You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I did some research on this, here are my findings:
The old Library permissions are stored in the ContentLibraryPermission model, it consists of the following columns:
library: FK to ContentLibrary
user: optional FK to User
group: optionak FK to Group
access_level: 'admin' | 'author' | 'read'
In the new Authz model, this would roughly translate to:
library: scope
user: subject
access_level: role
Now, we don't have an equivalent concept to "Group", what should we do in this case? should we just go through the users in the group and assign roles independently?
@rodmgwgu that's probably a @jmakowski1123 question, but I would guess that we would have to to it the way you said or ignore groups altogether. I'd also like to clarify the order of operations for operators upgrading to Ulmo to make sure I understand things correctly.
Do the upgrade: at this point only staff and superusers have access to libraries, other old permissions cease to have any effect, and there is no UI to update them
Run the migration script: at this point all users have the permissions they had before the upgrade
@rodmgwgu I don’t remember why this was blocked, but I think you can go ahead and start working on it. Mafer will let us know if there’s anything else we need.
Now, we don't have an equivalent concept to "Group", what should we do in this case? Should we just go through the users in the group and assign roles independently?
Do the upgrade: at this point only staff and superusers have access to libraries, other old permissions cease to have any effect, and there is no UI to update them
Run the migration script: at this point all users have the permissions they had before the upgrade
Just to clarify, the migration would be implemented as a data migration, so it will be applied as part of the upgrade.
Reacted by Maria Grimaldi (Majo) and Ty Hob / Brian Mesick
Activity
bmtcril commentedon Oct 30, 2025
Just noting that there is a preference to make this a data migration instead of something like a management command.
rodmgwgu commentedon Nov 3, 2025
@MaferMazu Is this still blocked? I would like to work on this.
rodmgwgu commentedon Nov 3, 2025
I did some research on this, here are my findings:
The old Library permissions are stored in the ContentLibraryPermission model, it consists of the following columns:
In the new Authz model, this would roughly translate to:
Now, we don't have an equivalent concept to "Group", what should we do in this case? should we just go through the users in the group and assign roles independently?
bmtcril commentedon Nov 4, 2025
@rodmgwgu that's probably a @jmakowski1123 question, but I would guess that we would have to to it the way you said or ignore groups altogether. I'd also like to clarify the order of operations for operators upgrading to Ulmo to make sure I understand things correctly.
Does this sound correct to everyone? cc @MaferMazu @mariajgrimaldi
mariajgrimaldi commentedon Nov 4, 2025
Sorry I missed your comments!
@rodmgwgu I don’t remember why this was blocked, but I think you can go ahead and start working on it. Mafer will let us know if there’s anything else we need.
That makes sense to me. "Group" might just be their notion of a role (a way of grouping users): https://github.com/openedx/edx-platform/blob/master/openedx/core/djangoapps/content_libraries/permissions.py#L18-L35
Thanks!
@bmtcril Sounds good to me!
rodmgwgu commentedon Nov 4, 2025
Just to clarify, the migration would be implemented as a data migration, so it will be applied as part of the upgrade.