openedx-authz 2.1.0__tar.gz → 2.3.0__tar.gz

{openedx_authz-2.1.0 → openedx_authz-2.3.0}/.github/workflows/ci.yml

@@ -21,7 +21,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           enable-cache: true
           python-version: ${{ matrix.python-version }}

{openedx_authz-2.1.0 → openedx_authz-2.3.0}/.github/workflows/release.yml

@@ -87,4 +87,4 @@ jobs:
         path: dist/
 
     - name: Publish to PyPI
-      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+      uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3

{openedx_authz-2.1.0 → openedx_authz-2.3.0}/CHANGELOG.rst

@@ -18,8 +18,8 @@ Added
 =====
 
 * Added the static authorization schema, a versioned YAML format for declaring permissions,
-  permission categories, roles, and role extensions (ADR 0017). The permissions and roles that
-  ``authz.policy`` defines are now also expressed as schema files under
+  permission categories, roles, and role extensions (ADR 0017). The permissions and roles
+  previously defined in ``authz.policy`` are expressed as schema files under
   ``openedx_authz/authz/schema/``.
 * Added the schema loading pipeline in ``openedx_authz/engine/schema/``, covering the discover,
   load, validate and compile phases of the lifecycle (ADR 0018), plus render and apply in
@@ -61,11 +61,18 @@ Fixed
   by priority. This aligns the compiler with ADR 0031 and removes a path where a higher-priority file
   could silently replace a role's base definition.
 
+Changed
+========
+
+* Removed ``authz.policy`` after moving its static role-permission policies to the authorization schema. Existing Casbin action grouping remains supported until permission dependencies move to the schema.
+* Calls to the deprecated ``load_policies`` command without an explicit policy file are now a no-op while deployment integrations move to ``load_authz_schema``.
+
 Notes
 =====
 
-* No authorization behavior changes in this release. Loading ``authz.policy`` works as before, and
-  the new pipeline runs only when ``load_authz_schema`` is invoked.
+* Existing custom policy files can still be loaded by passing their path to ``load_policies``.
+  Calls without a policy file do nothing while deployment integrations move to
+  ``load_authz_schema``.
 * Applying a schema is idempotent and preserves data the loader does not own: user assignments,
   dynamic roles, legacy ``g2`` action-inheritance rows, and pre-existing policy rows that no schema
   declares. Rows that already exist are adopted, gaining definition and source records rather than

{openedx_authz-2.1.0/src/openedx_authz.egg-info → openedx_authz-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openedx-authz
-Version: 2.1.0
+Version: 2.3.0
 Summary: Open edX AuthZ provides the architecture and foundations of the authorization framework.
 Author-email: Open edX Project <oscm@openedx.org>
 License-Expression: AGPL-3.0-or-later
@@ -55,7 +55,7 @@ Integration with edx-platform
 
 This repository became an edx-platform's dependency starting with the Ulmo release. From that release onwards, system policies are automatically updated.
 
-If you need to update the policies manually, it is recommended to use the ``./manage.py lms load_policies`` command.
+To update the static authorization definitions manually, run ``./manage.py lms load_authz_schema``.
 
 .. note::
     Currently, this package only supports the `content libraries' roles and permissions as documented here`_, and the migration of data from the old system to the new one is performed automatically.

{openedx_authz-2.1.0 → openedx_authz-2.3.0}/README.rst

@@ -18,7 +18,7 @@ Integration with edx-platform
 
 This repository became an edx-platform's dependency starting with the Ulmo release. From that release onwards, system policies are automatically updated.
 
-If you need to update the policies manually, it is recommended to use the ``./manage.py lms load_policies`` command.
+To update the static authorization definitions manually, run ``./manage.py lms load_authz_schema``.
 
 .. note::
     Currently, this package only supports the `content libraries' roles and permissions as documented here`_, and the migration of data from the old system to the new one is performed automatically.

{openedx_authz-2.1.0 → openedx_authz-2.3.0}/docs/decisions/0022-defer-authorization-implications.rst

@@ -45,6 +45,13 @@ Consequences
 * The current policy loader continues to handle existing Casbin grouping rows.
 * Introducing implication later requires a schema-version change and migration guidance.
 
