openedx / openedx/openedx-authz
Higher-level scopes are not returned when querying a more specific scope
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 0
- Forks
- 9
- Avg merge
- 13d 9h
- Merged PRs (30d)
- 9
Description
Description
According to the designs, a scope also applies to the higher levels in the hierarchy. For example:
- A specific course-level scope (
course-v1:OpenedX+DemoX+DemoCourse) also applies at the organization level (course-v1:OpenedX+*) and at the platform level (course-v1:*). - An organization-level scope (
course-v1:OpenedX+*) also applies at the platform level (course-v1:*).
Currently the response does not account for this inheritance in either case, so not all scopes that actually apply are being returned.
This also needs to be addressed for library scopes, not just course scopes — the same hierarchy logic (specific library → organization → platform) applies and should be handled consistently with courses.
Expected behavior
When querying any scope (course or library), the response should also include the scopes from all higher levels in the hierarchy that apply to it:
Course → should also include organization and platform.
Library → should also include organization and platform.
Organization → should also include platform.
Current behavior
Only the exact queried scope is returned, without propagating to higher levels in either case.
Context
This came up during a PR review comment
Proposed tasks
- Define the logic to resolve the full scope hierarchy (platform → organization → course/library)
- Update the response to include all applicable higher-level scopes, for any query level
- Ensure the logic is applied consistently to both course scopes and library scopes
- Add tests covering the different hierarchy levels (course→org→platform, library→org→platform, org→platform)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No source files or test paths are named. First locate the scope-query response logic and existing course and library scope tests, then trace how exact matches are resolved. Done means queries include applicable organization and platform scopes for course, library, and organization hierarchies, with tests covering each listed case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authorization
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100