fix: keep unmigrated legacy roles working under the authz authoring flag (#38855)

Granting and exercising course creator access crashed once
authz.enable_course_authoring was on. The courses.create_course
permission was implemented in AuthZ, but the course creator role itself
was never migrated there. The code deciding whether to use the AuthZ path
only checked the flag's state, not whether the specific role had actually
been migrated, so unmigrated roles like course creator still used the
AuthZ path and crashed.

enable_authz_course_authoring now takes an optional role and falls back
to the course creator role's own check for any role without a migrated
AuthZ equivalent, regardless of the flag. See ADR 0027.

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: mariajgrimaldi

cms/djangoapps/contentstore/asset_storage_handlers.py

@@ -26,14 +26,14 @@
 from openedx_filters.content_authoring.filters import LMSPageURLRequested
 from pymongo import ASCENDING, DESCENDING
 
+from common.djangoapps.student.roles import enable_authz_course_authoring
 from common.djangoapps.util.date_utils import get_default_time_display
 from common.djangoapps.util.json_request import JsonResponse
 from openedx.core.djangoapps.authz.constants import LegacyAuthoringPermission
 from openedx.core.djangoapps.authz.decorators import user_has_course_permission
 from openedx.core.djangoapps.contentserver.caching import del_cached_content
 from openedx.core.djangoapps.site_configuration import helpers as configuration_helpers
 from openedx.core.djangoapps.user_api.models import UserPreference
-from openedx.core.toggles import enable_authz_course_authoring
 from xmodule.contentstore.content import StaticContent  # pylint: disable=wrong-import-order
 from xmodule.contentstore.django import contentstore  # pylint: disable=wrong-import-order
 from xmodule.exceptions import NotFoundError  # pylint: disable=wrong-import-order

cms/djangoapps/contentstore/rest_api/v1/serializers/course_waffle_flags.py

@@ -5,7 +5,7 @@
 from rest_framework import serializers
 
 from cms.djangoapps.contentstore import toggles
-from openedx.core import toggles as core_toggles
+from common.djangoapps.student.roles import enable_authz_course_authoring
 
 
 class CourseWaffleFlagsSerializer(serializers.Serializer):
@@ -225,4 +225,4 @@ def get_enable_authz_course_authoring(self, obj):
         Method to get the authz.enable_course_authoring waffle flag
         """
         course_key = self.get_course_key()
-        return core_toggles.enable_authz_course_authoring(course_key)
+        return enable_authz_course_authoring(course_key)

cms/djangoapps/contentstore/tests/test_course_create_rerun.py

@@ -13,9 +13,9 @@
 from django.test import override_settings
 from django.test.client import RequestFactory
 from django.urls import reverse
+from edx_toggles.toggles.testutils import override_waffle_flag
 from opaque_keys.edx.keys import CourseKey
 from opaque_keys.edx.locator import CourseLocator
-from openedx_authz.constants.roles import COURSE_EDITOR
 from organizations.api import add_organization, get_course_organizations, get_organization_by_short_name
 from organizations.exceptions import InvalidOrganizationException
 from organizations.models import Organization
@@ -34,6 +34,7 @@
 from common.djangoapps.student.roles import CourseInstructorRole, CourseStaffRole, OrgContentCreatorRole
 from common.djangoapps.student.tests.factories import AdminFactory, UserFactory
 from openedx.core.djangoapps.authz.tests.mixins import CourseAuthoringAuthzTestMixin
+from openedx.core.toggles import AUTHZ_COURSE_AUTHORING_FLAG
 from xmodule.course_block import CourseFields
 from xmodule.modulestore.tests.django_utils import ModuleStoreTestCase
 from xmodule.modulestore.tests.factories import CourseFactory
@@ -386,119 +387,37 @@ def test_default_enable_flexible_peer_openassessments_on_rerun(
             )
 
