Description
As part of the work in 567e9a0, we added a dedicated endpoint to expose the current state of the authz.enable_course_authoring waffle flag. That endpoint lets the admin-console MFE decide what to show for this release (verawood), but the backend endpoints themselves are still not aware of the flag state.
This issue tracks the follow-up work needed to make the relevant backend endpoints aware of authz.enable_course_authoring, instead of leaving all filtering logic to the MFE.
Context
The current approach was chosen to avoid changing release-blocking endpoints late in the release cycle. The new endpoint is additive and lets the MFE apply the simpler release-time behavior. However, the ADR added in the commit notes that making the REST API endpoints themselves aware of the flag is still an open problem and should be addressed separately.
Expected behavior
Backend endpoints that expose or validate authoring-related roles, scopes, permissions, or assignments should take the authz.enable_course_authoring flag state into account where appropriate.
This should help avoid returning or validating authoring-related data in cases where the flag state means those items should not be considered available.
Notes
Related context:
Description
As part of the work in 567e9a0, we added a dedicated endpoint to expose the current state of the
authz.enable_course_authoringwaffle flag. That endpoint lets the admin-console MFE decide what to show for this release (verawood), but the backend endpoints themselves are still not aware of the flag state.This issue tracks the follow-up work needed to make the relevant backend endpoints aware of
authz.enable_course_authoring, instead of leaving all filtering logic to the MFE.Context
The current approach was chosen to avoid changing release-blocking endpoints late in the release cycle. The new endpoint is additive and lets the MFE apply the simpler release-time behavior. However, the ADR added in the commit notes that making the REST API endpoints themselves aware of the flag is still an open problem and should be addressed separately.
Expected behavior
Backend endpoints that expose or validate authoring-related roles, scopes, permissions, or assignments should take the
authz.enable_course_authoringflag state into account where appropriate.This should help avoid returning or validating authoring-related data in cases where the flag state means those items should not be considered available.
Notes
Related context: