Skip to content

feat(authz): assign a role from the roles table row menu - #286

Draft
jacobo-dominguez-wgu wants to merge 21 commits into
jacobo/roles-table-customfrom
jacobo/assign-role-row
Draft

jacobo-dominguez-wgu wants to merge 21 commits into
jacobo/roles-table-customfrom
jacobo/assign-role-row

Conversation

@jacobo-dominguez-wgu

Copy link
Copy Markdown
Contributor

Description

The "Assign role" item in each roles table row menu now opens the assign role wizard with that row's role preselected. It reuses the existing wizard and assignment endpoint; the new work is opening the wizard with a role already selected.

Closes openedx/openedx-authz#570

Changes

  • Shared assignable-roles hook: useAssignableRoleGroups (in role-assignation-wizard/hooks/) moves the rules out of AddRoleButton.
    • It decides which roles a user may assign: the user must be able to manage that resource type's team, and the course-authoring flag must be on for course roles.
    • AddRoleButton and the roles table now share it. AddRoleButton behaves the same.
  • Preselected role in the wizard: new initialRole prop on AssignRoleWizard. The role stays changeable and is restored after Cancel.
    • It is ignored unless the role is one the user may assign.
    • If the roles are still loading when the wizard opens, it applies once they arrive. It never overwrites a role the user already picked.
  • Row menu:
    • "Assign role" opens the wizard with the row's role selected.
    • The item is hidden when the user can't assign that role.
    • The table hosts one wizard and mounts it only while open, as AddRoleButton does.
  • RoleAssignmentContext: gives the action cells the assignment state. DataTable keeps the action column's cells from its first render, so a cell factory would hold the permissions from before they finished loading.

Testing

  1. Go to the Roles and Permissions Tab
  2. Open the ⋮ menu of Library Author.
    • Expected: it shows Duplicate and Assign role.
  3. Click Assign role.
    • Expected: the Assign Role modal opens with Library Author selected.

Demo

Screen.Recording.2026-11-10.at.10.15.28.AM.mov

Notes for reviewers

  • Stacked on jacobo/roles-table-custom, which holds the roles table.

dcoa and others added 21 commits November 9, 2026 13:35
Fetch the roles, permissions and categories catalog of the scope types the user can view, slice it by scope type, order its roles by permission count, and render its icons by name with CatalogIcon. Nothing consumes it yet.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The roles filter lists the catalog roles of each scope type instead of the hardcoded ones.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The roles and permissions page builds its matrix from the catalog roles, categories and permissions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The user permissions column groups the role permissions by catalog category, for the scope type of the assignment.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The wizard offers the catalog roles of the selected scope type and shows their permissions from the catalog.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Only one role is assigned, but each scope type rendered its own required
radio group, so assistive technology announced several required choices
and a selection in one group silently cleared another.

Render one required radio group named by the Roles heading, with each
scope type as a named group inside it. All the radios share a name, so
arrow keys move through every role and a single selection is native.
Roles offered in several scope types aren't supported yet, so the role
identifies its scope type.

Tests find the scope type groups by role and name, and drop the cases
the single group makes redundant.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The team members table and the audit user page take the library roles from the catalog instead of a hardcoded list.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
GET /api/authz/v1/scopes/ now expects scope_type=course-v1 or lib, and
only accepts course and library as deprecated aliases. The scopes filter
of the team tables still sent scope_type=library to users who can't view
courses; it now sends the library scope type (lib), so the console no
longer relies on the aliases and they can be removed from the API.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Delete the hardcoded roles, categories and permissions of courses and
libraries, the old role and permission types, and CONTENT_*_PERMISSIONS.
The team permissions the code checks now live in the authz constants,
per scope type: MANAGE_TEAM_ACTIONS next to VIEW_TEAM_ACTIONS, and the
validate/me lists built from them.

Replace CONTEXT_TYPES with the scope types: getScopeType reads the scope
type from a scope key, and the aggregate scope labels are keyed by it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Remove MAP_ROLE_KEY_TO_LABEL. The role cells take the role names from the
catalog through a new getRole lookup on useAuthzCatalog, and fall back to
the role id. The Django managed roles, which the catalog doesn't describe,
get translated names, and global staff uses the django.staff key the
backend sends. The row highlight of those roles matches their id instead
of their name, so it works in every language.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@openedx-webhooks openedx-webhooks added open-source-contribution PR author is not from Axim or 2U core contributor PR author is a Core Contributor (who may or may not have write access to this repo). labels Nov 10, 2026
@openedx-webhooks

Copy link
Copy Markdown

Thanks for the pull request, @jacobo-dominguez-wgu!

This repository is currently maintained by @openedx/committers-frontend.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

  • If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
    • This process (including the steps you'll need to take) is documented here.
  • If it doesn't, simply proceed with the next step.
🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

  • Dependencies

    This PR must be merged before / after / at the same time as ...

  • Blockers

    This PR is waiting for OEP-1234 to be accepted.

  • Timeline information

    This PR must be merged by XX date because ...

  • Partner information

    This is for a course on edx.org.

  • Supporting documentation
  • Relevant Open edX discussion forum threads
🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

🔘 Update the status of your PR

Your PR is currently marked as a draft. After completing the steps above, update its status by clicking "Ready for Review", or removing "WIP" from the title, as appropriate.


Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

  • The size and impact of the changes that it introduces
  • The need for product review
  • Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

@codecov

codecov Bot commented Nov 10, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 95.23810% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 98.76%. Comparing base (8ddf19d) to head (93712f7).

Files with missing lines Patch % Lines
...-module/roles-permissions/RoleAssignmentContext.ts 50.00% 2 Missing ⚠️
Additional details and impacted files
@@                      Coverage Diff                      @@
##           jacobo/roles-table-custom     #286      +/-   ##
=============================================================
- Coverage                      98.87%   98.76%   -0.11%     
=============================================================
  Files                             87       89       +2     
  Lines                           1513     1542      +29     
  Branches                         492      467      -25     
=============================================================
+ Hits                            1496     1523      +27     
- Misses                            17       19       +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

core contributor PR author is a Core Contributor (who may or may not have write access to this repo). open-source-contribution PR author is not from Axim or 2U

Projects

Status: Needs Triage

Development

Successfully merging this pull request may close these issues.

3 participants