feat: add authz schema pipeline and load_authz_schema command by rodmgwgu · Pull Request #446 · openedx/openedx-authz

rodmgwgu · 2026-09-10T18:18:11Z

Closes #410
Closes #433

Problem

The schema phases now exist independently but nothing runs them. Deployment needs one non-interactive entry point that drives discover → load → validate → compile → render → apply, reports what would change, and fails before writing anything if the schema is invalid (ADR 0018).

Approach

The last slice of the pipeline, on top of #480.

openedx_authz/engine/schema/pipeline.py — SchemaPipeline, wiring the phases in order
openedx_authz/management/commands/load_authz_schema.py — the deployment entry point: --dry-run to print the change report without writing, --force to allow removing roles that still have assignments, repeatable --dir for CI and local runs
openedx_authz/tests/schema/{test_pipeline,test_load_authz_schema_command}.py
Version bump 1.24.0 → 1.25.0 and the changelog entry for the whole stack

Manual testing instructions

Run in a tutor dev environment with this repo mounted. Every command below is shown for cms; lms works identically. Apply the migration first:

tutor dev run cms ./manage.py cms migrate openedx_authz

1. Dry run reports the change without writing

tutor dev run cms ./manage.py cms load_authz_schema --dry-run

Expect Casbin policy rows to add (0) Casbin policy rows to remove (0), and definition sections for 17 categories, 48 permissions, 11 roles, and 132 role-permission grants. Confirm nothing was written:

tutor dev run cms ./manage.py cms shell -c "
from openedx_authz.models.schema import AuthzRoleDefinition
print(AuthzRoleDefinition.objects.count())"   # 0

Please note: 0 Casbin policy changes is expected — the schema definitions match the policies already defined in the existing authz.policy file, which is auto-imported on launch.

2. Apply, then confirm it is idempotent

tutor dev run cms ./manage.py cms load_authz_schema
tutor dev run cms ./manage.py cms load_authz_schema

The first run prints the definition changes and Authz schema applied: 0 Casbin policy row(s) added, 0 removed; definition changes: 17 category, 48 permission, 11 role, 132 role-permission.. The second prints Authz schema unchanged; no rows written. — no duplicate rows, no churn (ADR 0018 §2).

3. A role extension changes an existing role without copying it (ADR 0023)

mkdir -p openedx_authz/authz/site_overrides
cat > openedx_authz/authz/site_overrides/overrides.yaml <<'YAML'
schema_version: "1.0"
priority: 200
role_extensions:
  - role: course_editor
    add_permissions:
      - courses.export_course
    remove_permissions:
      - courses.manage_tags
    display_name: Course author
YAML

tutor dev run cms ./manage.py cms load_authz_schema --dry-run \
    --dir openedx_authz/authz/site_overrides

Expect exactly one row added (courses.export_course), one removed (courses.manage_tags), and ~ course_editor under role definition changes. Clean up and restore:

rm -rf openedx_authz/authz/site_overrides
tutor dev run cms ./manage.py cms load_authz_schema

4. Removing an assigned role is blocked without `--force` (ADR 0018 §6)

Assign a static role to a test user, comment that role out of openedx_authz/authz/schema/course_roles.yaml, and apply. Expect a CommandError naming the role and the assigned subject, ending with "Re-run with force to remove them together with their assignments", and no database change. Re-run with --force and the role, its p rows, its assignment and its definition rows are gone, with one audit record per removed assignment.

5. An invalid schema stops deployment before any write

Introduce an error in a schema file — point a role at a permission that does not exist, or give a permission a CamelCase namespace — and run the command. It exits with a CommandError, the log lists every validation error with its source file, and the database is untouched.

Automated coverage

openedx_authz/tests/schema/ covers the full discover → load → validate → compile → render → plan/apply path. openedx_authz/tests/integration/test_schema_apply.py exercises the real Casbin enforcer and ORM; it is excluded from the default pytest run and needs an edx-platform environment:

tutor dev run cms pytest -p no:randomly --create-db --ds=cms.envs.test \
    /mnt/openedx-authz/openedx_authz/tests/integration/test_schema_apply.py

Rollback plan

Revert this PR to remove the command and the pipeline wiring; the phases from PRs 1–7 remain but nothing invokes them. The migration in #478 is additive; roll back by reverting and running the reverse migration if applied.

Retro compatibility

No authorization behavior changed. Existing loading of authz.policy works as before. The new policy loading is never automatic — it runs only when load_authz_schema is invoked.

Follow up work required

Once docs: add authorization schema reference #431 is merged, extend validation to use that JSON Schema to cover all cases defined in the ADR (Extend schema loader validation to use schema reference defined in #431 #459)
Implement the API layer to expose the new roles and permissions information (Role and permission metadata (Catalog API) #413)
Create a tutor plugin to run the management command automatically on deploy (tutor: implement auto running the management command on deploy #460)
In the same tutor plugin, implement patch support to add schemas via tutor (tutor: Implement the patch support to add custom schemas via tutor. #461)
Deprecate the authz.policy file — remove role and permission definitions already in the new schema, keeping the g2 definitions there for now (Deprecate authz.policy file #462)

AI Usage

Kiro was used to assist on feature planning and implementation. Implementation was done step by step with human guidance and validation, based on the ADRs.

Stack (8/8) — this PR was split into eight reviewable pieces. Bases chain bottom-up; merge in order.

feat: add authz schema discovery #474 — schema discovery
feat: add authz schema loading #475 — schema loading
feat: add authz schema compilation #476 — schema compilation
feat: add authz schema validation #477 — schema validation
feat: add authz schema definition models #478 — definition models + migration
feat: add authz schema policy renderer #479 — policy renderer
feat: add authz schema applier #480 — schema applier
This PR — pipeline + load_authz_schema command (base: rod/authz-schema-applier)

This PR keeps its original branch, rebuilt as one commit on top of 7/8 so the diff shows only the incremental slice. Merging all eight produces a tree byte-identical to the pre-split branch (389f946), verified with git diff. Every level was verified independently: manage.py check clean, full test suite green, and no new pylint findings relative to main.

Merge checklist:

Version bumped — 1.24.0 -> 1.25.0, once for the whole stack
Changelog record added — covers the whole stack
Documentation updated (not only docstrings) — covered by the already-merged ADRs
Fixup commits are squashed away
Unit tests added/updated
Manual testing instructions provided
Noted any: Concerns, dependencies, migration issues, deadlines, tickets — merge last, after feat: add authz schema discovery #474–feat: add authz schema applier #480; the DB migration is in feat: add authz schema definition models #478

openedx-webhooks · 2026-09-10T18:18:17Z

Thanks for the pull request, @rodmgwgu!

This repository is currently maintained by @openedx/committers-openedx-authz.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
- This process (including the steps you'll need to take) is documented here.
If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

Dependencies

This PR must be merged before / after / at the same time as ...
Blockers

This PR is waiting for OEP-1234 to be accepted.
Timeline information

This PR must be merged by XX date because ...
Partner information

This is for a course on edx.org.
Supporting documentation
Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

Details

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

The size and impact of the changes that it introduces
The need for product review
Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

carlos-marquez-wgu · 2026-09-21T16:54:35Z

I followed the manual testing instructions, migrations ran ok, but this command from Step 1 Dry-run

tutor dev run cms ./manage.py cms load_authz_schema --dry-run

Doesn't return Rows to add (132), Rows to remove (0), it returns 0 for both Rows to add and Rows to remove

