US: Allow reuse of library content by all Studio users

[MaferMazu]

As a Library Admin, I want to allow all Studio users to reuse published content from this library, so that reuse does not require per user grants.

Figma: https://www.figma.com/design/q3Knq0BKoVTBbtaxb81n9R/RBAC---Console---Wireframes?node-id=2750-12294&t=eKQ2ECoA7RZuMChl-4

Acceptance criteria

• Placement
  Toggle in the Permissions tab of Library Team Management.

• Access
  Visible and usable only for users with permission to manage library settings.

• Header context
  Shows library name and library ID in the header.

• Behavior
  Toggle label, "Allow all Studio users to reuse published content from this library." Copy is WIP.
  Default Off. When turned On, all authenticated Studio users can reuse published items from this library via course authoring.
  Draft content remains hidden.
  This grants reuse and view for the library (doesn't count as an explicit permission or role assignment).
  If a user already has a role, their existing permissions are unchanged.
  Turning Off removes this reuse access going forward.
  On save, show a success toast.

• States
  While saving, disable the control and show a saving state.
  Error shows a message with a Retry action.

Notes, out of scope for this card

• API is defined in a separate card. 401 and 403 use the same auth error view. 404 and general server errors use a not found or generic error view with a Retry.

[MaferMazu]

@gviedma-aulasneo, regarding this US, I have a question: is this related to ‘allow_public_read’?

Context:
The ‘allow_public_read’ option is currently available for libraries. Reference: openedx/frontend-app-authoring#1342.
In our current system, we only check readability, not reusability.
Based on our Library Roles and Permissions document, we will manage those permissions separately. However, I would like to know how we should manage the previous options.

Should we deprecate the ‘allow_public_read’ option and have ‘allow_public_reusability’ as a new option? Or are we going to have both options separate? Or does it make sense to merge them?

[gviedma-aulasneo]

@MaferMazu the goal is to keep parity with current behavior. If the toggle stays on, you see the libraries in the list, and you can reuse their content in your courses.

Regarding the hard validation, yes, we already decided to decouple "Reuse Library Content" and "View Library" as two different permissions.

But I wasn't thinking of this as a permission, more like a “we do not validate” case. Normally, we check that the user holds a permission, then grant or revoke access based on that. Here, I was imagining we would skip the user validation and grant access.

Accessing the library section already depends on having Studio access, and reusing content already requires edit access to the course, plus reaching the menu to select content from a library, so I assumed we do not need to overthink this flow, but maybe I'm wrong.

I know this is an abstraction and might be easier said than done. If a decision is needed, I'd be happy to talk through options, pros, and cons.

[gviedma-aulasneo]

minor corrections:

Access
Visible and usable only for users with permission to "manage library (delete:"settings") team".

Behavior:

• User with access to Library section can see the library and it's content. <<< Add

[MaferMazu]

@MaferMazu the goal is to keep parity with current behavior. If the toggle stays on, you see the libraries in the list, and you can reuse their content in your courses.

✅

Regarding the hard validation, yes, we already decided to decouple "Reuse Library Content" and "View Library" as two different permissions.

✅

But I wasn't thinking of this as a permission, more like a “we do not validate” case. Normally, we check that the user holds a permission, then grant or revoke access based on that. Here, I was imagining we would skip the user validation and grant access.

✅ Yes, I agree with you; this is not a permission, but rather an attribute of our library. That is True (the library has set that is reusable), we can reuse the content (and view it by inheritance).

Following the design: https://www.figma.com/design/q3Knq0BKoVTBbtaxb81n9R/RBAC---Console---Wireframes?node-id=2750-12294&t=eKQ2ECoA7RZuMChl-4

I will translate the current "allow_public_read" to "allow_public_reuse".
That doesn't change the current behavior (we currently don't check reusability, so it is implicit), and we don't duplicate options (if we want to check reusability, the read came by implication).

Thanks @gviedma-aulasneo

[MaferMazu]

minor corrections:

Access Visible and usable only for users with permission to "manage library (delete:"settings") team".

Behavior:

• User with access to Library section can see the library and it's content. <<< Add

Based on that, I changed "This grants reuse only, no edit permissions, no visibility in the Team Members list." to "This grants reuse and view for the library (doesn't count as an explicit permission or role assignment)."

But I didn't understand the Access, I think it is okay as it is "Visible and usable only for users with permission to manage library settings", based on the design: https://www.figma.com/design/q3Knq0BKoVTBbtaxb81n9R/RBAC---Console---Wireframes?node-id=2750-12294&t=eKQ2ECoA7RZuMChl-4

[gviedma-aulasneo]

@MaferMazu add to the US, please:

Test Cases

Setup

• Admin A has permission to manage team members for the library.
• Member M is a library member without permission to manage team members.
• User U has a Studio account and no roles in the library.
• The library has published and draft items.
• Start on Libraries → Library Team Management → Team Members tab.

Scenarios

• 1) With manage team, I can see the toggle and it is Off by default
  Given: I am logged in as Admin A with permission to manage team members
  When: I open the Team Members tab
  Then: I see the toggle labeled Allow all Studio users to reuse published content from this library
  And: the toggle is Off by default

• 2) With manage team, I can turn the toggle On
  Given: I am Admin A on the Team Members tab and the toggle is Off
  When: I turn it On and save
  Then: the control disables while saving
  And: when the save succeeds
  Then: I see a success toast
  And: all authenticated Studio users can reuse published items from this library via course authoring
  And: draft content remains hidden
  And: this grants reuse and view for the library, it does not create a role assignment

• 3) With manage team, I can turn the toggle Off
  Given: I am Admin A on the Team Members tab and the toggle is On
  When: I turn it Off and save
  Then: the control disables while saving
  And: when the save succeeds
  Then: I see a success toast
  And: reuse access for unaffiliated Studio users is removed going forward

• 4) Without manage team and toggle Off, I do not see the toggle
  Given: I am logged in as Member M without permission to manage team members
  And: the reuse toggle is Off
  When: I open the Team Members tab
  Then: I do not see the reuse toggle

• 5) Without manage team and toggle On, I see it but cannot change it
  Given: I am Member M without permission to manage team members
  And: the reuse toggle is On
  When: I open the Team Members tab
  Then: I see the reuse toggle in the On state
  And: the toggle is not interactive for me

• 6) Unaffiliated authoring, library not shared, I cannot see content to reuse
  Given: I am User U with no roles in the library
  And: the reuse toggle is Off for that library
  When: I go to course authoring and open the Reuse content from libraries picker
  Then: I do not see that library or its items in the listing

• 7) Unaffiliated authoring, library shared, I can see published items to reuse
  Given: I am User U with no roles in the library
  And: the reuse toggle is On for that library
  When: I go to course authoring and open the Reuse content from libraries picker
  Then: I can see the library’s published items in the listing
  And: I do not see draft items

[dcoa]

@MaferMazu I just have a question for you: the endpoint for the toggle does not change. I mean, it comes from the libraries' API and is still managed through it, correct?

[MaferMazu]

@dcoa, yes, this endpoint doesn't change.