openedx / openedx/openedx-authz

Higher-level scopes are not returned when querying a more specific scope

Open
#457 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

willow
Dominant language
Python
Stars
0
Forks
9
Avg merge
13d 9h
Merged PRs (30d)
9

Description

Description

According to the designs, a scope also applies to the higher levels in the hierarchy. For example:

  • A specific course-level scope (course-v1:OpenedX+DemoX+DemoCourse) also applies at the organization level (course-v1:OpenedX+*) and at the platform level (course-v1:*).
  • An organization-level scope (course-v1:OpenedX+*) also applies at the platform level (course-v1:*).

Currently the response does not account for this inheritance in either case, so not all scopes that actually apply are being returned.

This also needs to be addressed for library scopes, not just course scopes — the same hierarchy logic (specific library → organization → platform) applies and should be handled consistently with courses.

Expected behavior

When querying any scope (course or library), the response should also include the scopes from all higher levels in the hierarchy that apply to it:

Course → should also include organization and platform.
Library → should also include organization and platform.
Organization → should also include platform.

Current behavior

Only the exact queried scope is returned, without propagating to higher levels in either case.

Context

This came up during a PR review comment

Proposed tasks
  • Define the logic to resolve the full scope hierarchy (platform → organization → course/library)
  • Update the response to include all applicable higher-level scopes, for any query level
  • Ensure the logic is applied consistently to both course scopes and library scopes
  • Add tests covering the different hierarchy levels (course→org→platform, library→org→platform, org→platform)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source files or test paths are named. First locate the scope-query response logic and existing course and library scope tests, then trace how exact matches are resolved. Done means queries include applicable organization and platform scopes for course, library, and organization hierarchies, with tests covering each listed case.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authorization
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.