address 4 as that should happen as part of openedx/openedx-platform#38145 , but in that task it should throw an error if trying to turn on the RBAC flag for any non-course-v1 course until we are ready to support them.

It does not address other non-course-v1 locators. To the best of our (myself, Dave Ormsbee, Kyle McCormick) only know of one other possible case like this- Old Mongo keys. These are largely unsupported (do not work at all in Studio or Courseware, may not even show up on the student dashboard) and, as near as anyone can tell, un-testable.

If this approach looks good I will complete the rest of the merge checklist and update 38145 with details. This branch is tested in openedx-platform here.

Notes on CCX roles and permissions

The CCX Coach role is granted on the parent (course-v1) course, it is "the permission to create a single CCX course and manage it using the CCX Coach dashboard and a subset of the Instructor dashboard"
When the CCX Coach creates a CCX course from the parent course (in the LMS Instructor Dashboard of the parent course), they are automatically granted the legacy staff role on the CCX course as well.
At least 1 (maybe all?) instructors on the parent course are also granted the legacy instructor and staff on the CCX course

Testing

I do not expect anyone to do this, but here is what I did.

Setup

Make sure CCX is enabled on your instance (Add CUSTOM_COURSES_EDX: true to the Tutor patch "common-env-features")
Create course admin user (not staff or superuser)
a. Create through the normal UI
b. Log into studio as the user (will probably error, but creates a needed row in the database)
c. As superuser go to http://studio.local.openedx.io/admin/course_creators/coursecreator/
i. Your new user should show up in the list, mark them as "granted"
ii. Using "All Organizations" didn't work for me, courses wouldn't create, I had to add specific orgs to the user. You may have to create one first by creating a course as a superuser.
d. As superuser go to http://studio.local.openedx.io/admin/auth/user/
i. Click on your new user and mark them as "active" in the Permissions section, then save. !! There is an "is_active" flag under account recovery, that is the wrong one.
Create ccx coach user (not staff or superuser)
a. Create through the normal UI
b. Mark "active" in the Django admin as above

Test

All tests should complete without error.

Create course as the course creator user
a. Add some content / change course start date to a date in the past / publish
b. View in LMS
c. Get into correct configuration
If CCX:
i. As course creator: Studio -> Advanced Settings -> set CCX enabled true
ii. As course creator: Add the coach user to the course - LMS -> Instructor dashboard -> Membership -> Course Team Management -> CCX Coaches role, enter the coach username, add
iii. As coach: LMS -> CCX Coach -> CCX Coach Dashboard -> Enter name, create
iv. Due to an unrelated bug you must force publish the CCX course here before it will work: http://studio.local.openedx.io/admin/contentstore/courseoutlineregenerate/ (check the course box, from the "actions" box select "Regenerate selected course outlines", click "go")
v. Click through all of the CCX Coach Dashboard options, try everything
If RBAC:
i. Turn on the course override waffle flag for the parent and/or CCX course: http://studio.local.openedx.io/admin/waffle_utils/waffleflagcourseoverridemodel/
Update parent course
a. Add / change content
b. Publish
c. View in LMS, content should be up to date
If CCX and RBAC try with the waffle flags on and off for both the parent and CCX course

Merge checklist:
Check off if complete or not applicable:

Version bumped
Changelog record added
Documentation updated (not only docstrings)
Fixup commits are squashed away
Unit tests added/updated
Manual testing instructions provided
Noted any: Concerns, dependencies, migration issues, deadlines, tickets

No permissions are granted for CCX courses, this is just a placeholder to keep these courses from erroring until we get to the LMS side

bmtcril · 2026-04-02T14:17:29Z

Test results

RBAC?	CCX?	Result
❌	❌	✔️
❌	✔️	✔️
✔️	❌	✔️

Tests with both RBAC and CCX enabled:

RBAC enabled first, then CCX enabled ✔️
CCX enabled first, then RBAC enabled ✔️
✳️ RBAC first, migrate without delete, then CCX enabled, then remove RBAC then, rollback without delete ✔️
RBAC first, migrate with delete, then CCX enabled, then remove RBAC, then rollback with delete ✔️

✳️ I had difficulties after running the migrate w/delete command and was forcibly logged out. Once I logged back in things worked as expected.

bmtcril · 2026-04-02T17:00:01Z

Notes

These issues are unrelated to RBAC.

CCX courses have the instructor dash, but...