Details

Rows to add (0):
Rows to remove (0):
Definition changes - category (17):
  + course_access_content
  + course_advanced_certificates
  + course_files
  + course_grading
  + course_import_export
  + course_legacy
  + course_library_updates
  + course_other
  + course_pages_resources
  + course_schedule_details
  + course_tags_taxonomies
  + course_team_group
  + course_updates_handouts
  + library
  + library_collection
  + library_content
  + library_team
Definition changes - permission (48):
  + content_libraries.create_library_collection
  + content_libraries.delete_library
  + content_libraries.delete_library_collection
  + content_libraries.edit_library_collection
  + content_libraries.edit_library_content
  + content_libraries.manage_library_tags
  + content_libraries.manage_library_team
  + content_libraries.publish_library_content
  + content_libraries.reuse_library_content
  + content_libraries.view_library
  + content_libraries.view_library_team
  + courses.create_files
  + courses.delete_files
  + courses.edit_course_content
  + courses.edit_details
  + courses.edit_files
  + courses.edit_grading_settings
  + courses.edit_schedule
  + courses.export_course
  + courses.export_tags
  + courses.import_course
  + courses.legacy_beta_tester_permissions
  + courses.legacy_data_researcher_permissions
  + courses.legacy_instructor_role_permissions
  + courses.legacy_limited_staff_role_permissions
  + courses.legacy_staff_role_permissions
  + courses.manage_advanced_settings
  + courses.manage_certificates
  + courses.manage_course_team
  + courses.manage_course_updates
  + courses.manage_group_configurations
  + courses.manage_library_updates
  + courses.manage_pages_and_resources
  + courses.manage_tags
  + courses.manage_taxonomies
  + courses.publish_course_content
  + courses.view_advanced_settings
  + courses.view_certificates
  + courses.view_checklists
  + courses.view_course
  + courses.view_course_team
  + courses.view_course_updates
  + courses.view_files
  + courses.view_grading_settings
  + courses.view_group_configurations
  + courses.view_library_updates
  + courses.view_pages_and_resources
  + courses.view_schedule_and_details
Definition changes - role (11):
  + course_admin
  + course_auditor
  + course_beta_tester
  + course_data_researcher
  + course_editor
  + course_limited_staff
  + course_staff
  + library_admin
  + library_author
  + library_contributor
  + library_user
Definition changes - role-permission (132):
  + course_admin -> courses.create_files @ course-v1
  + course_admin -> courses.delete_files @ course-v1
  + course_admin -> courses.edit_course_content @ course-v1
  + course_admin -> courses.edit_details @ course-v1
  + course_admin -> courses.edit_files @ course-v1
  + course_admin -> courses.edit_grading_settings @ course-v1
  + course_admin -> courses.edit_schedule @ course-v1
  + course_admin -> courses.export_course @ course-v1
  + course_admin -> courses.export_tags @ course-v1
  + course_admin -> courses.import_course @ course-v1
  + course_admin -> courses.legacy_instructor_role_permissions @ course-v1
  + course_admin -> courses.manage_advanced_settings @ course-v1
  + course_admin -> courses.manage_certificates @ course-v1
  + course_admin -> courses.manage_course_team @ course-v1
  + course_admin -> courses.manage_course_updates @ course-v1
  + course_admin -> courses.manage_group_configurations @ course-v1
  + course_admin -> courses.manage_library_updates @ course-v1
  + course_admin -> courses.manage_pages_and_resources @ course-v1
  + course_admin -> courses.manage_tags @ course-v1
  + course_admin -> courses.manage_taxonomies @ course-v1
  + course_admin -> courses.publish_course_content @ course-v1
  + course_admin -> courses.view_advanced_settings @ course-v1
  + course_admin -> courses.view_certificates @ course-v1
  + course_admin -> courses.view_checklists @ course-v1
  + course_admin -> courses.view_course @ course-v1
  + course_admin -> courses.view_course_team @ course-v1
  + course_admin -> courses.view_course_updates @ course-v1
  + course_admin -> courses.view_files @ course-v1
  + course_admin -> courses.view_grading_settings @ course-v1
  + course_admin -> courses.view_group_configurations @ course-v1
  + course_admin -> courses.view_library_updates @ course-v1
  + course_admin -> courses.view_pages_and_resources @ course-v1
  + course_admin -> courses.view_schedule_and_details @ course-v1
  + course_auditor -> courses.view_advanced_settings @ course-v1
  + course_auditor -> courses.view_certificates @ course-v1
  + course_auditor -> courses.view_checklists @ course-v1
  + course_auditor -> courses.view_course @ course-v1
  + course_auditor -> courses.view_course_team @ course-v1
  + course_auditor -> courses.view_course_updates @ course-v1
  + course_auditor -> courses.view_files @ course-v1
  + course_auditor -> courses.view_grading_settings @ course-v1
  + course_auditor -> courses.view_group_configurations @ course-v1
  + course_auditor -> courses.view_library_updates @ course-v1
  + course_auditor -> courses.view_pages_and_resources @ course-v1
  + course_auditor -> courses.view_schedule_and_details @ course-v1
  + course_beta_tester -> courses.legacy_beta_tester_permissions @ course-v1
  + course_data_researcher -> courses.legacy_data_researcher_permissions @ course-v1
  + course_editor -> courses.create_files @ course-v1
  + course_editor -> courses.edit_course_content @ course-v1
  + course_editor -> courses.edit_details @ course-v1
  + course_editor -> courses.edit_files @ course-v1
  + course_editor -> courses.edit_grading_settings @ course-v1
  + course_editor -> courses.manage_course_updates @ course-v1
  + course_editor -> courses.manage_group_configurations @ course-v1
  + course_editor -> courses.manage_library_updates @ course-v1
  + course_editor -> courses.manage_pages_and_resources @ course-v1
  + course_editor -> courses.manage_tags @ course-v1
  + course_editor -> courses.view_advanced_settings @ course-v1
  + course_editor -> courses.view_certificates @ course-v1
  + course_editor -> courses.view_checklists @ course-v1
  + course_editor -> courses.view_course @ course-v1
  + course_editor -> courses.view_course_team @ course-v1
  + course_editor -> courses.view_course_updates @ course-v1
  + course_editor -> courses.view_files @ course-v1
  + course_editor -> courses.view_grading_settings @ course-v1
  + course_editor -> courses.view_group_configurations @ course-v1
  + course_editor -> courses.view_library_updates @ course-v1
  + course_editor -> courses.view_pages_and_resources @ course-v1
  + course_editor -> courses.view_schedule_and_details @ course-v1
  + course_limited_staff -> courses.legacy_limited_staff_role_permissions @ course-v1
  + course_staff -> courses.create_files @ course-v1
  + course_staff -> courses.delete_files @ course-v1
  + course_staff -> courses.edit_course_content @ course-v1
  + course_staff -> courses.edit_details @ course-v1
  + course_staff -> courses.edit_files @ course-v1
  + course_staff -> courses.edit_grading_settings @ course-v1
  + course_staff -> courses.edit_schedule @ course-v1
  + course_staff -> courses.export_course @ course-v1
  + course_staff -> courses.export_tags @ course-v1
  + course_staff -> courses.import_course @ course-v1
  + course_staff -> courses.legacy_staff_role_permissions @ course-v1
  + course_staff -> courses.manage_advanced_settings @ course-v1
  + course_staff -> courses.manage_certificates @ course-v1
  + course_staff -> courses.manage_course_updates @ course-v1
  + course_staff -> courses.manage_group_configurations @ course-v1
  + course_staff -> courses.manage_library_updates @ course-v1
  + course_staff -> courses.manage_pages_and_resources @ course-v1
  + course_staff -> courses.manage_tags @ course-v1
  + course_staff -> courses.publish_course_content @ course-v1
  + course_staff -> courses.view_advanced_settings @ course-v1
  + course_staff -> courses.view_certificates @ course-v1
  + course_staff -> courses.view_checklists @ course-v1
  + course_staff -> courses.view_course @ course-v1
  + course_staff -> courses.view_course_team @ course-v1
  + course_staff -> courses.view_course_updates @ course-v1
  + course_staff -> courses.view_files @ course-v1
  + course_staff -> courses.view_grading_settings @ course-v1
  + course_staff -> courses.view_group_configurations @ course-v1
  + course_staff -> courses.view_library_updates @ course-v1
  + course_staff -> courses.view_pages_and_resources @ course-v1
  + course_staff -> courses.view_schedule_and_details @ course-v1
  + library_admin -> content_libraries.create_library_collection @ lib
  + library_admin -> content_libraries.delete_library @ lib
  + library_admin -> content_libraries.delete_library_collection @ lib
  + library_admin -> content_libraries.edit_library_collection @ lib
  + library_admin -> content_libraries.edit_library_content @ lib
  + library_admin -> content_libraries.manage_library_tags @ lib
  + library_admin -> content_libraries.manage_library_team @ lib
  + library_admin -> content_libraries.publish_library_content @ lib
  + library_admin -> content_libraries.reuse_library_content @ lib
  + library_admin -> content_libraries.view_library @ lib
  + library_admin -> content_libraries.view_library_team @ lib
  + library_author -> content_libraries.create_library_collection @ lib
  + library_author -> content_libraries.delete_library_collection @ lib
  + library_author -> content_libraries.edit_library_collection @ lib
  + library_author -> content_libraries.edit_library_content @ lib
  + library_author -> content_libraries.manage_library_tags @ lib
  + library_author -> content_libraries.publish_library_content @ lib
  + library_author -> content_libraries.reuse_library_content @ lib
  + library_author -> content_libraries.view_library @ lib
  + library_author -> content_libraries.view_library_team @ lib
  + library_contributor -> content_libraries.create_library_collection @ lib
  + library_contributor -> content_libraries.delete_library_collection @ lib
  + library_contributor -> content_libraries.edit_library_collection @ lib
  + library_contributor -> content_libraries.edit_library_content @ lib
  + library_contributor -> content_libraries.manage_library_tags @ lib
  + library_contributor -> content_libraries.reuse_library_content @ lib
  + library_contributor -> content_libraries.view_library @ lib
  + library_contributor -> content_libraries.view_library_team @ lib
  + library_user -> content_libraries.reuse_library_content @ lib
  + library_user -> content_libraries.view_library @ lib
  + library_user -> content_libraries.view_library_team @ lib

