openedx / openedx/openedx-authz
Make backend endpoints aware of the course authoring flag
@mariajgrimaldi is already working on this.
Since Aug 17, 2026.
- Dominant language
- Python
- Stars
- 0
- Forks
- 9
- Avg merge
- 13d 9h
- Merged PRs (30d)
- 9
Description
Description
As part of the work in https://github.com/openedx/openedx-authz/commit/567e9a0d38b5a1d5286f44195ab77660a1cf6d93, we added a dedicated endpoint to expose the current state of the authz.enable_course_authoring waffle flag. That endpoint lets the admin-console MFE decide what to show for this release (verawood), but the backend endpoints themselves are still not aware of the flag state.
This issue tracks the follow-up work needed to make the relevant backend endpoints aware of authz.enable_course_authoring, instead of leaving all filtering logic to the MFE.
Context
The current approach was chosen to avoid changing release-blocking endpoints late in the release cycle. The new endpoint is additive and lets the MFE apply the simpler release-time behavior. However, the ADR added in the commit notes that making the REST API endpoints themselves aware of the flag is still an open problem and should be addressed separately.
Expected behavior
Backend endpoints that expose or validate authoring-related roles, scopes, permissions, or assignments should take the authz.enable_course_authoring flag state into account where appropriate.
This should help avoid returning or validating authoring-related data in cases where the flag state means those items should not be considered available.
Notes
Related context:
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading commit 567e9a0d38b5a1d5286f44195ab77660a1cf6d93 and issues 340, 341, and 358 to identify the relevant backend endpoints and the intended flag behavior. Review pull requests 378 and 390 for work already attempted; done means applicable endpoints consistently account for authz.enable_course_authoring when exposing or validating authoring-related data.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, authorization, backend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100