Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

User audit view: course-scope delete control can stay "course authoring disabled" incorrectly

Open
  • Is something wrong?
#258 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@dcoa is already working on this.

Since Oct 15, 2026.

  • #271 by @dcoa — open
  • #272 by @dcoa — open

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
55/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
react, typescript
Domain
authorization, frontend

Research direction

Start with the isCourseAuthoringDisabled branch of ActionsCell in src/authz-module/components/TableCells.tsx, then the createActionsCell(...) call inside the audit page's column useMemo, and check whether useCourseAuthoringFlag is re-evaluated once the flag states load. Done means a course-scope row with the flag on and courses.manage_course_team gets an enabled button labelled "Delete role action" on /authz/user/<username>, while the disabled state still applies when the flag is off.

Written by the indexing model from the issue text.

Description

In the user audit view (/authz/user/<username>), the delete control for a course-scope assignment renders as the "course authoring disabled" button (DisabledCourseActionButton). This happens even when course authoring is enabled for that course and the viewer may manage its team, so a course team member can't be removed from the console.

Measured within a single page load on Tutor main (overhangio/openedx-mfe:22.1.0-main, console bundle matching master), openedx-authz 1.23.0:

  • GET /api/authz/v1/waffle-flag-states/ → {"global": false, "org_overrides": {...}, "course_overrides": {"on": [..., "course-v1:E2E+E2EMV72DYTCW0Z+e2e"], "off": []}}, so the course is explicitly on.
  • POST /api/authz/v1/permissions/validate/me → [{"action": "courses.manage_course_team", "scope": "course-v1:E2E+E2EMV72DYTCW0Z+e2e", "allowed": true}]
  • The row (role course_staff, scope course-v1:E2E+E2EMV72DYTCW0Z+e2e) renders <span class="d-inline-block"><button aria-label="Delete role action" class="btn-icon btn-icon-light …" disabled>, the isCourseAuthoringDisabled branch of ActionsCell (src/authz-module/components/TableCells.tsx).

So isCourseEnabled(row.original.scope) evaluates to false for a course in courseOverrides.on. Library-scope rows on the same screen are removable, and the same assignment can be removed through Studio's Course Team endpoint or DELETE /api/authz/v1/roles/users/.

useCourseAuthoringFlag's resolution looks correct for this input. A possible cause is that the cell is rendered with the hook's loading state, in which everything resolves to false, and isn't re-rendered once the flag states arrive. The ActionsCell closure is created through createActionsCell(...) inside the audit page's column useMemo. I haven't stepped through it to confirm.

Impact: Studio's "Roles and Permissions" link leads here, and for a migrated course this is the team surface. Removing a course team member seems impossible from the UI.

Expected: a course whose flag resolves on, viewed by someone with courses.manage_course_team, gets an enabled delete control, as library-scope rows do.

Environment: 2026-10-13, local Tutor main. First seen 2026-09-22. Found by the Open edX end-to-end test suite (BTR TC-00620).

Dominant language
TypeScript
Stars
1
Forks
13
Avg merge
1d 7h
Merged PRs (30d)
15

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from openedx/frontend-app-admin-console

All issues in openedx/frontend-app-admin-console

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.