Verify platform-level glob scope in AuthZ and openedx-platform

[BryanttV]

Background / Context

The authorization architecture utilizes platform-level glob scopes restricted to specific resource types—specifically, course and library (e.g., course-v1:* and lib:*). This allows designated actors to have platform-wide access to all courses or all libraries without granting overarching administrative access to the entire system. We need to conduct an audit to ensure that these resource-specific platform scopes are correctly applied, respected, and enforced across AuthZ and openedx-platform.

Objective

Audit and verify that the course and library glob scopes are correctly enforced, ensuring they grant the expected platform-wide access to their respective resources without leaking permissions into other scopes or compromising granular access controls.

Scope of Work

1. Identification:

   • Identify the zones and endpoints within openedx-authz and openedx-platform (e.g., LMS, Studio) that interact with course and library resources and should support these platform-level glob scopes.

2. Audit & Verification:

   • Verify that the AuthZ configuration correctly parses and evaluates course-v1:* and lib:* scopes.
   • Inspect the authorization decorators/middleware in openedx-platform to confirm they accurately respect these scopes for platform-wide resource access.

Acceptance Criteria

• The endpoints and zones requiring course and library platform-level access are identified and documented.
• AuthZ and openedx-platform are confirmed to correctly enforce the course-v1:* and lib:* scopes.
• Any missing authorization checks or misconfigured discovered during the audit are documented for resolution.
• The necessary corrections are applied to the repositories.