[FC-0099] feat: implement custom matcher in casbin model #114

BryanttV · 2025-10-23T23:44:49Z

Description

This PR adds a custom matcher to the Casbin model. The matcher allows validating permissions based on library or user attributes, similar to how it’s currently handled with bridgekeeper.

For now, it only checks whether the user is staff or a superuser to grant all permissions.

This implementation is based on the work done in #101

Related Issues

Testing Instructions

Using Tutor:

Install this plugin with the changes in this PR.
Run the migrations by running tutor dev exec lms python manage.py lms migrate
Load the default policies by running tutor dev exec lms python manage.py lms load_policies
Test custom enforcements by running tutor dev exec lms python manage.py lms enforcement and verify that staff and superuser users have granted permissions in any library in any action.

Merge Checklist:

Check off if complete or not applicable:

Version bumped
Changelog record added
Documentation updated (not only docstrings)
Fixup commits are squashed away
Unit tests added/updated
Manual testing instructions provided
Noted any: Concerns, dependencies, migration issues, deadlines, tickets

openedx-webhooks · 2025-10-23T23:44:55Z

Thanks for the pull request, @BryanttV!

This repository is currently maintained by @openedx/committers-openedx-authz.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
- This process (including the steps you'll need to take) is documented here.
If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

Dependencies

This PR must be merged before / after / at the same time as ...
Blockers

This PR is waiting for OEP-1234 to be accepted.
Timeline information

This PR must be merged by XX date because ...
Partner information

This is for a course on edx.org.
Supporting documentation
Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

Details

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

The size and impact of the changes that it introduces
The need for product review
Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

mariajgrimaldi · 2025-11-03T13:16:00Z

Bryann is off this week so I'll be pushing this forward!

mariajgrimaldi · 2025-11-03T13:42:59Z

openedx_authz/engine/enforcer.py

            SyncedEnforcer: Configured Casbin enforcer with adapter and auto-sync
        """
+        # Avoid circular import
+        from openedx_authz.engine.matcher import check_custom_conditions  # pylint: disable=import-outside-toplevel


Is there a way we can avoid this circular import?

I moved this and it didn't fail. I'll deploy this so I can test it remotely!

mariajgrimaldi · 2025-11-03T13:43:20Z

openedx_authz/engine/enforcer.py


        adapter = ExtendedAdapter()
        enforcer = SyncedEnforcer(settings.CASBIN_MODEL, adapter)
+        enforcer.add_function("custom_check", check_custom_conditions)


I think we could call this: is_staff_or_superuser

bmtcril · 2025-11-05T14:52:31Z

openedx_authz/tests/rest_api/test_views.py

+        ("lib:AnyOrg1:ANYLIB1", True),
+        ("lib:AnyOrg2:ANYLIB2", True),
+        ("lib:AnyOrg3:ANYLIB3", True),
+        ("sc:AnyScope1", False),


Just a note that I think sc here is out of date

True! I updated the tesr cases

bmtcril · 2025-11-05T14:54:39Z

openedx_authz/tests/test_enforcement.py

+        User.objects.create_superuser(username="superuser", email="super@example.com", password="test")
+        User.objects.create_user(username="regular_user", email="regular@example.com", password="test")
+
+    @data(


Do we need a test that handles non-existent library keys? I assume that would return False, right?

Yes! I added a test case here: 7805698

bmtcril

👍

rodmgwgu

Looks good, thanks

MaferMazu

Thanks for this.

…r.py

openedx-webhooks added open-source-contribution PR author is not from Axim or 2U core contributor PR author is a Core Contributor (who may or may not have write access to this repo). labels Oct 23, 2025

openedx-webhooks added this to Contributions Oct 23, 2025

github-project-automation bot moved this to Needs Triage in Contributions Oct 23, 2025

BryanttV force-pushed the bav/attribute-checking branch from 3b0c476 to dcffff2 Compare October 27, 2025 13:57

mphilbrick211 added the FC Relates to an Axim Funded Contribution project label Oct 27, 2025

mphilbrick211 moved this from Needs Triage to Waiting on Author in Contributions Oct 27, 2025

mariajgrimaldi mentioned this pull request Oct 28, 2025

feat: add the base of attribute checking (for test, not for merge) #101

Closed

7 tasks

BryanttV mentioned this pull request Oct 31, 2025

Bug: As an admin or superuser, I can't manage access for a library #130

Closed

BryanttV force-pushed the bav/attribute-checking branch from 70bffb1 to 75942e6 Compare October 31, 2025 21:57

