openedx / openedx/openedx-core

`can_add_tag` is not correct for Django superusers

Open
#635 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
10
Forks
32
Avg merge
2d 17h
Merged PRs (30d)
12

Description

When accessing a taxonomy's tags in the REST API, the can_add_tag value is supposed to indicate if the user can add new tags to the taxonomy.

For read-only/system-defined or free text taxonomies, this value should always be false:

https://github.com/openedx/openedx-platform/blob/c0973707f398359a9a5ed87a72204a291ac1abe7/openedx/core/djangoapps/content_tagging/rules.py#L356-L369

However, because the logic for can_add_tag is only implemented as a permissions check, when a superuser uses the API, the can_add_tag value is always True, even for system-defined taxonomies and free text taxonomies, because the Django permissions code doesn't even evaluate the permissions predicate for superusers.

The result is that most devstack users will see the "+ add tag" button for these taxonomies, even though attempting to add a tag will result in an error:

Image

(attempting to add a new tag then correctly displays an error:)

Image

Related frontend issue: The error is reported three times, but none of those have the actual error reason shown. (TODO: open separate bug issue for this.)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in openedx/core/djangoapps/content_tagging/rules.py around lines 356-369 and trace how the REST API computes can_add_tag. Verify the behavior for Django superusers across read-only/system-defined and free text taxonomies. Done means those cases return false while addable taxonomies retain the correct permission-based result; add or update focused tests if the relevant test location is found.

Written by the indexing model from the issue text.

Assessment

Tech stack
django, python
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.