User - Organization - Channel Edit/View Permissions

❌ This issue is not open for contribution. Visit Contributing guidelines to learn about the contributing process and how to find suitable issues.

Overview

As Organizations and Channels are finally being connected, we need to find a way to merge permissions between these two models. Currently, Channels are owned via the editor property, but once they are part of an organization, channel editors need to include organization editors and admins. This equally applies to viewing permissions, tagged to Channel.viewers.

Complexity: Low
Target branch: unstable

The Change

Whenever the API needs to check for a user's editable/viewable channels, it should consider both personal channel permissions, AND organization channel permissions. In channel context, org admin permissions should translate to editing permissions as well.

Here are a few examples:

Person A is an editor on Channel A, and they have been invited to join Org 1.

Person A should be able to join Org 1 as an Org Viewer, and retain their edit permissions on their own channel
Person A should be able to join Org 1 as an Org Editor, and gain edit permissions for all org-associated channels
Person A should be able to join Org 1 as an Org Admin, and gain edit permissions for all org-associated channels and gain management permissions on the org itself (such as sending invitations to the org, upgrading permissions of others, etc.)

Admin B at Org 1 should have management permissions on the org itself (such as sending invitations to the org, upgrading permissions of others, etc.) as well as edit permissions for all org-associated channels
Org Editor B at Org 1 should have edit permissions for all org-associated channels (for example, although they are not the original creator of Channel A, they can now edit it)
Org Viewer B at Org 1 should be able to see Channel A, but not edit it. They should be able to edit their own created channels within the org, if any.

How to Get There

Whenever the API checks for channel EDIT permissions, or tries to find a user's editable channels. This is usually done via Channel.filter_edit_query_set() or Channel.editors (commonly used as User.editable_channels).

Whenever the API checks for channel VIEW permissions, or tries to find a user's viewable channels. This is usually done via Channel.filter_view_queryset() or Channel.viewers (commonly used as User.view_only_channels).

Acceptance Criteria

Previous Items

• Blocking comment from #6080

ContentNode.filter_edit_queryset (models.py:2373), AssessmentItem (3406), File (3608) route through PermissionCTE.editable_channels (1022) — m2m only, no org branch. /api/sync/ gates on Channel.filter_edit_queryset (sync/endpoint.py:61-67), so org-editor content changes are admitted, then rejected as "Not found" by get_edit_queryset() (base.py:798). Issue requires channels and content. Union the org channel ids into PermissionCTE.editable_channels.

• Blocking comment from #6080

ChannelViewSet.get_queryset (channel.py:518-521) re-annotates edit/view from the m2m tables; annotate() overwrites, discarding these grants. GET /api/channel/ returns edit: false, ?edit=true skips the channel, yet PATCH succeeds via filter_edit_queryset. Drop that re-annotation; fold organization_view/organization_edit into edit/view here.

General

• Channel Edit Querysets now consider edit rights through organization channels/roles
• Usage of User.editable_channels or Channel.editors is replaced with a combination of the original Channel.editors check + organization-wide check
• Channel View Querysets now consider view rights through organization channels/roles
• Usage of User.view_only_channels or Channel.viewers is replaced with a combination of the original Channel.viewers check + organization-wide check

AI usage

AI was used to gather a few code requirements across the code base (usage of edit permissions)