[efortish]

Description

Stacked on top of openedx#39255 / this branch (not mergeable until that one lands, since it carries that PR's full diff). Migrates every endpoint behind the Cohorts tab to the shared Instructor Dashboard AuthZ infrastructure from openedx-authz#486, per the README's migration guide (lms/djangoapps/instructor/authz/README.rst), whose "legacy rule that is not a bridgekeeper permission" example is literally written against this tab.

Endpoints migrated

View	Methods	authz_permission	Legacy fallback
CohortSettings (openedx.core.djangoapps.course_groups.views)	GET / PUT	view_cohorts / manage_cohorts	default (see below)
CohortHandler	GET / POST / PATCH	view_cohorts / manage_cohorts / manage_cohorts	default
CohortUsers	GET / POST / DELETE	view_cohorts / manage_cohorts / manage_cohorts	default
course_cohort_settings_handler (legacy function view, still used by Studio)	GET / PATCH	view_cohorts / manage_cohorts	custom, see below
CohortCSV (lms.djangoapps.instructor.views.api)	POST	manage_cohorts	custom, see below

The three DRF views (CohortSettings/CohortHandler/CohortUsers) don't set legacy_permission_check or permission_name at all. That's deliberate: with both left unset, user_has_instructor_permission's fallback resolves each method's own default from LEGACY_PERMISSION_CHECKS (keyed by authz_permission, not by view), and has_cohort_view_access/has_cohort_manage_access (already built in openedx#39255's legacy.py) already reproduce IsStaffOrAdmin's exact logic, GET included (staff/instructor plus forum admin/moderator/community TA), writes staff/instructor only. Setting a single legacy_permission_check here would have pinned one check across every method, undoing the per-method distinction the mapping is supposed to give. IsStaffOrAdmin itself is now dead code (this migration was its only remaining caller) and I deleted it along with course_groups/permissions.py.

course_cohort_settings_handler keeps its own, narrower legacy behavior: it only ever required get_course_with_access(user, 'staff', course_key) for both GET and PATCH (no forum-role carve-out, unlike the DRF views). I didn't want to silently broaden it, so it gets an explicit legacy check (_legacy_cohort_staff_access) that reproduces that exact call instead of falling back to the broader default.

CohortCSV previously used IsAdminUser (Django's global is_staff), not a course-level check at all, unlike every other cohorts endpoint. I preserved that exact behavior via a custom legacy_permission_check rather than widening it to has_cohort_manage_access, since that would grant CSV upload to course staff/instructors who couldn't do it before. Worth a product/security conversation if that's actually supposed to be manage_cohorts long-term, flagging it here rather than deciding unilaterally.

Shared infra change

InstructorAuthzPermission.has_permission hardcoded the course-key URL kwarg as course_id, true for every other Instructor Dashboard v2 view, but the cohorts API uses course_key_string. Added an optional course_id_url_kwarg view attribute (defaults to "course_id", so every already-migrated view is unaffected) and documented it in the README, since any future subtask with a non-standard kwarg name will hit the same thing.

Fixes openedx-authz#492.

Testing

Added:

• CohortsAuthzTest (course_groups/tests/test_views_authz.py): the three DRF views, across every GET/write endpoint, covering Course Admin, Course Staff, no permission, AuthZ denying a legacy instructor, the legacy path with the flag off, and that AuthZ isn't queried when the flag is off.
• CohortSettingsHandlerAuthzTest: the legacy function view, same coverage, plus a dedicated check that a course instructor keeps exactly the access it had before (not more, not less).
• CohortCSVAuthzTest: Course Admin and no-permission cases, plus a dedicated test that Django-staff keeps access while a course instructor (who gets manage_cohorts through AuthZ) does not get it through the legacy path, since that path was never broadened.
• test_custom_course_id_url_kwarg in the shared test_permissions.py, for the new course_id_url_kwarg attribute.

Also ran, unmodified:

• The existing openedx/core/djangoapps/course_groups/ suite (102 tests, including the OAuth-authenticated staff/non-staff cases and the CSV upload test), to confirm the legacy path is byte-for-byte unchanged.
• Full course_groups/ + instructor/authz/: 191 passed.
• Full lms/djangoapps/instructor/: 1027 passed.
• ruff, pylint, lint-imports clean.

Deadline

None