fix(authz): resolve course authoring flag inside the audit actions cell by dcoa · Pull Request #271 · openedx/frontend-app-admin-console

dcoa · 2026-10-15T10:50:52Z

Description

In the user audit view (/authz/user/<username>), the delete control for a course-scope assignment could rendered as the "course authoring disabled" button. This happened even when course authoring was on for that course and the viewer had courses.manage_course_team. As a result, course team members couldn't be removed from the console.

Root cause

Paragon's DataTable only reads additionalColumns through react-table's visibleColumns hook. React-table caches the visible columns with a memo that depends on columns, not on additionalColumns.

The audit page built the actions cell with createActionsCell({ isCourseEnabled }). On first render, the waffle-flag states are still loading, and useCourseAuthoringFlag returns a resolver that answers false for every course. When the flags arrived, the page rebuilt additionalColumns, but the table kept the first cell, which still held the loading-state resolver until cached get updated. Course rows therefore stayed on the DisabledCourseActionButton branch.

You can see the error for example entering the user view at first load, it will show the action disabled.

Before

After

Changes

ActionsCell (src/authz-module/components/TableCells.tsx) reads the flag with useCourseAuthoringFlag() itself, like TeamMemberViewActionCell already does. The isCourseEnabled prop is removed.
AuditUserPage no longer resolves the flag or passes it to the cell.
The TableCells tests mock the flag hook instead of passing the prop.
New regression test on the audit page: it renders with the flag still loading, then with it resolved on, and checks that the course row's delete control goes from disabled to enabled. This test fails without the fix.

Testing instructions

On an instance where course authoring is enabled for a specific course (course override on, global off), give a user a course_staff role on that course.
As a user with courses.manage_course_team on that course, open /authz/user/<username> directly so the flag query isn't cached yet.
The delete action on the course row should be enabled, and removing the role should work.
For a course where authoring is off, the delete action should still be disabled, with the "manage its team in Studio instead" tooltip.

DataTable only reads additionalColumns through react-table's visibleColumns hook, whose memo doesn't depend on it. The actions cell created by createActionsCell kept the isCourseEnabled resolver from the flag's loading state, so course-scope rows rendered the "course authoring disabled" delete button even after the flag resolved on. ActionsCell now reads the flag with useCourseAuthoringFlag directly. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

openedx-webhooks · 2026-10-15T10:50:59Z

Thanks for the pull request, @dcoa!

This repository is currently maintained by @openedx/committers-frontend.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
- This process (including the steps you'll need to take) is documented here.
If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

Dependencies

This PR must be merged before / after / at the same time as ...
Blockers

This PR is waiting for OEP-1234 to be accepted.
Timeline information

This PR must be merged by XX date because ...
Partner information

This is for a course on edx.org.
Supporting documentation
Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

Details

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

The size and impact of the changes that it introduces
The need for product review
Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

codecov · 2026-10-15T10:53:46Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.71%. Comparing base (2e8035b) to head (138b9c6).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #271      +/-   ##
==========================================
- Coverage   98.71%   98.71%   -0.01%     
==========================================
  Files          80       80              
  Lines        1403     1402       -1     
  Branches      474      472       -2     
==========================================
- Hits         1385     1384       -1     
  Misses         18       18

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

bra-i-am

Working as expected!!

The delete action only gates course authoring for course scopes. Reading that from the role key misclassifies roles whose name doesn't carry the "lib" prefix, so resolve the scope's context type instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

dcoa · 2026-10-20T07:42:08Z

@bra-i-am I just made a push to validate isCourseScope from scope field rather than role, could you please double check

bra-i-am

I really like the reuse of getScopeContextType you made here; it looks prettier!

In order to contribute to this cleaning effort, I would also suggest these changes.

I preserve my approve

bra-i-am · 2026-10-20T15:36:29Z

        : scope,
      iconSrc: getScopeResourceIcon(scope),
    };
  }, [row.original, formatMessage]);


Currently, useMemo is a no-op because row.original will always return a new object

Suggested change

}, [role, scope, org, formatMessage]);

bra-i-am · 2026-10-20T15:47:57Z


  return (
    <span className="d-flex align-items-center">
      {iconSrc && <Icon color="primary" src={iconSrc} className="mr-2" size="xs" />}


iconSrc will never be falsy

Suggested change

<Icon color="primary" src={iconSrc} className="mr-2" size="xs" />

Already in #255

bra-i-am · 2026-10-20T15:51:40Z

  const { key, ...cellProps } = cell.getCellProps({ 'data-role': MAP_ROLE_KEY_TO_LABEL[value] || '' });
  return (
    <span key={key} {...cellProps}>
      {MAP_ROLE_KEY_TO_LABEL[value] || ''}
    </span>
  );


we can extract MAP_ROLE_KEY_TO_LABEL[value] to avoid duplicating it in this component

