feat: libraries v2 support for studio perms XBlock service by Kelketek · Pull Request #39074 · openedx/openedx-platform

Kelketek · 2026-09-02T22:50:57Z

Description

This Pull Request makes the studio permissions service more consistently available, and adds support for Libraries v2 to it.

Supporting information

Internal ticket: https://tasks.opencraft.com/browse/BB-11135

Testing instructions

Switch your devstack to this branch
Install this version of XBlocks-core
Follow the instructions there to test the revised service capabilities

Other information

To check: Does this change make the service available in the LMS? Do we care if so?

openedx-webhooks · 2026-09-02T22:51:02Z

Thanks for the pull request, @Kelketek!

This repository is currently maintained by @openedx/wg-maintenance-openedx-platform-oncall.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
- This process (including the steps you'll need to take) is documented here.
If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

Dependencies

This PR must be merged before / after / at the same time as ...
Blockers

This PR is waiting for OEP-1234 to be accepted.
Timeline information

This PR must be merged by XX date because ...
Partner information

This is for a course on edx.org.
Supporting documentation
Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

Details

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

The size and impact of the changes that it introduces
The need for product review
Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

Kelketek · 2026-09-11T00:35:35Z

@pkulkark This is ready for you.

pkulkark · 2026-09-11T16:32:41Z

+    def can_read(self, context_key):
+        """ Does the user have read access to the given course/library? """
+        if isinstance(context_key, LibraryLocatorV2):
+            return authz_api.is_user_allowed(


Why not use the [user_has_permission_across_lib_authz_systems](https://github.com/openedx/openedx-platform/blob/master/openedx/core/djangoapps/content_libraries/api/libraries.py#L842) method? That seems to handle both legacy as well as authz grants and additional checks via the bridgekeeper rules behind has_perm.

@pkulkark I tried that, but it violates the import linting rules. You are not permitted to import higher-level packages from lower-level ones.

I also had to move the service because the LMS isn't permitted to import from the CMS.

I see. Perhaps we could directly add user.is_authenticated and user.is_active and user.is_staff in that case? Both are plain attribute checks in the bridgekeeper rules. Adding them to the library branch would close the gap where an inactive user with an authz role passes here, and the one where global staff get write on a course but not on a library through the same method.

As for the legacy grants, if we can't add an exception (like this example), could we atleast note in the docstring that this service does not see legacy grants?

@pkulkark We don't have to worry about the legacy grants, as all of the grant info has been copied over by now and the legacy checks are just pending removal.

The staff check shouldn't be needed, as someone can be non-global staff and still have library access.

The anonymous check isn't necessary-- authz will return False. I've tested this:

In [1]: import openedx_authz.api as authz_api In [2]: from django.contrib.auth.models import AnonymousUser In [3]: user = AnonymousUser() In [4]: from openedx_authz.constants.permissions import EDIT_LIBRARY_CONTENT, VIEW_LIBRARY In [5]: authz_api.is_user_allowed(user, VIEW_LIBRARY.identifier, 'lib:Test:TL100')

is_active isn't checked by authz, and while in most cases it would probably be checked by the calling code during the request process, I've gone ahead and added a check to be safe.

Fair enough. Thanks @Kelketek

pkulkark · 2026-09-11T16:37:55Z

Note: This PR is what makes the permission check in openedx/xblocks-core#291 work in v2 libraries. Since xblocks-contrib is a pip package that operators can bump independently of a platform upgrade, an operator could install the PDF conversion block on a platform that does not yet carry this change. In that state the check falls back to the Django staff flag, which blocks real library authors and lets any staff user write assets into libraries they can only view. Worth saying explicitly on both PRs which one has to land first.

Kelketek · 2026-09-11T18:17:56Z

@pkulkark

In that state the check falls back to the Django staff flag, which blocks real library authors and lets any staff user write assets into libraries they can only view. Worth saying explicitly on both PRs which one has to land first.