BryanttV marked this pull request as ready for review October 31, 2025 22:45

mariajgrimaldi added this to RBAC AuthZ Board Nov 3, 2025

mariajgrimaldi moved this to Ready for review in RBAC AuthZ Board Nov 3, 2025

mariajgrimaldi self-assigned this Nov 3, 2025

mariajgrimaldi requested review from MaferMazu, bmtcril and rodmgwgu November 3, 2025 13:02

mariajgrimaldi reviewed Nov 3, 2025

View reviewed changes

mariajgrimaldi mentioned this pull request Nov 3, 2025

[FC-0099] feat: filter libraries based on user-role scopes openedx/openedx-platform#37564

Merged

mariajgrimaldi linked an issue Nov 5, 2025 that may be closed by this pull request

Bug: As an admin or superuser, I can't manage access for a library #130

Closed

bmtcril reviewed Nov 5, 2025

View reviewed changes

mariajgrimaldi force-pushed the bav/attribute-checking branch from 3be701c to 7805698 Compare November 6, 2025 10:42

mariajgrimaldi requested a review from bmtcril November 6, 2025 11:14

bmtcril approved these changes Nov 6, 2025

View reviewed changes

rodmgwgu approved these changes Nov 6, 2025

View reviewed changes

MaferMazu approved these changes Nov 6, 2025

View reviewed changes

MaferMazu mentioned this pull request Nov 6, 2025

Manage attribute checks in addition to RBAC checks #87

Open

mphilbrick211 moved this from Waiting on Author to In Eng Review in Contributions Nov 6, 2025

BryanttV and others added 11 commits November 11, 2025 11:24

feat: add custom matcher in casbin model

c5262fb

refactor: enhance custom condition checks for authorization in matche…

8d401e7

…r.py

feat: add tests for staff and superuser automatic permission grants

6458b59

test: validate permissions for not library scopes

1d7087a

refactor: drop /tests package in favor of openedx_authz/tests

4bd8f2d

refactor: address PR reviews

c3f0d69

refactor: drop sc: references

4b15aeb

refactor: add test case for non-existent lib scope

6d039c9

refactor: go back to previous configuration for tox.ini

fd8dca3

refactor: address quality issues

f423be1

chore: update docs for release

b5de0c8

mariajgrimaldi force-pushed the bav/attribute-checking branch from 804f5a2 to b5de0c8 Compare November 11, 2025 10:25

mariajgrimaldi merged commit b7e82cc into openedx:main Nov 11, 2025
13 checks passed

github-project-automation bot moved this from Ready for review to Done in RBAC AuthZ Board Nov 11, 2025

github-project-automation bot moved this from In Eng Review to Done in Contributions Nov 11, 2025

mariajgrimaldi mentioned this pull request Nov 13, 2025

Bug: Fix circular import #141

Closed

[FC-0099] feat: implement custom matcher in casbin model #114

[FC-0099] feat: implement custom matcher in casbin model #114

Uh oh!

Conversation

BryanttV commented Oct 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related Issues

Testing Instructions

Merge Checklist:

Uh oh!

openedx-webhooks commented Oct 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mariajgrimaldi commented Nov 3, 2025

Uh oh!

mariajgrimaldi Nov 3, 2025

Choose a reason for hiding this comment

Uh oh!

mariajgrimaldi Nov 6, 2025

Choose a reason for hiding this comment

Uh oh!

mariajgrimaldi Nov 3, 2025

Choose a reason for hiding this comment

Uh oh!

bmtcril Nov 5, 2025

Choose a reason for hiding this comment

Uh oh!

mariajgrimaldi Nov 6, 2025

Choose a reason for hiding this comment

Uh oh!

bmtcril Nov 5, 2025

Choose a reason for hiding this comment

Uh oh!

mariajgrimaldi Nov 6, 2025

Choose a reason for hiding this comment

Uh oh!

bmtcril left a comment

Choose a reason for hiding this comment

Uh oh!

rodmgwgu left a comment

Choose a reason for hiding this comment

Uh oh!

MaferMazu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

BryanttV commented Oct 23, 2025 •

edited

Loading

openedx-webhooks commented Oct 23, 2025 •

edited

Loading