+Addendum: Remove the Static Policy File (2026-11-03)
+=====================================================
+
+Static role-permission policies moved from ``authz.policy`` to the authorization schema, and the policy file was removed. The Casbin ``g2`` model, matcher behavior, and stored grouping rows remain unchanged.
+
+New installations no longer load the default ``g2`` relationships that were stored in ``authz.policy``. `Issue #91`_ and `Issue #523`_ track defining permission dependencies in the authorization schema.
+
 Rejected Alternatives
 *********************
 
@@ -62,5 +69,9 @@ References
 **********
 
 * `ADR 0017`_
+* `Issue #91`_
+* `Issue #523`_
 
 .. _ADR 0017: 0017-static-authorization-schema.rst
+.. _Issue #91: https://github.com/openedx/openedx-authz/issues/91
+.. _Issue #523: https://github.com/openedx/openedx-authz/issues/523

{openedx_authz-2.1.0 → openedx_authz-2.3.0}/docs/decisions/0030-tutor-implementation-authz-schema-discovery.rst

@@ -102,7 +102,7 @@ Example rendered file with two plugin contributions:
 Schemas discovered through ``OPENEDX_AUTHZ_SCHEMA_FILES`` have no Python package or module. To satisfy the source-tracking requirements of `ADR 0025`_, their source record uses:
 
 * ``distribution`` = ``<tutor-patch>`` — a sentinel value that is an invalid Python package name, guaranteeing no collision with any installed distribution.
-* ``module`` = ``null`` — filesystem sources have no owning Python module, and using the absolute path would be inconsistent with the field's semantics elsewhere in the model.
+* ``module`` = the absolute filesystem path of the schema file (e.g. ``/openedx/config/authz-schema.yml``). Filesystem sources have no owning Python module, but reusing the path here keeps the ``(distribution, module)`` unique constraint enforceable and avoids the ``NULL``-handling complications that a ``null`` value would introduce across the ORM, migrations, and source-identity logic.
 * ``resource_path`` = the absolute filesystem path of the schema file (e.g. ``/openedx/config/authz-schema.yml``).
 * ``distribution_version`` = ``0.0.0`` — a sentinel value, since filesystem sources carry no package version.
 

{openedx_authz-2.1.0 → openedx_authz-2.3.0}/src/openedx_authz/authz/schema/course_permissions.yaml

@@ -56,7 +56,7 @@ permission_categories:
     description: Additional permissions not included in other categories, such as viewing checklists.
     icon: DrawShapes
   # Backend-only category for legacy compatibility actions that have no frontend
-  # display metadata. These are referenced by legacy roles in authz.policy.
+  # display metadata. These are referenced by legacy roles in course_roles.yaml.
   - id: course_legacy
     display_name: Legacy compatibility
     description: Internal compatibility permissions that map legacy course roles to the authorization system. Not shown as individually assignable permissions.

{openedx_authz-2.1.0 → openedx_authz-2.3.0}/src/openedx_authz/engine/renderer.py

@@ -7,7 +7,7 @@ the ``render`` and ``apply`` lifecycle steps:
   memory, without touching the database.
 * ``apply`` persists the rows in a single transaction, while preserving data
   owned by other services (ADR 0018 §3): dynamic roles, user assignments, and
-  the legacy ``g2`` action-inheritance rows that still live in ``authz.policy``.
+  legacy ``g2`` action-inheritance rows.
 
 Key semantics:
     * Idempotent (ADR 0018 §2): re-applying identical definitions changes

{openedx_authz-2.1.0 → openedx_authz-2.3.0}/src/openedx_authz/engine/schema/discovery.py

@@ -1,7 +1,7 @@
 """Discover static authz schema resources (the ``discover`` step, ADR 0019).
 
