Skip to content

Task - RBAC AuthZ - Add Scope-Type Filtering to get_scopes_for_user_and_permission #246

@dwong2708

Description

@dwong2708

Description

Currently, get_scopes_for_user_and_permission may return a mix of scope types (e.g., CourseOverviewData, OrgCourseOverviewGlobData, and potentially others).

In downstream consumers, we are repeatedly applying additional filtering logic to handle only the relevant scope types (e.g., course-level scopes). This pattern introduces:

  • Duplicate filtering logic across multiple code paths
  • Increased risk of edge cases or inconsistencies
  • Reduced clarity on what the API is expected to return

There is also an upcoming need to handle organization-level scopes separately, which further highlights the importance of clearly separating scope types.

Problem

The current API does not provide a way to filter results by scope type, forcing consumers to:

Be aware of all possible scope types
Implement their own filtering logic
Potentially miss new or unexpected scope types

Proposed Solution

Enhance the get_scopes_for_user_and_permission API to support filtering by scope type.

For example, introduce an optional parameter:

get_scopes_for_user_and_permission(
    username,
    permission,
    scope_types: Optional[List[str]] = None
)

Where scope_types could include values such as:

  • "course"
  • "course_glob"
  • "organization" (future use)

The API would then return only scopes matching the requested types.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

Status

Done

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions