Skip to content

RoleCache legacy compatibility layer ignores platform-wide glob scopes #379

Closed
openedx/openedx-platform
#38984

Description

@efortish

Description

authz_get_all_course_assignments_for_user() (common/djangoapps/student/roles.py:184) only fetches CourseOverviewData and OrgCourseOverviewGlobData scope types, and never PlatformCourseOverviewGlobData (the course-v1:* platform-wide glob).

Even if PlatformCourseOverviewGlobData were fetched, _get_org_and_course_id_from_authz_scope() (roles.py:163) has no branch for it. The method only maps scopes to (org, course_id) or (org, None), while a platform-wide scope does not fit that representation because it applies to every organization.

These assignments feed RoleCache / BulkRoleCache, which index roles by course_id and back RoleCache.has_role(role, course_id, org), used throughout legacy has_access() / CourseRole.has_user() checks. As a result, a user whose only role assignment is a platform-wide glob (e.g. an instructor on course-v1:*) gets an empty RoleCache for every course, causing legacy access checks to silently deny access even though the AuthZ assignment exists.

Newer AuthZ-native checks (e.g. user_can_create_library and HasPermissionInContentLibraryScope) are unaffected because they consult IS_PLATFORM_GLOB directly.

Found while auditing openedx/openedx-platform#38660 for openedx-authz#366.

Activity

  1. moved this to In Grooming in RBAC AuthZ Boardon Aug 4, 2026
  2. moved this from In Grooming to Ready for Development in RBAC AuthZ Boardon Aug 4, 2026
  3. moved this from Ready for Development to Ready for Review in RBAC AuthZ Boardon Aug 13, 2026
  4. moved this from Ready for Review to In Review in RBAC AuthZ Boardon Aug 20, 2026
  5. moved this from In Review to Ready for Review in RBAC AuthZ Boardon Aug 20, 2026
  6. BryanttV commented on Sep 2, 2026

    @BryanttV
    Contributor

    PR approved

  7. moved this from Ready for Review to Done in RBAC AuthZ Boardon Sep 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

willowReleased in Willow

Type

No type

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions