fix: hide course authoring content when enable_course_authoring is off

[bra-i-am]

Caution

This PR depends on and contains the change from #172
After merging it, this PR needs to be rebased with master and then marked as ready for review

Closes openedx/openedx-authz#340
Closes openedx/openedx-authz#341

When the authz.enable_course_authoring waffle flag is OFF, the Admin Console was still displaying course-related content in the Team Members tab, Audit User view, and role assignment wizard. This PR makes all those surfaces aware of the flag state.

How it works

The flag state is surfaced indirectly through the permission system: when the flag is turned off for an org, the authz migration removes course roles from Casbin, which causes courses.view_course_team to return allowed: false for users who no longer have any active course roles. The frontend uses useValidateUserPermissionsNonSuspense with the new VIEW_TEAM_PERMISSIONS constant as the signal for whether to show course content.

Main changes

• roles-permissions/index.ts — adds VIEW_TEAM_PERMISSIONS, a new constant with VIEW_LIBRARY_TEAM and VIEW_COURSE_TEAM actions, used as the domain-visibility signal across all components.
• ScopesFilter — checks VIEW_COURSE_TEAM and passes scope_type=library to the scopes API when course view is not allowed, so courses are excluded from the dropdown at the API level.
• TeamMembersTable — computes effectiveQuerySettings that injects roles=<library_role_keys> into the API request when course view is not allowed, so only library assignments are fetched and the pagination count is accurate.
• AuditUserPage — applies the same effectiveQuerySettings approach as TeamMembersTable.
• AssignRoleWizardPage — adds a VIEW_TEAM_PERMISSIONS check alongside the existing MANAGE_TEAM_PERMISSIONS check; course roles are excluded from rolesAssignable when VIEW_COURSE_TEAM is not allowed, so they do not appear in the role assignment wizard.

Test plan

• Set authz.enable_course_authoring OFF at platform level and add an org-level override set to Force Off for the target org — this triggers the rollback migration.
• Log in as a user who has only library roles (no course roles in any org). Verify: Role filter shows only library groups, Scope filter shows only libraries, table rows contain no course roles, role assignment wizard lists only library roles.
• Log in as a user who has course roles in an org where the flag is still ON. Verify: all course content appears across all views.
• Log in as a user who has both library and course roles in the affected org. Verify: after the migration runs, only library roles and scopes are shown across all views, including the wizard.

Screencast

Screencast.from.02-07-26.10.29.24.webm

[openedx-webhooks]

Thanks for the pull request, @bra-i-am!

This repository is currently maintained by @openedx/committers-frontend.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

• If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
  • This process (including the steps you'll need to take) is documented here.
• If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

• Dependencies

  This PR must be merged before / after / at the same time as ...

• Blockers

  This PR is waiting for OEP-1234 to be accepted.

• Timeline information

  This PR must be merged by XX date because ...

• Partner information

  This is for a course on edx.org.

• Supporting documentation
• Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

🔘 Update the status of your PR

Your PR is currently marked as a draft. After completing the steps above, update its status by clicking "Ready for Review", or removing "WIP" from the title, as appropriate.

---

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

• Overview of Review Process for Community Contributions
• Pull Request Status Guide
• Making changes to your pull request

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

• The size and impact of the changes that it introduces
• The need for product review
• Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.59%. Comparing base (e3d90d8) to head (93a14f8).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #176      +/-   ##
==========================================
+ Coverage   97.44%   97.59%   +0.15%     
==========================================
  Files          66       67       +1     
  Lines        1525     1579      +54     
  Branches      386      378       -8     
==========================================
+ Hits         1486     1541      +55     
+ Misses         39       38       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[dcoa]

Just some small changes

[dcoa]

Please avoid this

Instead:

import type { GetAllRoleAssignmentsResponse } from '@src/authz-module/data/api';

const mockedAllRoleAssignments: {
  data: GetAllRoleAssignmentsResponse | undefined;
  error: Error | null;
  isLoading: boolean;
  refetch: jest.Mock;
} = {
  // ...existing object
};

[dcoa]

The default value must be false. The reasoning is we can not assume a user has a permission.

It also make some parts of the UI for example the table flicks because isCourseViewAllowed is true then evaluate to false.

[dcoa]

This type change is not necessary.