 
-class TestCourseHandlerAuthz(
-    CourseAuthoringAuthzTestMixin,
-    ModuleStoreTestCase,
-):
+@ddt.ddt
+class TestCourseHandlerStaffAccess(ModuleStoreTestCase):
     """
-    AuthZ integration tests for course_handler using real RBAC (no mocks).
+    Tests that global staff can create a course through course_handler with no
+    course-specific role, covering the GlobalStaff bypass in user_has_role. Course
+    creation doesn't check AuthZ (see ADR 0027), so this doesn't use the AuthZ mixin.
     """
 
     def setUp(self):
         super().setUp()
-
         self.url = reverse("course_handler")
+        self.staff_user = AdminFactory()
+        self.staff_client = AjaxEnabledTestClient()
+        self.staff_client.login(username=self.staff_user.username, password=self.TEST_PASSWORD)
 
-        # Create a base course to extract org
-        self.course = CourseFactory.create()
-        self.course_key = self.course.id
-        self.org = self.course_key.org
-
-        # If your policy expects this format, keep it
-        self.org_key = f"course-v1:{self.org}+*"
-
-        self.authorized_client = AjaxEnabledTestClient()
-        self.authorized_client.login(
-            username=self.authorized_user.username,
-            password=self.password,
-        )
-
-        self.unauthorized_client = AjaxEnabledTestClient()
-        self.unauthorized_client.login(
-            username=self.unauthorized_user.username,
-            password=self.password,
-        )
-        self.authorized_staff_client = AjaxEnabledTestClient()
-        self.authorized_staff_client.login(
-            username=self.staff_user.username,
-            password=self.password,
-        )
-
-    # ------------------------------------------------------------
-    # CREATE COURSE -- Non-staff users and existing Organization
-    # ------------------------------------------------------------
-    @override_settings(DISABLE_COURSE_CREATION=False)
-    def test_create_course_unauthorized(self):
-        """
-        User without role cannot create course.
-        """
-
-        response = self.unauthorized_client.ajax_post(self.url, {
-            "org": self.org,
-            "number": "CS101",
-            "display_name": "Authz Course",
-            "run": "2026_T1",
-        })
-
-        assert response.status_code == 403
-
-    @override_settings(DISABLE_COURSE_CREATION=False)
-    def test_create_course_unauthorized_with_role(self):
-        """
-        User with role but without required permission cannot create course.
-        """
-
-        self.add_user_to_role_in_course(
-            self.unauthorized_user,
-            COURSE_EDITOR.external_key,
-            "course-v1:someotherorg+*",
-        )
-
-        response = self.unauthorized_client.ajax_post(self.url, {
-            "org": self.org,
-            "number": "CS101",
-            "display_name": "Authz Course",
-            "run": "2026_T1",
-        })
-
-        assert response.status_code == 403
-
-    # ------------------------------------------------------------
-    # CREATE COURSE -- Staff users
-    # Only staff users can create course, and they can do it
-    # without an org role.
-    # ------------------------------------------------------------
-    def test_create_course_staff(self):
+    @ddt.data(True, False)
+    def test_create_course_staff(self, authz_enabled):
         """
-        Staff user can create course.
+        Staff user can create a course with no prior course-specific role, whether
+        the AuthZ course-authoring flag is on or off.
         """
-        response = self.authorized_staff_client.ajax_post(self.url, {
-            "org": self.org,
-            "number": "CS101",
-            "display_name": "Authz Course",
-            "run": "2026_T1",
-        })
+        with override_waffle_flag(AUTHZ_COURSE_AUTHORING_FLAG, active=authz_enabled):
+            response = self.staff_client.ajax_post(self.url, {
+                "org": "StaffOrg",
+                "number": "CS101",
+                "display_name": "Staff Course",
+                "run": "2026_T1",
+            })
 
         assert response.status_code == 200
 
-    # ------------------------------------------------------------
-    # FEATURE FLAG
-    # ------------------------------------------------------------
-    @override_settings(DISABLE_COURSE_CREATION=True)
-    def test_create_course_disabled_by_flag(self):
-        """
-        Even authorized users cannot create course if feature flag is off.
-        """
-
-        response = self.authorized_staff_client.ajax_post(self.url, {
-            "org": self.org,
-            "number": "CS101",
-            "display_name": "Authz Course",
-            "run": "2026_T1",
-        })
-
-        assert response.status_code == 403
-
 
 class TestCourseRerunAuthz(
     CourseAuthoringAuthzTestMixin,

cms/djangoapps/contentstore/views/course.py

@@ -74,6 +74,7 @@
     GlobalStaff,
     OrgStaffRole,
     UserBasedRole,
+    enable_authz_course_authoring,
     strict_role_checking,
 )
 from common.djangoapps.util.json_request import JsonResponse, JsonResponseBadRequest, expect_json
@@ -857,7 +858,7 @@ def _get_course_keys_from_platform_scope() -> set[CourseKey]:
     if core_toggles.AUTHZ_COURSE_AUTHORING_FLAG.is_enabled():
         return set(course_keys)
 
