refactor: address review feedback

Author: dcoa

CHANGELOG.rst

@@ -14,6 +14,16 @@ Change Log
 Unreleased
 **********
 
+1.20.0 - 2026-07-01
+*******************
+
+Added
+=====
+
+* Make ``scope`` optional when validating actions: the permission validation API and
+  ``/permissions/validate/me`` endpoint now allow checking whether a user holds a
+  permission in any scope (via ``is_user_allowed_in_any_scope``) when no scope is provided.
+
 1.19.0 - 2026-06-17
 *******************
 

openedx_authz/__init__.py

@@ -4,6 +4,6 @@
 
 import os
 
-__version__ = "1.19.0"
+__version__ = "1.20.0"
 
 ROOT_DIRECTORY = os.path.dirname(os.path.abspath(__file__))

openedx_authz/rest_api/v1/serializers.py

@@ -70,21 +70,14 @@ class PermissionValidationSerializer(ActionMixin, ScopeMixin):  # pylint: disabl
     scope; when omitted, the permission is validated across any scope.
     """
 
-    scope = serializers.CharField(max_length=255, required=False, allow_null=True)
+    scope = serializers.CharField(max_length=255, required=False)
 
 
 class PermissionValidationResponseSerializer(PermissionValidationSerializer):  # pylint: disable=abstract-method
     """Serializer for permission validation response."""
 
     allowed = serializers.BooleanField()
 
-    def to_representation(self, instance: dict) -> dict:
-        """Serialize the result, omitting ``scope`` when the request had no scope."""
-        representation = super().to_representation(instance)
-        if instance.get("scope") is None:
-            representation.pop("scope", None)
-        return representation
-
 
 class RoleScopeValidationMixin(serializers.Serializer):  # pylint: disable=abstract-method
     """Mixin providing role and scope validation logic."""

openedx_authz/tests/api/test_users.py

@@ -613,8 +613,21 @@ def test_is_user_allowed(self, username, action, scope_name, expected_result):
         # jane is library_user on lib:Org1:english_101, which never grants these permissions.
         ("jane", permissions.DELETE_LIBRARY.identifier, False),
         ("jane", permissions.MANAGE_LIBRARY_TEAM.identifier, False),
+        # daniel is course_staff on course-v1:TestOrg+TestCourse+2024_T1, so he holds the
+        # staff course permissions in at least one scope.
+        ("daniel", permissions.COURSES_VIEW_COURSE.identifier, True),
+        ("daniel", permissions.COURSES_EDIT_COURSE_CONTENT.identifier, True),
+        ("daniel", permissions.COURSES_PUBLISH_COURSE_CONTENT.identifier, True),
+        # course_staff never grants team management, so daniel holds it in no scope.
+        ("daniel", permissions.COURSES_MANAGE_COURSE_TEAM.identifier, False),
+        # carlos is course_staff on three different courses; he still holds these in some scope.
+        ("carlos", permissions.COURSES_VIEW_COURSE.identifier, True),
+        ("carlos", permissions.COURSES_MANAGE_ADVANCED_SETTINGS.identifier, True),
+        # jane only holds a library role, so she has no course permission in any scope.
+        ("jane", permissions.COURSES_VIEW_COURSE.identifier, False),
         # A user without any assignment is not allowed in any scope.
         ("nonexistent_user", permissions.MANAGE_LIBRARY_TEAM.identifier, False),
+        ("nonexistent_user", permissions.COURSES_VIEW_COURSE.identifier, False),
     )
     @unpack
     def test_is_user_allowed_in_any_scope(self, username, action, expected_result):
@@ -630,17 +643,27 @@ def test_is_user_allowed_in_any_scope(self, username, action, expected_result):
         )
         self.assertEqual(result, expected_result)
 
-    def test_is_user_allowed_in_any_scope_staff_always_allowed(self):
+    @data(
+        # Staff-only user
+        ("staff_member", {"is_staff": True}),
+        # Superuser-only user
+        ("superuser_member", {"is_superuser": True}),
+        # Both staff and superuser
+        ("staff_superuser_member", {"is_staff": True, "is_superuser": True}),
+    )
+    @unpack
+    def test_is_user_allowed_in_any_scope_staff_always_allowed(self, username, flags):
         """Staff/superusers are allowed for any action regardless of explicit assignments.
 
         Expected result:
-            - The function returns True for a staff user that has no role assignments.
+            - The function returns True for a staff and/or superuser user that has no
+              role assignments.
         """
         User = get_user_model()
-        User.objects.create_user(username="staff_member", email="staff_member@example.com", is_staff=True)
+        User.objects.create_user(username=username, email=f"{username}@example.com", **flags)
 
         result = is_user_allowed_in_any_scope(
-            user_external_key="staff_member",
+            user_external_key=username,
             action_external_key=permissions.MANAGE_LIBRARY_TEAM.identifier,
         )
         self.assertTrue(result)