Spike - RBAC Authz - Figure out mechanism for executing automatic roles migration on flag change

[rodmgwgu]

When setting on unsetting the feature flag, we need to make sure to execute the migration process.

This can be applied at several levels:

• Global
• Org
• Course specific

Challenges:

• How to trigger the migration (hooks? other way?)
• How to make sure one migration is happening at a time (avoid conflicts of migrations happening at the same time, for example if someone enables and disables the flag quickly)
• How to inform the user if there was any issue during the migration, or if it has completed.

[BryanttV]

Spike document: https://openedx.atlassian.net/wiki/spaces/OEPM/pages/6205112321/Spike+-+RBAC+AuthZ+-+Automatic+Role+Migration

[rodmgwgu]

Thanks @BryanttV, I reviewed the spike and I agree with most of the approach, just added some comments for discussion.

[mariajgrimaldi]

I haven't reviewed the approach yet, so I'll leave more specific comments inline. My only worry is the general concern of running data migrations when an instance is live. Usually data migrations are executed in "perfect" conditions because any failure could cause an invalid state. A running instance might not be the right condition. That could be one of the reasons why data migrations run by operators are carefully executed during downtime for example. So I'd be a bit cautious about triggering this with a toggle, also because some instructors have access to the Django admin and don't understand the risk of this migration. Can we hide this behind a feature flag so operators can opt-in only after knowing the risks?