This has changed now that I made the permissions service more available. Now it requires the permissions service and no longer falls back.

pkulkark

LGTM 👍

bradenmacdonald · 2026-09-16T22:35:32Z

-    """
-    Service that can provide information about a user's permissions.
-
-    Deprecated. To be replaced by a more general authorization service.


"Hmm, this StudioPermissionsService is marked as Deprecated, and now this PR is un-deprecating it. I wonder who marked it as deprecated and what the replacement is."

(looks at git blame)

Oh.

bradenmacdonald · 2026-09-16T22:37:08Z

+    def can_read(self, context_key):
+        """ Does the user have read access to the given course/library? """
+        if isinstance(context_key, LibraryLocatorV2):
+            return self._user.is_active and authz_api.is_user_allowed(
+                self._user,
+                VIEW_LIBRARY.identifier,
+                str(context_key),
+            )
+        return has_studio_read_access(self._user, context_key)
+
+    def can_write(self, context_key):
+        """ Does the user have write access to the given course/library? """
+        if isinstance(context_key, LibraryLocatorV2):
+            return self._user.is_active and authz_api.is_user_allowed(
+                self._user,
+                EDIT_LIBRARY_CONTENT.identifier,
+                str(context_key),
+            )
+        return has_studio_write_access(self._user, context_key)


I guess we need can_read and can_write for backwards compatibility, but we have much more fine-grained permissions now. Should we update the permissions service to support those fine-grained permissions instead?

@bradenmacdonald I've pushed a change here that includes much more fine-grained permissions. I'm about to start adding tests for it now. Is this what you had in mind?

@Kelketek Yes, that's what I had in mind :)

@bradenmacdonald Cool-- I've cleaned it up a bit and added some tests. There was one hitch here-- it looks like the AuthZ perms for courses aren't actually added yet. So I put in a decorator shim to perform fallback behavior until they're working right.

Hmm, am I missing something? We've been merging a whole bunch of PRs like this which use the new course authoring permissions to make parts of the Studio UI read-only. And I tested those PRs, and they were working as expected, so I thought the fine-grained Studio permissions were implemented.

@bradenmacdonald Nope, I am. I found loading the roles didn't make the code work, and some comments in other code talked about AuthZ support not being available yet, and I figured that was universal.

Reading that PR gave me enough context to figure out how to get things working here, and I've updated the PR to test AuthZ being enabled and disabled in the course. Please check now. :)

bradenmacdonald · 2026-09-16T22:37:45Z


 def create_library(
-    org: str,
+    org: Organization,


It's a little concerning that mypy hadn't flagged any error here ?

@bradenmacdonald Yes, it is. And after playing with it for a bit, I can't seem to make it fail. I don't want to detour too far here, but something's up. I tried changing mypy's file includes to globs just to make sure the directory paths weren't insufficient, and I tried switching the types back and forth, but despite the fact I know some files that call this function are in the includes, they aren't considered wrong whether I set it to Organization or string, and whether I comment out the assert below or not.

Ah, it's because https://github.com/openedx/edx-organizations doesn't include types, so mypy treats Organization as Any.

Kelketek · 2026-09-21T19:31:10Z

@bradenmacdonald Ready for another pass. Thanks!

Kelketek · 2026-09-25T14:00:53Z

@bradenmacdonald Reminder ping :) Is there anything else you need here or is this good to go?

bradenmacdonald · 2026-09-25T17:07:50Z

@Kelketek I just have a huge stack of PRs waiting for my review, so it may take a while. Is there a deadline here?

Kelketek · 2026-09-25T17:57:19Z

@bradenmacdonald The whole thing between all PRs needs to be completed before the next release. Other than that, no. Thanks for the heads up!

bradenmacdonald

LGTM. I've read the code but didn't test the latest version. Sorry for the delay :/

I'm just going to ask on Slack if anyone from the RBAC team wants to review this as well.

rodmgwgu

Changes look good and go along the plans for openedx-authz.

About your question: "Does this change make the service available in the LMS? Do we care if so?" -> No problem, we were already planning to extend the availability of authz functionality to LMS as part of the instructor dashboard integration we are starting soon.

