Gap - RBAC AuthZ - Assign role to all scopes in platform no supported in openedx-authz

[rodmgwgu]

This is a gap found on M2 of the AuthZ for course authoring project.

The figma design and user stories, on the "Assign Role" screen specify a "All courses in Platform" option, however this is not currently supported on the backend authz implementation. I started making changes for this but I found that this will also require changes on openedx-platform and extra discussion to make sure we are not missing anything.

Draft PR: #267 (This solution needs discussion, also this breaks course and library listing on openedx-platform, which will need changes)

[BryanttV]

Objective

Define and refine the technical approach required to support assigning RBAC roles to all courses in the platform while preserving current authorization behavior and avoiding unintended access to other resources such as libraries.

Problem Statement

Current Gap

The system currently supports authorization scopes tied to these resources:

• Course
• Library
• Organization (Course or Library)

But there is no backend representation for: “Access to all courses in the platform”

Current Behavior

Scope Type	Description	Class
Course	Access to a single course	CourseOverviewData
Library	Access to a single library	ContentLibraryData
Organization in Courses	Access to all courses within an Org	OrgCourseOverviewGlobData
Organization in Libraries	Access to all libraries within an Org	OrgContentLibraryGlobData

Expected Behavior

The platform should support assigning a role that:

• Applies to all existing courses.
• Automatically applies to future courses.
• Does not grant access to libraries or other future scopes.
• Works consistently across LMS and Studio.
• Integrates cleanly with the current RBAC/AuthZ architecture.

Note

Analyzing the Draft PR, a new general-level scope is being included that applies to all scopes, not just at the course level. A different approach should be taken in this case.

Proposed Solution

1. Include a new base scope PlatformGlobData to assign platform-level permissions, following the same pattern as the OrgGlobData scope.
2. Include a new course scope (PlatformCourseOverviewGlobData) that inherits from the base scope.
   • Note: Optionally, a library scope could be included if necessary in the future.
3. Include a complete test suite, ensuring that the current behavior is not affected.
4. Validate behavior alongside openedx-platform and make corresponding changes in listing and filtering if necessary, verifying that everything works as expected.