fix: content libraries permissions [FC-0062]

[rpenido]

Description

This PR changes the permissions for content libraries so that only people who can create courses should be allowed to create new content libraries.

Additional Information

• Related to Only course creators should be permitted to create new beta Content Libraries #35943

Testing instructions

• Read the code and check if the unit tests cover the expected behavior
• Go through the testing instructions from fix: content libraries permission [FC-0062] frontend-app-authoring#1545

---

Private ref: FAL-3987

[openedx-webhooks]

Thanks for the pull request, @rpenido!

What's next?

Please work through the following steps to get your changes ready for engineering review:

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

• If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
  • This process (including the steps you'll need to take) is documented here.
• If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

• Dependencies

  This PR must be merged before / after / at the same time as ...

• Blockers

  This PR is waiting for OEP-1234 to be accepted.

• Timeline information

  This PR must be merged by XX date because ...

• Partner information

  This is for a course on edx.org.

• Supporting documentation
• Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

🔘 Let us know that your PR is ready for review:

Who will review my changes?

This repository is currently maintained by @openedx/wg-maintenance-edx-platform. Tag them in a comment and let them know that your changes are ready for review.

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

• Overview of Review Process for Community Contributions
• Pull Request Status Guide
• Making changes to your pull request

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

• The size and impact of the changes that it introduces
• The need for product review
• Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

[rpenido]

Hi @bradenmacdonald and @ormsbee!
This is ready for review!

I had one doubt while manually testing it:

This code handles the visibility of the + New Library button on the Studio, for both library_v1 and library_v2:

edx-platform/cms/djangoapps/contentstore/views/library.py

Lines 55 to 70 in 70b60ff

	def _user_can_create_library_for_org(user, org=None):
	"""
	Helper method for returning the library creation status for a particular user,
	taking into account the libraries_v1_enabled toggle.
	if the ENABLE_CREATOR_GROUP value is False, then any user can create a library (in any org),
	if library creation is enabled.
	if the ENABLE_CREATOR_GROUP value is true, then what a user can do varies by thier role.
	Global Staff: can make libraries in any org.
	Course Creator Group Members: can make libraries in any org.
	Organization Staff: Can make libraries in the organization for which they are staff.
	Course Staff: Can make libraries in the organization which has courses of which they are staff.
	Course Admin: Can make libraries in the organization which has courses of which they are Admin.
	"""

Just to confirm, are Organization Staff, Course Staff and Course Admin also course_creators in this context?
I hadn't considered them yet.

Also, ENABLE_CREATOR_GROUP=False previously was "everyone can create libraries", and we are moving to "only global staff can create libraries". Is this intended? Are we diverging from library_v1 permissions here?

[bradenmacdonald]

@ormsbee or @jmakowski1123 can correct me if I'm wrong, but I don't think we want any org-specific permissions for now. It will be simply what's described on the ticket:

When ENABLE_CREATOR_GROUP is False, only global staff may create new content libraries.
When ENABLE_CREATOR_GROUP is True, people in the course creator group can create content libraries, along with global staff. Other users may not create libraries.

Are we diverging from library_v1 permissions here?

Yes, we are diverging from library v1 permissions.

This code handles the visibility of the + New Library button on the Studio, for both library_v1 and library_v2:

Let me look into this a bit more. Ideally for v2 the button should match the new behavior that you've added here.

[rpenido]

Let me look into this a bit more. Ideally for v2 the button should match the new behavior that you've added here.

No big issues. We can create another attribute to handle the library_v2 case.

[bradenmacdonald]

@rpenido OK, please do that.

[rpenido]

@rpenido OK, please do that.

@bradenmacdonald
Here: openedx/frontend-app-authoring#1545

[rpenido]

This is ready for review @bradenmacdonald!

[ormsbee]

Question: Isn't the is_active check redundant here?

[rpenido]

Yes! Good catch!
Removed here: 30c6d06

[ormsbee]

Please squash your commits and add context to your commit message from the PR description. Otherwise, good to merge and create a backport PR into the sumac branch. Thank you!

[ormsbee]

@rpenido: You'll need to rebase off the latest master to fix the static-assets-check check.

[rpenido]

@ormsbee Done! Backport PR here #35979

[edx-pipeline-bot]

2U Release Notice: This PR has been deployed to the edX staging environment in preparation for a release to production.

[edx-pipeline-bot]

2U Release Notice: This PR has been deployed to the edX production environment.

[edx-pipeline-bot]

2U Release Notice: This PR has been deployed to the edX production environment.