Description
authz_get_all_course_assignments_for_user() (common/djangoapps/student/roles.py:184) only fetches CourseOverviewData and OrgCourseOverviewGlobData scope types, and never PlatformCourseOverviewGlobData (the course-v1:* platform-wide glob).
Even if PlatformCourseOverviewGlobData were fetched, _get_org_and_course_id_from_authz_scope() (roles.py:163) has no branch for it. The method only maps scopes to (org, course_id) or (org, None), while a platform-wide scope does not fit that representation because it applies to every organization.
These assignments feed RoleCache / BulkRoleCache, which index roles by course_id and back RoleCache.has_role(role, course_id, org), used throughout legacy has_access() / CourseRole.has_user() checks. As a result, a user whose only role assignment is a platform-wide glob (e.g. an instructor on course-v1:*) gets an empty RoleCache for every course, causing legacy access checks to silently deny access even though the AuthZ assignment exists.
Newer AuthZ-native checks (e.g. user_can_create_library and HasPermissionInContentLibraryScope) are unaffected because they consult IS_PLATFORM_GLOB directly.
Found while auditing openedx/openedx-platform#38660 for openedx-authz#366.
Description
authz_get_all_course_assignments_for_user()(common/djangoapps/student/roles.py:184) only fetchesCourseOverviewDataandOrgCourseOverviewGlobDatascope types, and neverPlatformCourseOverviewGlobData(thecourse-v1:*platform-wide glob).Even if
PlatformCourseOverviewGlobDatawere fetched,_get_org_and_course_id_from_authz_scope()(roles.py:163) has no branch for it. The method only maps scopes to(org, course_id)or(org, None), while a platform-wide scope does not fit that representation because it applies to every organization.These assignments feed
RoleCache/BulkRoleCache, which index roles bycourse_idand backRoleCache.has_role(role, course_id, org), used throughout legacyhas_access()/CourseRole.has_user()checks. As a result, a user whose only role assignment is a platform-wide glob (e.g. an instructor oncourse-v1:*) gets an emptyRoleCachefor every course, causing legacy access checks to silently deny access even though the AuthZ assignment exists.Newer AuthZ-native checks (e.g.
user_can_create_libraryandHasPermissionInContentLibraryScope) are unaffected because they consultIS_PLATFORM_GLOBdirectly.Found while auditing
openedx/openedx-platform#38660foropenedx-authz#366.