RBAC M3: Implementing permissions logic

[MaferMazu]

Implements library-specific roles, scopes, and permission logic. Builds on the RBAC core and prepares for UI integration.

Deliverables:
● Defined role types and scopes
● Default policies and configuration
● Unit/integration tests
● Documentation of rules, scope behavior, and evaluation logic

[MaferMazu]

Policy model (everything explicit)

# Policies for the 'role:library_admin'
# All permissions are listed explicitly.
p, role:library_admin, act:create_library, *, allow
p, role:library_admin, act:delete_library, *, allow
p, role:library_admin, act:edit_library, *, allow
p, role:library_admin, act:publish_library, *, allow
p, role:library_admin, act:manage_library_tags, *, allow
p, role:library_admin, act:view_library, *, allow
p, role:library_admin, act:reuse_library_content, *, allow
p, role:library_admin, act:manage_library_team, *, allow
p, role:library_admin, act:view_library_team, *, allow
p, role:library_admin, act:create_library_collection, *, allow
p, role:library_admin, act:edit_library_collection, *, allow
p, role:library_admin, act:delete_library_collection, *, allow
p, role:library_admin, act:delete_library_content, *, allow
p, role:library_admin, act:publish_library_content, *, allow
p, role:library_admin, act:import_library_content, *, allow

# Policies for the 'role:library_author'
# All permissions are listed explicitly.
p, role:library_author, act:edit_library, *, allow
p, role:library_author, act:manage_library_tags, *, allow
p, role:library_author, act:view_library, *, allow
p, role:library_author, act:view_library_team, *, allow
p, role:library_author, act:create_library_collection, *, allow
p, role:library_author, act:edit_library_collection, *, allow
p, role:library_author, act:delete_library_collection, *, allow
p, role:library_author, act:delete_library_content, *, allow
p, role:library_author, act:publish_library_content, *, allow
p, role:library_author, act:import_library_content, *, allow
p, role:library_author, act:reuse_library_content, *, allow

# Policies for the 'role:library_collaborator'
# All permissions are listed explicitly.
p, role:library_collaborator, act:edit_library, *, allow
p, role:library_collaborator, act:delete_library_content, *, allow
p, role:library_collaborator, act:manage_library_tags, *, allow
p, role:library_collaborator, act:view_library, *, allow
p, role:library_collaborator, act:reuse_library_content, *, allow
p, role:library_collaborator, act:view_library_team, *, allow
p, role:library_collaborator, act:create_library_collection, *, allow
p, role:library_collaborator, act:edit_library_collection, *, allow
p, role:library_collaborator, act:delete_library_collection, *, allow
p, role:library_collaborator, act:import_library_content, *, allow

# Policies for the 'role:library_user'
# All permissions are listed explicitly.
p, role:library_user, act:view_library, *, allow
p, role:library_user, act:view_library_team, *, allow
p, role:library_user, act:reuse_library_content, *, allow

# Action Inheritance (g2)
# g2, <child_action>, <parent_action>
g2, act:edit_library, act:delete_library
g2, act:edit_library_content, act:delete_library_content
g2, act:view_library, act:edit_library
g2, act:view_library, act:publish_library
g2, act:view_library_team, act:manage_library_team
g2, act:view_library_tags, act:manage_library_tags
g2, act:edit_library_collection, act:delete_library_collection
g2, act:view_library_collection, act:edit_library_collection

Reference:

• https://openedx.atlassian.net/wiki/spaces/OEPM/pages/4840095745/Library+Roles+and+Permissions
• https://www.figma.com/design/q3Knq0BKoVTBbtaxb81n9R/RBAC---Console---Wireframes?node-id=2713-1647&p=f&t=A79I695wrR9cN9H3-0
• [FC-0099] feat: add casbin model configuration (CONF) #49

[MaferMazu]

# Policies for the 'role:library_admin'
# This role has full admin powers and inherits all other roles.
p, role:library_admin, act:delete_library, *, allow
p, role:library_admin, act:publish_library, *, allow
p, role:library_admin, act:manage_library_team, *, allow
p, role:library_admin, act:manage_library_tags, *, allow
p, role:library_admin, act:delete_library_content, *, allow
p, role:library_admin, act:publish_library_content, *, allow
p, role:library_admin, act:delete_library_collection, *, allow
p, role:library_admin, act:create_library, *, allow
p, role:library_admin, act:create_library_collection, *, allow

# Policies for the 'role:library_author'
# This role inherits from 'user' and 'collaborator' and has its unique permissions.
p, role:library_author, act:delete_library_content, *, allow
p, role:library_author, act:publish_library_content, *, allow
p, role:library_author, act:edit_library, *, allow
p, role:library_author, act:manage_library_tags, *, allow
p, role:library_author, act:create_library_collection, *, allow
p, role:library_author, act:edit_library_collection, *, allow
p, role:library_author, act:delete_library_collection, *, allow

# Policies for the 'role:library_collaborator'
# This role has permissions for editing and collections.
p, role:library_collaborator, act:edit_library, *, allow
p, role:library_collaborator, act:delete_library_content, *, allow
p, role:library_collaborator, act:manage_library_tags, *, allow
p, role:library_collaborator, act:create_library_collection, *, allow
p, role:library_collaborator, act:edit_library_collection, *, allow
p, role:library_collaborator, act:delete_library_collection, *, allow

