feat: use authz permission checks for tagging in course authoring by wgu-taylor-payne · Pull Request #38416 · openedx/openedx-platform

wgu-taylor-payne · 2026-04-22T23:53:11Z

Description

Use authz permission checks for tagging in course authoring when the AUTHZ_COURSE_AUTHORING_FLAG flag is enabled.

Companion openedx-core PR: openedx/openedx-core#550.

Supporting information

Closes #38143.
Adjacent investigation into legacy permissions around tagging: #38222
Permission list: https://openedx.atlassian.net/wiki/spaces/OEPM/pages/5528715266/openedx-authz+permission+list

Testing instructions

Automated tests

pytest --ds=cms.envs.test \
openedx/core/djangoapps/content_tagging/rest_api/v1/tests/test_views.py::TestObjectTagOrgViewWithAuthz \
cms/djangoapps/contentstore/views/tests/test_block.py::TestXBlockOutlineHandlerAuthz

Manual tests

Enable the authz.enable_course_authoring flag.
Navigate to the course outline or block editor for a course where the flag is enabled.
Global staff/superusers: can view outline, add/remove tags, see edit/delete controls on tags.
Course staff role: can view outline, add/remove tags, see edit/delete controls on tags. Cannot tag other courses they don't have the role on.
Course auditor role: can view outline and see existing tags (read-only). Cannot add/remove tags (403).

Deadline

Verawood

Other information

GitHub Copilot with Claude Sonnet 4 was used to aid development.

openedx-webhooks · 2026-04-22T23:53:17Z

Thanks for the pull request, @wgu-taylor-payne!

This repository is currently maintained by @openedx/wg-maintenance-openedx-platform.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
- This process (including the steps you'll need to take) is documented here.
If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

Dependencies

This PR must be merged before / after / at the same time as ...
Blockers

This PR is waiting for OEP-1234 to be accepted.
Timeline information

This PR must be merged by XX date because ...
Partner information

This is for a course on edx.org.
Supporting documentation
Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

🔘 Update the status of your PR

Your PR is currently marked as a draft. After completing the steps above, update its status by clicking "Ready for Review", or removing "WIP" from the title, as appropriate.

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

The size and impact of the changes that it introduces
The need for product review
Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

.

Renames the openedx_django_lib.fields import in EntityLinkBase from the removed key_field helper to ref_field. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…0.43.0 Updates callers of get_learning_package_by_key (renamed to get_learning_package_by_ref), create_learning_package, and update_learning_package to use the new package_ref kwarg, and switches .key attribute reads to .package_ref. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

… 0.43.0 Switches callers of get_publishable_entity_by_key (now _by_ref) to the new name, and renames .key attribute reads on PublishableEntity, Component, and Container (via PublishableEntityMixin) to .entity_ref. Query filters using key__in/entity__key become entity_ref__in/ entity__entity_ref. The set_library_item_collections param entity_key is renamed to entity_ref for consistency. Collection.key reads are intentionally left for the collection_code rename in a later commit. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…re 0.43.0 Updates callers of get_component_by_key/component_exists_by_key (now _by_code) and switches the local_key kwarg on create_component, create_component_and_version, and related queries to component_code. Also renames component.local_key reads to component.component_code and adjusts a modulestore_migrator container query that filtered on publishable_entity__key (now entity_ref). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…edx-core 0.43.0 Switches get_container_by_key to get_container_by_code and renames the container creation kwarg from key to container_code for both create_container_and_version and its platform wrapper. Updates ComponentVersionMedia accesses: the model field .key becomes .path, and create_component_version_media's key kwarg becomes path. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…-core 0.43.0 Renames all Collection APIs that took key/collection_key to use collection_code: create_collection, update_collection, delete_collection, restore_collection, add_to_collection, etc. Switches Collection.key attribute reads to .collection_code across tests, signal handlers, search indexers, and modulestore_migrator. Filters like target_collection__key become target_collection__collection_code. Also updates the library restore serializer to track the renamed lp_restored_data fields: archive_org_key -> archive_org_code, archive_slug -> archive_package_code, key -> package_ref, archive_lp_key -> archive_package_ref. The archive_org_code and archive_package_code fields now allow None, since openedx-core no longer raises ValueError when the archive_package_ref cannot be parsed as {prefix}:{org_code}:{package_code}. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fix: build locator with container_code fix: pylint and mypy fix: queries for search index fix: some missed cvm.key -> cvm.path fix: undo breaking library changes fix: openedx-core no longer raises integrityerror on conflict fix: misses in modulestore_migrator fix: search tests docs: Improve collection_code/key TODO comment

This is necessary because we are no longer presuming that package_ref follows the same format as a Content Library. In the future, we may want a more graceful way of handling this.

wgu-taylor-payne requested review from feanil and kdmccormick as code owners April 22, 2026 23:53

openedx-webhooks added open-source-contribution PR author is not from Axim or 2U core contributor PR author is a Core Contributor (who may or may not have write access to this repo). labels Apr 22, 2026

openedx-webhooks added this to Contributions Apr 22, 2026

github-project-automation Bot moved this to Needs Triage in Contributions Apr 22, 2026

wgu-taylor-payne marked this pull request as draft April 22, 2026 23:55

wgu-taylor-payne force-pushed the tpayne/authz-tagging branch from ef6373b to c4fe6db Compare April 23, 2026 17:10

wgu-taylor-payne changed the base branch from master to kdmccormick/keys April 23, 2026 17:15

wgu-taylor-payne force-pushed the tpayne/authz-tagging branch from c4fe6db to 2252cc5 Compare April 23, 2026 17:30

kdmccormick force-pushed the kdmccormick/keys branch from bb5cc86 to cd39b2d Compare April 23, 2026 18:36

kdmccormick and others added 11 commits April 23, 2026 15:23

fix: Allow --reset or --init on reindex_studio as no-ops

6049f99

temp: fail fast false

009c3c6

build: Upgrade openedx-core pin, 0.39.2 -> 0.44.0

73a7936

.

refactor: Rename key_field to ref_field for openedx-core 0.43.0

57ef381

Renames the openedx_django_lib.fields import in EntityLinkBase from the removed key_field helper to ref_field. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fix: Return 'unknown/unknown' for un-parseable org/lib archive slugs

e41a0a2

This is necessary because we are no longer presuming that package_ref follows the same format as a Content Library. In the future, we may want a more graceful way of handling this.

kdmccormick force-pushed the kdmccormick/keys branch from cd39b2d to e41a0a2 Compare April 23, 2026 19:28

wgu-taylor-payne added 6 commits April 23, 2026 13:33

feat: check authz permission on xblock outline

bdbff72

feat: check authz permissions for course tagging

7e0f991

temp: point to openedx-core branch for CI

20587dd

fixup! feat: check authz permissions for course tagging

67065ed

fixup! temp: point to openedx-core branch for CI

988e3e6

fixup! feat: check authz permissions for course tagging

8269e38

wgu-taylor-payne force-pushed the tpayne/authz-tagging branch from e2cbbfa to 8269e38 Compare April 23, 2026 19:58

kdmccormick force-pushed the kdmccormick/keys branch 3 times, most recently from bf0ac23 to 85fbbdd Compare April 23, 2026 21:18

kdmccormick deleted the branch openedx:kdmccormick/keys April 23, 2026 21:44

kdmccormick closed this Apr 23, 2026

github-project-automation Bot moved this from Needs Triage to Done in Contributions Apr 23, 2026

wgu-taylor-payne mentioned this pull request Apr 23, 2026

feat: use authz permission checks for tagging in course authoring #38436

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: use authz permission checks for tagging in course authoring#38416

feat: use authz permission checks for tagging in course authoring#38416
wgu-taylor-payne wants to merge 17 commits intoopenedx:kdmccormick/keysfrom
WGU-Open-edX:tpayne/authz-tagging

wgu-taylor-payne commented Apr 22, 2026

Uh oh!

openedx-webhooks commented Apr 22, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

wgu-taylor-payne commented Apr 22, 2026

Description

Supporting information

Testing instructions

Automated tests

Manual tests

Deadline

Other information

Uh oh!

openedx-webhooks commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

openedx-webhooks commented Apr 22, 2026 •

edited

Loading