-Providers register **directories** (not individual files); the loader reads
-every ``.yaml`` file inside them. Two contribution sources are merged:
+Providers register **directories** of ``.yaml`` files, or individual absolute
+filesystem paths. Three contribution sources are merged:
 
 1. The ``authz.schema`` entry-point group. Each registered callable returns
    directory paths in the package-anchored format below (e.g.
@@ -9,6 +9,10 @@ every ``.yaml`` file inside them. Two contribution sources are merged:
 2. The ``OPENEDX_AUTHZ_SCHEMA_DIRECTORIES`` Django setting, a list of directory
    path strings in the same format. This lets operators and CI contribute
    directories without shipping a package entry point.
+3. The ``OPENEDX_AUTHZ_SCHEMA_FILES`` Django setting, a list of absolute
+   filesystem paths each naming one schema file (ADR 0030). This is the route
+   used by the Tutor ``openedx-authz-schema`` patch to feed a rendered file
+   into discovery without anchoring it on a Python package.
 
 Directory format: these are **not** filesystem paths (neither relative nor
 absolute). Each is a package-anchored ``importlib.resources`` path: the first
@@ -36,12 +40,15 @@ import logging
 from dataclasses import dataclass
 from enum import StrEnum
 from importlib import metadata, resources
+from pathlib import Path
 
 from django.conf import settings
 from django.core.exceptions import ImproperlyConfigured
 
 ENTRY_POINT_GROUP = "authz.schema"
 SETTINGS_DIRECTORIES_NAME = "OPENEDX_AUTHZ_SCHEMA_DIRECTORIES"
+SETTINGS_FILE_SENTINEL = "<tutor-patch>"
+SETTINGS_FILE_VERSION = "0.0.0"
 SCHEMA_FILE_SUFFIXES = (".yaml", ".yml")
 
 logger = logging.getLogger(__name__)
@@ -101,6 +108,45 @@ class DiscoveredResource:
             ) from exc
 
 
+@dataclass(frozen=True)
+class DiscoveredFileResource(DiscoveredResource):
+    """A schema file discovered via an absolute filesystem path (ADR 0030).
+
+    Unlike :class:`DiscoveredResource`, which resolves through
+    ``importlib.resources``, this variant reads directly from the filesystem.
+    Fields are populated with sentinel values: ``package`` is
+    :data:`SETTINGS_FILE_SENTINEL` and both ``module`` and ``resource_path``
+    hold the absolute path.
+    """
+
+    @classmethod
+    def from_path(cls, file_path: str) -> DiscoveredFileResource:
+        """Build a resource from an absolute filesystem path.
+
+        Sentinel values are used for ``package`` and ``module`` because the
+        file is not anchored on any Python package.
+        """
+        return cls(
+            package=SETTINGS_FILE_SENTINEL,
+            resource_path=file_path,
+            module=file_path,
+            origin=Origin.SETTINGS,
+        )
+
+    def read_bytes(self) -> bytes:
+        """Read the file directly from the filesystem via :class:`pathlib.Path`.
+
+        Raises:
+            SchemaDiscoveryError: If the file cannot be read.
+        """
+        try:
+            return Path(self.resource_path).read_bytes()
+        except OSError as exc:
+            raise SchemaDiscoveryError(
+                f"Could not read schema file {self.resource_path!r}: {exc}"
+            ) from exc
+
+
 class SchemaDiscoveryError(Exception):
     """Raised when a provider fails or a declared directory cannot be read."""
 
@@ -139,6 +185,7 @@ class SchemaDiscovery:
         found: list[DiscoveredResource] = []
         found.extend(self._discover_entry_points())
         found.extend(self._discover_settings_directories())
+        found.extend(self._discover_settings_files())
         for directory in self._passed_in_directories:
             found.extend(self._iter_directory(directory, origin=Origin.PASSED_IN))
 
@@ -184,6 +231,48 @@ class SchemaDiscovery:
             discovered.extend(self._iter_directory(directory, origin=Origin.SETTINGS))
         return discovered
 