Cohorts don't have the "Enable cohorts" checkbox so it's just a title with nothing to do
There is no "Extensions" tab (this may be desired behavior)
Gradebook just spins (GET /api/grades/v1/gradebook/ccx-v1:AximU+RBAC104+2026+ccx@5/grading-info?graded_only=true 403's)
- However CCX Coach - Student Admin - View gradebook works
Aspects Reports just spin - this is usually a data issue, the course needs to publish and there needs to be some amount of data to trigger the pipeline to ingest events

The instructor dash MFE conversion team have been made aware of these issues.

Previously if there were any errors, success messages were eaten. Added message to state why no roles may have been migrated (already migrated, bad ids)

rodmgwgu

Thanks for looking into this!, code looks good, just one small comment correction and please update the changelog and version.

openedx_authz/api/data.py

wgu-taylor-payne

Approving — clean approach, just a few typos below.

Review assisted by Kiro.

openedx_authz/api/data.py

openedx_authz/management/commands/authz_migrate_course_authoring.py

openedx_authz/management/commands/authz_rollback_course_authoring.py

mariajgrimaldi

I'll deploy this on our sandbox environment! Thanks a lot

mariajgrimaldi · 2026-04-08T10:19:06Z

openedx_authz/constants/roles.py

+# This is a known LMS-only permission, but doesn't actually grant anything yet.
+#
+# It is intended to be handled in the Willow time frame.
+CCX_COACH_PERMISSIONS = []


Permissions should be specified here I belive: https://github.com/openedx/openedx-authz/blob/main/openedx_authz/constants/permissions.py

I think that's where we would define the permissions that we would include here, however we aren't migrating any of the CCX permissions right now, they are all in LMS / instructor dash, so this just creates an empty permission set so that we can define the role.

rodmgwgu

Looks good, Thanks!

rodmgwgu · 2026-04-08T18:24:24Z

@mariajgrimaldi @bmtcril did you test this in sandbox? would you be ok with merging this?

bmtcril · 2026-04-08T18:39:03Z

I haven't been able to get into the sandbox to test, @mariajgrimaldi is it down?

feat: Add CCX concepts

aa773f4

No permissions are granted for CCX courses, this is just a placeholder to keep these courses from erroring until we get to the LMS side

bmtcril marked this pull request as draft April 2, 2026 14:13

Tycho Hob added 5 commits April 3, 2026 11:14

style: Fix formatting

39d8a31

refactor: Clarify migration command output

b245375

Previously if there were any errors, success messages were eaten. Added message to state why no roles may have been migrated (already migrated, bad ids)

style: Use a generator for checking valid course key input

ab1329f

test: Pick up coverge changes

f5db108

build: Remove Django 4.2 tests, we no longer support it

4b7f6ff

bmtcril force-pushed the bmtcril/handle_ccx branch from 6cf67cb to 4b7f6ff Compare April 3, 2026 17:29

bmtcril marked this pull request as ready for review April 3, 2026 18:54

bmtcril changed the title ~~DRAFT: Add CCX concepts~~ Add CCX concepts, fix errors around CCX Apr 3, 2026

rodmgwgu requested changes Apr 7, 2026

View reviewed changes

openedx_authz/api/data.py Outdated Show resolved Hide resolved

wgu-taylor-payne approved these changes Apr 7, 2026

View reviewed changes

mariajgrimaldi reviewed Apr 8, 2026

View reviewed changes

Tycho Hob added 2 commits April 8, 2026 09:47

fix: Various typos in output and docstrings

58d4fc4

chore: Bump version, update changelog

0184ddd

rodmgwgu approved these changes Apr 8, 2026

View reviewed changes

bmtcril merged commit 9b3c787 into main Apr 9, 2026
8 checks passed

bmtcril deleted the bmtcril/handle_ccx branch April 9, 2026 12:41

Conversation

bmtcril commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Notes on CCX roles and permissions

Testing

Setup

Test

Uh oh!

bmtcril commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bmtcril commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Notes

Uh oh!

rodmgwgu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

wgu-taylor-payne left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mariajgrimaldi left a comment

Choose a reason for hiding this comment

Uh oh!

mariajgrimaldi Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

bmtcril Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

rodmgwgu left a comment

Choose a reason for hiding this comment

Uh oh!

rodmgwgu commented Apr 8, 2026

Uh oh!

bmtcril commented Apr 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

bmtcril commented Apr 2, 2026 •

edited

Loading

bmtcril commented Apr 2, 2026 •

edited

Loading

bmtcril commented Apr 2, 2026 •

edited

Loading

wgu-taylor-payne left a comment •

edited

Loading