# Policies for the 'role:library_user'
# This role has only basic permissions.
p, role:library_user, act:view_library, *, allow
p, role:library_user, act:view_library_team, *, allow
p, role:library_user, act:reuse_library_content, *, allow


# Role-to-Role and User-to-Role Mapping (g)
# This is a new, simplified hierarchy.
# admin > author > collaborator > user
g, role:library_author, role:library_collaborator, *
g, role:library_collaborator, role:library_user, *
g, role:library_admin, role:library_author, *

# Action Inheritance (g2)
# The logical inheritance is now more complete.
g2, act:edit_library, act:delete_library
g2, act:view_library, act:edit_library
g2, act:edit_library, act:create_library
g2, act:view_library, act:publish_library
g2, act:view_library_team, act:manage_library_team
g2, act:view_library_tags, act:manage_library_tags
g2, act:edit_library_collection, act:delete_library_collection
g2, act:view_library_collection, act:edit_library_collection
g2, act:edit_library_collection, act:create_library_collection
g2, act:view_library_content, act:edit_library_content
g2, act:edit_library_content, act:delete_library_content
g2, act:view_library_content, act:publish_library_content
g2, act:view_library_content, act:reuse_library_content

With inheritance @BryanttV

[MaferMazu]

Update things to do:

Reasoning: the console, for the mvp, only manage the endpoints regarding library team, so all the endpoints that aren't related to teams needs to be changed, to use the current authz system.

Strategy: We are not revoking the current access; only adding a new check for permission. This will ensure that something like 'has an explicit permission in the new system' or 'you have access for the previous system' is met.

• Check and update the authz.policy [FC-0099] feat: add public API to interact with roles and permissions #75 (make sure we are taking into account the roles and permissions from the doc.
• Add openedx_authz as a requirement in edx-platform.
• Modify the rest_api/containers.py to add the lines related to content edition to the openedx_authz.api.permissions.has_permission to edit_library.
  • Add openedx_authz.api.permissions.has_permission for view_libraries
• Modify rest_api/blocks - similar to containers, add the new check for views and edit using the new api methods (openedx_authz.api.permissions.has_permission)
  • Add in the libraryblockpublishview the edit to publish_library_content.
• Modify the rest_api/collections to add our enforcer and using the new schema (not edit_library but create_collections, edit_collections, delete_collections)
• Mosify the rest_api/serializers: when checkin can_edit, use and or to add our authz backend enforcer: openedx_authz.api.permissions.has_permission
• Modify content_libraries/library_context to also check our enforcement (using: edit_library, view_library) - We should't touch permissions.CAN_LEARN_FROM_THIS_CONTENT_LIBRARY because in the new system, we are not longer checking that.
• Modify rest_api/libraries
  • permissions.CAN_DELETE_THIS_CONTENT_LIBRARY -> add delete_library with our check (openedx_authz.api.permissions.has_permission)
  • permissions.CAN_CREATE_CONTENT_LIBRARY -> we can add our check create_library (optional - it won't have an effect because the mvp doesn't take it into account the create_library assignation)
  • the can_view - add our view_library
  • the can_edit - add our edit_library
  • permissions.CAN_VIEW_THIS_CONTENT_LIBRARY_TEAM - use our view_library_team (optional - we'll cover it in our rest api)
  • edit_library_team - use our view_library_team (optional - we'll cover it in our rest api)
  • Add in the librarycommitview the edit to publish_library.
• Modify lib/xblock/upstream_sync_container (optional) - It has a comment: # TODO: should permissions be checked at this low level?
• Modify content_stagging/views to add our enforcement (view_library)
• Modify the rest_api/v2/views/downstreams (optional - unstable)
• Modify the api/libraries
  • add view_library
  • create_library (optional)
• Script to migrate the current data to the new authz system
  • Translate the current roles to the new ones - reference
• Documentation (could live in the DEPR ticket) Follow up the DEPR ticket #79

Out of MVP:

• manage_taxonomies: This is a new permission and doesn't affect the console MVP. We will have it in our system, but we won't check it.
• manage_library_tags: The code for showing this is here. But currently, we are not checking if the user can have manage_library_tags. Make a proper edit here to add the new check; it may take some time, but it doesn't affect the MVP.
• reuse_library_content: right now, we are not checking the reusability; we show all the libraries, filtering them by org. For the MVP, I suggest not making any changes to this. To explain the change more clearly and get responses in the DEPR ticket.

Other things to check, but less clear:

• authoring/library-authoring/data/api.ts because it mentions the library access (the roles for the old system)
  • Check if there is another point in authoring that doesn't use the edx-platform context (we already took into account) to check permissions.
• "Allow all Studio users to reuse published content from this library." - It is something we need to check because I suggested avoiding using the reuse_library_content, but also, at this point, we were only checking explicit permissions in Casbin, but for this kind of case, we have a rule or an attribute in the library (have this reuse/read for all).

[mariajgrimaldi]

I think most of the cases could be covered by adding: or user_has_permission(username, permission, library_key) here at least for the majority of cases that rely on require_permission_for_library_key. That would be the easiest thing, although we'd need to rely on what the permission is which makes sense to me. @MaferMazu, what do you think?

[MaferMazu]

Yes, most of them are covered with the has_permission. The only case that raises doubts for me at this point is the case "all studio users can reuse the library", because it is not an explicit permission. Currently, we have: https://github.com/openedx/edx-platform/blob/master/openedx/core/djangoapps/content_libraries/permissions.py#L70. I'll initiate an internal discussion, but yes, it is something we need to consider.