AuthZ Extensibility in Willow: Enable Roles and Permissions Contributed by Modules

Description

Allow an installed module to contribute new roles and permissions (including the metadata needed by the Administrative Console) without changing openedx-authz critical code paths or adding role-specific frontend code.

• Spike: Extensibility Proposal for Willow Instructor Dashboard Use Case

• Guiding use case: Instructor Dashboard.

• Context: The PoC already showed that Casbin can load, assign, and enforce new role and permission strings. This epic covers the missing definition layer around that behavior: contribution/discovery, metadata, validation, and role-agnostic APIs.

• Scope covered: Use cases A1, A2, A5, and A6 (add a role with existing permissions; add a role with new permissions; add new/existing permissions to a built-in role). Uses the current scope and subject.

• Out of scope: new scope types, new subject types, scope REST discovery, and plugin removal.

No files or tests are named. Start with the linked Extensibility Proposal and the existing Casbin proof of concept, focusing on contribution/discovery, metadata, validation, and role-agnostic APIs for use cases A1, A2, A5, and A6. Done means modules can contribute roles and permissions, including Administrative Console metadata, without changing critical authorization paths or adding role-specific frontend code.