+    def _discover_settings_files(self) -> list[DiscoveredResource]:
+        """Read ``OPENEDX_AUTHZ_SCHEMA_FILES`` from Django settings (ADR 0030).
+
+        Each item is an absolute filesystem path to a single schema file.
+        Unlike ``_discover_settings_directories``, every listed path must exist
+        and have a supported extension; a missing or misnamed file is treated
+        as a misconfiguration and raises ``SchemaDiscoveryError``.
+
+        Absent, empty, or unconfigured settings yield nothing. As with
+        ``_discover_settings_directories``, ``ImproperlyConfigured`` degrades
+        to no contribution so CI can run outside a Django process.
+        """
+        try:
+            file_paths = getattr(settings, "OPENEDX_AUTHZ_SCHEMA_FILES", None) or []
+        except ImproperlyConfigured:
+            return []
+        if not isinstance(file_paths, list):
+            raise SchemaDiscoveryError(
+                "OPENEDX_AUTHZ_SCHEMA_FILES must be a list of filesystem paths, "
+                f"got {type(file_paths).__name__!r}."
+            )
+        discovered: list[DiscoveredResource] = []
+        for file_path in file_paths:
+            if not file_path.endswith(SCHEMA_FILE_SUFFIXES):
+                raise SchemaDiscoveryError(
+                    f"Schema file {file_path!r} contributed through "
+                    "OPENEDX_AUTHZ_SCHEMA_FILES has an unsupported file extension, "
+                    f"accepted extensions: {SCHEMA_FILE_SUFFIXES}"
+                )
+
+            path = Path(file_path)
+            if not path.is_file():
+                raise SchemaDiscoveryError(
+                    f"Schema file {file_path!r} contributed through "
+                    "OPENEDX_AUTHZ_SCHEMA_FILES is not an actual file"
+                )
+
+            discovered.append(
+                DiscoveredFileResource.from_path(file_path)
+            )
+        return discovered
+
     def _iter_directory(self, directory: str, *, origin: Origin) -> list[DiscoveredResource]:
         """Resolve a directory path and return one resource per ``.yaml`` file.
 

{openedx_authz-2.1.0 → openedx_authz-2.3.0}/src/openedx_authz/engine/schema/parsing.py

@@ -17,9 +17,13 @@ from importlib import metadata
 
 import yaml
 
-from openedx_authz.engine.schema.discovery import DiscoveredResource
+from openedx_authz.engine.schema.discovery import (
+    SETTINGS_FILE_VERSION,
+    DiscoveredFileResource,
+    DiscoveredResource,
+)
 from openedx_authz.engine.schema.exceptions import SchemaLoadError
-from openedx_authz.engine.schema.types import ParsedSchemaDocument, SourceRecord
+from openedx_authz.engine.schema.types import ParsedSchemaDocument, SourceFileRecord, SourceRecord
 
 logger = logging.getLogger(__name__)
 
@@ -42,17 +46,19 @@ class SchemaParser:
         documents = []
         for resource in resources:
             contents = resource.read_bytes()
-            data = self.parse_yaml(contents, resource)
-            schema_version = str(data.get("schema_version", "")) if isinstance(data, dict) else ""
-            source = self.build_source_record(resource, contents, schema_version)
-            documents.append(ParsedSchemaDocument(source=source, data=data))
+            for data in self.parse_yamls(contents, resource):
+                schema_version = str(data.get("schema_version", "")) if isinstance(data, dict) else ""
+                source = self.build_source_record(resource, contents, schema_version)
+                documents.append(ParsedSchemaDocument(source=source, data=data))
         return documents
 
     @staticmethod
-    def parse_yaml(contents: bytes, resource: DiscoveredResource) -> object:
-        """Parse YAML bytes and preserve the resulting root value."""
+    def parse_yamls(contents: bytes, resource: DiscoveredResource) -> list[object]:
+        """Parse YAML bytes as a multi-document stream, skipping empty 
+        documents, and preserve the resulting root value.
+        """
         try:
-            return yaml.safe_load(contents)
+            return [doc for doc in yaml.safe_load_all(contents) if doc is not None]
         except yaml.YAMLError as exc:
             raise SchemaLoadError(f"Invalid YAML in {resource.package}:{resource.resource_path}: {exc}") from exc
 
@@ -66,14 +72,17 @@ class SchemaParser:
         """
         distribution, version = self.resolve_distribution(resource)
         content_digest = hashlib.sha256(contents).hexdigest()
-        return SourceRecord(
-            distribution=distribution,
-            distribution_version=version,
-            module=resource.module,
-            resource_path=resource.resource_path,
-            schema_version=schema_version,
-            content_digest=content_digest,
-        )
+        source_record = {
+            'distribution': distribution,
+            'distribution_version': version,
+            'module': resource.module,
+            'resource_path': resource.resource_path,
+            'schema_version': schema_version,
+            'content_digest': content_digest,
+        }
+        if isinstance(resource, DiscoveredFileResource):
+            return SourceFileRecord(**source_record)
+        return SourceRecord(**source_record)
 
