Bug: I need to check if someone has permissions globally using openedx-authz

[MaferMazu]

Description

For the MVP, we need to check if someone has create_library permissions, but the scope of that permission is global.

Details

The following code works, but it is not clear what 'sc:generic' means.

user.has_perm(library_permission) or authz_api.is_user_allowed(
        user,
        lib_permission_in_authz,
        'sc:generic',

Y tried to change it to '*' and I get:
openedx/core/djangoapps/content_libraries/tests/test_content_libraries.py::LibraryRestoreViewTestCase::test_restore_library_unauthorized - ValueError: Invalid external_key format: *

Full log:

ERROR    django.request:log.py:253 Internal Server Error: /api/libraries/v2/restore/
Traceback (most recent call last):
  File "/openedx/venv/lib/python3.11/site-packages/django/core/handlers/exception.py", line 55, in inner
    response = get_response(request)
               ^^^^^^^^^^^^^^^^^^^^^
  File "/openedx/venv/lib/python3.11/site-packages/django/core/handlers/base.py", line 197, in _get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/openedx/venv/lib/python3.11/site-packages/django/views/decorators/csrf.py", line 65, in _view_wrapper
    return view_func(request, *args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/openedx/venv/lib/python3.11/site-packages/django/views/generic/base.py", line 105, in view
    return self.dispatch(request, *args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/openedx/venv/lib/python3.11/site-packages/django/utils/decorators.py", line 48, in _wrapper
    return bound_method(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/openedx/venv/lib/python3.11/site-packages/rest_framework/views.py", line 515, in dispatch
    response = self.handle_exception(exc)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/openedx/venv/lib/python3.11/site-packages/rest_framework/views.py", line 475, in handle_exception
    self.raise_uncaught_exception(exc)
  File "/openedx/venv/lib/python3.11/site-packages/rest_framework/views.py", line 486, in raise_uncaught_exception
    raise exc
  File "/openedx/venv/lib/python3.11/site-packages/rest_framework/views.py", line 512, in dispatch
    response = handler(request, *args, **kwargs)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/openedx/edx-platform/openedx/core/djangoapps/content_libraries/rest_api/libraries.py", line 839, in post
    if not api.user_can_create_library(request.user):
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/openedx/edx-platform/openedx/core/djangoapps/content_libraries/api/libraries.py", line 240, in user_can_create_library
    has_perms = user.has_perm(library_permission) or authz_api.is_user_allowed(
                                                     ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/openedx/venv/lib/python3.11/site-packages/openedx_authz/api/users.py", line 188, in is_user_allowed
    ScopeData(external_key=scope_external_key),
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/openedx/venv/lib/python3.11/site-packages/openedx_authz/api/data.py", line 189, in __call__
    scope_cls = cls.get_subclass_by_external_key(kwargs["external_key"])
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/openedx/venv/lib/python3.11/site-packages/openedx_authz/api/data.py", line 247, in get_subclass_by_external_key
    raise ValueError(f"Invalid external_key format: {external_key}")
ValueError: Invalid external_key format: *

Expected behavior

Have a way to ask for permissions withouth a specific scope or have a way to ask for a scope globally using the api.

• I added the idea of not having the scope, because internally it could mean * for Casbin, and it is okay.

[MaferMazu]

@mariajgrimaldi, I am assigning this to you if you have an idea to fix the issue in a better way, or if there is a way to do this. If not, I can open a PR adding the option to accept None as scope, and internally it'll mean * to casbin.