feat: create Course Limited Staff role [BB-7503]

[0x29a]

Description

• Makes it possible to inherit permissions of some of the built-in roles.
• Adds a new course team role, which has the same permissions as Course Staff, but no Studio access.

This should be considered as a temporary workaround. Ideally, we should wait for “Fine grained RBAC” to be implemented (see this roadmap item) and build new roles using the refactored systems. See this document as well for additional context.

Testing instructions

1. Switch your devstack to open-craft:0x29a/bb7503/disable-instructor-access-to-studio.
2. Register two users, course_staff@example.com and course_limited_staff@example.com.
3. As a Django staff user, assign course_staff@example.com to Staff course team role using the Instructor Dashboard.
4. As a Django staff user, assign course_limited_staff@example.com to Limited Staff course team role using the Instructor Dashboard.
5. As course_staff@example.com, ensure that you can access Studio.
6. As course_limited_staff@example.com, ensure that you have the same permissions as course_staff@example.com (like accessing the Instructor Dashboard, etc), but don't have access to Studio.

private-ref

[openedx-webhooks]

Thanks for the pull request, @0x29a! Please note that it may take us up to several weeks or months to complete a review and merge your PR.

Feel free to add as much of the following information to the ticket as you can:

• supporting documentation
• Open edX discussion forum threads
• timeline information ("this must be merged by XX date", and why that is)
• partner information ("this is a course on edx.org")
• any other information that can help Product understand the context for the PR

All technical communication about the code itself will be done via the GitHub pull request interface. As a reminder, our process documentation is here.

Please let us know once your PR is ready for our review and all tests are green.

[Agrendalath]

@0x29a, I see you're reusing the commit from my PoC. Don't forget to add yourself as an author!

[Agrendalath]

@mphilbrick211, are we going to need the product review for this?

[mphilbrick211]

@mphilbrick211, are we going to need the product review for this?

Checking with @jmakowski1123 on this. Thanks, @Agrendalath!

[Agrendalath]

👍

• I tested this: tested that the "Limited Staff" role provides access to the Instructor Dashboard, but not to the Studio.
• I read through the code
• I checked for accessibility issues: n/a
• Includes documentation: n/a
• I made sure any change in configuration variables is reflected in the corresponding client's configuration-secure repository: n/a

[Agrendalath]

@mphilbrick211, @jmakowski1123, a friendly reminder about this PR. This is ready to be merged from our end.

[cablaa77]

approved

[openedx-webhooks]

@0x29a 🎉 Your pull request was merged! Please take a moment to answer a two question survey so we can improve your experience in the future.

[edx-pipeline-bot]

2U Release Notice: This PR has been deployed to the edX staging environment in preparation for a release to production.

[edx-pipeline-bot]

2U Release Notice: This PR has been deployed to the edX production environment.

[edx-pipeline-bot]

2U Release Notice: This PR has been deployed to the edX production environment.