RBAC M3: Implementing permissions logic #15

Activity

1. gviedma-aulasneo

   added this to RBAC AuthZ Boardon Jul 30, 2025
2. MaferMazu

   converted this from a draft issue on Aug 6, 2025
3. MaferMazu commented on Sep 17, 2025

   

   MaferMazu

   on Sep 17, 2025

   Last edited by MaferMazu

   ContributorAuthor

   More actions

   Policy model (everything explicit)

   # Policies for the 'role:library_admin'
   # All permissions are listed explicitly.
   p, role:library_admin, act:create_library, *, allow
   p, role:library_admin, act:delete_library, *, allow
   p, role:library_admin, act:edit_library, *, allow
   p, role:library_admin, act:publish_library, *, allow
   p, role:library_admin, act:manage_library_tags, *, allow
   p, role:library_admin, act:view_library, *, allow
   p, role:library_admin, act:reuse_library_content, *, allow
   p, role:library_admin, act:manage_library_team, *, allow
   p, role:library_admin, act:view_library_team, *, allow
   p, role:library_admin, act:create_library_collection, *, allow
   p, role:library_admin, act:edit_library_collection, *, allow
   p, role:library_admin, act:delete_library_collection, *, allow
   p, role:library_admin, act:delete_library_content, *, allow
   p, role:library_admin, act:publish_library_content, *, allow
   p, role:library_admin, act:import_library_content, *, allow
   
   # Policies for the 'role:library_author'
   # All permissions are listed explicitly.
   p, role:library_author, act:edit_library, *, allow
   p, role:library_author, act:manage_library_tags, *, allow
   p, role:library_author, act:view_library, *, allow
   p, role:library_author, act:view_library_team, *, allow
   p, role:library_author, act:create_library_collection, *, allow
   p, role:library_author, act:edit_library_collection, *, allow
   p, role:library_author, act:delete_library_collection, *, allow
   p, role:library_author, act:delete_library_content, *, allow
   p, role:library_author, act:publish_library_content, *, allow
   p, role:library_author, act:import_library_content, *, allow
   p, role:library_author, act:reuse_library_content, *, allow
   
   # Policies for the 'role:library_collaborator'
   # All permissions are listed explicitly.
   p, role:library_collaborator, act:edit_library, *, allow
   p, role:library_collaborator, act:delete_library_content, *, allow
   p, role:library_collaborator, act:manage_library_tags, *, allow
   p, role:library_collaborator, act:view_library, *, allow
   p, role:library_collaborator, act:reuse_library_content, *, allow
   p, role:library_collaborator, act:view_library_team, *, allow
   p, role:library_collaborator, act:create_library_collection, *, allow
   p, role:library_collaborator, act:edit_library_collection, *, allow
   p, role:library_collaborator, act:delete_library_collection, *, allow
   p, role:library_collaborator, act:import_library_content, *, allow
   
   # Policies for the 'role:library_user'
   # All permissions are listed explicitly.
   p, role:library_user, act:view_library, *, allow
   p, role:library_user, act:view_library_team, *, allow
   p, role:library_user, act:reuse_library_content, *, allow
   
   # Action Inheritance (g2)
   # g2, <child_action>, <parent_action>
   g2, act:edit_library, act:delete_library
   g2, act:edit_library_content, act:delete_library_content
   g2, act:view_library, act:edit_library
   g2, act:view_library, act:publish_library
   g2, act:view_library_team, act:manage_library_team
   g2, act:view_library_tags, act:manage_library_tags
   g2, act:edit_library_collection, act:delete_library_collection
   g2, act:view_library_collection, act:edit_library_collection
   
   
   

   Reference:

   • https://openedx.atlassian.net/wiki/spaces/OEPM/pages/4840095745/Library+Roles+and+Permissions
   • https://www.figma.com/design/q3Knq0BKoVTBbtaxb81n9R/RBAC---Console---Wireframes?node-id=2713-1647&p=f&t=A79I695wrR9cN9H3-0
   • [FC-0099] feat: add casbin model configuration (CONF) #49
4. MaferMazu commented on Sep 17, 2025

   

   MaferMazu

   on Sep 17, 2025

   ContributorAuthor

   More actions

   # Policies for the 'role:library_admin'
   # This role has full admin powers and inherits all other roles.
   p, role:library_admin, act:delete_library, *, allow
   p, role:library_admin, act:publish_library, *, allow
   p, role:library_admin, act:manage_library_team, *, allow
   p, role:library_admin, act:manage_library_tags, *, allow
   p, role:library_admin, act:delete_library_content, *, allow
   p, role:library_admin, act:publish_library_content, *, allow
   p, role:library_admin, act:delete_library_collection, *, allow
   p, role:library_admin, act:create_library, *, allow
   p, role:library_admin, act:create_library_collection, *, allow
   
