[BB-3622] Restrict user create course

[farhaanbukhsh]

The condition added to ensure that if the feature is enabled
user will not be able to create the course outside of the organisation
in which they belong.

JIRA tickets: BB-3622

Discussions: Link to any public dicussions about this PR or the design/architecture. Otherwise omit this.

Dependencies: None

Screenshots:

Sandbox URL: TBD - sandbox is being provisioned.

Merge deadline: "None" if there's no rush, "ASAP" if it's critical, or provide a specific date if there is one.

Testing instructions:

1. Get the devstack up and running
2. Pull this branch in edx-platform
3. Drop in the studio shell make dev.shell.studio
4. vim /edx/etc/studio.yml
5. In the FEATURES dictionary add RESTRICT_NON_ORG_COURSE_CREATION: true
6. Now create a user either make it a staff user
7. Go to the admin page and in localhost:18010/admin/student/courseaccessrole/ create a new entry, add the user, give it instructor privilege, don't add the Org yet
8. Log in the studio and try creating the course, you should get an error
9. Now in the course access role add an organization with which you were trying to create the course, save it.
10. Try creating the course again, it should create the course.

Author notes and concerns:

1. It's a in discovery feature

Reviewers

• @lgp171188

[lgp171188]

@farhaanbukhsh, we may have to update this message after edX's review. At this point, I'd suggest something like

User does not have the permission to create courses in this organization

[farhaanbukhsh]

that does sound reasonable. Thanks 😄

[lgp171188]

@farhaanbukhsh, I haven't yet finished a review pass or tested these changes. But would like to know the answers for these questions/whether these are handled in your change.

• When this feature flag is enabled, what happens when a superuser/global staff user without any entries in the "user access role" table tries to create courses in an organization?
• Is there a way to allow a user with course creation permission (via the "course creator role" or by the virtue of being a global staff or superuser) to create course in any organization when this feature flag is enabled?
• The get_user_permissions only gets a list of what permissions a user has and doesn't actually check what they are. So my question is - does this not matter since this code path will be allowed only for users with the "course creator" permission? If yes, should we consider restricting it to just the users with the "instructor" permission?
• Are there are any other ways to create/import course that might bypass this check even when the feature flag is enabled?

[farhaanbukhsh]

@farhaanbukhsh, I haven't yet finished a review pass or tested these changes. But would like to know the answers for these questions/whether these are handled in your change.

Hey, @lgp171188 I have tested these and replied to the query let me know what do you have in mind.

• When this feature flag is enabled, what happens when a superuser/global staff user without any entries in the "user access role" table tries to create courses in an organization?

Superuser and global staff are allowed to create courses for any organization. For normal users, they need to be in the organization and have a staff/instructor role in the org to see and create a course.

• Is there a way to allow a user with course creation permission (via the "course creator role" or by the virtue of being a global staff or superuser) to create a course in any organization when this feature flag is enabled?

Yes as the above point, if a user is a superuser/global staff then the user can bypass the flag and create the course because get_user_permission allows that to happen.

• The get_user_permissions only gets a list of what permissions a user has and doesn't actually check what they are. So my question is - does this not matter since this code path will be allowed only for users with the "course creator" permission? If yes, should we consider restricting it to just the users with the "instructor" permission?

For now, we are just checking if the user is in the organization, for the simple reason if the user has any other role except the instructor or staff, the user won't be allowed to see the studio page at all which is the user interface to create a course. But if we want we can even figure out or do a role-based check.

Now we use the has_studio_write_access method to check if the user has access to the course creation. I think this is a better way to check if the user should be allowed to create a course. what do your think?

• Are there are any other ways to create/import course that might bypass this check even when the feature flag is enabled?

Except for the user being the superuser of global staff, I was not able to find a way out.

[lgp171188]

@farhaanbukhsh, nit: create a library or create libraries. Same below. It is also a good idea to log the user id, org and library/course name. What do you think?

[lgp171188]

Suggested change

	# Restricts users from creating courses in organisation which they don't belog to
	# Restricts users from creating courses in organisations which they don't belong to

[lgp171188]

@farhaanbukhsh, would it make sense to check and restrict access based on this only when the ENABLE_CREATOR_GROUP feature flag is set enabled?

[lgp171188]

@farhaanbukhsh, this should be added to the default feature flags with its value set to False. Also would it be better to name it RESTRICT_COURSE_CREATION_TO_ORG_ROLES?

When adding this to the FEATURES dict in the settings, remember to document it using the guidelines here.

Also can you update the comment above to indicate that this doesn't affect the global superusers and staff users?

[lgp171188]

Suggested change

	def test_library_creation_with_normaL_user_with_non_acess_role(self):
	def test_library_creation_with_normaL_user_with_non_access_role(self):

[lgp171188]

@farhaanbukhsh, instead of using a trailing slash, it is better to add line breaks after the opening parenthesis and use implicit string concatenation of adjacent strings, no?

[lgp171188]

@farhaanbukhsh, same as https://github.com/open-craft/edx-platform/pull/319/files#r580562010

[lgp171188]

@farhaanbukhsh, 👍 Please squash the changes to a single commit with an appropriate commit message before merging.

• I tested the changes in this PR and verified that:
  • Superusers and global staff users can always create courses in any organization with or without this feature flag enabled.
  • When the feature flag is enabled, in addition to having the course creation permission via course creator groups (enabled by default), the user should also have a role (any role would suffice as the user is already a course creator) in the course's organization to be able to create a course under an organization.
  • When the feature flag is disabled (the current and default behavior), the existing behavior allowing course creator users to create courses in all organizations is preserved.
• I read through the code
• I checked for accessibility issues NA
• Includes documentation NA