[DEPR]: Libraries' Roles and Permission System

RFC Start Date

2025-10-16

Target Plan Accepted Date

2025-10-30

Target Transition Unblocked Date

December 2025 (With Ulmo cut)

Earliest Breaking Changes Unblocked Date

April 2026

Earliest Open edX Named Release with Breaking Changes

Willow

Rationale

The Roles and Permissions improvement project aims to enhance the management of permissions on the Open edX platform. To mitigate the possible risk associated with completely overhauling a core system like authorization, our primary strategy is to implement a staging or phased migration plan. We will start migrating the current library permissions and roles to the new authorization system.

Removal

• Libraries Roles and Permission System
  • API methods regarding authorization in https://github.com/openedx/edx-platform/tree/a0b4f8168659795a5c356e83b4dfed16fb4282ae/openedx/core/djangoapps/content_libraries/api
  • The Rest API methods regarding authorization in https://github.com/openedx/edx-platform/tree/a0b4f8168659795a5c356e83b4dfed16fb4282ae/openedx/core/djangoapps/content_libraries/rest_api
  • The library's permissions: https://github.com/openedx/edx-platform/blob/a0b4f8168659795a5c356e83b4dfed16fb4282ae/openedx/core/djangoapps/content_libraries/permissions.py
  • ContentLibraryPermission model: https://github.com/openedx/edx-platform/blob/a0b4f8168659795a5c356e83b4dfed16fb4282ae/openedx/core/djangoapps/content_libraries/models.py#L186

Replacement

• New AuthZ System: https://github.com/openedx/openedx-authz
  • API: https://github.com/openedx/openedx-authz/pull/75
  • Rest API: https://github.com/openedx/openedx-authz/pull/84
  • Libraries permissions and roles: https://github.com/openedx/openedx-authz/pull/94
  • Policy: https://github.com/openedx/openedx-authz/pull/92

Deprecation

• We'll mark the rest api methods regarding authorization in content libraries as depr.
• We'll mark the ContentLibraryPermission model as depr.

https://github.com/openedx/openedx-platform/pull/38052

Additional Info

[!NOTE]
For the Ulmo release, we are going to add this new authorization system without removing the existing one, following the expand-contract deprecation model.

More information: https://github.com/openedx/openedx-authz/pull/66

Task List (Transition Unblocked)

• Having a migration script to transform existing explicit role assignments into the new authorization model

Task List (DEPR)

• Remove the code mentioned in the removal section. - planned for Willow.

Start by reviewing the content_libraries API and rest_api directories, permissions.py, and the ContentLibraryPermission model in models.py. Compare the existing authorization paths with the replacement work in openedx-authz and check the deprecation changes in open edX pull request 38052. Done means removing the listed legacy code without breaking the new authorization flow or its migration path.