   # Policies for the 'role:library_author'
   # This role inherits from 'user' and 'collaborator' and has its unique permissions.
   p, role:library_author, act:delete_library_content, *, allow
   p, role:library_author, act:publish_library_content, *, allow
   p, role:library_author, act:edit_library, *, allow
   p, role:library_author, act:manage_library_tags, *, allow
   p, role:library_author, act:create_library_collection, *, allow
   p, role:library_author, act:edit_library_collection, *, allow
   p, role:library_author, act:delete_library_collection, *, allow
   
   # Policies for the 'role:library_collaborator'
   # This role has permissions for editing and collections.
   p, role:library_collaborator, act:edit_library, *, allow
   p, role:library_collaborator, act:delete_library_content, *, allow
   p, role:library_collaborator, act:manage_library_tags, *, allow
   p, role:library_collaborator, act:create_library_collection, *, allow
   p, role:library_collaborator, act:edit_library_collection, *, allow
   p, role:library_collaborator, act:delete_library_collection, *, allow
   
   # Policies for the 'role:library_user'
   # This role has only basic permissions.
   p, role:library_user, act:view_library, *, allow
   p, role:library_user, act:view_library_team, *, allow
   p, role:library_user, act:reuse_library_content, *, allow
   
   
   # Role-to-Role and User-to-Role Mapping (g)
   # This is a new, simplified hierarchy.
   # admin > author > collaborator > user
   g, role:library_author, role:library_collaborator, *
   g, role:library_collaborator, role:library_user, *
   g, role:library_admin, role:library_author, *
   
   # Action Inheritance (g2)
   # The logical inheritance is now more complete.
   g2, act:edit_library, act:delete_library
   g2, act:view_library, act:edit_library
   g2, act:edit_library, act:create_library
   g2, act:view_library, act:publish_library
   g2, act:view_library_team, act:manage_library_team
   g2, act:view_library_tags, act:manage_library_tags
   g2, act:edit_library_collection, act:delete_library_collection
   g2, act:view_library_collection, act:edit_library_collection
   g2, act:edit_library_collection, act:create_library_collection
   g2, act:view_library_content, act:edit_library_content
   g2, act:edit_library_content, act:delete_library_content
   g2, act:view_library_content, act:publish_library_content
   g2, act:view_library_content, act:reuse_library_content
   

   With inheritance @BryanttV
5. MaferMazu

   added sub-issues on Sep 22, 2025

   • Libraries MVP Roles and Permissions Investigation and Model Validation #62
   • Default policies and configuration #63
6. mariajgrimaldi

   removed a sub-issue on Sep 30, 2025

   • Default policies and configuration #63
7. MaferMazu

   added sub-issues on Oct 1, 2025

   • Follow up the DEPR ticket #79
   • Default policy #80
8. MaferMazu commented on Oct 2, 2025

   

   MaferMazu

   on Oct 2, 2025

   Last edited by MaferMazu

   ContributorAuthor

   More actions

   Update things to do:

   Reasoning: the console, for the mvp, only manage the endpoints regarding library team, so all the endpoints that aren't related to teams needs to be changed, to use the current authz system.

   Strategy: We are not revoking the current access; only adding a new check for permission. This will ensure that something like 'has an explicit permission in the new system' or 'you have access for the previous system' is met.

   • Check and update the authz.policy [FC-0099] feat: add public API to interact with roles and permissions #75 (make sure we are taking into account the roles and permissions from the doc.
   • Add openedx_authz as a requirement in edx-platform.
   • Modify the rest_api/containers.py to add the lines related to content edition to the openedx_authz.api.permissions.has_permission to edit_library.
     • Add openedx_authz.api.permissions.has_permission for view_libraries
   • Modify rest_api/blocks - similar to containers, add the new check for views and edit using the new api methods (openedx_authz.api.permissions.has_permission)
     • Add in the libraryblockpublishview the edit to publish_library_content.
   • Modify the rest_api/collections to add our enforcer and using the new schema (not edit_library but create_collections, edit_collections, delete_collections)
   • Mosify the rest_api/serializers: when checkin can_edit, use and or to add our authz backend enforcer: openedx_authz.api.permissions.has_permission
   • Modify content_libraries/library_context to also check our enforcement (using: edit_library, view_library) - We should't touch permissions.CAN_LEARN_FROM_THIS_CONTENT_LIBRARY because in the new system, we are not longer checking that.
   • Modify rest_api/libraries
     • permissions.CAN_DELETE_THIS_CONTENT_LIBRARY -> add delete_library with our check (openedx_authz.api.permissions.has_permission)
     • permissions.CAN_CREATE_CONTENT_LIBRARY -> we can add our check create_library (optional - it won't have an effect because the mvp doesn't take it into account the create_library assignation)
     • the can_view - add our view_library
     • the can_edit - add our edit_library
     • permissions.CAN_VIEW_THIS_CONTENT_LIBRARY_TEAM - use our view_library_team (optional - we'll cover it in our rest api)
     • edit_library_team - use our view_library_team (optional - we'll cover it in our rest api)
     • Add in the librarycommitview the edit to publish_library.
   • Modify lib/xblock/upstream_sync_container (optional) - It has a comment: # TODO: should permissions be checked at this low level?
   • Modify content_stagging/views to add our enforcement (view_library)
   • Modify the rest_api/v2/views/downstreams (optional - unstable)
   • Modify the api/libraries
     • add view_library
     • create_library (optional)
   • Script to migrate the current data to the new authz system
     • Translate the current roles to the new ones - reference
   • Documentation (could live in the DEPR ticket) Follow up the DEPR ticket #79

