-
Notifications
You must be signed in to change notification settings - Fork 5
Description
Description
We should add to edx-platform / authoring the manage_library_tags and reuse_library_content enforcements.
Context:
In openedx-authz, we already defined those permissions, and they are described here: https://openedx-authz.readthedocs.io/en/latest/concepts/core_roles_and_permissions/content_library_roles.html
But we didn't update the enforcement points (the places in the code where we check whether someone has permissions) for those permissions.
How it currently works:
Reusability of the library content
In the old system, the view library implies reusability. When we add the new system, anyone with view_library_content will also have reuse_library_content. This won't break the current behavior, but for the new system and the product perspective we discussed with @gviedma-aulasneo, the implication should be inverted (reuse implies view, not the other way around).
Expected behavior:
The implication is already managed by openedx-authz policies. Still, we should add to the edx-platform the code that checks whether the user has reusability permissions for the reusability functions.
Manage library tags
In the old system, if someone has edit_library_content, they can put tags on the content. We maintain the behavior, but from a product perspective, the ideal is to separate that permission. Currently, it works as mentioned, but it would be ideal to add the specific check in the code.
Expected behavior:
Having in, I suppose it is in authoring, a specific enforcement that requires the permission manage_library_tags before showing the tags options.
Metadata
Metadata
Assignees
Labels
Type
Projects
Status