-    return {course_key for course_key in course_keys if core_toggles.enable_authz_course_authoring(course_key)}
+    return {course_key for course_key in course_keys if enable_authz_course_authoring(course_key)}
 
 
 def _get_course_keys_from_scopes(authz_scopes: list[ScopeData]) -> set[CourseKey]:
@@ -888,15 +889,15 @@ def _get_course_keys_from_scopes(authz_scopes: list[ScopeData]) -> set[CourseKey
 
     for access in authz_scopes:
         if isinstance(access, CourseOverviewData) and access.course_key:
-            if core_toggles.enable_authz_course_authoring(access.course_key):
+            if enable_authz_course_authoring(access.course_key):
                 course_keys.add(access.course_key)
         elif isinstance(access, OrgCourseOverviewGlobData) and access.org:
             org_keys.add(access.org)
 
     if org_keys:
         course_keys.update(
             key for key in _get_course_keys_for_org_scope(org_keys)
-            if core_toggles.enable_authz_course_authoring(key)
+            if enable_authz_course_authoring(key)
         )
 
     return course_keys
@@ -1344,7 +1345,7 @@ def rerun_course(user, source_course_key, org, number, run, fields, background=T
     # is implemented (pre-assigning roles without a CourseOverview). Once resolved,
     # add_instructor can be called unconditionally here and the created_user fallback
     # in get_in_process_course_actions can be removed.
-    if not core_toggles.enable_authz_course_authoring(destination_course_key):
+    if not enable_authz_course_authoring(destination_course_key):
         add_instructor(destination_course_key, user, user)
 
     # Mark the action as initiated

common/djangoapps/student/auth.py

@@ -11,7 +11,7 @@
 from django.core.exceptions import PermissionDenied
 from opaque_keys.edx.locator import LibraryLocator
 from openedx_authz import api as authz_api
-from openedx_authz.constants.permissions import COURSES_CREATE_COURSE, COURSES_MANAGE_ADVANCED_SETTINGS
+from openedx_authz.constants.permissions import COURSES_MANAGE_ADVANCED_SETTINGS
 
 from common.djangoapps.student.roles import (
     CourseBetaTesterRole,
@@ -227,9 +227,9 @@ def is_content_creator(user, org):
     """
     Determine whether a user is allowed to create course content for a given organization.
 
-    This function abstracts the permission check for course creation. Depending on the
-    state of the AuthZ feature flag, it delegates the evaluation to either the AuthZ-based
-    RBAC system or the legacy role-based permission system.
+    Neither CourseCreatorRole nor OrgContentCreatorRole has a migrated AuthZ equivalent yet
+    (see ADR 0027), so this always checks the legacy role-based permission system. Once
+    either role gets a migrated equivalent, this should also check AuthZ, gated on that role.
 
     Args:
         user (User): The user whose permissions are being evaluated.
@@ -238,38 +238,10 @@ def is_content_creator(user, org):
     Returns:
         bool: True if the user has permission to create course content in the given
         organization, False otherwise.
-
-    Notes:
-        - When AuthZ is enabled, this checks permissions via RBAC policies.
-        - When AuthZ is disabled, this falls back to legacy Django role checks.
-        - Course creation may still be blocked by global feature flags (e.g.,
-          DISABLE_COURSE_CREATION), which are enforced downstream.
     """
-    if core_toggles.AUTHZ_COURSE_AUTHORING_FLAG.is_enabled():
-        return _has_content_creator_access(user, org)
     return _has_legacy_content_creator_access(user, org)
 
