Repository navigation
refactor: replace legacy authz policy loading - #1509
Draft
mariajgrimaldi wants to merge 2 commits into
Draft
mariajgrimaldi wants to merge 2 commits into
mariajgrimaldi wants to merge 2 commits into
Conversation
Add the load_authz_schema management command to the CMS and LMS init scripts, right after load_policies within the existing openedx-authz guard block. load_policies populates the Casbin policy rows that the authorization engine uses for permission checks, but those rows carry no display metadata — no role names, descriptions, permission categories, or source tracking. load_authz_schema fills that gap: it discovers static authz schema YAML files contributed by installed applications, validates and compiles them, and writes the resulting role and permission definitions to dedicated tables. The API then serves those definitions so frontends like the Admin Console can display roles and permissions. The command is idempotent — running it twice with the same schema produces no duplicate rows and preserves dynamic roles and user assignments. It must run after migrations (it needs the DB schema) and before the application serves traffic. See also: - openedx/openedx-authz#446 - https://github.com/openedx/openedx-authz/blob/main/docs/decisions/0021-authorization-definition-api.rst
This was referenced Oct 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This removes the
load_policiescalls from the LMS and CMS initialization jobs. Static role-permission policies now come fromload_authz_schema, and openedx-authz no longer needs the default policy file thatload_policiesloaded.Open PR #1496 adds
load_authz_schemawhile keepingload_policies. We can include this change there instead. If we keep it separate, this PR should be merged after #1496.This must remain a draft until openedx-platform uses an openedx-authz release that includes
load_authz_schemaand the removal ofauthz.policy.Depends on openedx/openedx-authz#538, which solves openedx/openedx-authz#462.
How to Test
Render and run the LMS and CMS initialization jobs with the new openedx-authz version. Both jobs should run
load_authz_schemawithout callingload_policies.