feat: include authz role grants in Meilisearch access filter by wgu-taylor-payne · Pull Request #39073 · openedx/openedx-platform

wgu-taylor-payne · 2026-09-02T21:24:00Z

Description

Studio search is powered by Meilisearch. On each request to the Studio search token endpoint (GET /api/content_search/v2/studio/), _get_meili_access_filter builds the per-user tenant-token filter that Meilisearch enforces server-side: org IN [<org short_names>] OR access_id IN [<SearchAccess ids>]. Both clauses were built from legacy roles only (CourseStaff/CourseInstructor for access_id, OrgStaff/OrgInstructor for org).

Users holding an authz-only course role (course_editor/course_auditor granted through openedx-authz, with no legacy CourseAccessRole twin) were invisible to the filter, so their courses returned zero results in the global Studio search modal and the "Review Content Updates" tab on the Library Updates page.

This change widens both clauses to include authz role grants at all three scope levels, gated behind AUTHZ_COURSE_AUTHORING_FLAG:

Per-course (CourseOverviewData) → access_id clause, gated per course.
Org-wide glob (course-v1:Org+*, OrgCourseOverviewGlobData) → org clause (one entry per org, avoiding an access_id fan-out against the JWT size cap). Gated at the org tier via a new public CourseWaffleFlag.is_enabled_for_org(org) (org override → global switch).
Platform-wide (course-v1:*, PlatformCourseOverviewGlobData) → the authz analogue of global staff. When the flag is globally on, this short-circuits to a see-everything ({}) filter. When globally off, the grant is expanded per-scope to only the orgs/courses where the flag resolves on — a global-off flag can still be force-on per org/course, so it must not silently hide everything.

The load-bearing cases are course_editor/course_auditor, which have no legacy twin (the authz→legacy compat layer already bridges course_staff→staff and course_admin→instructor). Helpers query purely by scope type and are role-agnostic; inclusion is pure widening into an OR filter, so a user can only gain search on scopes they already hold a role on. All lookups fail open: a DatabaseError degrades to legacy access rather than a 500, while unexpected exceptions propagate. The user's assignment set is fetched once per request (@request_cached) and shared across helpers; authz course keys are normalized to strings to de-duplicate against legacy grants.

Commit structure. Two commits: (1) feat: add org-tier resolution to CourseWaffleFlag adds the reusable public is_enabled_for_org to waffle_utils; (2) feat: include authz course + org role grants in Meilisearch access filter consumes it.

Impacted user roles: Course Author (authz editors/auditors at course, org, or platform scope), Operator (behavior gated behind AUTHZ_COURSE_AUTHORING_FLAG).

Supporting information

Fixes Studio search (Meilisearch) does not include courses for authz-only users openedx-authz#417
Surfaced during view_library_updates work in Add courses.view_library_updates enforcement in openedx-platform openedx-authz#398 and PR feat: split read vs write authz checks for library updates #39009.

Testing instructions

Enable AUTHZ_COURSE_AUTHORING_FLAG (globally, or per-course/per-org override).
Give a user an authz course_editor/course_auditor role and no legacy course role.
As that user, search in the global Studio search modal — the course's content now appears (previously: zero results).
Repeat with an org-wide grant (course-v1:Org+*) and a platform-wide grant (course-v1:*); confirm search returns the org's / all content.
Confirm the course's Library Updates → "Review Content Updates" tab resolves component details.
Automated: pytest openedx/core/djangoapps/waffle_utils/tests/test_init.py openedx/core/djangoapps/content/search/tests/test_models.py openedx/core/djangoapps/content/search/tests/test_views.py — covers is_enabled_for_org resolution, and per-course / org-glob / platform-glob grants (including fail-open, flag-off exclusion, override force-on, and legacy de-duplication) against both mocked and real seeded authz policy.

Deadline

None.

Other information

Feature-flagged. With the flag off everywhere and no overrides, the filter is unchanged from today.
No database migrations.
Performance / follow-up (not blocking): helpers read scope.external_key/scope.org from get_user_role_assignments_per_scope_type, which eagerly expands each role's implicit permissions (discarded here). It runs once per token fetch, not per keystroke. A scopes-only authz API and/or a cached access set with an invalidation contract would be the clean optimization, intentionally left out of this correctness fix.

