feat: add api function for get user role assignments for role by BryanttV · Pull Request #240 · openedx/openedx-authz

BryanttV · 2026-03-25T22:31:47Z

Description

This PR creates a new api function: get_user_role_assignments_for_role to fetch a subject's role assignments filtered by a specific role.

Additionally, it adds the org property to ContentLibraryData and CourseOverviewData. This is necessary to get the specific organization for each scope's data, not only for glob scopes.

Related Issues

Task - RBAC AuthZ - Update compatibility layer to support org roles openedx-platform#38032

Testing Instructions

Add different roles to a user in different scopes.
Now, use the get_user_role_assignments_for_role function:

from openedx_authz.api import assign_role_to_user_in_scope, get_user_role_assignments_for_role

assign_role_to_user_in_scope("marie", "course_staff", "course-v1:OpenedX+DemoX+DemoCourse")
assign_role_to_user_in_scope("marie", "course_staff", "course-v1:WGU+Python+2020")
assign_role_to_user_in_scope("marie", "course_staff", "course-v1:OpenedX+RBAC+2026")
assign_role_to_user_in_scope("marie", "course_auditor", "course-v1:XBlocks.org+XBlocks+2026")
assign_role_to_user_in_scope("marie", "course_auditor", "course-v1:WGUv2+Python+2025")
assign_role_to_user_in_scope("marie", "course_auditor", "course-v1:AXIM+*")

>>> get_user_role_assignments_for_role("marie", "course_staff")
[
    user^marie => [role^course_staff] @ course-v1^course-v1:OpenedX+DemoX+DemoCourse,
    user^marie => [role^course_staff] @ course-v1^course-v1:WGU+AdvancedPython+2026,
    user^marie => [role^course_staff] @ course-v1^course-v1:OpenedX+RBAC+2026,
]

>>> get_user_role_assignments_for_role("marie", "course_auditor") 
[
    user^marie => [role^course_auditor] @ course-v1^course-v1:XBlocks.org+XBlocks+2026,
    user^marie => [role^course_auditor] @ course-v1^course-v1:WGUv2+Python+2025,
    user^marie => [role^course_auditor] @ course-v1^course-v1:AXIM+*
]

Merge checklist

Check off if complete or not applicable:

Version bumped
Changelog record added
Documentation updated (not only docstrings)
Fixup commits are squashed away
Unit tests added/updated
Manual testing instructions provided
Noted any: Concerns, dependencies, migration issues, deadlines, tickets

openedx-webhooks · 2026-03-25T22:31:52Z

Thanks for the pull request, @BryanttV!

This repository is currently maintained by @openedx/committers-openedx-authz.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
- This process (including the steps you'll need to take) is documented here.
If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

Dependencies

This PR must be merged before / after / at the same time as ...
Blockers

This PR is waiting for OEP-1234 to be accepted.
Timeline information

This PR must be merged by XX date because ...
Partner information

This is for a course on edx.org.
Supporting documentation
Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

Details

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

The size and impact of the changes that it introduces
The need for product review
Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

…lasses

…d by role

mariajgrimaldi · 2026-03-27T15:15:36Z

openedx_authz/api/roles.py

+def get_subject_role_assignments_for_role(subject: SubjectData, role: RoleData) -> list[RoleAssignmentData]:
+    """Get role assignments for a subject filtered by a specific role across all scopes.
+
+    Args:
+        subject: The SubjectData object representing the subject.
+        role: The RoleData object representing the role to filter by.
+
+    Returns:
+        list[RoleAssignmentData]: A list of assignments where the subject has the specified role.
+    """
+    return [
+        assignment
+        for assignment in get_subject_role_assignments(subject)
+        if any(assigned_role.namespaced_key == role.namespaced_key for assigned_role in assignment.roles)
+    ]


Not sure what'd be better performance-wise, but instead of doing two passes on the return of the enforcer, we could implement a get_subect_role_assignments_filtered_by filtered by role key:

openedx-authz/openedx_authz/api/roles.py

Lines 271 to 294 in 16a6bbb

def get_subject_role_assignments(subject: SubjectData) -> list[RoleAssignmentData]:

"""Get all the roles for a subject across all scopes.

Args:

subject: The SubjectData object representing the subject (e.g., SubjectData(external_key='john_doe')).

Returns:

list[RoleAssignmentData]: A list of role assignments for the subject.

"""

enforcer = AuthzEnforcer.get_enforcer()

role_assignments = []

for policy in enforcer.get_filtered_grouping_policy(GroupingPolicyIndex.SUBJECT.value, subject.namespaced_key):

role = RoleData(namespaced_key=policy[GroupingPolicyIndex.ROLE.value])

role.permissions = get_permissions_for_single_role(role)

role_assignments.append(

RoleAssignmentData(

subject=subject,

roles=[role],

scope=ScopeData(namespaced_key=policy[GroupingPolicyIndex.SCOPE.value]),

)

)

return role_assignments

Thanks, @mariajgrimaldi! Based on your suggestion, I’ve been thinking about implementing a method to retrieve role assignments filtered by subject, role, and/or scope. I think this could be quite useful for different use cases.

