[FC-0099] refactor!: consider global scope as wildcard managed by ScopeData by mariajgrimaldi · Pull Request #132 · openedx/openedx-authz

mariajgrimaldi · 2025-10-31T16:25:57Z

Description

This PR adds support to the global type by allowing the use of "*" as a global external_key that will be managed by the base ScopeData class with global namespace.

Merge checklist:
Check off if complete or not applicable:

Version bumped
Changelog record added
Documentation updated (not only docstrings)
Fixup commits are squashed away
Unit tests added/updated
Manual testing instructions provided
Noted any: Concerns, dependencies, migration issues, deadlines, tickets

openedx-webhooks · 2025-10-31T16:26:02Z

Thanks for the pull request, @mariajgrimaldi!

This repository is currently maintained by @openedx/committers-openedx-authz.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
- This process (including the steps you'll need to take) is documented here.
If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

Dependencies

This PR must be merged before / after / at the same time as ...
Blockers

This PR is waiting for OEP-1234 to be accepted.
Timeline information

This PR must be merged by XX date because ...
Partner information

This is for a course on edx.org.
Supporting documentation
Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

Details

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

The size and impact of the changes that it introduces
The need for product review
Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

mariajgrimaldi · 2025-10-31T17:21:15Z

+    # The 'sc' namespace is used for generic scopes that aren't tied to a specific resource type.
+    # This base class supports:
+    # 1. Global scopes (external_key='*') that apply across all resource types
+    # 2. Custom generic scopes that don't map to specific domain objects
+    # Subclasses like ContentLibraryData ('lib') represent concrete resource types.
    NAMESPACE: ClassVar[str] = "sc"


@bmtcril: remember we talked about the usage of this generic scope? I think we found one!

I was thinking of changing NAMESPACE to an empty string cause I'm not sure how descriptive is sc. What do you think?

FYI @MaferMazu @BryanttV

What did "sc" stand for?

Maybe we could change it to something related to "anonymous", as if it's supposed to identify scopes that don't map to specific objects, then they are "anonymous"?

Thinking on the usage of a namespaced key, it would look something like:

"anon^*"

Otherwise if we use an empty string, it woud be like "^*" right?

Won't this cause confusion because of the "missing" namespace?

sc means scope 🥲, not very explicit though. Initially was only to have base definitions for all the other scopes, but now we can use it for global scopes so it might make sense to change this namespace.

Won't this cause confusion because of the "missing" namespace?

I think it will! Considering what I said here, https://github.com/openedx/openedx-authz/pull/132/files#r2486208488, instead of anonymous, should we use global or some synonym?

I think global makes the most sense, but whatever we use needs to be something that will never get a real value of the same name, right?

Exactly! What about these?

global: global^* (++1 most votes)

instance: instance^*

In all cases, having something like can_create_libraries in NAMESPACE^* would mean I can create any number of libraries in my Open edX instance. This only makes sense for the * external key, right? It wouldn’t make sense for a specific key or would it also apply there? If so, then maybe we won't get values with the same name?

My understanding here is that in the case of the can_create_libraries permission, global^* Would mean that it applies to anything, not only libraries, but in practice can_create_libraries will only be evaluated on lib objects.

But, if at some point we add some more generic permissions, like can_create, that could apply that more than one domain object, then we could define more specific things, like global^*:DemoX:CSPROB, that would apply on anything on the org DemoX that is called CSPROB (courses, libs, etc). But this is a whole different level of complexity that I don't think we need now.

The thing with can_create_libraries is that we can't actually evaluate it with a concrete library, but only against the instance (not sure how to call it) so it could be similar to can_create but only checked in context of libraries - hopefully I'm not getting all of this mixed up (so please correct me if I'm wrong!) 😅

that would apply on anything on the org DemoX that is called CSPROB (courses, libs, etc). But this is a whole different level of complexity that I don't think we need now.

~~I totally agree. Do you think global^*:DemoX:CSPROB wouldn't work for that can_create case?~~ Oh I understand now! We should consider also cases without the *!

Oh you are right, for can_create_libraries it doesn't make sense to specify a concrete library, so global makes sense there. It would make sense for something like can_edit_library instead.

mariajgrimaldi · 2025-10-31T17:25:43Z

+        # an external_key to mean generic scope which maps to base ScopeData class.
+        # The only remaining issue is that internally the namespace key used in policies will be
+        # The generic scope namespace (sc^*), so we need to handle that case here.
+        if kwargs.get("external_key") == GENERIC_SCOPE_WILDCARD:


Generic or global?

If this is a question on naming, I think global is clearer.

I initially used generic scope cause this scope can be specialized into other scopes: content libraries, courses... But this might be too ambiguous. It might make sense making it global when not specialized?

Global makes more sense to me 👍

rodmgwgu · 2025-10-31T18:50:06Z

+        # an external_key to mean generic scope which maps to base ScopeData class.
+        # The only remaining issue is that internally the namespace key used in policies will be
+        # The generic scope namespace (sc^*), so we need to handle that case here.
+        if kwargs.get("external_key") == GENERIC_SCOPE_WILDCARD:


If this is a question on naming, I think global is clearer.

rodmgwgu · 2025-10-31T18:52:03Z

+    # The 'sc' namespace is used for generic scopes that aren't tied to a specific resource type.
+    # This base class supports:
+    # 1. Global scopes (external_key='*') that apply across all resource types
+    # 2. Custom generic scopes that don't map to specific domain objects
+    # Subclasses like ContentLibraryData ('lib') represent concrete resource types.
    NAMESPACE: ClassVar[str] = "sc"


What did "sc" stand for?

rodmgwgu · 2025-10-31T18:57:45Z

+    # The 'sc' namespace is used for generic scopes that aren't tied to a specific resource type.
+    # This base class supports:
+    # 1. Global scopes (external_key='*') that apply across all resource types
+    # 2. Custom generic scopes that don't map to specific domain objects
+    # Subclasses like ContentLibraryData ('lib') represent concrete resource types.
    NAMESPACE: ClassVar[str] = "sc"


Maybe we could change it to something related to "anonymous", as if it's supposed to identify scopes that don't map to specific objects, then they are "anonymous"?