Thanks!

rodmgwgu · 2026-10-15T18:44:32Z

+        """ Does the user have write access to the given course/library? """
+        warnings.warn(
+            "can_write is deprecated. "
+            "Use a more specific permission, like can_write_content, can_create_files, "


nit: it should be "can_edit_content" instead of "can_write_content"

Kelketek · 2026-10-15T19:19:13Z

Thanks, @rodmgwgu ! Glad to hear it.

@bradenmacdonald I've rebased to get everything up to date. Anything else we need, or are we good to go here?

openedx-webhooks added open-source-contribution PR author is not from Axim or 2U core contributor PR author is a Core Contributor (who may or may not have write access to this repo). labels Sep 2, 2026

openedx-webhooks added this to Contributions Sep 2, 2026

github-project-automation Bot moved this to Needs Triage in Contributions Sep 2, 2026

Kelketek changed the title ~~feat: libraries v2 support for studio perms~~ feat: libraries v2 support for studio perms XBlock service Sep 3, 2026

Kelketek force-pushed the fox/studio-permissions-universality branch 16 times, most recently from d1b890f to 702805f Compare September 9, 2026 18:18

mphilbrick211 moved this from Needs Triage to Waiting on Author in Contributions Sep 9, 2026

Kelketek force-pushed the fox/studio-permissions-universality branch 2 times, most recently from 5dbbc5b to a12c7d7 Compare September 10, 2026 23:55

Kelketek mentioned this pull request Sep 10, 2026

feat: gotenberg support for PDF block openedx/xblocks-core#291

Open

Kelketek marked this pull request as ready for review September 11, 2026 00:35

Kelketek requested a review from a team as a code owner September 11, 2026 00:35

pkulkark reviewed Sep 11, 2026

View reviewed changes

Comment thread openedx/core/djangoapps/xblock/runtime/runtime.py

Kelketek force-pushed the fox/studio-permissions-universality branch 4 times, most recently from 54a33ba to 14899bf Compare September 11, 2026 19:19

pkulkark approved these changes Sep 11, 2026

View reviewed changes

bradenmacdonald reviewed Sep 16, 2026

View reviewed changes

Kelketek force-pushed the fox/studio-permissions-universality branch 2 times, most recently from 18d2f1f to 4d4a7ac Compare September 21, 2026 19:29

Kelketek force-pushed the fox/studio-permissions-universality branch 4 times, most recently from 1f327b0 to 09f2ebd Compare September 23, 2026 18:19

bradenmacdonald approved these changes Oct 15, 2026

View reviewed changes

rodmgwgu approved these changes Oct 15, 2026

View reviewed changes

feat: libraries v2 support for studio perms

f1c0e01

Kelketek force-pushed the fox/studio-permissions-universality branch from 09f2ebd to f1c0e01 Compare October 15, 2026 18:54

bradenmacdonald merged commit 4915ebb into openedx:master Oct 15, 2026
42 checks passed

bradenmacdonald deleted the fox/studio-permissions-universality branch October 15, 2026 20:56

github-project-automation Bot moved this from Waiting on Author to Done in Contributions Oct 15, 2026

Conversation

Kelketek commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Supporting information

Testing instructions

Other information

Uh oh!

openedx-webhooks commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Kelketek commented Sep 11, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Kelketek Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

pkulkark commented Sep 11, 2026

Uh oh!

Kelketek commented Sep 11, 2026

Uh oh!

pkulkark left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Kelketek commented Sep 21, 2026

Uh oh!

Kelketek commented Sep 25, 2026

Uh oh!

bradenmacdonald commented Sep 25, 2026

Uh oh!

Kelketek commented Sep 25, 2026

Uh oh!

bradenmacdonald left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rodmgwgu left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Kelketek commented Oct 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Kelketek commented Sep 2, 2026 •

edited

Loading

openedx-webhooks commented Sep 2, 2026 •

edited

Loading

Kelketek Sep 11, 2026 •

edited

Loading

bradenmacdonald left a comment •

edited

Loading