Repository navigation
fix: split authz view and manage permissions in ProctoredExamSettingsView - #39196
Conversation
openedx-webhooks
added
open-source-contribution
|
Thanks for the pull request, @BryanttV! This repository is currently maintained by Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review. 🔘 Get product approvalIf you haven't already, check this list to see if your contribution needs to go through the product review process.
🔘 Provide contextTo help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:
🔘 Get a green buildIf one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green. DetailsWhere can I find more information?If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources: When can I expect my changes to be merged?Our goal is to get community contributions seen and reviewed as efficiently as possible. However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:
💡 As a result it may take up to several weeks or months to complete a review and merge your PR. |
rodmgwgu
left a comment
rodmgwgu
left a comment
There was a problem hiding this comment.
Thanks for this, tested in my local and works as described, code looks good, thanks!
…ngsView GET and POST on this endpoint only required studio read access, so a user who could view a course in Studio could also read or overwrite its proctored exam settings by calling the API directly, bypassing the UI's staff-only enforcement. Add the same authz check used elsewhere for pages-and-resources management, with a write-level legacy fallback when authz is disabled. Closes openedx-authz#443
Make the AuthZ check the only gate for the proctored exam settings endpoint instead of stacking it on top of the legacy Studio read check: - GET requires courses.view_pages_and_resources and POST requires courses.manage_pages_and_resources. Without AuthZ, both fall back to legacy Studio read access, as before. - POST checks access before validating the payload. - Users with is_staff, or with the manage permission when AuthZ is enabled, can edit the fields reserved to edX staff. Replace the mocked AuthZ tests with tests that assign real roles. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
ed0a557 to
0cb8eaf
Compare
5 participants
Description
Builds on #39153, which added the
courses.manage_pages_and_resourcesAuthZ check toProctoredExamSettingsView. That change stacked the AuthZ check on top of the legacy Studio read check and used the manage permission for both GET and POST. This PR makes AuthZ the only gate for the endpoint and splits read from write access:courses.view_pages_and_resources; POST requirescourses.manage_pages_and_resources.POSTnow checks access before validating the payload, so unauthorized users get a 403 instead of payload-dependent responses.is_staff, or by users holding the manage permission when AuthZ is enabled for the course. Without AuthZ, they stay reserved to global staff.get_course_and_check_accesscall is replaced by a directmodulestore().get_course(...)lookup after the permission check, so the AuthZ check is not stacked on top of the legacy one.Impacted roles: Course Author / Course Staff managing proctoring settings in Studio, and Operators using the API directly.
Supporting information
courses.manage_pages_and_resourcestoProctoredExamSettingsViewopenedx-authz#443Testing instructions
200onGET /api/contentstore/v1/proctored_exam_settings/<course_id>and403onPOST.courses.manage_pages_and_resourcescanGETandPOST, including the staff-only fields.403on both.is_staffusers can edit the staff-only fields.