AI Usage

Kiro was used to aid in development and testing.

openedx-webhooks · 2026-09-02T21:24:06Z

Thanks for the pull request, @wgu-taylor-payne!

This repository is currently maintained by @openedx/wg-maintenance-openedx-platform-oncall.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
- This process (including the steps you'll need to take) is documented here.
If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

Dependencies

This PR must be merged before / after / at the same time as ...
Blockers

This PR is waiting for OEP-1234 to be accepted.
Timeline information

This PR must be merged by XX date because ...
Partner information

This is for a course on edx.org.
Supporting documentation
Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

Details

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

The size and impact of the changes that it introduces
The need for product review
Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

Copilot

🔵 Needs a closer look

It changes authorization-sensitive filtering logic (who can search what) and should receive final human review despite strong test coverage.

Pull request overview

This PR updates Studio’s Meilisearch tenant-token access filter generation to include authorization grants coming from openedx-authz (including authz-only course roles like course_editor/course_auditor) so that users granted access via authz can see the appropriate course/org content in Studio search when AUTHZ_COURSE_AUTHORING_FLAG is enabled.

Changes:

Expand per-course access_id filtering to union in authz CourseOverviewData scope assignments (flag-gated per course, fail-open on DatabaseError).
Expand org org IN [...] filtering to union in authz org-glob (OrgCourseOverviewGlobData) assignments resolved to org short_names (flag-gated per org via org override/global switch).
Add/extend CMS test coverage for both per-course authz access and org-glob authz access paths.

File summaries

File	Description
openedx/core/djangoapps/content/search/models.py	Adds authz assignment caching and helpers to include authz-derived course/org access in search access computation.
openedx/core/djangoapps/content/search/api.py	Unions authz org-glob grants into `_get_user_orgs` to populate the Meilisearch `org` clause.
openedx/core/djangoapps/content/search/tests/test_models.py	Adds tests for authz-only per-course and org-glob access behavior, including flag gating and fail-open error handling.
openedx/core/djangoapps/content/search/tests/test_views.py	Adds a Studio token endpoint test to verify authz org-glob access lands in the `org` filter clause.

Review details

Files reviewed: 4/4 changed files
Comments generated: 1
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

CourseWaffleFlag could only resolve a flag for a course key (is_enabled), which walks course override -> org override -> global switch. There was no public way to ask whether a flag is enabled for an entire org, independent of any single course. Add a public is_enabled_for_org(org) that resolves the flag at the org tier only: an org override (force-on / force-off) takes precedence, otherwise the global switch. Per-course overrides are not consulted -- a setting made for one course cannot answer whether the flag is on for the whole org. Extract the org-override read that was inline in _get_course_override_value into a shared _get_org_override_value(org) helper so both entry points resolve org overrides identically and share one cached_flags() entry per org.

BryanttV

Thanks @wgu-taylor-payne! I have a few comments

…lter get_access_ids_for_request built the Meilisearch tenant-token filter from legacy CourseStaffRole/CourseInstructorRole only, so users holding an authz-only course role (course_editor / course_auditor with no legacy twin) were excluded from the search access filter. Their courses returned zero results in the global Studio search modal and the Library Updates "Review Content Updates" tab. This is openedx-authz#417. Add _get_authz_course_keys to union the user's per-course authz role assignments (CourseOverviewData scope) into the access_id filter clause, gated per-course on AUTHZ_COURSE_AUTHORING_FLAG so global-off deployments with per-course/org overrides still resolve correctly. Also handle org-wide (glob) authz grants, e.g. course-v1:Org+*, which surface as an OrgCourseOverviewGlobData scope rather than a per-course scope and so were missed by both filter clauses -- the same openedx#417 gap for the org case. Add get_authz_org_keys to resolve org-glob grants to org short_names and union them into _get_user_orgs, landing them in the org IN [...] clause (one entry per org, mirroring legacy org staff roles and avoiding per-course access_id fan-out against the JWT size cap). Each org is gated via CourseWaffleFlag.is_enabled_for_org, since a per-course override cannot gate an org-wide grant. A single per-request-cached fetch (_get_cached_authz_assignments) backs both helpers so the enforcer is queried once per request rather than twice. The authz lookups fail open on a DatabaseError (logged, empty set) so search degrades to legacy access rather than 500-ing; any other error propagates. Scope parsing is narrowed to InvalidKeyError so a non-course authz scope (e.g. a library) is skipped rather than mishandled. Closes: openedx/openedx-authz#417