Thinking on the usage of a namespaced key, it would look something like:

"anon^*"

Otherwise if we use an empty string, it woud be like "^*" right?

Won't this cause confusion because of the "missing" namespace?

Co-authored-by: Rodrigo Mendez <[email protected]>

mariajgrimaldi · 2025-11-04T11:32:03Z

@MaferMazu: can you confirm this version still works for you?

rodmgwgu · 2025-11-04T15:42:54Z

Should we change this to GLOBAL_SCOPE_WILDCARD?

Done! Thanks for the suggestion :)

bmtcril

I think this is good to go after the change of GENERIC_SCOPE_WILDCARD to GLOBAL_SCOPE_WILDCARD.

MaferMazu

Thanks for the changes @mariajgrimaldi, they work as expected <3

refactor: consider global scope wildcard when instantiating scope

38a0573

openedx-webhooks added open-source-contribution PR author is not from Axim or 2U core contributor PR author is a Core Contributor (who may or may not have write access to this repo). labels Oct 31, 2025

openedx-webhooks added this to Contributions Oct 31, 2025

github-project-automation Bot moved this to Needs Triage in Contributions Oct 31, 2025

docs: update docstring with latest changes

5bc85e1

mariajgrimaldi linked an issue Oct 31, 2025 that may be closed by this pull request

Bug: I need to check if someone has permissions globally using openedx-authz #131

Closed

mariajgrimaldi added 2 commits October 31, 2025 17:53

test: add a test case for wildcard scope

5e8453d

docs: update scope docstring

4c1577a

mariajgrimaldi changed the title ~~refactor: consider global scope wildcard when instantiating scope~~ refactor: consider global scope as wildcard managed by ScopeData Oct 31, 2025

mariajgrimaldi marked this pull request as ready for review October 31, 2025 17:19

mariajgrimaldi requested review from BryanttV, MaferMazu, bmtcril and rodmgwgu October 31, 2025 17:20

mariajgrimaldi commented Oct 31, 2025

View reviewed changes

rodmgwgu reviewed Oct 31, 2025

View reviewed changes

mariajgrimaldi changed the title ~~refactor: consider global scope as wildcard managed by ScopeData~~ [FC-0099] refactor: consider global scope as wildcard managed by ScopeData Nov 3, 2025

mariajgrimaldi added this to RBAC AuthZ Board Nov 3, 2025

mariajgrimaldi moved this to Ready for review in RBAC AuthZ Board Nov 3, 2025

docs: Apply suggestion from @rodmgwgu

eb540c5

Co-authored-by: Rodrigo Mendez <[email protected]>

mariajgrimaldi requested a review from rodmgwgu November 3, 2025 19:17

refactor: use global namespace instead of sc

685ebb1

mphilbrick211 added the FC Relates to an Axim Funded Contribution project label Nov 4, 2025

mphilbrick211 moved this from Needs Triage to Ready for Review in Contributions Nov 4, 2025

rodmgwgu reviewed Nov 4, 2025

View reviewed changes

bmtcril approved these changes Nov 4, 2025

View reviewed changes

MaferMazu approved these changes Nov 4, 2025

View reviewed changes

mariajgrimaldi added 2 commits November 5, 2025 13:00

refactor: change generic to global wildecard constant

cf2fa62

docs: update docs for next release

e802390

mariajgrimaldi changed the title ~~[FC-0099] refactor: consider global scope as wildcard managed by ScopeData~~ [FC-0099] feat: consider global scope as wildcard managed by ScopeData Nov 5, 2025

mariajgrimaldi changed the title ~~[FC-0099] feat: consider global scope as wildcard managed by ScopeData~~ [FC-0099] refactor!: consider global scope as wildcard managed by ScopeData Nov 5, 2025

mariajgrimaldi merged commit b9414ed into main Nov 5, 2025
14 checks passed

mariajgrimaldi deleted the MJG/global-lib-scope branch November 5, 2025 12:14

github-project-automation Bot moved this from Ready for review to Done in RBAC AuthZ Board Nov 5, 2025

github-project-automation Bot moved this from Ready for Review to Done in Contributions Nov 5, 2025

mariajgrimaldi mentioned this pull request Mar 17, 2026

feat: add org glob support #225

Merged

14 tasks

Conversation

mariajgrimaldi commented Oct 31, 2025 • edited by MaferMazu Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Uh oh!

openedx-webhooks commented Oct 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mariajgrimaldi Nov 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mariajgrimaldi Nov 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mariajgrimaldi commented Nov 4, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bmtcril left a comment

Choose a reason for hiding this comment

Uh oh!

MaferMazu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

mariajgrimaldi commented Oct 31, 2025 •

edited by MaferMazu

Loading

openedx-webhooks commented Oct 31, 2025 •

edited

Loading

mariajgrimaldi Nov 3, 2025 •

edited

Loading

mariajgrimaldi Nov 4, 2025 •

edited

Loading