Suggested change

const label = MAP_ROLE_KEY_TO_LABEL[value] || '';

const { key, ...cellProps } = cell.getCellProps({ 'data-role': label });

return (

<span key={key} {...cellProps}>

{label}

</span>

);

Replaced for inline text #255

bra-i-am · 2026-10-20T16:11:36Z

  const isDjangoRole = DJANGO_MANAGED_ROLES.includes(role);
  return (
    <span>
      { isDjangoRole
        ? formatMessage(
            messages['authz.user.table.permissions.access.label'],
            { accessType: role === 'django.superuser' ? 'total' : 'partial' },
          )
        : formatMessage(messages['authz.user.table.permissions.available.count'], { count })}
    </span>
  );


I'm not a big fan of having nested ternary operators... ik the accessType ternary is not literally nested, but it could be kinda cleaner

Suggested change

const accessType = role === 'django.superuser' ? 'total' : 'partial';

const text = DJANGO_MANAGED_ROLES.includes(role)

? formatMessage(messages['authz.user.table.permissions.access.label'], { accessType })

: formatMessage(messages['authz.user.table.permissions.available.count'], { count });

return <span>{text}</span>;

Applied in #255

bra-i-am · 2026-10-20T16:15:28Z

@@ -200,9 +203,8 @@
    );
  }


Remove RoleToDelete to let TS do its job; also, roleToDelete is created to be used once immediately after... it could be passed directly

const handleDelete = () => { onClickDeleteButton({ role, scope, name: MAP_ROLE_KEY_TO_LABEL[role] || '', }); };

Applied in #255

dcoa · 2026-10-20T22:58:45Z

In order to contribute to this cleaning effort, I would also suggest these changes.

Thanks @bra-i-am those changes are good, I will take those in consideration when I start the refactoring here #247 and leave here only the changes directly related to the action button and the course flag.

openedx-semantic-release-bot · 2026-10-22T00:57:04Z

🎉 This PR is included in version 1.0.0-alpha.11 🎉

The release is available on:

Your semantic-release bot 📦🚀

openedx-webhooks added open-source-contribution PR author is not from Axim or 2U core contributor PR author is a Core Contributor (who may or may not have write access to this repo). labels Oct 15, 2026

openedx-webhooks added this to Contributions Oct 15, 2026

github-project-automation Bot moved this to Needs Triage in Contributions Oct 15, 2026

dcoa linked an issue Oct 15, 2026 that may be closed by this pull request

User audit view: course-scope delete control can stay "course authoring disabled" incorrectly #258

Closed

dcoa marked this pull request as ready for review October 15, 2026 10:54

dcoa requested review from bra-i-am and jesusbalderramawgu October 15, 2026 11:01

dcoa mentioned this pull request Oct 15, 2026

fix(verawood): audit user course delete flag stale #272

Open

bra-i-am approved these changes Oct 19, 2026

View reviewed changes

bra-i-am approved these changes Oct 20, 2026

View reviewed changes

dcoa merged commit e2a8609 into openedx:master Oct 22, 2026
6 checks passed

github-project-automation Bot moved this from Needs Triage to Done in Contributions Oct 22, 2026

openedx-semantic-release-bot added the released on @latest label Oct 22, 2026

dcoa mentioned this pull request Oct 22, 2026

refactor: reorganize user table to match team members order and styles #255

Merged


	<Icon color="primary" src={iconSrc} className="mr-2" size="xs" />

+  const accessType = role === 'django.superuser' ? 'total' : 'partial';
+  const text = DJANGO_MANAGED_ROLES.includes(role)
+    ? formatMessage(messages['authz.user.table.permissions.access.label'], { accessType })
+    : formatMessage(messages['authz.user.table.permissions.available.count'], { count });
+  return <span>{text}</span>;

Conversation

dcoa commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Root cause

Changes

Testing instructions

Uh oh!

openedx-webhooks commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

bra-i-am left a comment

Choose a reason for hiding this comment

Uh oh!

dcoa commented Oct 20, 2026

Uh oh!

bra-i-am left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dcoa commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

openedx-semantic-release-bot commented Oct 22, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

dcoa commented Oct 15, 2026 •

edited

Loading

openedx-webhooks commented Oct 15, 2026 •

edited

Loading

codecov Bot commented Oct 15, 2026 •

edited

Loading

dcoa commented Oct 20, 2026 •

edited

Loading