feat: Implement AuthZ checks on assets endpoints#38194
feat: Implement AuthZ checks on assets endpoints#38194rodmgwgu wants to merge 3 commits intoopenedx:masterfrom
Conversation
openedx-webhooks
added
open-source-contribution
|
Thanks for the pull request, @rodmgwgu! This repository is currently maintained by Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review. 🔘 Get product approvalIf you haven't already, check this list to see if your contribution needs to go through the product review process.
🔘 Provide contextTo help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:
🔘 Get a green buildIf one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green. DetailsWhere can I find more information?If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources: When can I expect my changes to be merged?Our goal is to get community contributions seen and reviewed as efficiently as possible. However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:
💡 As a result it may take up to several weeks or months to complete a review and merge your PR. |
rodmgwgu
requested review from
BryanttV,
bmtcril,
dwong2708,
mariajgrimaldi and
wgu-taylor-payne
| ''' | ||
| course_key = CourseKey.from_string(course_key_string) | ||
| if not has_course_author_access(request.user, course_key): | ||
| # Everyone should have at least view access to proceedd. |
There was a problem hiding this comment.
Does at least view correspond with L84-L89?
There was a problem hiding this comment.
Yes, what I meant here is that if you don't have COURSES_VIEW_FILES permission, you won't proceed further, as the other permissions imply a view access.
Perhaps I should reword this to be clearer
| course_key, | ||
| LegacyAuthoringPermission.WRITE | ||
| ): | ||
| raise PermissionDenied() |
There was a problem hiding this comment.
I wonder the impact of this for non-users of authz
There was a problem hiding this comment.
If not using authz, this will just repeat the equivalent of has_course_author_access(request.user, course_key) 3 times, which if we already passed on the first check, won't affect on logic.
On performance, my understanding is that has_course_author_access internal logic is cached, so it shouldn't be a big deal.
Alternatively we could explicitly check for the authz flag before this code block to avoid repeated calls, do you think this would be necessary?
There was a problem hiding this comment.
I ended up refactoring this for clarity and included the check to avoid calling it repeatedly, thanks for pointing this out.
rodmgwgu
force-pushed
the
rod/file-permissions
branch
from
3e34952 to
f900349
Compare
3 participants
Description
Implement new AuthZ permission checks over endpoints related with file assets handling in course authoring.
The new AuthZ permission checks only apply when the enable_authz_course_authoring feature flag is enabled for the specific course, or globally, otherwise existing behavior persist.
The following AuthZ permissions are being used:
The following endpoints were updated:
Supporting information
Closes openedx/openedx-authz#193
Testing
Verified that:
Running relevant tests manually:
On a cms container (run with
tutor dev exec cms bash), do:Deadline
Verawood