You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
authz_get_all_course_assignments_for_user() (common/djangoapps/student/roles.py:184) only fetches CourseOverviewData and OrgCourseOverviewGlobData scope types, and never PlatformCourseOverviewGlobData (the course-v1:* platform-wide glob).
Even if PlatformCourseOverviewGlobData were fetched, _get_org_and_course_id_from_authz_scope() (roles.py:163) has no branch for it. The method only maps scopes to (org, course_id) or (org, None), while a platform-wide scope does not fit that representation because it applies to every organization.
These assignments feed RoleCache / BulkRoleCache, which index roles by course_id and back RoleCache.has_role(role, course_id, org), used throughout legacy has_access() / CourseRole.has_user() checks. As a result, a user whose only role assignment is a platform-wide glob (e.g. an instructor on course-v1:*) gets an empty RoleCache for every course, causing legacy access checks to silently deny access even though the AuthZ assignment exists.
Newer AuthZ-native checks (e.g. user_can_create_library and HasPermissionInContentLibraryScope) are unaffected because they consult IS_PLATFORM_GLOB directly.
Found while auditing openedx/openedx-platform#38660 for openedx-authz#366.
Activity
BryanttV commentedon Sep 2, 2026
PR approved
fix: RoleCache legacy compat layer ignores platform-wide glob role as…