feat: add AuthZ permissions for course schedule & details by dwong2708 · Pull Request #38213 · openedx/openedx-platform

dwong2708 · 2026-03-25T15:36:08Z

Description

This PR introduces new AuthZ permission checks for the Schedule & Details section in course settings, implemented behind a feature flag.

The work follows the requirements defined in the ticket, covering both read and update operations for course schedule and details.

Scope of Changes

Permissions introduced:

courses.view_schedule_and_details
course.edit_schedule
course.edit_details
course.view_course

Endpoints updated:

GET /api/contentstore/v1/course_settings/{course_id}/
GET /api/contentstore/v1/course_details/{course_id}/
PUT /api/contentstore/v1/course_details/{course_id}/

All permission checks are gated behind the corresponding feature flag.

Implementation Details

GET endpoints. Require courses.view_schedule_and_details permission.
PUT endpoint
- Handles updates for both schedule and details in a single request.
- Introduce payload-level inspection to differentiate between schedule and details updates, and enforce permissions accordingly.
Due to the merged data model (schedule + details updated together), enforcing separate permissions (course.edit_schedule vs course.edit_details) at field level would introduce additional complexity and performance overhead.

Testing instructions

Verified that:

Authorized users can access the endpoints.
Unauthorized users receive a 403 response.
Legacy permission fallback works as expected.

Running relevant tests manually:

On a cms container (run with tutor dev exec cms bash), do:

pytest -p no:randomly --ds=cms.envs.test cms/djangoapps/contentstore/rest_api/v1/views/tests/test_course_details.py::CourseDetailsAuthzViewTest

pytest -p no:randomly --ds=cms.envs.test cms/djangoapps/contentstore/rest_api/v1/views/tests/test_settings.py

Deadline

Verawood

Other information

Closes openedx/openedx-authz#195

openedx-webhooks · 2026-03-25T15:36:16Z

Thanks for the pull request, @dwong2708!

This repository is currently maintained by @openedx/wg-maintenance-openedx-platform.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
- This process (including the steps you'll need to take) is documented here.
If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

Dependencies

This PR must be merged before / after / at the same time as ...
Blockers

This PR is waiting for OEP-1234 to be accepted.
Timeline information

This PR must be merged by XX date because ...
Partner information

This is for a course on edx.org.
Supporting documentation
Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

Details

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

The size and impact of the changes that it introduces
The need for product review
Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

cms/djangoapps/contentstore/rest_api/v1/views/course_details.py

rodmgwgu

Just some nits and changes needed due to other PRs already merged in master.

Please make sure to rebase from master to make sure nothing breaks.

cms/djangoapps/contentstore/rest_api/v1/views/course_details.py

openedx/core/djangoapps/authz/tests/mixins.py

rodmgwgu

Looking good, thanks!

wgu-taylor-payne · 2026-03-30T21:30:29Z

cms/djangoapps/contentstore/rest_api/v1/views/course_details.py

        serializer = CourseDetailsSerializer(updated_data)
        return Response(serializer.data)
+
+    def _classify_update(self, request: Request, course_key: str) -> tuple[bool, bool]:


course_key is a CourseKey.

wgu-taylor-payne · 2026-03-30T21:41:12Z

cms/djangoapps/contentstore/rest_api/v1/views/tests/test_course_details.py

+        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+
+    def test_put_authorized_user_can_edit_course_schedule_and_details(self):
+            """


Indetation gets off here and the next method, using 12 spaces rather than 8.

wgu-taylor-payne · 2026-03-30T21:42:49Z

cms/djangoapps/contentstore/rest_api/v1/views/tests/test_course_details.py

+
+            self.assertEqual(response.status_code, status.HTTP_200_OK)
+
+    def test_put_unauthorized_user_can_edit_course_schedule_and_details(self):


Suggested change

def test_put_unauthorized_user_can_edit_course_schedule_and_details(self):

def test_put_unauthorized_user_cannot_edit_course_schedule_and_details(self):

wgu-taylor-payne · 2026-03-30T21:44:07Z

cms/djangoapps/contentstore/rest_api/v1/views/tests/test_course_details.py

+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+
+    def test_put_unauthorized_user_can_edit_course_schedule(self):


Suggested change

def test_put_unauthorized_user_can_edit_course_schedule(self):

def test_put_unauthorized_user_cannot_edit_course_schedule(self):

wgu-taylor-payne · 2026-03-30T21:48:58Z

cms/djangoapps/contentstore/rest_api/v1/views/tests/test_course_details.py

+        Only COURSE_STAFF and COURSE_ADMIN can edit schedule related fields.
+        """
+        self.add_user_to_role_in_course(
+            self.authorized_user,


The method name and docstring say unauthorized user and then we make the authorized_user the one that is unauthorized, which is a bit confusing. This also happens in test_put_unauthorized_user_can_edit_course_schedule_and_details and potentially others.

wgu-taylor-payne · 2026-03-31T04:22:28Z

cms/djangoapps/contentstore/rest_api/v1/views/course_details.py

+
+        if not is_schedule_update and not is_details_update:
+            # No updatable fields provided in the request
+            raise ValidationError("No updatable fields provided in the request.")


