Spike: Backend Endpoint Strategy for Course Authoring Flag #372

Description

Investigate how authorization-related backend endpoints should consistently account for the status of the authz.enable_course_authoring Waffle Flag, ensuring that the exposure and validation of roles, permissions, scopes, and assignments associated with course authoring align with the availability of the feature.

Questions to Answer

• Which backend endpoints should account for the status of the authz.enable_course_authoring Waffle Flag?
• How should the Waffle Flag affect the behavior of each endpoint (filtering, validation, authorization, or response content)?
• Should this logic be implemented centrally within the framework or explicitly in each endpoint?

Deliverables

• Inventory of endpoints that should account for the status of the Waffle Flag.
• Definition of expected behavior for each endpoint when the feature is enabled vs. disabled.
• Proposal for a consistent strategy to incorporate this logic into the backend, taking into account that the flag will be deprecated in the next releases. The design must ensure that removing the feature flag in the future will require minimal to no refactoring.
• Strategy to verify performance (load testing, response times, etc.) to ensure the new validation logic does not degrade the backend's efficiency.
• Analysis of risks, impact, and architectural considerations.
• High-level estimate for implementing the proposed solution.