I reviewed the Casbin Management API, specifically the get_filtered_grouping_policy method, which we already use in our API functions, but it offers more fine-grained filtering that we can take advantage of for our needs.

This led me to implement a function called get_role_assignments(), which takes three optional arguments (subject, role, and scope). This allows us to perform queries to retrieve assignments by:

Only user, only role, or only scope.

Combinations like user + role, user + scope, role + scope, etc.

What do you think?

mariajgrimaldi · 2026-03-27T15:21:32Z

openedx_authz/api/data.py


    NAMESPACE: ClassVar[str] = "lib"

+    @property


Should this be cached?

Yes, we could cache it. Although it might be better to cache the library_key/course_key property, since that’s what handles the parsing. What do you think?

Oh yeah, that sounds good!

… api

…elper function

openedx-webhooks added open-source-contribution PR author is not from Axim or 2U core contributor PR author is a Core Contributor (who may or may not have write access to this repo). labels Mar 25, 2026

openedx-webhooks added this to Contributions Mar 25, 2026

github-project-automation bot moved this to Needs Triage in Contributions Mar 25, 2026

BryanttV added 2 commits March 26, 2026 15:00

feat: add org property to ContentLibraryData and CourseOverviewData c…

164865f

…lasses

feat: add api function to retrieve role assignments for users filtere…

2c9d4eb

…d by role

BryanttV mentioned this pull request Mar 26, 2026

feat: implement org retrieval for user roles in authz compatibility layer openedx/openedx-platform#38216

Open

BryanttV changed the title ~~feat: add api function for get user role assignment for role~~ feat: add api function for get user role assignments for role Mar 27, 2026

BryanttV mentioned this pull request Mar 27, 2026

Task - RBAC AuthZ - Update compatibility layer to support org roles openedx/openedx-platform#38032

Open

test: add unit tests for get_user_role_assignments_for_role function

f5b4e94

mariajgrimaldi reviewed Mar 27, 2026

View reviewed changes

BryanttV marked this pull request as ready for review March 27, 2026 15:19

test: add unit tests for organization property

fece3a3

mariajgrimaldi reviewed Mar 27, 2026

View reviewed changes

BryanttV force-pushed the bav/get-orgs-for-user branch from 86a0a56 to fece3a3 Compare March 27, 2026 15:22

refactor: use @cached_property for library_key and course_key

5e5fb14

mphilbrick211 moved this from Needs Triage to In Eng Review in Contributions Mar 27, 2026

feat: add flexible filtering for user role assignments

7b82c9f

BryanttV force-pushed the bav/get-orgs-for-user branch from c79a426 to 85b4f8b Compare March 27, 2026 22:26

refactor: remove unused role assignment functions from user and roles…

242a962

… api

BryanttV force-pushed the bav/get-orgs-for-user branch from 85b4f8b to 242a962 Compare March 27, 2026 22:29

BryanttV added 2 commits March 27, 2026 17:42

refactor: rename get_field_index_and_values

8ef0268

test: add comprehensive tests for role assignment filtering and new h…

2549209

…elper function

BryanttV requested a review from mariajgrimaldi March 28, 2026 01:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add api function for get user role assignments for role#240

feat: add api function for get user role assignments for role#240
BryanttV wants to merge 9 commits intoopenedx:mainfrom
eduNEXT:bav/get-orgs-for-user

BryanttV commented Mar 25, 2026 •

edited

Loading

Uh oh!

openedx-webhooks commented Mar 25, 2026 •

edited

Loading

Uh oh!

mariajgrimaldi Mar 27, 2026

Uh oh!

BryanttV Mar 28, 2026

Uh oh!

mariajgrimaldi Mar 27, 2026

Uh oh!

BryanttV Mar 27, 2026

Uh oh!

mariajgrimaldi Mar 27, 2026

Uh oh!

BryanttV Mar 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	def get_subject_role_assignments(subject: SubjectData) -> list[RoleAssignmentData]:
	"""Get all the roles for a subject across all scopes.

	Args:
	subject: The SubjectData object representing the subject (e.g., SubjectData(external_key='john_doe')).

	Returns:
	list[RoleAssignmentData]: A list of role assignments for the subject.
	"""
	enforcer = AuthzEnforcer.get_enforcer()
	role_assignments = []
	for policy in enforcer.get_filtered_grouping_policy(GroupingPolicyIndex.SUBJECT.value, subject.namespaced_key):
	role = RoleData(namespaced_key=policy[GroupingPolicyIndex.ROLE.value])
	role.permissions = get_permissions_for_single_role(role)

	role_assignments.append(
	RoleAssignmentData(
	subject=subject,
	roles=[role],
	scope=ScopeData(namespaced_key=policy[GroupingPolicyIndex.SCOPE.value]),
	)
	)
	return role_assignments

Conversation

BryanttV commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related Issues

Testing Instructions

Merge checklist

Uh oh!

openedx-webhooks commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mariajgrimaldi Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

BryanttV Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

mariajgrimaldi Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

BryanttV Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

mariajgrimaldi Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

BryanttV Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

BryanttV commented Mar 25, 2026 •

edited

Loading

openedx-webhooks commented Mar 25, 2026 •

edited

Loading