   Out of MVP:

   • manage_taxonomies: This is a new permission and doesn't affect the console MVP. We will have it in our system, but we won't check it.
   • manage_library_tags: The code for showing this is here. But currently, we are not checking if the user can have manage_library_tags. Make a proper edit here to add the new check; it may take some time, but it doesn't affect the MVP.
   • reuse_library_content: right now, we are not checking the reusability; we show all the libraries, filtering them by org. For the MVP, I suggest not making any changes to this. To explain the change more clearly and get responses in the DEPR ticket.

   Other things to check, but less clear:

   • authoring/library-authoring/data/api.ts because it mentions the library access (the roles for the old system)
     • Check if there is another point in authoring that doesn't use the edx-platform context (we already took into account) to check permissions.
   • "Allow all Studio users to reuse published content from this library." - It is something we need to check because I suggested avoiding using the reuse_library_content, but also, at this point, we were only checking explicit permissions in Casbin, but for this kind of case, we have a rule or an attribute in the library (have this reuse/read for all).
9. mariajgrimaldi commented on Oct 2, 2025

   

   mariajgrimaldi

   on Oct 2, 2025

   Last edited by mariajgrimaldi

   Member

   More actions

   I think most of the cases could be covered by adding: or user_has_permission(username, permission, library_key) here at least for the majority of cases that rely on require_permission_for_library_key. That would be the easiest thing, although we'd need to rely on what the permission is which makes sense to me. @MaferMazu, what do you think?
10. MaferMazu commented on Oct 2, 2025

    

    MaferMazu

    on Oct 2, 2025

    ContributorAuthor

    More actions

    Yes, most of them are covered with the has_permission. The only case that raises doubts for me at this point is the case "all studio users can reuse the library", because it is not an explicit permission. Currently, we have: https://github.com/openedx/edx-platform/blob/master/openedx/core/djangoapps/content_libraries/permissions.py#L70. I'll initiate an internal discussion, but yes, it is something we need to consider.
11. MaferMazu

    added sub-issues on Oct 9, 2025

    • Manage attribute checks in addition to RBAC checks #87
    • Enforcement Updates #88
    • Migration Script #89
    • Mechanism to sync roles #90
12. MaferMazu

    added sub-issues on Oct 22, 2025

    • Mark as deprecated the rest api authz methods and model for libraries #99
    • Improve the enforcement calls in the code #104
    • Grant Library Admin when Creating a Library #111
13. MaferMazu

    added this to Build-Test-Release Working Group and removed this from Build-Test-Release Working Groupon Oct 22, 2025
14. MaferMazu commented on Dec 4, 2025

    

    MaferMazu

    on Dec 4, 2025

    ContributorAuthor

    More actions

    For the MVP, we handled #87, but it could be improved.
    So the ticket will remain open, but I'll remove it from this milestone as we solve it for the MVP.
15. MaferMazu

    removed a sub-issue on Dec 4, 2025

    • Manage attribute checks in addition to RBAC checks #87
16. gviedma-aulasneo

    moved this from EPICS to Done in RBAC AuthZ Boardon Jan 22, 2026
17. gviedma-aulasneo

    closed this as completedby moving to Done in RBAC AuthZ Boardon Jan 22, 2026
18. gviedma-aulasneo

    added

    ulmoReleased in UlmoReleased in Ulmo

    on Jan 22, 2026
19. MaferMazu

    removed a sub-issue on Jun 3, 2026

    • Follow up the DEPR ticket #79