fix: keep unmigrated legacy roles working under the authz authoring flag (#38855)

[mariajgrimaldi]

Description

Granting and exercising course creator access crashed once authz.enable_course_authoring was on. The courses.create_course permission was implemented in AuthZ, but the course creator role itself was never migrated there. The code deciding whether to use the AuthZ path only checked the flag's state, not whether the specific role had actually been migrated, so unmigrated roles like course creator still used the AuthZ path and crashed.

enable_authz_course_authoring now takes an optional role and falls back to the course creator role's own check for any role without a migrated AuthZ equivalent, regardless of the flag. See ADR 0027.

Merged to master as 0f57cf2bbf1.

Backport of: #38855 but dropping dd6c7bd since it only affects the master branch not verawood

Supporting information

Fixes openedx/openedx-authz#353
Fixes openedx/openedx-authz#354

Testing instructions

openedx-authz#353 (500 on granting course creator via Django admin)

1. Enable the authz.enable_course_authoring waffle flag.
2. Log in to Studio as a user with no course creator access, and request it from Studio.
3. Log in as a Django admin, go to /admin/course_creators/coursecreator/<id>/change/.
4. Set the request to Granted and save.
5. Before this fix a 500 error (InvalidKeyError trying to parse course_key=None) was raised.

openedx-authz#354 (403 on course creation despite a legacy grant)

1. With the flag still on, grant a non-admin user course creator access for all organizations via Django admin (/admin/course_creators/coursecreator/).
2. Log in to Studio as that user, open the New Course form, fill it in, and submit.
3. Before this fix, POST /course/ returns 403 (User does not have the permission to create courses in this organization or course creation is disabled).

Deadline

Verawood

Other information

Include anything else that will help reviewers and consumers understand the change.

• Does this change depend on other changes elsewhere?
• Any special concerns or limitations? For example: deprecations, migrations, security, or accessibility.
• If your database migration can't be rolled back easily.

[openedx-webhooks]

Thanks for the pull request, @mariajgrimaldi!

This repository is currently maintained by @openedx/wg-maintenance-openedx-platform.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

• If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
  • This process (including the steps you'll need to take) is documented here.
• If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

• Dependencies

  This PR must be merged before / after / at the same time as ...

• Blockers

  This PR is waiting for OEP-1234 to be accepted.

• Timeline information

  This PR must be merged by XX date because ...

• Partner information

  This is for a course on edx.org.

• Supporting documentation
• Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

Details

---

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

• Overview of Review Process for Community Contributions
• Pull Request Status Guide
• Making changes to your pull request

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

• The size and impact of the changes that it introduces
• The need for product review
• Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

[mariajgrimaldi]

Confirmed this is working on the PR sandbox: https://github.com/openedx/openedx-platform/pull/38891/checks?check_run_id=87363304519. You can follow the instructions in the cover letter to test!

FYI @farhaanbukhsh 👀

[mariajgrimaldi]

@farhaanbukhsh: considering we had a successfull build and tests on the PR sandbox - and also an approval (thanks @AhtishamShahid!), I'm going to go ahead and merge this! I'll be on the lookout for any regression. Thanks!