     @classmethod
     def resolve_distribution(cls, resource: DiscoveredResource) -> tuple[str, str]:
@@ -88,6 +97,8 @@ class SchemaParser:
         the one that actually ships this resource's file, and only fall back to
         a deterministic (sorted) choice when no single owner can be identified.
         """
+        if isinstance(resource, DiscoveredFileResource):
+            return resource.package, SETTINGS_FILE_VERSION
         top_level = resource.package.split(".", 1)[0]
         try:
             mapping = metadata.packages_distributions()

{openedx_authz-2.1.0 → openedx_authz-2.3.0}/src/openedx_authz/engine/schema/types/__init__.py

@@ -37,6 +37,7 @@ from openedx_authz.engine.schema.types.definitions import (
 from openedx_authz.engine.schema.types.loading import (
     ParsedSchemaDocument,
     SchemaDocument,
+    SourceFileRecord,
     SourceRecord,
 )
 
@@ -49,6 +50,7 @@ __all__ = [
     # loading
     "SourceRecord",
     "ParsedSchemaDocument",
+    "SourceFileRecord",
     "SchemaDocument",
     # compilation
     "RelationshipSource",

{openedx_authz-2.1.0 → openedx_authz-2.3.0}/src/openedx_authz/engine/schema/types/loading.py

@@ -60,6 +60,22 @@ class SourceRecord:
         return f"{self.distribution}:{module_path}/{filename}"
 
 
+@dataclass(frozen=True)
+class SourceFileRecord(SourceRecord):
+    """Source record for a filesystem-path schema resource (ADR 0030).
+
+    Overrides :attr:`source_id` to use the absolute path directly, since the
+    parent's ``module.replace(".", "/")`` convention assumes dotted Python
+    module paths and would corrupt a filesystem path containing a file
+    extension.
+    """
+
+    @property
+    def source_id(self) -> str:
+        """Return ``"<distribution>:<absolute_path>"``."""
+        return f"{self.distribution}:{self.resource_path}"
+
+
 @dataclass(frozen=True)
 class ParsedSchemaDocument:
     """One parsed YAML value and the provenance of the resource that supplied it."""

{openedx_authz-2.1.0 → openedx_authz-2.3.0}/src/openedx_authz/management/commands/load_policies.py

@@ -1,7 +1,7 @@
 """Django management command to load policies into the authz Django model.
 
 The command supports:
-- Specifying the path to the Casbin policy file. Default is 'openedx_authz/engine/config/authz.policy'.
+- Specifying the path to a Casbin policy file. Calls without a file are a no-op.
 - Specifying the Casbin model configuration file. Default is 'openedx_authz/engine/config/model.conf'.
 - Optionally clearing existing policies in the database before loading new ones.
 """
@@ -25,9 +25,8 @@ class Command(BaseCommand):
     and persistence of authorization policies within the Django application.
 
     Example Usage:
-        python manage.py load_policies --policy-file-path /path/to/authz.policy
-        python manage.py load_policies --policy-file-path /path/to/authz.policy --model-file-path /path/to/model.conf
-        python manage.py load_policies
+        python manage.py load_policies --policy-file-path /path/to/custom.policy
+        python manage.py load_policies --policy-file-path /path/to/custom.policy --model-file-path /path/to/model.conf
     """
 
     help = "Load policies from a Casbin policy file into the Django database model."
@@ -74,7 +73,13 @@ class Command(BaseCommand):
             options["model_file_path"],
         )
         if policy_file_path is None:
-            policy_file_path = os.path.join(ROOT_DIRECTORY, "engine", "config", "authz.policy")
+            self.stdout.write(
+                self.style.WARNING(
+                    "No policy file supplied; nothing was loaded. "
+                    "Use load_authz_schema for static role-permission policies."
+                )
+            )
+            return
         if model_file_path is None:
             model_file_path = os.path.join(ROOT_DIRECTORY, "engine", "config", "model.conf")
 

{openedx_authz-2.1.0 → openedx_authz-2.3.0}/src/openedx_authz/tests/api/test_roles.py

@@ -5,10 +5,8 @@ including role creation, assignment, permission management, and querying
 roles and permissions within specific scopes.
 """
 
-from importlib.resources import files
 from unittest.mock import patch
 
-import casbin
 from ddt import data as ddt_data
 from ddt import ddt, unpack
 from django.test import TestCase
@@ -50,8 +48,8 @@ from openedx_authz.constants.roles import (
     LIBRARY_USER_PERMISSIONS,
 )
 from openedx_authz.engine.enforcer import AuthzEnforcer
-from openedx_authz.engine.utils import migrate_policy_between_enforcers
 from openedx_authz.models import ExtendedCasbinRule, Scope, Subject
+from openedx_authz.tests.test_utils import seed_static_authorization_policies
 
 
 def _mock_get_or_create_scope(scope_data):
@@ -76,20 +74,14 @@ class BaseRolesTestCase(TestCase):
 
     @classmethod
     def _seed_database_with_policies(cls):
-        """Seed the database with policies from the policy file.
+        """Seed the database with policies from the authorization schema.
 
         This simulates the one-time database seeding that would happen
         during application deployment, separate from the runtime policy loading.
         """
         global_enforcer = AuthzEnforcer.get_enforcer()
         global_enforcer.load_policy()
-        model_path = str(files("openedx_authz.engine").joinpath("config/model.conf"))
-        policy_path = str(files("openedx_authz.engine").joinpath("config/authz.policy"))
-
-        migrate_policy_between_enforcers(
-            source_enforcer=casbin.Enforcer(model_path, policy_path),
-            target_enforcer=global_enforcer,
-        )
+        seed_static_authorization_policies(global_enforcer)
         global_enforcer.clear_policy()  # Clear to simulate fresh start for each test
 
     @classmethod
@@ -181,7 +173,7 @@ class RolesTestSetupMixin(BaseRolesTestCase):
         super().setUpClass()
         # Define specific assignments for this test class
         assignments = [
-            # Basic library roles from authz.policy
+            # Basic library roles from the authorization schema
             {
                 "subject_name": "alice",
                 "role_name": roles.LIBRARY_ADMIN.external_key,
@@ -202,7 +194,7 @@ class RolesTestSetupMixin(BaseRolesTestCase):
                 "role_name": roles.LIBRARY_USER.external_key,
                 "scope_name": "lib:Org1:english_101",
             },
-            # Basic course roles from authz.policy
+            # Basic course roles from the authorization schema
             {
                 "subject_name": "daniel",
                 "role_name": roles.COURSE_STAFF.external_key,
@@ -430,17 +422,17 @@ class TestRolesAPI(RolesTestSetupMixin):
             self.assertFalse(ExtendedCasbinRule.objects.filter(subject=subj_obj, scope=scope_obj).exists())
 
     @ddt_data(
-        # Library Admin role with actual permissions from authz.policy
+        # Library Admin role with permissions from the authorization schema
         (
             roles.LIBRARY_ADMIN.external_key,
             LIBRARY_ADMIN_PERMISSIONS,
         ),
-        # Library Author role with actual permissions from authz.policy
+        # Library Author role with permissions from the authorization schema
         (
             roles.LIBRARY_AUTHOR.external_key,
             LIBRARY_AUTHOR_PERMISSIONS,
         ),
-        # Library Contributor role with actual permissions from authz.policy
+        # Library Contributor role with permissions from the authorization schema
         (
             roles.LIBRARY_CONTRIBUTOR.external_key,
             LIBRARY_CONTRIBUTOR_PERMISSIONS,
@@ -466,7 +458,7 @@ class TestRolesAPI(RolesTestSetupMixin):
         """
         assigned_permissions = get_permissions_for_single_role(RoleData(external_key=role_name))
 
-        self.assertEqual(assigned_permissions, expected_permissions)
+        self.assertEqual(sorted(assigned_permissions, key=str), sorted(expected_permissions, key=str))
 
     @ddt_data(
         # Role assigned to multiple users in different scopes
@@ -502,8 +494,8 @@ class TestRolesAPI(RolesTestSetupMixin):
 
         self.assertIn(role_name, assigned_permissions)
         self.assertEqual(
-            assigned_permissions[role_name]["permissions"],
-            expected_permissions,
+            sorted(assigned_permissions[role_name]["permissions"], key=str),
+            sorted(expected_permissions, key=str),
         )
 
     @ddt_data(
@@ -544,14 +536,17 @@ class TestRolesAPI(RolesTestSetupMixin):
         """Test retrieving role definitions from policy for a namespace wildcard scope.
 