Next command to query if anything changes do indeed return 0, so everything good there

I guess the above output is fine as everything else matches, I'll continue with the rest

EDIT:
Second step throw me this

First run of tutor dev run cms ./manage.py cms load_authz_schema

2026-09-21 16:55:22,112 INFO 1 [openedx_authz.engine.enforcer] [user None] [ip None] enforcer.py:183 - Reloaded policy to version e5c4d849-e0b7-479f-8300-3d1b79d23ce8
2026-09-21 16:55:22,413 INFO 1 [openedx_authz.engine.renderer] [user None] [ip None] renderer.py:645 - Authz schema apply: persisted 11 role(s), 48 permission(s), 17 category(ies).
2026-09-21 16:55:22,416 INFO 1 [openedx_authz.engine.renderer] [user None] [ip None] renderer.py:334 - Authz schema apply: policy rows unchanged; definitions synced.
Authz schema applied: 0 row(s) added, 0 removed.

Second run of tutor dev run cms ./manage.py cms load_authz_schema

2026-09-21 17:10:56,515 INFO 1 [openedx_authz.engine.enforcer] [user None] [ip None] enforcer.py:183 - Reloaded policy to version e5c4d849-e0b7-479f-8300-3d1b79d23ce8
2026-09-21 17:10:56,748 INFO 1 [openedx_authz.engine.renderer] [user None] [ip None] renderer.py:645 - Authz schema apply: persisted 11 role(s), 48 permission(s), 17 category(ies).
2026-09-21 17:10:56,750 INFO 1 [openedx_authz.engine.renderer] [user None] [ip None] renderer.py:334 - Authz schema apply: policy rows unchanged; definitions synced.
Authz schema unchanged; no rows written.

Seems like its only a minor problem with the reported updated rows?

carlos-marquez-wgu · 2026-09-21T19:11:25Z

Opinion: I think it'll be nice if the command that applies the changes:

tutor dev run cms ./manage.py cms load_authz_schema

Also prints the changes in the same way as when passing --dry-run, that way is more clear what changed, instead of only displaying how many rows were changed

rodmgwgu · 2026-09-21T22:00:26Z

I followed the manual testing instructions, migrations ran ok, but this command from Step 1 Dry-run

tutor dev run cms ./manage.py cms load_authz_schema --dry-run

Doesn't return Rows to add (132), Rows to remove (0), it returns 0 for both Rows to add and Rows to remove

