- Add optional
orgsquery param to theGET /api/authz/v1/scopes/endpoint, that supports filtering results by multiple orgs.
- Add
RoleAssignmentAuditmodel to record role assignment and removal events, including operation type, subject, role, scope, actor database ID, and timestamp. - Emit
ROLE_ASSIGNMENT_CREATEDandROLE_ASSIGNMENT_DELETEDOpen edX public signal events viatransaction.on_commitafter every successful role assignment or removal. - Add Django admin for
RoleAssignmentAuditwith filters by operation type and scope type (course, content library), date hierarchy, and search by subject, role, and scope.
- Add automatic course authoring migration mechanism triggered by the
authz.enable_course_authoringwaffle flag when it is toggled at course or organization scope.
- Add bulk scope support to
PUT /api/authz/v1/roles/users/: accept ascopeslist field to assign a role across multiple scopes in a single request, while keeping backward compatibility with the existing singlescopefield.
- Add
scopes/endpoint to list all scopes (courses and libraries), sorted by org, with search and pagination support.
- Add the
/api/authz/v1/assignments/endpoint for listing all user role assignments, to be used in the admin console.
- Apply view team permissions to the user assignments and team members endpoints.
- Align docstrings and API docs accordingly.
- Add the
/api/authz/v1/users/<username>/assignments/endpoint to get a list of role assignations for a user.
- Add
users/validateendpoint for bulk validation of user identifiers (usernames or emails).
- Add
users/validateendpoint for bulk validation of user identifiers (usernames or emails). - Add org-wide support to migration commands for forward and backward migration of course authoring permissions.
- Add
users/endpoint to fetch all team members, with optional filters for orgs, scopes, search by username user full name or email, sorting and pagination.
- Fix enforcer
is_admin_or_superuser_checkthat was not taking into account Org glob scopes.
- Add
orgs/endpoint to list and search orgs, with pagination, as required for filters in the Admin Console.
- Add stub CCX_COACH role/ CCXCourseOverviewData scope to prevent errors when working with CCX courses.
- Add ADR for global scope support for role assignments.
- Add
get_user_role_assignments_filteredapi function to fetch user role assignments filtered by user, role, and/or scope. - Add
orgproperty toContentLibraryDataandCourseOverviewData.
- Add support for organization global scopes.
- Dropped support for Python 3.11.
- Add authz_migrate_course_authoring command to migrate legacy CourseAccessRole data to the new Authz (Casbin-based) system
- Add authz_rollback_course_authoring command to rollback Authz roles back to legacy CourseAccessRole
- Support optional --delete flag for controlled cleanup of source permissions after successful migration
- Add migrate_legacy_course_roles_to_authz and migrate_authz_to_legacy_course_roles service functions
- Add unit tests to verify migration and command behavior
- ADR on the AuthZ for Course Authoring Migration Process Details.
- ADR on the AuthZ for Course Authoring implementation plan.
- ADR on the AuthZ for Course Authoring Feature Flag Implementation Details.
- Defined courses roles and permissions mappings, including legacy compatible permissions.
- Add course staff role, permission to manage advanced course settings, and introduce course scope
- Add configurable logging level for Casbin enforcer via
CASBIN_LOG_LEVELsetting (defaults to WARNING).
- Use a RequestCache for is_admin_or_superuser matcher to improve performance.
- Use short_name instead of name from organization when building library key.
- Handle cache invalidation via a uuid in the database to ensure policy reloads occur only when necessary.
- Migration to transfer legacy permissions from ContentLibraryPermission to the new Casbin-based authorization model.
- Avoid circular import of AuthzEnforcer.
- Signal to clear policies associated to a user when they are retired.
- BREAKING: Update permission format to include app namespace prefix.
- Register
CasbinRulemodel in the Django admin. - Register
ExtendedCasbinRulemodel in the Django admin as an inline model ofCasbinRule.
- ExtendedCasbinRule model to extend the base CasbinRule model for additional metadata, and cascade delete support.
- Implement custom matcher to check for staff and superuser status.
- Avoid duplicates when getting scopes for given user and permissions.
- Add support for global scopes instead of generic sc scope to support instance-level permissions.
- Load authorization policies in permission class.
- Consider Content Library V2 toggle only in CMS service variant.
- Refactor to get permissions' scopes instead of role.
- Use correct content library toggle to check if Content Library V2 is enabled.
- Disable auto-save and auto-load of policies if Content Library V2 is disabled.
- Fix constants and test class to be able to use it outside this app.
- New
get_object()method in ScopeData to retrieve underlying domain objects - Implementation of
get_object()for ContentLibraryData with canonical key validation
- Refactor
ContentLibraryData.exists()to useget_object()internally
- Fix role user count to accurately filter users assigned to roles within specific scopes instead of across all scopes.
- Function API to retrieve scopes for a given role and subject.
- Allow disabling auto-load and auto-save of policies by setting CASBIN_AUTO_LOAD_POLICY_INTERVAL to -1.
- Migrate from using pycodestyle and isort to ruff for code quality checks and formatting.
- Enhance enforcement command with dual operational modes (database and file mode).
- Initial migration to establish dependency on casbin_adapter for automatic CasbinRule table creation.
- Use a SyncedEnforcer with default auto load policy.
- Remove Casbin Redis watcher from engine configuration.
- Default policy for Content Library roles and permissions.
- Add plugin_settings in test settings.
- Update permissions for RoleListView.
- Load policy before adding policies in the loading script to avoid duplicates.
- Initialize enforcer when application is ready to avoid access errors.
- Implementation of REST API for roles and permissions management.
- ADRs for key design decisions.
- Casbin model (CONF) and engine layer for authorization.
- Implementation of public API for roles and permissions management.
- Basic repo structure and initial setup.