         Expected result:
-            - Role definitions defined in authz.policy for the scope are returned.
+            - Role definitions defined in the authorization schema for the scope are returned.
             - Each role includes the permissions declared in its policy rules.
         """
         roles_in_scope = get_role_definitions_in_scope(ScopeData(namespaced_key=namespaced_scope))
         roles_by_key = {role.external_key: role for role in roles_in_scope}
 
         self.assertEqual(set(roles_by_key.keys()), expected_roles)
-        self.assertEqual(roles_by_key[sample_role].permissions, expected_permissions)
+        self.assertEqual(
+            sorted(roles_by_key[sample_role].permissions, key=str),
+            sorted(expected_permissions, key=str),
+        )
 
     def test_get_role_definitions_in_scope_returns_empty_for_concrete_scope(self):
         """Concrete scopes do not match namespace wildcard policy definitions."""

{openedx_authz-2.1.0 → openedx_authz-2.3.0}/src/openedx_authz/tests/integration/test_views.py

@@ -1,10 +1,8 @@
 """Integration tests for openedx_authz views."""
 
-import os
 import uuid
 from urllib.parse import urlencode
 
-import casbin
 import pytest
 from django.contrib.auth import get_user_model
 from django.test import TestCase
@@ -12,12 +10,11 @@ from django.urls import reverse
 from rest_framework import status
 from rest_framework.test import APIClient
 
-from openedx_authz import ROOT_DIRECTORY
 from openedx_authz.api.users import assign_role_to_user_in_scope
 from openedx_authz.engine.enforcer import AuthzEnforcer
-from openedx_authz.engine.utils import migrate_policy_between_enforcers
 from openedx_authz.models.core import ExtendedCasbinRule
 from openedx_authz.tests.integration.test_models import create_test_library
+from openedx_authz.tests.test_utils import seed_static_authorization_policies
 
 User = get_user_model()
 
@@ -30,19 +27,10 @@ class TestRoleAssignmentView(TestCase):
     def setUpClass(cls):
         """Set up test class - seed database with policies."""
         super().setUpClass()
-        # Seed the database with policies from the policy file
-        # This loads the policy definitions (p, g rules) that define what permissions each role has
+        # Seed the database with policies from the authorization schema
         global_enforcer = AuthzEnforcer.get_enforcer()
         global_enforcer.load_policy()
-
-        # Use absolute paths based on the package ROOT_DIRECTORY
-        model_conf = os.path.join(ROOT_DIRECTORY, "engine", "config", "model.conf")
-        authz_policy = os.path.join(ROOT_DIRECTORY, "engine", "config", "authz.policy")
-
-        migrate_policy_between_enforcers(
-            source_enforcer=casbin.Enforcer(model_conf, authz_policy),
-            target_enforcer=global_enforcer,
-        )
+        seed_static_authorization_policies(global_enforcer)
 
     def setUp(self):
         """Set up the test client and any required data."""

{openedx_authz-2.1.0 → openedx_authz-2.3.0}/src/openedx_authz/tests/rest_api/test_views.py

@@ -1559,7 +1559,7 @@ class TestArbitraryRoleSupport(ViewTestMixin):
     def setUpClass(cls):
         super().setUpClass()
         # Defined with the same wildcard library scope as the built-in library roles
-        # (see authz.policy), so it's visible for any specific library scope.
+        # (see library_roles.yaml), so it's visible for any specific library scope.
         AuthzEnforcer.get_enforcer().add_policy(
             make_role_key(cls.CUSTOM_ROLE),
             make_action_key(cls.CUSTOM_ACTION),