fix: scope Studio organization list to current tenant [EDLYPRODUCT-8305] - #745
Merged
Waleed-Mujahid merged 1 commit intoJul 3, 2026
Conversation
The Studio `/organizations` endpoint (`OrganizationListView`) returned every edX organization across all tenants. The taxonomy "Assign to organizations" modal and the taxonomy list-page org filter both consume this endpoint via the MFE `getOrganizations()` call, so a tenant could see organizations belonging to other tenants in our multi-tenant (eox-tenant) setup. The course-creation org dropdown was already scoped to the active tenant through the `OrganizationsRequested` openedx-filter (`cms/djangoapps/contentstore/views/course.py:get_organizations`), but `OrganizationListView` never ran its list through that filter. Run the org short-name list through `OrganizationsRequested.run_filter`, mirroring the existing course.py usage. The filter returns the list unchanged when no tenant config is present (its pipeline short-circuits on a falsy `get_tenant_config()`), so single-tenant and non-request contexts are unaffected. Marked with `#EDLYCUSTOM` per the fork's core-change convention. Ticket: https://projects.arbisoft.com/arbisoft/browse/EDLYPRODUCT-8305/
Waleed-Mujahid
marked this pull request as ready for review
June 29, 2026 06:52
muhammadali286
approved these changes
Jul 3, 2026
Waleed-Mujahid
deleted the
fix/EDLYPRODUCT-8305-taxonomy-org-list-tenant-filter
branch
July 3, 2026 07:38
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The taxonomy "Assign to organizations" picker (Studio → Taxonomies → Manage Organizations) was listing every edX organization across all tenants instead of only the organizations belonging to the current tenant.
Root cause
The taxonomy MFE org pickers (the Manage Organizations modal and the taxonomy-list org filter) both fetch their list from the Studio
/organizationsendpoint:frontend-app-authoring/src/taxonomy/manage-orgs/data/api.ts→generic/data/api.ts:getOrganizations()→GET <STUDIO_BASE_URL>/organizationscms/djangoapps/contentstore/views/organization.py:OrganizationListView.get→organizations.api.get_organizations()→ all orgs, unfilteredThe course-creation org dropdown is already tenant-scoped because
cms/djangoapps/contentstore/views/course.py:get_organizations()runs its list through theOrganizationsRequestedopenedx-filter (defined inedly-features-app, wired viaOPEN_EDX_FILTERS_CONFIG→io.edly.content_authoring.organization.list.requested.v1).OrganizationListViewsimply never applied that filter.Fix
Apply the same
OrganizationsRequested.run_filter(...)to the org list returned byOrganizationListView, exactly mirroring the existing course.py usage:short_namestrings).OrganizationsRequestedPipeline) short-circuits and returns the input unchanged whenget_tenant_config()is falsy, so single-tenant / non-request / management-shell contexts are unaffected.#EDLYCUSTOMper the fork's core-change convention.Impact
Fixes the taxonomy org pickers and the taxonomy list-page org filter (both share
/organizations). Any other consumer of/organizationsnow also respects tenant isolation, matching the behavior already in place for course creation.Testing
red.apps.local.openedx.io, open Studio → Taxonomies → a taxonomy → Manage Organizations.useOrganizationListData).red), not all edX orgs.Ticket
https://projects.arbisoft.com/arbisoft/browse/EDLYPRODUCT-8305/