feat(authz): add permission validation for advanced settings and certificate pages

[dcoa]

Description

This PR is the continuation of the effort to implement the new Authz system into Course Authoring. The PR is focused on hiding actions according to user permissions.

Specifically, it splits the Advanced Settings and Certificates pages into a view level and a manage level:

• Adds the new courses.view_advanced_settings and courses.view_certificates permissions to src/authz/constants.ts, and exposes them through getAdvancedSettingsPermissions() / getCertificatesPermissions().
• Access points (Settings dropdown in the header, HelpSidebar, and the course outline CourseInfoSidebar) now gate the Advanced Settings and Certificates links on the view_* permission instead of manage_*, so users with read-only access can still reach the pages.
• Advanced Settings: page access is now gated by canViewAdvancedSettings (PermissionDeniedAlert otherwise). Without manage_advanced_settings the page renders a ViewOnlyPermissionsAlert banner and every SettingCard field is disabled.
• Certificates: permissions moved into CertificatesProvider (src/certificates/context.tsx) so they're resolved once and consumed anywhere in the tree. Page access is gated by canViewCertificates; without manage_certificates the page shows the ViewOnlyPermissionsAlert banner and hides the write actions: the Activate/Deactivate button, the Set up certificate button on the empty state, the edit/delete actions on the certificate details card, and the edit action on each signatory. The Preview button stays available to read-only users.

Important

Depends on openedx/openedx-platform#39008 and openedx/openedx-platform#39007

Impacted user roles: Course Auditor / Course Editor — i.e. anyone whose role grants view_advanced_settings or view_certificates without the matching manage_*. Users with the manage_* permissions ( Course Staff / Course Admin) are unaffected. This only takes effect when the enable_authz_course_authoring waffle flag is on; with the flag off, the legacy behavior is preserved.

It closes openedx/openedx-authz#316

Testing instructions

1. Check out this branch and run the MFE against a devstack/tutor instance with both backend PRs above applied.
2. Enable the enable_authz_course_authoring waffle flag.
3. Assign a user a role that grants courses.view_advanced_settings and courses.view_certificates but not the corresponding manage_* permissions, and log in as that user.
   • Use the API http://local.openedx.io:8000/api/authz/v1/roles/users/
   • Assign course_auditor as role
4. Open the course and verify:
   • Header → Settings dropdown shows Advanced Settings and Certificates.
   • The Advanced Settings link is also visible in the Help sidebar and in the course outline info sidebar (Settings tab).
5. Go to Advanced Settings and verify:
   • The page loads (no "permission denied" alert).
   • A "view only" alert is shown under the page header.
   • All setting fields are disabled and cannot be edited.
6. Go to Certificates (with ENABLE_CERTIFICATE_PAGE=true) and verify:
   • The page loads and shows the "view only" alert.
   • The Preview button is present, but Activate/Deactivate is not.
   • The certificate details card shows no edit or delete icon buttons.
   • Signatories show no edit icon button.
   • On a course with modes but no certificate yet, the Set up certificate button is hidden.
7. Now log in as a user with manage_advanced_settings / manage_certificates and repeat steps 5–6: no "view only" alert, all fields editable, and every action button present and working as before.
8. Finally, log in as a user with neither permission and confirm the pages return the permission-denied alert and the links are hidden from the menus/sidebars.
9. Turn the waffle flag off and confirm the legacy behavior is unchanged for all users.

Advanced Settings

** Certificates**

Best Practices Checklist

We're trying to move away from some deprecated patterns in this codebase. Please
check if your PR meets these recommendations before asking for a review:

• Any new files are using TypeScript (.ts, .tsx).
• Avoid propTypes and defaultProps in any new or modified code.
• Tests should use the helpers in src/testUtils.tsx (specifically initializeMocks)
• Do not add new fields to the Redux state/store. Use React Context to share state among multiple components.
• Use React Query to load data from REST APIs. See any apiHooks.ts in this repo for examples.
• All new i18n messages in messages.ts files have a description for translators to use.
• Avoid using ../ in import paths. To import from parent folders, use @src, e.g. import { initializeMocks } from '@src/testUtils'; instead of from '../../../../testUtils'

[openedx-webhooks]

Thanks for the pull request, @dcoa!

This repository is currently maintained by @bradenmacdonald.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

• If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
  • This process (including the steps you'll need to take) is documented here.
• If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

• Dependencies

  This PR must be merged before / after / at the same time as ...

• Blockers

  This PR is waiting for OEP-1234 to be accepted.

• Timeline information

  This PR must be merged by XX date because ...

• Partner information

  This is for a course on edx.org.

• Supporting documentation
• Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

🔘 Update the status of your PR

Your PR is currently marked as a draft. After completing the steps above, update its status by clicking "Ready for Review", or removing "WIP" from the title, as appropriate.

---

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

• Overview of Review Process for Community Contributions
• Pull Request Status Guide
• Making changes to your pull request

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

• The size and impact of the changes that it introduces
• The need for product review
• Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.93%. Comparing base (16e19f1) to head (55c5bd4).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #3206   +/-   ##
=======================================
  Coverage   95.92%   95.93%           
=======================================
  Files        1397     1397           
  Lines       33581    33600   +19     
  Branches     7947     7946    -1     
=======================================
+ Hits        32214    32233   +19     
  Misses       1308     1308           
  Partials       59       59           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.