openedx / openedx/openedx-platform
Spike - RBAC AuthZ - review content tagging legacy permissions (taxonomies)
@gviedma-aulasneo is already working on this.
Since Jun 3, 2026.
- Dominant language
- Python
- Stars
- 8.2k
- Forks
- 4.4k
- Avg merge
- 6d 18h
- Merged PRs (30d)
- 42
Description
Related PR and discussion: https://github.com/openedx/openedx-platform/pull/38173
The has_view_object_tags_access method in openedx/core/djangoapps/content_tagging/auth.py is used for validating permissions on tag exporting for courses.
However, this method not only takes into account permissions for courses, but also for other kind of objects.
As part of the AuthZ for Course Authoring project, a new check for authz permissions on courses was added, however the legacy permission check was kept as a fallback for non-course objects.
We should revisit this to fully understand this method use cases and identify next steps.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.