The objective of this research is to identify which endpoints already exists for authz and identify what changes or new endpoints will need to be implemented for the new Admin Console designs that will be implemented in Milestone 2.

Existing endpoints used for library role management

The following endpoints already exist and are currently being used for library role management:

GET /api/authz/v1/roles/?scope=(library key): Returns the existing roles and the permissions they allow.

Example response:

{
    "count": 4,
    "next": null,
    "previous": null,
    "results": [
        {
            "role": "library_admin",
            "permissions": [
                "content_libraries.view_library",
                "content_libraries.manage_library_tags",
                "content_libraries.delete_library",
                "content_libraries.edit_library_content",
                "content_libraries.publish_library_content",
                "content_libraries.reuse_library_content",
                "content_libraries.view_library_team",
                "content_libraries.manage_library_team",
                "content_libraries.create_library_collection",
                "content_libraries.edit_library_collection",
                "content_libraries.delete_library_collection"
            ],
            "user_count": 1
        },
        {
            "role": "library_author",
            "permissions": [
                "content_libraries.view_library",
                "content_libraries.manage_library_tags",
                "content_libraries.edit_library_content",
                "content_libraries.publish_library_content",
                "content_libraries.reuse_library_content",
                "content_libraries.view_library_team",
                "content_libraries.create_library_collection",
                "content_libraries.edit_library_collection",
                "content_libraries.delete_library_collection"
            ],
            "user_count": 0
        },
        {
            "role": "library_contributor",
            "permissions": [
                "content_libraries.view_library",
                "content_libraries.manage_library_tags",
                "content_libraries.edit_library_content",
                "content_libraries.reuse_library_content",
                "content_libraries.view_library_team",
                "content_libraries.create_library_collection",
                "content_libraries.edit_library_collection",
                "content_libraries.delete_library_collection"
            ],
            "user_count": 1
        },
        {
            "role": "library_user",
            "permissions": [
                "content_libraries.view_library",
                "content_libraries.reuse_library_content",
                "content_libraries.view_library_team"
            ],
            "user_count": 0
        }
    ]
}

GET /api/authz/v1/roles/users/?scope=(library key&search=(search text)&sort_by=username&order=asc&page_size=10&page=1: Returns a list of users that are assigned to the specified library with a list of attached roles.

Example Response:

{
    "count": 2,
    "next": null,
    "previous": null,
    "results": [
        {
            "username": "admin",
            "full_name": "",
            "email": "admin@example.com",
            "roles": [
                "library_admin"
            ]
        },
        {
            "username": "contributor",
            "full_name": "",
            "email": "contributor@example.com",
            "roles": [
                "library_contributor"
            ]
        }
    ]
}

PUT /api/authz/v1/roles/users/: Assigns a role for a scope to a list of users.

Example Payload:

{
  "users":["contributor"],
  "role":"library_author",
  "scope":"lib:WGU:CSPROB"
}

Example Response:

{
    "completed": [
        {
            "user_identifier": "contributor",
            "status": "role_added"
        }
    ],
    "errors": []
}

DELETE /api/authz/v1/roles/users/: Remove multiple users from a specific role within a scope

Requirements for new Admin Console views

Roles and Permissions Management (Global access)

Users endpoint:

List users in the system, include global admins
Pagination
Sort by name or email
Search by username or email
Filter by one or more organizations (fetch orgs from db)
Filter by one or more roles (fixed list of roles)
Filter by one or more scopes (fetch libraries and courses from db, with org)

Orgs endpoint:

List orgs that the calling user has access to
Search by org name or key
Paginate (load more)

Scope endpoint:

List scopes (courses and libraries)
Search by library or course name or key
Paginate (load more)

Specific User role assignments

List all role assignments for a given user (role, org, scope)
Paginate

Audit specific user view

Specific User role assignments (Perhaps we can unify with the one we need to use on prev view)

List all role assignments for a given user (role, org, scope)
Paginate
Filter by Org
Filter by Role

Assign Role

Validate username or email

Validate each username or email entered when the user clicks “Next“
There could be an existing endpoint for this, research.

List Roles

This is hardcoded, so no new endpoint needed

List Scopes

List scopes that the current user has management permissions over
Filter by type (library or course)
Sorted by Org
Pagination
Search
Filter by Orgs

Assign role

Assign a role to one or more users and one or more scopes

Relevant permissions for these endpoints

When the user enters the Admin Console, if the user is not a superuser or global admin, they should only be shown relevant information according to their own permissions.

Relevant permissions:

Read only:

content_libraries.view_library
courses.view_course

Read and Write:

content_libraries.manage_library_team
courses.manage_course_team

This means that in the endpoints that we create for AuthZ, we should take these permissions into account for filtering results and allowing actions.

Proposed Endpoints for M2

GET /api/authz/v1/users/

Query params:
- page_size: For pagination
- page: For pagination
- sort_by: Sorting by email or user name
- search: For searching by email or user name
- orgs: Comma separated list of orgs to filter by
- scopes: Comma separated list of scopes to filter by
Needs to filter to only show users with relevant assignments for orgs and scopes that the calling user has view access

GET /api/authz/v1/orgs/

Query params:
- search: For searching by org name or short name
- page_size: For pagination
- page: For pagination
Needs to filter to only relevant orgs that the calling user has view access (or show all? ask Guillermo)

GET /api/authz/v1/scopes/

Query params:
- page_size: For pagination
- page: For pagination
- search: For searching by scope name or key
- management_permission_only (default false): This will be user to filter either by only scopes that have “management“ permissions (if true), or just view permissions.
Needs to filter to only relevant scopes (courses or libraries) that the calling user has view access
Always sort by org

GET /api/authz/v1/users/(user_id)/assignments/

Query params:
- page_size: For pagination
- page: For pagination
- orgs: Comma separated list of orgs to filter by
- roles: Comma separated list of roles to filter by
- sort_by: role, org or scope
Needs to filter to only relevant assignments to orgs or scopes (courses or libraries) that the calling user has view access to

PUT /api/authz/v1/roles/users/

This endpoint already exists, but it only supports one scope at a time. We will need to add support for more than one scope at a time, but keep backwards compatibility.

POST /api/authz/v1/users/validate

Body params (json):
- users: Array of strings containing usernames or emails to validate
Only users with manage permissions can call this endpoint.