Details

Rows to add (0):
Rows to remove (0):
Definition changes - category (17):
  + course_access_content
  + course_advanced_certificates
  + course_files
  + course_grading
  + course_import_export
  + course_legacy
  + course_library_updates
  + course_other
  + course_pages_resources
  + course_schedule_details
  + course_tags_taxonomies
  + course_team_group
  + course_updates_handouts
  + library
  + library_collection
  + library_content
  + library_team
Definition changes - permission (48):
  + content_libraries.create_library_collection
  + content_libraries.delete_library
  + content_libraries.delete_library_collection
  + content_libraries.edit_library_collection
  + content_libraries.edit_library_content
  + content_libraries.manage_library_tags
  + content_libraries.manage_library_team
  + content_libraries.publish_library_content
  + content_libraries.reuse_library_content
  + content_libraries.view_library
  + content_libraries.view_library_team
  + courses.create_files
  + courses.delete_files
  + courses.edit_course_content
  + courses.edit_details
  + courses.edit_files
  + courses.edit_grading_settings
  + courses.edit_schedule
  + courses.export_course
  + courses.export_tags
  + courses.import_course
  + courses.legacy_beta_tester_permissions
  + courses.legacy_data_researcher_permissions
  + courses.legacy_instructor_role_permissions
  + courses.legacy_limited_staff_role_permissions
  + courses.legacy_staff_role_permissions
  + courses.manage_advanced_settings
  + courses.manage_certificates
  + courses.manage_course_team
  + courses.manage_course_updates
  + courses.manage_group_configurations
  + courses.manage_library_updates
  + courses.manage_pages_and_resources
  + courses.manage_tags
  + courses.manage_taxonomies
  + courses.publish_course_content
  + courses.view_advanced_settings
  + courses.view_certificates
  + courses.view_checklists
  + courses.view_course
  + courses.view_course_team
  + courses.view_course_updates
  + courses.view_files
  + courses.view_grading_settings
  + courses.view_group_configurations
  + courses.view_library_updates
  + courses.view_pages_and_resources
  + courses.view_schedule_and_details
Definition changes - role (11):
  + course_admin
  + course_auditor
  + course_beta_tester
  + course_data_researcher
  + course_editor
  + course_limited_staff
  + course_staff
  + library_admin
  + library_author
  + library_contributor
  + library_user
Definition changes - role-permission (132):
  + course_admin -> courses.create_files @ course-v1
  + course_admin -> courses.delete_files @ course-v1
  + course_admin -> courses.edit_course_content @ course-v1
  + course_admin -> courses.edit_details @ course-v1
  + course_admin -> courses.edit_files @ course-v1
  + course_admin -> courses.edit_grading_settings @ course-v1
  + course_admin -> courses.edit_schedule @ course-v1
  + course_admin -> courses.export_course @ course-v1
  + course_admin -> courses.export_tags @ course-v1
  + course_admin -> courses.import_course @ course-v1
  + course_admin -> courses.legacy_instructor_role_permissions @ course-v1
  + course_admin -> courses.manage_advanced_settings @ course-v1
  + course_admin -> courses.manage_certificates @ course-v1
  + course_admin -> courses.manage_course_team @ course-v1
  + course_admin -> courses.manage_course_updates @ course-v1
  + course_admin -> courses.manage_group_configurations @ course-v1
  + course_admin -> courses.manage_library_updates @ course-v1
  + course_admin -> courses.manage_pages_and_resources @ course-v1
  + course_admin -> courses.manage_tags @ course-v1
  + course_admin -> courses.manage_taxonomies @ course-v1
  + course_admin -> courses.publish_course_content @ course-v1
  + course_admin -> courses.view_advanced_settings @ course-v1
  + course_admin -> courses.view_certificates @ course-v1
  + course_admin -> courses.view_checklists @ course-v1
  + course_admin -> courses.view_course @ course-v1
  + course_admin -> courses.view_course_team @ course-v1
  + course_admin -> courses.view_course_updates @ course-v1
  + course_admin -> courses.view_files @ course-v1
  + course_admin -> courses.view_grading_settings @ course-v1
  + course_admin -> courses.view_group_configurations @ course-v1
  + course_admin -> courses.view_library_updates @ course-v1
  + course_admin -> courses.view_pages_and_resources @ course-v1
  + course_admin -> courses.view_schedule_and_details @ course-v1
  + course_auditor -> courses.view_advanced_settings @ course-v1
  + course_auditor -> courses.view_certificates @ course-v1
  + course_auditor -> courses.view_checklists @ course-v1
  + course_auditor -> courses.view_course @ course-v1
  + course_auditor -> courses.view_course_team @ course-v1
  + course_auditor -> courses.view_course_updates @ course-v1
  + course_auditor -> courses.view_files @ course-v1
  + course_auditor -> courses.view_grading_settings @ course-v1
  + course_auditor -> courses.view_group_configurations @ course-v1
  + course_auditor -> courses.view_library_updates @ course-v1
  + course_auditor -> courses.view_pages_and_resources @ course-v1
  + course_auditor -> courses.view_schedule_and_details @ course-v1
  + course_beta_tester -> courses.legacy_beta_tester_permissions @ course-v1
  + course_data_researcher -> courses.legacy_data_researcher_permissions @ course-v1
  + course_editor -> courses.create_files @ course-v1
  + course_editor -> courses.edit_course_content @ course-v1
  + course_editor -> courses.edit_details @ course-v1
  + course_editor -> courses.edit_files @ course-v1
  + course_editor -> courses.edit_grading_settings @ course-v1
  + course_editor -> courses.manage_course_updates @ course-v1
  + course_editor -> courses.manage_group_configurations @ course-v1
  + course_editor -> courses.manage_library_updates @ course-v1
  + course_editor -> courses.manage_pages_and_resources @ course-v1
  + course_editor -> courses.manage_tags @ course-v1
  + course_editor -> courses.view_advanced_settings @ course-v1
  + course_editor -> courses.view_certificates @ course-v1
  + course_editor -> courses.view_checklists @ course-v1
  + course_editor -> courses.view_course @ course-v1
  + course_editor -> courses.view_course_team @ course-v1
  + course_editor -> courses.view_course_updates @ course-v1
  + course_editor -> courses.view_files @ course-v1
  + course_editor -> courses.view_grading_settings @ course-v1
  + course_editor -> courses.view_group_configurations @ course-v1
  + course_editor -> courses.view_library_updates @ course-v1
  + course_editor -> courses.view_pages_and_resources @ course-v1
  + course_editor -> courses.view_schedule_and_details @ course-v1
  + course_limited_staff -> courses.legacy_limited_staff_role_permissions @ course-v1
  + course_staff -> courses.create_files @ course-v1
  + course_staff -> courses.delete_files @ course-v1
  + course_staff -> courses.edit_course_content @ course-v1
  + course_staff -> courses.edit_details @ course-v1
  + course_staff -> courses.edit_files @ course-v1
  + course_staff -> courses.edit_grading_settings @ course-v1
  + course_staff -> courses.edit_schedule @ course-v1
  + course_staff -> courses.export_course @ course-v1
  + course_staff -> courses.export_tags @ course-v1
  + course_staff -> courses.import_course @ course-v1
  + course_staff -> courses.legacy_staff_role_permissions @ course-v1
  + course_staff -> courses.manage_advanced_settings @ course-v1
  + course_staff -> courses.manage_certificates @ course-v1
  + course_staff -> courses.manage_course_updates @ course-v1
  + course_staff -> courses.manage_group_configurations @ course-v1
  + course_staff -> courses.manage_library_updates @ course-v1
  + course_staff -> courses.manage_pages_and_resources @ course-v1
  + course_staff -> courses.manage_tags @ course-v1
  + course_staff -> courses.publish_course_content @ course-v1
  + course_staff -> courses.view_advanced_settings @ course-v1
  + course_staff -> courses.view_certificates @ course-v1
  + course_staff -> courses.view_checklists @ course-v1
  + course_staff -> courses.view_course @ course-v1
  + course_staff -> courses.view_course_team @ course-v1
  + course_staff -> courses.view_course_updates @ course-v1
  + course_staff -> courses.view_files @ course-v1
  + course_staff -> courses.view_grading_settings @ course-v1
  + course_staff -> courses.view_group_configurations @ course-v1
  + course_staff -> courses.view_library_updates @ course-v1
  + course_staff -> courses.view_pages_and_resources @ course-v1
  + course_staff -> courses.view_schedule_and_details @ course-v1
  + library_admin -> content_libraries.create_library_collection @ lib
  + library_admin -> content_libraries.delete_library @ lib
  + library_admin -> content_libraries.delete_library_collection @ lib
  + library_admin -> content_libraries.edit_library_collection @ lib
  + library_admin -> content_libraries.edit_library_content @ lib
  + library_admin -> content_libraries.manage_library_tags @ lib
  + library_admin -> content_libraries.manage_library_team @ lib
  + library_admin -> content_libraries.publish_library_content @ lib
  + library_admin -> content_libraries.reuse_library_content @ lib
  + library_admin -> content_libraries.view_library @ lib
  + library_admin -> content_libraries.view_library_team @ lib
  + library_author -> content_libraries.create_library_collection @ lib
  + library_author -> content_libraries.delete_library_collection @ lib
  + library_author -> content_libraries.edit_library_collection @ lib
  + library_author -> content_libraries.edit_library_content @ lib
  + library_author -> content_libraries.manage_library_tags @ lib
  + library_author -> content_libraries.publish_library_content @ lib
  + library_author -> content_libraries.reuse_library_content @ lib
  + library_author -> content_libraries.view_library @ lib
  + library_author -> content_libraries.view_library_team @ lib
  + library_contributor -> content_libraries.create_library_collection @ lib
  + library_contributor -> content_libraries.delete_library_collection @ lib
  + library_contributor -> content_libraries.edit_library_collection @ lib
  + library_contributor -> content_libraries.edit_library_content @ lib
  + library_contributor -> content_libraries.manage_library_tags @ lib
  + library_contributor -> content_libraries.reuse_library_content @ lib
  + library_contributor -> content_libraries.view_library @ lib
  + library_contributor -> content_libraries.view_library_team @ lib
  + library_user -> content_libraries.reuse_library_content @ lib
  + library_user -> content_libraries.view_library @ lib
  + library_user -> content_libraries.view_library_team @ lib

