openedx / openedx/openedx-core
`can_add_tag` is not correct for Django superusers
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 10
- Forks
- 32
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 12
Description
When accessing a taxonomy's tags in the REST API, the can_add_tag value is supposed to indicate if the user can add new tags to the taxonomy.
For read-only/system-defined or free text taxonomies, this value should always be false:
However, because the logic for can_add_tag is only implemented as a permissions check, when a superuser uses the API, the can_add_tag value is always True, even for system-defined taxonomies and free text taxonomies, because the Django permissions code doesn't even evaluate the permissions predicate for superusers.
The result is that most devstack users will see the "+ add tag" button for these taxonomies, even though attempting to add a tag will result in an error:
(attempting to add a new tag then correctly displays an error:)
Related frontend issue: The error is reported three times, but none of those have the actual error reason shown. (TODO: open separate bug issue for this.)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in openedx/core/djangoapps/content_tagging/rules.py around lines 356-369 and trace how the REST API computes can_add_tag. Verify the behavior for Django superusers across read-only/system-defined and free text taxonomies. Done means those cases return false while addable taxonomies retain the correct permission-based result; add or update focused tests if the relevant test location is found.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- django, python
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100