 
-def _has_content_creator_access(user, org):
-    """
-    Check if the user has content creator access based on AuthZ permissions.
-
-    Returns:
-        bool: True if the user has platform-wide or org-scoped course creation permission.
-    """
-    if getattr(settings, 'DISABLE_COURSE_CREATION', False):
-        return False
-
-    scope_keys = (
-        authz_api.PlatformCourseOverviewGlobData.build_external_key(),
-        authz_api.OrgCourseOverviewGlobData.build_external_key(org),
-    )
-    return any(
-        authz_api.is_user_allowed(user.username, COURSES_CREATE_COURSE.identifier, scope_key)
-        for scope_key in scope_keys
-    )
-
-
 def _has_legacy_content_creator_access(user, org):
     """
     Check if the user has the role to create content.

common/djangoapps/student/roles.py

@@ -21,7 +21,7 @@
 from common.djangoapps.student.models import CourseAccessRole
 from common.djangoapps.student.signals.signals import emit_course_access_role_added, emit_course_access_role_removed
 from openedx.core.lib.cache_utils import get_cache
-from openedx.core.toggles import enable_authz_course_authoring
+from openedx.core.toggles import AUTHZ_COURSE_AUTHORING_FLAG
 
 log = logging.getLogger(__name__)
 
@@ -43,6 +43,24 @@ def get_legacy_role_from_authz_role(authz_role: str) -> str:
     return next((k for k, v in authz_roles.LEGACY_COURSE_ROLE_EQUIVALENCES.items() if v == authz_role), None)
 
 
+def enable_authz_course_authoring(course_key: CourseKey | None = None, role: str | None = None) -> bool:
+    """
+    True only if the authz.enable_course_authoring waffle flag is enabled and, when `role` is
+    given, that role has a migrated authz equivalent.
+
+    The migration only covers a subset of legacy roles (see LEGACY_COURSE_ROLE_EQUIVALENCES
+    and ADR 0027), so an unmigrated role must keep resolving to the legacy path even with the
+    flag on. Most callers have no specific role in scope and can omit `role`. Pass it when
+    acting on a specific legacy role, so a role like course_creator_group falls back to legacy
+    instead of crashing or being denied by authz (see openedx-authz#353, #354).
+    """
+    if not AUTHZ_COURSE_AUTHORING_FLAG.is_enabled(course_key):
+        return False
+    if role is not None and get_authz_role_from_legacy_role(role) is None:
+        return False
+    return True
+
+
 def authz_add_role(user: User, authz_role: str, course_key: str):
     """
     Add a user's role in a course if not already added.
@@ -520,7 +538,7 @@ def add_users(self, *users):
         """
         Add the supplied django users to this role.
         """
-        if enable_authz_course_authoring(self.course_key):
+        if enable_authz_course_authoring(self.course_key, role=self._role_name):
             self._authz_add_users(users)
         else:
             self._legacy_add_users(users)
@@ -561,7 +579,7 @@ def remove_users(self, *users):
         """
         Remove the supplied django users from this role.
         """
-        if enable_authz_course_authoring(self.course_key):
+        if enable_authz_course_authoring(self.course_key, role=self._role_name):
             self._authz_remove_users(users)
         else:
             self._legacy_remove_users(users)
@@ -599,7 +617,7 @@ def users_with_role(self):
         """
         Return a django QuerySet for all of the users with this role
         """
-        if enable_authz_course_authoring(self.course_key):
+        if enable_authz_course_authoring(self.course_key, role=self._role_name):
             return self._authz_users_with_role()
         else:
             return self._legacy_users_with_role()
@@ -628,7 +646,7 @@ def get_orgs_for_user(self, user):
         """
         Returns a list of org short names for the user with given role.
         """
-        if enable_authz_course_authoring(self.course_key):
+        if enable_authz_course_authoring(self.course_key, role=self._role_name):
             return self._authz_get_orgs_for_user(user)
         else:
             return self._legacy_get_orgs_for_user(user)
@@ -642,7 +660,7 @@ def has_org_for_user(self, user: User, org: str | None = None) -> bool:
             org: optional org to check against access to role,
                 if not specified, will return True if the user has access to at least one org
         """
-        if enable_authz_course_authoring(self.course_key):
+        if enable_authz_course_authoring(self.course_key, role=self._role_name):
             orgs_with_role = self.get_orgs_for_user(user)
             if org:
                 return org in orgs_with_role