Skip to content

feat: support organization-level scopes for course list [authz]#38307

Merged
bmtcril merged 2 commits intoopenedx:masterfrom
eduNEXT:mfmz/org-for-course-list
Apr 10, 2026
Merged

feat: support organization-level scopes for course list [authz]#38307
bmtcril merged 2 commits intoopenedx:masterfrom
eduNEXT:mfmz/org-for-course-list

Conversation

@MaferMazu
Copy link
Copy Markdown
Contributor

@MaferMazu MaferMazu commented Apr 8, 2026 •
edited
Loading

Description

This change addresses openedx/openedx-authz#243 by enabling the retrieval of course listings based on organization-level permissions for authz.

Previously, users with course roles via authz were limited to viewing only explicitly assigned courses in the CMS, as organization scopes were not considered during the lookup.

With this update, users with organization-wide permissions will now correctly see all courses in their organization in their course listing.

Supporting information

Resolves: openedx/openedx-authz#243

Testing instructions

The tests added are only unit tests. If you want to check an end-to-end test, follow the following instructions:

Requirements:

  • Have an environment with this code.
  • Add the flag "authz.enable_course_authoring" in the Django Admin (/admin/waffle/flag/) (Set Everyone: Yes)
  • Create a new user without special permissions.
  • Assigns the user a course role with org-level scope.
    • For example, I create a registry in the Django Admin Casbin table like this: g user^student1 role^course_staff course-v1^course-v1:openedx+* (in this case, the org is openedx)

Test:

Deadline

Verawood

@openedx-webhooks openedx-webhooks added the open-source-contribution PR author is not from Axim or 2U label Apr 8, 2026
@openedx-webhooks
Copy link
Copy Markdown

openedx-webhooks commented Apr 8, 2026 •
edited
Loading

Thanks for the pull request, @MaferMazu!

This repository is currently maintained by @openedx/wg-maintenance-openedx-platform.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

  • If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
    • This process (including the steps you'll need to take) is documented here.
  • If it doesn't, simply proceed with the next step.
🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

  • Dependencies

    This PR must be merged before / after / at the same time as ...

  • Blockers

    This PR is waiting for OEP-1234 to be accepted.

  • Timeline information

    This PR must be merged by XX date because ...

  • Partner information

    This is for a course on edx.org.

  • Supporting documentation
  • Relevant Open edX discussion forum threads
🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

Details
Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

  • The size and impact of the changes that it introduces
  • The need for product review
  • Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

@github-project-automation github-project-automation bot moved this to Needs Triage in Contributions Apr 8, 2026
@MaferMazu MaferMazu force-pushed the mfmz/org-for-course-list branch from 13d2947 to 646964b Compare April 8, 2026 18:56
@MaferMazu MaferMazu marked this pull request as ready for review April 8, 2026 19:28
@MaferMazu MaferMazu changed the title fix: add org scope in course list authz feat: support organization-level scopes for course list Apr 8, 2026
@MaferMazu MaferMazu force-pushed the mfmz/org-for-course-list branch from 646964b to 9640095 Compare April 8, 2026 19:34
@MaferMazu MaferMazu mentioned this pull request Apr 8, 2026
Closed
@MaferMazu MaferMazu changed the title feat: support organization-level scopes for course list feat: support organization-level scopes for course list [authz] Apr 8, 2026
dwong2708
dwong2708 suggested changes Apr 8, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@dwong2708 dwong2708 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good overall! Just a couple of comments, thanks.

@rodmgwgu rodmgwgu requested a review from Copilot April 8, 2026 21:35
Copilot AI reviewed Apr 8, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds organization-level AuthZ scope handling to Studio’s course listing so users with org-wide permissions can see all courses in their org (addressing openedx-authz#243), rather than only explicitly-scoped courses.

Changes:

  • Extend _get_authz_accessible_courses_list to expand OrgCourseOverviewGlobData scopes into course keys for the org and apply the per-course authoring toggle.
  • Add unit tests covering org-scope inclusion and toggle filtering behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
cms/djangoapps/contentstore/views/course.py Expands AuthZ course listing to include org-scoped permissions by querying org courses and filtering by the waffle flag.
cms/djangoapps/contentstore/tests/test_course_listing.py Adds tests for org-scope behavior and toggle-respecting filtering.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

rodmgwgu
rodmgwgu reviewed Apr 8, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@rodmgwgu rodmgwgu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking good overall, just some comments. Thanks!

mariajgrimaldi
mariajgrimaldi reviewed Apr 9, 2026
View reviewed changes
@MaferMazu MaferMazu force-pushed the mfmz/org-for-course-list branch from 150bc33 to f63e9a1 Compare April 9, 2026 16:06
@dwong2708
Copy link
Copy Markdown
Contributor

dwong2708 commented Apr 9, 2026

@MaferMazu just a minor comment, could you add something like the following to the PR description?

Resolves: openedx/openedx-authz#243

This helps link the task to the PR. I noticed you already included the link, but keywords like “Resolves” or “Closes” are needed for it to work properly.

@MaferMazu MaferMazu force-pushed the mfmz/org-for-course-list branch 2 times, most recently from ef0960e to c40dc9d Compare April 9, 2026 18:59
@MaferMazu MaferMazu mentioned this pull request Apr 9, 2026
Open
@MaferMazu
feat: support organization-level scopes for course list
ea0765d 
fix: apply feedback related to test and types

refactor: abstract process in _get_course_keys_from_scopes
@MaferMazu MaferMazu force-pushed the mfmz/org-for-course-list branch from c40dc9d to ea0765d Compare April 9, 2026 20:01
@MaferMazu
test: suppress PT009 for unittest-style assertions
72671af 
Add noqa comments to suppress PT009 linting warnings for unittest-style
assertions (assertEqual, assertTrue, etc.) which are appropriate for tests
inheriting from unittest.TestCase/ModuleStoreTestCase.
@mphilbrick211 mphilbrick211 moved this from Needs Triage to In Eng Review in Contributions Apr 9, 2026
@MaferMazu
Copy link
Copy Markdown
Contributor Author

MaferMazu commented Apr 10, 2026

This is ready for re-review @mariajgrimaldi @dwong2708 @rodmgwgu 🙌

rodmgwgu
rodmgwgu approved these changes Apr 10, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@rodmgwgu rodmgwgu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested in my local and works as described, thanks!

dwong2708
dwong2708 approved these changes Apr 10, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@dwong2708 dwong2708 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! Thanks.

bmtcril
bmtcril approved these changes Apr 10, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@bmtcril bmtcril left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks!

@bmtcril bmtcril merged commit 3bf7968 into openedx:master Apr 10, 2026
52 of 69 checks passed
@github-project-automation github-project-automation bot moved this from In Eng Review to Done in Contributions Apr 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mariajgrimaldi mariajgrimaldi mariajgrimaldi left review comments

Copilot code review Copilot Copilot left review comments

@bmtcril bmtcril bmtcril approved these changes

@wgu-taylor-payne wgu-taylor-payne Awaiting requested review from wgu-taylor-payne

+2 more reviewers

@rodmgwgu rodmgwgu rodmgwgu approved these changes

@dwong2708 dwong2708 dwong2708 approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

open-source-contribution PR author is not from Axim or 2U

Projects

Contributions
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Task - RBAC AuthZ - Implement Org Scope for Course list

8 participants

@MaferMazu @openedx-webhooks @dwong2708 @mariajgrimaldi @bmtcril @rodmgwgu @mphilbrick211