US: M2.9 Toggle reuse content library

[gviedma-aulasneo]

User story

As a Library Admin, I want to enable or disable public reuse of a library's published content directly from the library sidebar, so the rest of my team can use it in their courses without needing an explicit role assignment.

Acceptance criteria

• The toggle is located in the library sidebar, below the "Manage Library Team" entry point.
• The toggle label is "Allow public reuse"
• The toggle is visible to all users who can see the sidebar, but only interactive for users with manage_library_team on that library.
• Users without manage_library_team see the toggle in its current state but cannot interact with it.
• The default state is Off.
• When turned On, all authenticated Studio users can view and reuse published items from that library via course authoring. Draft content remains hidden.
• This does not create a role assignment or explicit permission grant.
• If a user already has a role on the library, their existing permissions are unchanged.
• When turned Off, reuse access for unaffiliated Studio users is removed going forward.
• While saving, the control is disabled and shows a saving state.
• On success, a success toast appears.
• On error, an error message appears with a Retry action.

Test cases

Setup

• Admin A has manage_library_team for Library 1.
• Member M is a library team member without manage_library_team.
• User U has a Studio account and no roles in Library 1.
• Library 1 has published and draft items.

Scenarios

1. Admin sees the toggle and it is Off by default
   Given: I am logged in as Admin A
   When: I open Library 1
   Then: I see the toggle in the sidebar below "Manage Library Team"
   And: the toggle is Off by default

2. Admin can turn the toggle On
   Given: I am Admin A and the toggle is Off
   When: I turn it On
   Then: the control disables while saving
   And: on success a success toast appears
   And: all authenticated Studio users can view and reuse published items from Library 1
   And: draft content remains hidden
   And: no role assignment is created

3. Admin can turn the toggle Off
   Given: I am Admin A and the toggle is On
   When: I turn it Off
   Then: the control disables while saving
   And: on success a success toast appears
   And: reuse access for unaffiliated Studio users is removed going forward

4. Member without manage_library_team sees the toggle but cannot interact with it
   Given: I am logged in as Member M and the toggle is On
   When: I open Library 1
   Then: I see the toggle in the On state
   And: the toggle is not interactive

5. Error shows a retry action
   Given: I am Admin A and I toggle the state
   When: the save fails
   Then: an error message appears with a Retry action
   And: the toggle returns to its previous state

6. Unaffiliated user cannot reuse content when toggle is Off
   Given: I am User U and the toggle is Off for Library 1
   When: I go to course authoring and open the reuse content picker
   Then: I do not see Library 1 or its items

7. Unaffiliated user can reuse published content when toggle is On
   Given: I am User U and the toggle is On for Library 1
   When: I go to course authoring and open the reuse content picker
   Then: I can see Library 1's published items
   And: I do not see draft items

Design

https://www.figma.com/design/onU2END2OXaF7RRLWEHsZI/AuthZ---v2?node-id=7639-26180&t=FLJ7Zz9Qhu9MtJVZ-4

Out of scope

• 401 and 403 use the existing auth error view. 404 and server errors use the existing not found or generic error view.

Notes

• This toggle replaces allow_public_read and is translated to allow_public_reuse. Current behavior is preserved.
• Granting reuse also implies view access for the library. This is not a permission or role assignment, it is an attribute of the library.

[MaferMazu]

I wasn't able to check in Django Admin whether the library changed the allow_public_read attribute properly (in https://LMS/admin/content_libraries/contentlibrary/8/change/, I get 500 in Verawood and in Muscat), which raises some questions because it could cause problems with allowing public reuse/read.

Small notes:
The toggle is currently above, not below.
The label uses read instead of reuse

Details

Tested in the Verawood sandbox

• The toggle is located in the library sidebar, below the "Manage Library Team" entry point.
• The toggle label is "Allow public reuse"
• The toggle is visible to all users who can see the sidebar, but only interactive for users with manage_library_team on that library.
• Users without manage_library_team see the toggle in its current state but cannot interact with it.
• The default state is Off.
• When turned On, all authenticated Studio users can view and reuse published items from that library via course authoring. Draft content remains hidden.
• This does not create a role assignment or explicit permission grant.
• If a user already has a role on the library, their existing permissions are unchanged.
• When turned Off, reuse access for unaffiliated Studio users is removed going forward.
• While saving, the control is disabled and shows a saving state.
• On success, a success toast appears.
• On error, an error message appears with a Retry action.

Screenshots

[MaferMazu]

This is already developed, but I marked it as blocked because we cannot test it in the test environments yet.

[MaferMazu]

Update:
I tested it in the Verawood community sandbox, and this is failing: the public libraries are not listed in the libraries endpoint, and there is also an issue accessing the Django Admin Content Library model.

So I am getting two issues:

• Content Library listing doesn't take into account the public libraries (that is also happening in my local)
• I can't access a library instance in the Django Admin (it is happening in Muscat and in the Verawood community sandbox) - I open a PR for it: fix: django admin wasn't showing details of content libraries (#38578) [Verawood Backport] openedx-platform#38675

[MaferMazu]

Content Library listing doesn't take into account the public libraries (that is also happening in my local)

In reality, this worked as expected, but I was expecting something different.

Context:
When we develop the MVP for Ulmo, we take into account the permissions written with Bridgekeeper:

# Is the user allowed to view the specified content library in Studio,
# including to view the raw OLX and asset files?
CAN_VIEW_THIS_CONTENT_LIBRARY = 'content_libraries.view_library'
perms[CAN_VIEW_THIS_CONTENT_LIBRARY] = is_user_active & (
    # Global staff can access any library
    is_global_staff |
    # Libraries with "public read" permissions can be accessed only by course creators
    (Attribute('allow_public_read', True) & is_course_creator) |

https://github.com/openedx/openedx-platform/blob/release/verawood/openedx/core/djangoapps/content_libraries/permissions.py#L243

The code explicitly said that only if the library has the allow_public_read and is a course creator, you can see the libraries (because if we remove the course creator condition completely, a student could see the public library, and we don't want that); but as for the second phase, we can have users with course roles, they are not capable of seeing this public libraries. - For this reason, I thought this wasn't working, because a course member can't use a public library if they don't have explicit permission to create a course.

For the Verawood release, I think we can leave it as is, because the feature worked as expected, with the limitation that a course editor or course admin can't use resources in a public library because they don't have course_creator. But for Willow we should definitely evaluate this, because as a course team member, I am expecting to use all the Studios public resources available.

[MaferMazu]

@gviedma-aulasneo I need your insight here.
The current condition to see the public libraries, if the user has explicit permission, is staff, or is course_creator and the library has the public_read; so if I am a course admin over a course, but I am not course creator, I won't be able to see the public libraries.
Is that behavior okay to maintain in Verawood?

[MaferMazu]

I reviewed this again, and we maintain the behavior from Ulmo to Verawood, and it is okay, so... We don't have a bug here, but I'll create a new issue to evaluate this deeply because I think it is natural if someone has at least one role in Studio, they should see the public libraries. Because right now, only the course creator can see these public libraries.

[MaferMazu]

@gviedma-aulasneo I'll close this issue because, during a recent review, we confirmed that the current behavior matches the transition from Ulmo to Verawood. This is working as designed, so it is not a bug

But it is something we can improve for Willow, so there is a ticket to evaluate that, #310.