Next command to query if anything changes do indeed return 0, so everything good there

I guess the above output is fine as everything else matches, I'll continue with the rest

EDIT: Second step throw me this

First run of tutor dev run cms ./manage.py cms load_authz_schema

2026-09-21 16:55:22,112 INFO 1 [openedx_authz.engine.enforcer] [user None] [ip None] enforcer.py:183 - Reloaded policy to version e5c4d849-e0b7-479f-8300-3d1b79d23ce8
2026-09-21 16:55:22,413 INFO 1 [openedx_authz.engine.renderer] [user None] [ip None] renderer.py:645 - Authz schema apply: persisted 11 role(s), 48 permission(s), 17 category(ies).
2026-09-21 16:55:22,416 INFO 1 [openedx_authz.engine.renderer] [user None] [ip None] renderer.py:334 - Authz schema apply: policy rows unchanged; definitions synced.
Authz schema applied: 0 row(s) added, 0 removed.

Second run of tutor dev run cms ./manage.py cms load_authz_schema

2026-09-21 17:10:56,515 INFO 1 [openedx_authz.engine.enforcer] [user None] [ip None] enforcer.py:183 - Reloaded policy to version e5c4d849-e0b7-479f-8300-3d1b79d23ce8
2026-09-21 17:10:56,748 INFO 1 [openedx_authz.engine.renderer] [user None] [ip None] renderer.py:645 - Authz schema apply: persisted 11 role(s), 48 permission(s), 17 category(ies).
2026-09-21 17:10:56,750 INFO 1 [openedx_authz.engine.renderer] [user None] [ip None] renderer.py:334 - Authz schema apply: policy rows unchanged; definitions synced.
Authz schema unchanged; no rows written.

Seems like its only a minor problem with the reported updated rows?

Thanks for validating, in this case, it says 0 for both rows to add and to remove because it refers to the casbin p rows, which already exist because of the old policy which has the exact same equivalent rows as the ones generated by the new schema. But this does look confusing, I'll change the text to better communicate this.

carlos-marquez-wgu · 2026-09-21T22:07:49Z

 *******************

 Changed
-=======


Removed by accident?

yes, fixed, thanks!

carlos-marquez-wgu · 2026-09-23T17:38:52Z

Awesome work, thanks, @rodmgwgu !

Add the load_authz_schema management command to the CMS and LMS init scripts, right after load_policies within the existing openedx-authz guard block. load_policies populates the Casbin policy rows that the authorization engine uses for permission checks, but those rows carry no display metadata — no role names, descriptions, permission categories, or source tracking. load_authz_schema fills that gap: it discovers static authz schema YAML files contributed by installed applications, validates and compiles them, and writes the resulting role and permission definitions to dedicated tables. The API then serves those definitions so frontends like the Admin Console can display roles and permissions. The command is idempotent — running it twice with the same schema produces no duplicate rows and preserves dynamic roles and user assignments. It must run after migrations (it needs the DB schema) and before the application serves traffic. See also: - openedx/openedx-authz#446 - https://github.com/openedx/openedx-authz/blob/main/docs/decisions/0021-authorization-definition-api.rst

mariajgrimaldi

I haven't tested this, will do so soon!

mariajgrimaldi · 2026-10-01T16:51:52Z

+        self._gate(self._validator.validate(documents))
+        schema = self._compiler.compile(documents)
+        self._gate(self._validator.validate_compiled(schema))


What would happen if two commands with different schemas (let's say one it's out of date) are executed at the same time? I guess the atomic in the previous PR would take care of that?

Yes, the previous PR ensures that applying the actual change is atomic, and if two commands run at the same time, the last one finishing will win.

However there is nothing that would prevent this from happening, but given how this command is meant to be run (on deployment, usually via tutor), I don't see this happening easily.

What do you think?

I see it more as two operators running the command from different shells at the same time, rather than necessarily two deployments, since the command can also be executed manually.

I don't think we need to prevent that from happening, but we should at least make it visible when another execution is already in progress.

mariajgrimaldi · 2026-10-06T18:55:21Z

[non-blocking] Could we reduce or consolidate the distribution ownership warnings? Nearly every command in the Tutor acceptance run printed this several times:

Could not uniquely resolve the distribution that ships a schema resource; selecting deterministically.

The repeated warnings made the actual schema report difficult to find. Could we print this once and include which distribution was selected, or lower the log level when the fallback is safe?

mariajgrimaldi · 2026-10-06T18:56:17Z

+    def _report_plan(self, plan, *, applied: bool) -> None:
+        """Print the change report (ADR 0018 §6).
+
+        Covers the definition tables (roles, permissions, categories, and
+        role-permission grants) as well as the Casbin ``p`` policy rows. The two
+        are reported separately because they are distinct layers: apply syncs the
+        definition metadata even when no ``p`` row changes, so a metadata-only
+        edit is a real change the operator needs to see. ``applied`` only changes
+        the verb tense in the section headers (past tense once written).
+        """
+        if plan.unchanged:
+            self.stdout.write(self.style.SUCCESS("Authz schema unchanged; nothing would be written."))
+            return
+
+        added_label = "added" if applied else "to add"
+        removed_label = "removed" if applied else "to remove"
+
+        self.stdout.write(f"Casbin policy rows {added_label} ({len(plan.added_rows)}):")
+        for row in plan.added_rows:
+            self.stdout.write(f"  + {row.as_policy()}")
+
+        self.stdout.write(f"Casbin policy rows {removed_label} ({len(plan.removed_rows)}):")
+        for row in plan.removed_rows:
+            self.stdout.write(f"  - {row.as_policy()}")
+
+        self._report_definitions(plan)
+
+        if plan.blocking_assignments:
+            self.stdout.write(
+                self.style.WARNING(
+                    f"{len(plan.blocking_assignments)} role(s) with existing assignments would be "
+                    "removed; apply requires --force:"
+                )
+            )
+            for role, subject in plan.blocking_assignments:
+                self.stdout.write(f"  ! {role} assigned to {subject}")


[non-blocking] Could we format the change report as one compact, colorized diff? The current output separates additions and removals, so related changes are difficult to scan.

Something like this would be easier to review:

Casbin policies (2) + p, role^course_editor, act^courses.view_course, course-v1^*, allow - p, role^old_editor, act^courses.manage_tags, course-v1^*, allow Definitions (2) + permission: courses.view_course ~ role: course_editor

The +, ~, and - markers would still work without color. We could also omit empty sections.

openedx-webhooks added open-source-contribution PR author is not from Axim or 2U core contributor PR author is a Core Contributor (who may or may not have write access to this repo). labels Sep 10, 2026

openedx-webhooks added this to Contributions Sep 10, 2026

github-project-automation Bot moved this to Needs Triage in Contributions Sep 10, 2026

rodmgwgu marked this pull request as draft September 10, 2026 18:36

rodmgwgu added this pull request to stack #447 September 10, 2026 18:40

BryanttV linked an issue Sep 11, 2026 that may be closed by this pull request

Core Loader, Compilation, and Definition Validation #410

Closed

rodmgwgu force-pushed the rod/authz-schema-loader branch 2 times, most recently from 6750d1c to 4a43021 Compare September 14, 2026 18:42

rodmgwgu mentioned this pull request Sep 15, 2026

docs: add ADR for authorization schema source tracking #444

Merged

1 of 7 tasks

mphilbrick211 moved this from Needs Triage to Waiting on Author in Contributions Sep 17, 2026

rodmgwgu force-pushed the rod/authz-schema-loader branch 2 times, most recently from 2b4993d to 49effcb Compare September 17, 2026 18:17

