AuthZ Extensibility in Willow: Enable Roles and Permissions Contributed by Modules #408

Description

Allow an installed module to contribute new roles and permissions (including the metadata needed by the Administrative Console) without changing openedx-authz critical code paths or adding role-specific frontend code.

• Spike: Extensibility Proposal for Willow Instructor Dashboard Use Case

• Guiding use case: Instructor Dashboard.

• Context: The PoC already showed that Casbin can load, assign, and enforce new role and permission strings. This epic covers the missing definition layer around that behavior: contribution/discovery, metadata, validation, and role-agnostic APIs.

• Scope covered: Use cases A1, A2, A5, and A6 (add a role with existing permissions; add a role with new permissions; add new/existing permissions to a built-in role). Uses the current scope and subject.

• Out of scope: new scope types, new subject types, scope REST discovery, and plugin removal.