BryanttV

LGTM! Thanks for addressing my comments!

openedx-webhooks added open-source-contribution PR author is not from Axim or 2U core contributor PR author is a Core Contributor (who may or may not have write access to this repo). labels Sep 2, 2026

openedx-webhooks added this to Contributions Sep 2, 2026

github-project-automation Bot moved this to Needs Triage in Contributions Sep 2, 2026

wgu-taylor-payne force-pushed the tpayne/fix-meilisearch-access-ids-authz branch 2 times, most recently from 5d245c8 to a65995b Compare September 8, 2026 22:40

wgu-taylor-payne changed the title ~~feat: include authz course role assignments in Meilisearch access_ids~~ feat: include authz course + org role grants in Meilisearch access filter Sep 8, 2026

wgu-taylor-payne mentioned this pull request Sep 9, 2026

Provide a typed exception surface (AuthzError hierarchy) at the public API boundary openedx/openedx-authz#439

Open

mphilbrick211 added the mao-onboarding Reviewing this will help onboard devs from an Axim mission-aligned organization (MAO). label Sep 9, 2026

mphilbrick211 moved this from Needs Triage to Waiting on Author in Contributions Sep 9, 2026

wgu-taylor-payne force-pushed the tpayne/fix-meilisearch-access-ids-authz branch from a65995b to c898c71 Compare September 10, 2026 15:49

wgu-taylor-payne marked this pull request as ready for review September 10, 2026 18:21

wgu-taylor-payne requested review from BryanttV, mariajgrimaldi and rodmgwgu and a lite review from Copilot September 10, 2026 18:21

Copilot started reviewing on behalf of wgu-taylor-payne September 10, 2026 18:22 View session

Copilot AI reviewed Sep 10, 2026

View reviewed changes

Comment thread openedx/core/djangoapps/content/search/models.py

wgu-taylor-payne marked this pull request as draft September 10, 2026 19:33

wgu-taylor-payne force-pushed the tpayne/fix-meilisearch-access-ids-authz branch from c898c71 to aef74ef Compare September 11, 2026 18:52

wgu-taylor-payne marked this pull request as ready for review September 11, 2026 19:02

BryanttV suggested changes Sep 14, 2026

View reviewed changes

Comment thread openedx/core/djangoapps/content/search/tests/test_models.py

Comment thread openedx/core/djangoapps/content/search/models.py Outdated

Comment thread openedx/core/djangoapps/content/search/models.py Outdated

wgu-taylor-payne force-pushed the tpayne/fix-meilisearch-access-ids-authz branch 2 times, most recently from 5e9355a to 093e93d Compare September 14, 2026 21:10

wgu-taylor-payne force-pushed the tpayne/fix-meilisearch-access-ids-authz branch from 093e93d to a0c7099 Compare September 15, 2026 19:27

BryanttV approved these changes Sep 16, 2026

View reviewed changes

wgu-taylor-payne changed the title ~~feat: include authz course + org role grants in Meilisearch access filter~~ feat: include authz role grants in Meilisearch access filter Sep 16, 2026

Navigation Menu

Uh oh!

feat: include authz role grants in Meilisearch access filter - #39073

feat: include authz role grants in Meilisearch access filter#39073
wgu-taylor-payne wants to merge 2 commits into
openedx:masterfrom
WGU-Open-edX:tpayne/fix-meilisearch-access-ids-authz

wgu-taylor-payne commented Sep 2, 2026 •

edited

Loading

Uh oh!

openedx-webhooks commented Sep 2, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

BryanttV left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

BryanttV left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

wgu-taylor-payne commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Supporting information

Testing instructions

Deadline

Other information

AI Usage

Uh oh!

openedx-webhooks commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

BryanttV left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

BryanttV left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

wgu-taylor-payne commented Sep 2, 2026 •

edited

Loading

openedx-webhooks commented Sep 2, 2026 •

edited

Loading