fix: backport RBAC (openedx-authz) bug fixes to release/verawood

[BryanttV]

Closes: openedx/openedx-authz#513

Description

Backport to release/verawood of the RBAC (openedx-authz) bug fixes already merged into master, as tracked in openedx/openedx-authz#513. They fix wrongful 403s in Studio, crashes with platform-wide (glob) role assignments, and inconsistent permission gates.

Commits

#	Original PR	Description	Notes
1	#39001	Upgrade openedx-authz 1.21.0 → 1.23.0	Not a cherry-pick. Required by #38973 (≥ 1.22.0) and by the view_* permission PRs (1.23.0).
2	#38973	Revert "Cannot rerun courses – authz role assignment expects rerun to already exist"	Reverts #38858, the Verawood backport of #38840. The requirements/*.txt hunks were dropped because the bump is in commit 1.
3	#39007	Split read vs write authz checks for advanced settings	Clean. Requires authz 1.23.0.
4	#39008	Split read vs write authz checks for certificates	Clean. Requires authz 1.23.0.
5	#38986	Course Auditor gets 403 navigating to a course unit	Clean.
6	#38984	RoleCache legacy compat layer ignores platform-wide glob role assignments	Clean.
7	#38980	Platform-wide glob role assignments crash get_orgs_for_user/has_org_for_user	Clean.
8	#39075	Course editor gets 403 copying a unit to the clipboard	Clean.
9	#39009	Split read vs write authz checks for library updates	Dependency of #39055 (its tests conflict without it). Requires authz 1.23.0.
10	#39055	Allow Course Admin/Staff/Editor to sync library updates into a course	Clean after #39009.
11	#39013	Authz edit permission gate for XBlock component card action menu	Dependency of #39050 (conflicts in block.py, preview.py, tests and template without it).
12	#39112	Make can_tag_object's course check authorization-service aware	Conflict in content_tagging/rest_api/v1/views.py, because Verawood pins openedx-core==1.0.3 and its view differs from master. Resolved by keeping Verawood's code, removing ObjectTagOrgView.ensure_user_has_can_tag_object_permissions, and dropping the now-unused COURSES_MANAGE_TAGS import. The parent method in openedx-core 1.0.3 resolves through has_perm("oel_tagging.can_tag_object"), as the PR assumes.
13	#39050	Gate xblock action menu on authz edit/manage_tags permissions	Clean after #39013.
14	#39113	Add authz validation to course optimizer tool	Clean.
15	#39144	Align reindex link with authz permissions	Conflict in contentstore/utils.py, because master migrated ENABLE_COURSEWARE_INDEX off FEATURES-as-dict. Resolved by keeping settings.FEATURES.get('ENABLE_COURSEWARE_INDEX', False) plus the new user_can_reindex_course(...) check.
16	#39010	Split read vs write authz checks for group configurations	Conflicts in contentstore/views/course.py and contentstore/views/tests/test_group_configurations.py, because master dropped the legacy Group Configurations page (49c2f556ac) while Verawood still has it. Resolved by keeping Verawood's legacy text/html branch in group_configurations_list_handler (including the redirect and render_to_response) and applying only the PR's read/write permission changes. In the tests, the imports were merged: Verawood's override_waffle_flag and toggles were kept, and COURSE_AUDITOR and COURSE_EDITOR were added. Requires authz 1.23.0.

Not included yet

• feat: gate Studio Meilisearch access on authz view_course grants #39073
• fix: let course_id bypass library access when reviewing pending updates #39107
• fix: split authz view and manage permissions in ProctoredExamSettingsView #39196
• fix: apply openedx-authz manage_tags orgs consistently across tagging rules #39197 (Draft PR)
• Gradebook fails with UnboundLocalError in BulkRoleCache.prefetch (authz compat roles loop) openedx-authz#514 (Without PR yet)

[openedx-webhooks]

Thanks for the pull request, @BryanttV!

This repository is currently maintained by @openedx/wg-maintenance-openedx-platform-oncall.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

• If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
  • This process (including the steps you'll need to take) is documented here.
• If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

• Dependencies

  This PR must be merged before / after / at the same time as ...

• Blockers

  This PR is waiting for OEP-1234 to be accepted.

• Timeline information

  This PR must be merged by XX date because ...

• Partner information

  This is for a course on edx.org.

• Supporting documentation
• Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

🔘 Update the status of your PR

Your PR is currently marked as a draft. After completing the steps above, update its status by clicking "Ready for Review", or removing "WIP" from the title, as appropriate.

---

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

• Overview of Review Process for Community Contributions
• Pull Request Status Guide
• Making changes to your pull request

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

• The size and impact of the changes that it introduces
• The need for product review
• Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.