|
| 1 | +0010: AuthZ for Course Authoring - Feature Flag Implementation Details |
| 2 | +###################################################################### |
| 3 | + |
| 4 | +Status |
| 5 | +****** |
| 6 | + |
| 7 | +**Draft** |
| 8 | + |
| 9 | +Context |
| 10 | +******* |
| 11 | + |
| 12 | +We need to implement the new RBAC functionality for course authoring behind a Waffle flag as a |
| 13 | +beta feature for several key reasons: |
| 14 | + |
| 15 | +- Enable incremental development without breaking existing functionality |
| 16 | +- Allow large sites to test performance and functionality at small scale before full deployment |
| 17 | +- Mitigate risks associated with the Verawood release timeline |
| 18 | + |
| 19 | +The feature flag must support enablement at multiple granularity levels: |
| 20 | + |
| 21 | +- **Course level**: Individual courses |
| 22 | +- **Organization level**: All courses within an organization |
| 23 | +- **Instance level**: All courses across the entire instance |
| 24 | + |
| 25 | +Detailed implementation research can be found in the |
| 26 | +`Authoring Waffle Flag Implementation Spike`_. |
| 27 | + |
| 28 | +Decision |
| 29 | +******** |
| 30 | + |
| 31 | +**Implementation Approach** |
| 32 | + |
| 33 | +- Implement as a Waffle flag with multi-level support: |
| 34 | + |
| 35 | + - **Course level**: Using `WaffleFlagCourseOverrideModel`_ |
| 36 | + - **Organization level**: Using `WaffleFlagOrgOverrideModel`_ |
| 37 | + - **Instance level**: Using standard Waffle Switch |
| 38 | + |
| 39 | +- **Flag Configuration** |
| 40 | + |
| 41 | + - Flag name: ``authz.enable_course_authoring`` |
| 42 | + - Management via Django Admin UI or management command |
| 43 | + - Deprecation scheduled after 2 Open edX releases (after Willow) |
| 44 | + |
| 45 | +**Platform Integration** |
| 46 | + |
| 47 | +- All openedx-platform code related to course authoring must respect the flag state |
| 48 | +- Multi-course endpoints must handle both legacy and new AuthZ mechanisms simultaneously |
| 49 | +- Bidirectional migration process will be implemented (details in separate ADR) |
| 50 | + |
| 51 | +**Migration Behavior** |
| 52 | + |
| 53 | +When the flag state changes, automatic migration occurs immediately: |
| 54 | + |
| 55 | +- **Flag enabled**: Legacy role assignments migrate to new system and are removed from legacy |
| 56 | + system |
| 57 | +- **Flag disabled**: New system role assignments migrate to legacy system and are removed from |
| 58 | + new system |
| 59 | + |
| 60 | + *Note: Roles without legacy equivalents remain in the new system and are not migrated* |
| 61 | + |
| 62 | + |
| 63 | +Consequences |
| 64 | +************ |
| 65 | + |
| 66 | +- Documentation will be created for explaining the feature flag |
| 67 | +- Documentation will be created for comparing roles between the legacy and new AuthZ systems |
| 68 | +- A DEPR ticket will be created to track the deprecation of the feature flag after Willow |
| 69 | + |
| 70 | +Rejected Alternatives |
| 71 | +********************* |
| 72 | + |
| 73 | +**Instance-level only flag implementation** |
| 74 | + Makes testing difficult on large instances with mixed requirements. |
| 75 | + |
| 76 | +**Django setting implementation** |
| 77 | + Requires deployment and service restart for flag changes, increasing testing complexity and risk. |
| 78 | + |
| 79 | +**Per-user level implementation** |
| 80 | + Creates inconsistent permission experiences within the same course. Course staff could |
| 81 | + attempt to set permissions in one system for users operating in another system, resulting |
| 82 | + in ineffective permission changes. |
| 83 | + |
| 84 | +References |
| 85 | +********** |
| 86 | + |
| 87 | +* `How to Implement the right toggle type`_ |
| 88 | +* `Authoring Waffle Flag Implementation Spike`_ |
| 89 | + |
| 90 | +.. _How to Implement the right toggle type: https://docs.openedx.org/projects/edx-toggles/en/ |
| 91 | + latest/how_to/implement_the_right_toggle_type.html#implementing-the-right-toggle-class |
| 92 | +.. _Authoring Waffle Flag Implementation Spike: https://openedx.atlassian.net/wiki/spaces/OEPM/ |
| 93 | + pages/5646221313/Spike+-+RBAC+AuthZ+-+Authoring+Waffle+Flag+Implementation |
| 94 | +.. _WaffleFlagCourseOverrideModel: https://github.com/openedx/openedx-platform/blob/ |
| 95 | + 22485757573d32e3c0cb1c36855d83bcd2b1251d/openedx/core/djangoapps/waffle_utils/models.py#L14 |
| 96 | +.. _WaffleFlagOrgOverrideModel: https://github.com/openedx/openedx-platform/blob/ |
| 97 | + 22485757573d32e3c0cb1c36855d83bcd2b1251d/openedx/core/djangoapps/waffle_utils/models.py#L75 |
| 98 | + |
0 commit comments