All interactive enrol/unenrol codepaths mark the context dirty

Manually enrolling and unenrolling self, and other users should
transparently set the context dirty. So walk all callers to
role_assign() and role_unassign() and mark the context dirty
where appropriate.

OTOH, most automated-backend enrol/unenrol mechanisms should not.
The backend lookups that happen when you login are well covered
by the login/enrolment process, and don't need to be marked dirty.

course/unenrol.php

@@ -44,6 +44,9 @@
                 error("An error occurred while trying to unenrol that person.");
             }
 
+            // force accessinfo refresh for users visiting this context...
+            mark_context_dirty($context->path);
+
             add_to_log($course->id, 'course', 'unenrol', "view.php?id=$course->id", $userid);
             redirect($CFG->wwwroot.'/user/index.php?id='.$course->id);
 

lib/accesslib.php

@@ -2734,6 +2734,9 @@ function enrol_into_course($course, $user, $enrol) {
             return false;
         }
 
+        // force accessinfo refresh for users visiting this context...
+        mark_context_dirty($context->path);
+
         email_welcome_message_to_user($course, $user);
 
         add_to_log($course->id, 'course', 'enrol', 'view.php?id='.$course->id, $user->id);

lib/moodlelib.php

@@ -2240,15 +2240,22 @@ function sync_metacourse($course) {
     $success = true;
 
     // Make the unassignments, if they are not managers.
+    $unchanged = true;
     foreach ($unassignments as $unassignment) {
         if (!in_array($unassignment->userid, $managers)) {
             $success = role_unassign($unassignment->roleid, $unassignment->userid, 0, $context->id) && $success;
+            $unchanged = false;
         }
     }
 
     // Make the assignments.
     foreach ($assignments as $assignment) {
         $success = role_assign($assignment->roleid, $assignment->userid, 0, $context->id) && $success;
+        $unchanged = false;
+    }
+    if (!$unchanged) {
+        // force accessinfo refresh for users visiting this context...
+        mark_context_dirty($context->path);
     }
 
     return $success;
@@ -3400,16 +3407,16 @@ function reset_course_userdata($data, $showfeedback=true) {
     }
 
     // Delete other stuff
-    $coursecontext = get_context_instance(CONTEXT_COURSE, $data->courseid);
+    $context = get_context_instance(CONTEXT_COURSE, $data->courseid);
 
     if (!empty($data->reset_students) or !empty($data->reset_teachers)) {
-        $teachers     = array_keys(get_users_by_capability($coursecontext, 'moodle/course:update'));
-        $participants = array_keys(get_users_by_capability($coursecontext, 'moodle/course:view'));
+        $teachers     = array_keys(get_users_by_capability($context, 'moodle/course:update'));
+        $participants = array_keys(get_users_by_capability($context, 'moodle/course:view'));
         $students     = array_diff($participants, $teachers);
 
         if (!empty($data->reset_students)) {
             foreach ($students as $studentid) {
-                role_unassign(0, $studentid, 0, $coursecontext->id);
+                role_unassign(0, $studentid, 0, $context->id);
             }
             if ($showfeedback) {
                 notify($strdeleted .' '.get_string('students'), 'notifysuccess');
@@ -3421,7 +3428,7 @@ function reset_course_userdata($data, $showfeedback=true) {
 
         if (!empty($data->reset_teachers)) {
             foreach ($teachers as $teacherid) {
-                role_unassign(0, $teacherid, 0, $coursecontext->id);
+                role_unassign(0, $teacherid, 0, $context->id);
             }
             if ($showfeedback) {
                 notify($strdeleted .' '.get_string('teachers'), 'notifysuccess');
@@ -3454,10 +3461,13 @@ function reset_course_userdata($data, $showfeedback=true) {
         }
     }
 
-    // deletes all role assignments, and local override, these have no courseid in table and needs separate process
-    $context = get_context_instance(CONTEXT_COURSE, $data->courseid);
+    // deletes all role assignments, and local override,
+    // these have no courseid in table and needs separate process
     delete_records('role_capabilities', 'contextid', $context->id);
 
+    // force accessinfo refresh for users visiting this context...
+    mark_context_dirty($context->path);
+
     return $result;
 }