I think technically if a PUT request comes in with the same data as the current data, the endpoint should return a 200 response with the current object state. So, at least in that case, an error wouldn't be appropriate.

wgu-taylor-payne · 2026-03-31T04:26:33Z

cms/djangoapps/contentstore/rest_api/v1/views/course_details.py

+                # Any non-schedule field counts as details update
+                current_value = getattr(course_details, field, None)
+                if payload_value != current_value:
+                    is_details_update = True


I was testing this a little and found I got to this line under the if statement with these values:

field: 'certificates_display_behavior' payload_value: 'CertificatesDisplayBehaviors.END' current_value: <CertificatesDisplayBehaviors.END: 'end'>

wgu-taylor-payne · 2026-03-31T05:03:43Z

cms/djangoapps/contentstore/rest_api/v1/views/course_details.py

+                            f"Invalid date format for field {field}: {payload_value}"
+                        ) from exc
+
+                if payload_value and getattr(course_details, field) != payload_value:


Can payload_value be None?

wgu-taylor-payne · 2026-03-31T05:05:52Z

cms/djangoapps/contentstore/rest_api/v1/views/course_details.py

+            (is_schedule_update, is_details_update)
+        """
+        payload = request.data
+        schedule_fields = {"start_date", "end_date", "enrollment_start", "enrollment_end"}


How about making this into a class attribute and frozenset?

SCHEDULE_FIELDS = frozenset({"start_date", "end_date", "enrollment_start", "enrollment_end"})

wgu-taylor-payne · 2026-03-31T05:17:03Z

cms/djangoapps/contentstore/rest_api/v1/views/course_details.py

+
+            # Normalize/validate schedule fields
+            if field in schedule_fields:
+                if payload_value is not None and not is_schedule_update:


Should we just check if it is a schedule update right away and skip if we already know it is?

if is_schedule_update: continue

We could also do this in the else clause:

if is_details_update: continue

If we do that then raise this up to the top of the for loop:

if is_schedule_update and is_details_update: break

openedx-webhooks added the open-source-contribution PR author is not from Axim or 2U label Mar 25, 2026

openedx-webhooks added this to Contributions Mar 25, 2026

github-project-automation bot moved this to Needs Triage in Contributions Mar 25, 2026

dwong2708 changed the title ~~Dwong2708/authz new perms schedule details~~ feat: add AuthZ permissions for course schedule & details (behind feature flag) Mar 25, 2026

dwong2708 changed the title ~~feat: add AuthZ permissions for course schedule & details (behind feature flag)~~ feat: add AuthZ permissions for course schedule & details Mar 25, 2026

dwong2708 marked this pull request as ready for review March 25, 2026 16:39

dwong2708 requested review from bmtcril, rodmgwgu and wgu-taylor-payne March 25, 2026 16:39

rodmgwgu suggested changes Mar 25, 2026

View reviewed changes

dwong2708 requested review from mariajgrimaldi and rodmgwgu March 26, 2026 00:15

rodmgwgu suggested changes Mar 27, 2026

View reviewed changes

cms/djangoapps/contentstore/rest_api/v1/views/course_details.py Outdated Show resolved Hide resolved

openedx/core/djangoapps/authz/tests/mixins.py Outdated Show resolved Hide resolved

openedx/core/djangoapps/authz/tests/mixins.py Outdated Show resolved Hide resolved

mphilbrick211 added Make Upgrade In Progress mao-onboarding Reviewing this will help onboard devs from an Axim mission-aligned organization (MAO). and removed Make Upgrade In Progress labels Mar 27, 2026

mphilbrick211 moved this from Needs Triage to In Eng Review in Contributions Mar 27, 2026

dwong2708 added 6 commits March 27, 2026 16:06

feat: add AuthZ permissions for schedule and course details

d384a40

fixup! feat: add AuthZ permissions for schedule and course details

12d9f33

fixup! feat: add AuthZ permissions for schedule and course details

8c2f432

fixup! feat: add AuthZ permissions for schedule and course details

31bbe21

fixup! feat: add AuthZ permissions for schedule and course details

878dda8

fixup! feat: add AuthZ permissions for schedule and course details

fa7ea64

dwong2708 force-pushed the dwong2708/authz-new-perms-schedule-details branch from 93e2c75 to fa7ea64 Compare March 27, 2026 22:25

dwong2708 requested a review from rodmgwgu March 27, 2026 23:42

rodmgwgu approved these changes Mar 30, 2026

View reviewed changes

wgu-taylor-payne reviewed Mar 31, 2026

View reviewed changes


		self.assertEqual(response.status_code, status.HTTP_200_OK)

		def test_put_unauthorized_user_can_edit_course_schedule_and_details(self):

	def test_put_unauthorized_user_can_edit_course_schedule_and_details(self):
	def test_put_unauthorized_user_cannot_edit_course_schedule_and_details(self):

Conversation

dwong2708 commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Scope of Changes

Implementation Details

Testing instructions

Deadline

Other information

Uh oh!

openedx-webhooks commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rodmgwgu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rodmgwgu left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

dwong2708 commented Mar 25, 2026 •

edited

Loading

openedx-webhooks commented Mar 25, 2026 •

edited

Loading