feat: add VIEW permission for advanced settings access control

Author: bra-i-am

common/djangoapps/student/auth.py

@@ -11,7 +11,7 @@
 from django.core.exceptions import PermissionDenied
 from opaque_keys.edx.locator import LibraryLocator
 from openedx_authz import api as authz_api
-from openedx_authz.constants.permissions import COURSES_CREATE_COURSE, COURSES_MANAGE_ADVANCED_SETTINGS
+from openedx_authz.constants.permissions import COURSES_CREATE_COURSE, COURSES_MANAGE_ADVANCED_SETTINGS, COURSES_VIEW_ADVANCED_SETTINGS
 
 from common.djangoapps.student.roles import (
     CourseBetaTesterRole,
@@ -201,26 +201,43 @@ def check_course_advanced_settings_access(user, course_key, access_type='read'):
     Returns:
         bool: True if user has permission, False otherwise
     """
-    if core_toggles.AUTHZ_COURSE_AUTHORING_FLAG.is_enabled(course_key):
-        # For feature_restricted access type, check DISABLE_ADVANCED_SETTINGS feature
-        if (
-            access_type == 'feature_restricted'
-            and settings.FEATURES.get('DISABLE_ADVANCED_SETTINGS', False)
-        ):
-            # When feature is disabled, only staff/superuser can access (bypass authz)
-            return user.is_staff or user.is_superuser
-        # Otherwise check authz permission
-        return authz_api.is_user_allowed(user.username, COURSES_MANAGE_ADVANCED_SETTINGS.identifier, str(course_key))
-
-    # Legacy permission checks
+    if not core_toggles.AUTHZ_COURSE_AUTHORING_FLAG.is_enabled(course_key):
+        if access_type == 'read':
+            return has_studio_read_access(user, course_key)
+        if access_type == 'feature_restricted':
+            return has_studio_advanced_settings_access(user)
+        if access_type == 'write':
+            return has_studio_write_access(user, course_key)
+        return False
+
+    course_id = str(course_key)
+    username = user.username
+    disable_advanced = settings.FEATURES.get('DISABLE_ADVANCED_SETTINGS', False)
+
+    # Feature flag override: when DISABLE_ADVANCED_SETTINGS is enabled,
+    # only staff/superuser can access regardless of authz permissions
+    if access_type == 'feature_restricted' and disable_advanced:
+        return user.is_staff or user.is_superuser
+
+    # MANAGE permission grants full access (read + write)
+    has_manage = authz_api.is_user_allowed(
+        username,
+        COURSES_MANAGE_ADVANCED_SETTINGS.identifier,
+        course_id,
+    )
+    if has_manage:
+        return True
+
+    # VIEW permission allows read-only access for auditors
     if access_type == 'read':
-        return has_studio_read_access(user, course_key)
-    if access_type == 'feature_restricted':
-        return has_studio_advanced_settings_access(user)
-    if access_type == 'write':
-        return has_studio_write_access(user, course_key)
+        return authz_api.is_user_allowed(
+            username,
+            COURSES_VIEW_ADVANCED_SETTINGS.identifier,
+            course_id,
+        )
 
-    raise ValueError(f"Invalid access_type: {access_type}")
+    # write and feature_restricted (when not disabled) require MANAGE
+    return False
 
 
 def is_content_creator(user, org):