Base automatically changed from rod/authz-schema-files to main September 17, 2026 18:51

rodmgwgu force-pushed the rod/authz-schema-loader branch 2 times, most recently from 4861927 to 3956e81 Compare September 18, 2026 15:29

rodmgwgu marked this pull request as ready for review September 18, 2026 15:34

rodmgwgu requested review from BryanttV, mariajgrimaldi and wgu-taylor-payne September 18, 2026 17:34

This was referenced Sep 21, 2026

Plugin Discovery Mechanism and Aggregation #433

Open

Extend schema loader validation to use schema reference defined in #431 #459

Open

rodmgwgu force-pushed the rod/authz-schema-loader branch from 3956e81 to c75eccb Compare September 21, 2026 20:58

carlos-marquez-wgu reviewed Sep 21, 2026

View reviewed changes

rodmgwgu added this pull request to stack #481 September 23, 2026 16:41

rodmgwgu force-pushed the rod/authz-schema-loader branch from f5ad8fe to ce37ce4 Compare September 23, 2026 17:03

rodmgwgu requested a review from BryanttV September 23, 2026 17:20

carlos-marquez-wgu approved these changes Sep 23, 2026

View reviewed changes

rodmgwgu force-pushed the rod/authz-schema-loader branch 5 times, most recently from 9ffc961 to cb95be0 Compare September 24, 2026 23:01

rodmgwgu force-pushed the rod/authz-schema-loader branch 2 times, most recently from 23c2d94 to 66886b4 Compare September 25, 2026 15:47

rodmgwgu force-pushed the rod/authz-schema-loader branch 2 times, most recently from 44f0866 to 02a2dad Compare September 29, 2026 15:12

carlos-marquez-wgu mentioned this pull request Sep 29, 2026

feat: run load_authz_schema during LMS/CMS init overhangio/tutor#1496

Draft

rodmgwgu force-pushed the rod/authz-schema-loader branch from 02a2dad to 3276379 Compare September 30, 2026 23:08

mariajgrimaldi reviewed Oct 1, 2026

View reviewed changes

rodmgwgu force-pushed the rod/authz-schema-loader branch from 3276379 to 7a03353 Compare October 5, 2026 22:41

mariajgrimaldi reviewed Oct 6, 2026

View reviewed changes

feat: add authz schema pipeline and load_authz_schema command

fdbe286

rodmgwgu force-pushed the rod/authz-schema-loader branch from 7a03353 to fdbe286 Compare October 7, 2026 19:07

Navigation Menu

Repository navigation

feat: add authz schema pipeline and load_authz_schema command - #446

feat: add authz schema pipeline and load_authz_schema command#446
rodmgwgu wants to merge 1 commit into
rod/authz-schema-applierfrom
rod/authz-schema-loader

rodmgwgu commented Sep 10, 2026 •

edited

Loading

Uh oh!

openedx-webhooks commented Sep 10, 2026 •

edited

Loading

Uh oh!

carlos-marquez-wgu commented Sep 21, 2026 •

edited

Loading

Uh oh!

carlos-marquez-wgu commented Sep 21, 2026 •

edited

Loading

Uh oh!

rodmgwgu commented Sep 21, 2026

Uh oh!

carlos-marquez-wgu Sep 21, 2026

Uh oh!

rodmgwgu Sep 21, 2026

Uh oh!

carlos-marquez-wgu commented Sep 23, 2026

Uh oh!

mariajgrimaldi left a comment

Uh oh!

mariajgrimaldi Oct 1, 2026

Uh oh!

rodmgwgu Oct 5, 2026

Uh oh!

mariajgrimaldi Oct 6, 2026

Uh oh!

mariajgrimaldi commented Oct 6, 2026

Uh oh!

mariajgrimaldi Oct 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

rodmgwgu commented Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Approach

Manual testing instructions

1. Dry run reports the change without writing

2. Apply, then confirm it is idempotent

3. A role extension changes an existing role without copying it (ADR 0023)

4. Removing an assigned role is blocked without --force (ADR 0018 §6)

5. An invalid schema stops deployment before any write

Automated coverage

Rollback plan

Retro compatibility

Follow up work required

AI Usage

Uh oh!

openedx-webhooks commented Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

carlos-marquez-wgu commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

carlos-marquez-wgu commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rodmgwgu commented Sep 21, 2026

Uh oh!

carlos-marquez-wgu Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

rodmgwgu Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

carlos-marquez-wgu commented Sep 23, 2026

Uh oh!

mariajgrimaldi left a comment

Choose a reason for hiding this comment

Uh oh!

mariajgrimaldi Oct 1, 2026

Choose a reason for hiding this comment

Uh oh!

rodmgwgu Oct 5, 2026

Choose a reason for hiding this comment

Uh oh!

mariajgrimaldi Oct 6, 2026

Choose a reason for hiding this comment

Uh oh!

mariajgrimaldi commented Oct 6, 2026

Uh oh!

mariajgrimaldi Oct 6, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

rodmgwgu commented Sep 10, 2026 •

edited

Loading

4. Removing an assigned role is blocked without `--force` (ADR 0018 §6)

openedx-webhooks commented Sep 10, 2026 •

edited

Loading

carlos-marquez-wgu commented Sep 21, 2026 •

edited

Loading

carlos-marquez-wgu commented Sep 21, 2026 •

edited

Loading