Skip to content

fix: scope Studio organization list to current tenant [EDLYPRODUCT-8305] - #745

Merged
Waleed-Mujahid merged 1 commit into
develop-ulmofrom
fix/EDLYPRODUCT-8305-taxonomy-org-list-tenant-filter
Jul 3, 2026
Merged

fix: scope Studio organization list to current tenant [EDLYPRODUCT-8305]#745
Waleed-Mujahid merged 1 commit into
develop-ulmofrom
fix/EDLYPRODUCT-8305-taxonomy-org-list-tenant-filter

Conversation

@Waleed-Mujahid

Copy link
Copy Markdown
Member

Summary

The taxonomy "Assign to organizations" picker (Studio → Taxonomies → Manage Organizations) was listing every edX organization across all tenants instead of only the organizations belonging to the current tenant.

Root cause

The taxonomy MFE org pickers (the Manage Organizations modal and the taxonomy-list org filter) both fetch their list from the Studio /organizations endpoint:

  • MFE: frontend-app-authoring/src/taxonomy/manage-orgs/data/api.tsgeneric/data/api.ts:getOrganizations()GET <STUDIO_BASE_URL>/organizations
  • Backend: cms/djangoapps/contentstore/views/organization.py:OrganizationListView.getorganizations.api.get_organizations()all orgs, unfiltered

The course-creation org dropdown is already tenant-scoped because cms/djangoapps/contentstore/views/course.py:get_organizations() runs its list through the OrganizationsRequested openedx-filter (defined in edly-features-app, wired via OPEN_EDX_FILTERS_CONFIGio.edly.content_authoring.organization.list.requested.v1). OrganizationListView simply never applied that filter.

Fix

Apply the same OrganizationsRequested.run_filter(...) to the org list returned by OrganizationListView, exactly mirroring the existing course.py usage:

organizations = get_organizations()
org_names_list = [(org["short_name"]) for org in organizations]
#EDLYCUSTOM: filter the org list down to the current tenant's organizations
# (same OrganizationsRequested filter used for the course-creation org dropdown).
org_names_list = OrganizationsRequested.run_filter(organizations=org_names_list)
  • One line + the import; no behavioral change to the response shape (still a JSON list of short_name strings).
  • The filter's pipeline (OrganizationsRequestedPipeline) short-circuits and returns the input unchanged when get_tenant_config() is falsy, so single-tenant / non-request / management-shell contexts are unaffected.
  • Marked with #EDLYCUSTOM per the fork's core-change convention.

Impact

Fixes the taxonomy org pickers and the taxonomy list-page org filter (both share /organizations). Any other consumer of /organizations now also respects tenant isolation, matching the behavior already in place for course creation.

Testing

  1. As a tenant admin (GlobalCourseCreator) on red.apps.local.openedx.io, open Studio → Taxonomies → a taxonomy → Manage Organizations.
  2. Hard-refresh (org list is cached client-side by react-query useOrganizationListData).
  3. "Add another organization" now lists only the current tenant's orgs (e.g. red), not all edX orgs.

Note: verify in the UI — a manage.py cms shell check is not representative because the shell has no eox-tenant request context, so the filter passes through and returns all orgs.

Ticket

https://projects.arbisoft.com/arbisoft/browse/EDLYPRODUCT-8305/

The Studio `/organizations` endpoint (`OrganizationListView`) returned every
edX organization across all tenants. The taxonomy "Assign to organizations"
modal and the taxonomy list-page org filter both consume this endpoint via
the MFE `getOrganizations()` call, so a tenant could see organizations
belonging to other tenants in our multi-tenant (eox-tenant) setup.

The course-creation org dropdown was already scoped to the active tenant
through the `OrganizationsRequested` openedx-filter
(`cms/djangoapps/contentstore/views/course.py:get_organizations`), but
`OrganizationListView` never ran its list through that filter.

Run the org short-name list through `OrganizationsRequested.run_filter`,
mirroring the existing course.py usage. The filter returns the list unchanged
when no tenant config is present (its pipeline short-circuits on a falsy
`get_tenant_config()`), so single-tenant and non-request contexts are
unaffected.

Marked with `#EDLYCUSTOM` per the fork's core-change convention.

Ticket: https://projects.arbisoft.com/arbisoft/browse/EDLYPRODUCT-8305/
@Waleed-Mujahid Waleed-Mujahid self-assigned this Jun 29, 2026
@Waleed-Mujahid
Waleed-Mujahid marked this pull request as ready for review June 29, 2026 06:52
@Waleed-Mujahid
Waleed-Mujahid merged commit e1c7ce3 into develop-ulmo Jul 3, 2026
17 of 49 checks passed
@Waleed-Mujahid
Waleed-Mujahid deleted the fix/EDLYPRODUCT-8305-taxonomy-org-list-tenant-filter branch July 3, 2026 07:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants