Course Admin/Staff/Editor cannot sync library updates into a course

[BryanttV]

Description

Currently, the course library synchronization endpoint is performing an incorrect permission validation. For the request to be successful, the system requires the user to explicitly have permissions (at least view) on the library being synchronized.

This defeats the purpose of the new RBAC permission courses.manage_library_updates, which should be the only requirement needed at the course level to execute the synchronization of updates.

Current behavior

When making a POST request to the /api/contentstore/v2/downstreams/{usage_key}/sync endpoint, the operation fails (with a 403) if the user executing the action does not have direct permissions on the source library, even if the user has the courses.manage_library_updates permission assigned in the course.

Expected behavior

Any user with a role with the courses.manage_library_updates permission in the course should be able to successfully execute the POST /api/contentstore/v2/downstreams/{usage_key}/sync request to synchronize the library, without needing explicit permissions (neither view nor edit) on the library in question. Authorization validation should be based solely on this new RBAC permission.

Steps to reproduce

1. Create a course and a content library.
2. Add the content library to the course.
3. Set up a test user and assign them a Course Admin/Course Staff/Course Editor role within the course context.
4. Ensure that the test user does not have any permissions assigned on the library (neither read nor write).
5. Authenticate as the test user and attempt to perform the synchronization by executing a POST /api/contentstore/v2/downstreams/{usage_key}/sync request.
6. Observe that the request is rejected due to a lack of permissions on the library, instead of completing successfully.

[carlos-marquez-wgu]

assign me