feat: add platform-level glob scope for content libraries (#333)

* feat: add PlatformContentLibraryGlobData scope and related tests

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: run make format

* chore: bump version to 1.18.0

* test: enhance library role assignment tests

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: BryanttV

CHANGELOG.rst

@@ -14,6 +14,14 @@ Change Log
 Unreleased
 **********
 
+1.18.0 - 2026-06-09
+*******************
+
+Added
+=====
+
+* Add platform glob scope for content libraries.
+
 1.17.1 - 2026-06-05
 *******************
 

openedx_authz/__init__.py

@@ -4,6 +4,6 @@
 
 import os
 
-__version__ = "1.17.1"
+__version__ = "1.18.0"
 
 ROOT_DIRECTORY = os.path.dirname(os.path.abspath(__file__))

openedx_authz/api/data.py

@@ -37,6 +37,7 @@
     "OrgGlobData",
     "OrgContentLibraryGlobData",
     "PermissionData",
+    "PlatformContentLibraryGlobData",
     "PlatformCourseOverviewGlobData",
     "PlatformGlobData",
     "PolicyIndex",
@@ -414,7 +415,7 @@ def get_all_platform_glob_namespaces(mcs) -> dict[str, Type["ScopeData"]]:
 
         Examples:
             >>> ScopeMeta.get_all_platform_glob_namespaces()
-            {'course-v1': PlatformCourseOverviewGlobData}
+            {'course-v1': PlatformCourseOverviewGlobData, 'lib': PlatformContentLibraryGlobData}
         """
         return mcs.platform_glob_registry
 
@@ -428,7 +429,13 @@ def get_all_registered_scopes(mcs) -> list[Type["ScopeData"]]:
 
         Examples:
             >>> ScopeMeta.get_all_registered_scopes()
-            [ScopeData, ContentLibraryData, OrgCourseOverviewGlobData, PlatformCourseOverviewGlobData]
+            [
+                ScopeData,
+                ContentLibraryData,
+                OrgCourseOverviewGlobData,
+                PlatformContentLibraryGlobData,
+                PlatformCourseOverviewGlobData,
+            ]
         """
         return list(
             {
@@ -1227,6 +1234,60 @@ def get_admin_manage_permission(cls) -> PermissionData:
         return COURSES_MANAGE_COURSE_TEAM
 
 
+@define
+class PlatformContentLibraryGlobData(PlatformGlobData):
+    """Platform-level glob pattern for content libraries.
+
+    This class represents glob patterns that match all content libraries in the platform.
+    Format: ``lib:*``
+
+    The glob pattern allows granting permissions to all libraries across the entire
+    platform without needing to specify organizations or individual libraries.
+
+    Attributes:
+        NAMESPACE (str): 'lib' for content library scopes.
+        IS_PLATFORM_GLOB (bool): True for scope data that represents a platform-level glob pattern.
+        external_key (str): The glob pattern (always ``lib:*``).
+        namespaced_key (str): The pattern with namespace (``lib^lib:*``).
+
+    Validation Rules:
+        - Must be exactly ``lib:*``
+        - Applies to all existing and future libraries in the platform
+        - Does not grant access to other resource types
+
+    Examples:
+        >>> glob = PlatformContentLibraryGlobData(external_key='lib:*')
+        >>> glob.exists()
+        True
+        >>> glob.namespaced_key
+        'lib^lib:*'
+
+    Note:
+        This class is automatically instantiated by the ScopeMeta metaclass when
+        a library scope with the platform wildcard is created.
+    """
+
+    NAMESPACE: ClassVar[str] = "lib"
+
+    @classmethod
+    def get_admin_view_permission(cls) -> PermissionData:
+        """Get the permission required to view this scope.
+
+        Returns:
+            PermissionData: The permission required to view this scope in the admin console.
+        """
+        return VIEW_LIBRARY_TEAM
+
+    @classmethod
+    def get_admin_manage_permission(cls) -> PermissionData:
+        """Get the permission required to manage this scope.
+
+        Returns:
+            PermissionData: The permission required to manage this scope in the admin console.
+        """
+        return MANAGE_LIBRARY_TEAM
+
+
 class CCXCourseOverviewData(CourseOverviewData):
     """CCX course scope for authorization in the Open edX platform.
 

openedx_authz/api/users.py

@@ -331,9 +331,7 @@ def _filter_allowed_assignments(
     if is_user_staff_or_superuser(user_external_key):
         return assignments
 
-    return filter_role_assignments_visible_to_subject(
-        UserData(external_key=user_external_key), assignments
-    )
+    return filter_role_assignments_visible_to_subject(UserData(external_key=user_external_key), assignments)
 
 
 def get_visible_role_assignments_for_user(

openedx_authz/engine/matcher.py

@@ -5,6 +5,7 @@
     CourseOverviewData,
     OrgContentLibraryGlobData,
     OrgCourseOverviewGlobData,
+    PlatformContentLibraryGlobData,
     PlatformCourseOverviewGlobData,
     ScopeData,
     UserData,
@@ -16,6 +17,7 @@
     (CourseOverviewData.NAMESPACE, CourseOverviewData),
     (OrgContentLibraryGlobData.NAMESPACE, OrgContentLibraryGlobData),
     (OrgCourseOverviewGlobData.NAMESPACE, OrgCourseOverviewGlobData),
+    (PlatformContentLibraryGlobData.NAMESPACE, PlatformContentLibraryGlobData),
     (PlatformCourseOverviewGlobData.NAMESPACE, PlatformCourseOverviewGlobData),
 }
 

openedx_authz/tests/api/test_data.py

@@ -14,6 +14,7 @@
     OrgContentLibraryGlobData,
     OrgCourseOverviewGlobData,
     PermissionData,
+    PlatformContentLibraryGlobData,
     PlatformCourseOverviewGlobData,
     RoleAssignmentData,
     RoleData,
@@ -271,12 +272,15 @@ def test_scope_data_registration(self):
         # Glob registries for platform-level scopes
         self.assertIn("course-v1", ScopeMeta.platform_glob_registry)
         self.assertIs(ScopeMeta.platform_glob_registry["course-v1"], PlatformCourseOverviewGlobData)
+        self.assertIn("lib", ScopeMeta.platform_glob_registry)
+        self.assertIs(ScopeMeta.platform_glob_registry["lib"], PlatformContentLibraryGlobData)
 
     @data(
         ("ccx-v1^ccx-v1:OpenedX+DemoX+DemoCourse+ccx@1", CCXCourseOverviewData),
         ("course-v1^course-v1:WGU+CS002+2025_T1", CourseOverviewData),
         ("lib^lib:DemoX:CSPROB", ContentLibraryData),
         ("lib^lib:DemoX*", OrgContentLibraryGlobData),
+        ("lib^lib:*", PlatformContentLibraryGlobData),
         ("course-v1^course-v1:OpenedX*", OrgCourseOverviewGlobData),
         ("course-v1^course-v1:*", PlatformCourseOverviewGlobData),
         ("global^generic_scope", ScopeData),
@@ -299,6 +303,7 @@ def test_dynamic_instantiation_via_namespaced_key(self, namespaced_key, expected
         ("course-v1^course-v1:WGU+CS002+2025_T1", CourseOverviewData),
         ("lib^lib:DemoX:CSPROB", ContentLibraryData),
         ("lib^lib:DemoX:*", OrgContentLibraryGlobData),
+        ("lib^lib:*", PlatformContentLibraryGlobData),
         ("course-v1^course-v1:OpenedX+*", OrgCourseOverviewGlobData),
         ("course-v1^course-v1:*", PlatformCourseOverviewGlobData),
         ("lib^*", ScopeData),
@@ -458,6 +463,7 @@ def test_get_subclass_by_namespaced_key_invalid_glob_pattern_raises(self, namesp
         ("course-v1:WGU+CS002+2025_T1", CourseOverviewData),
         ("lib:DemoX:CSPROB", ContentLibraryData),
         ("lib:DemoX:*", OrgContentLibraryGlobData),
+        ("lib:*", PlatformContentLibraryGlobData),
         ("course-v1:OpenedX+*", OrgCourseOverviewGlobData),
         ("course-v1:*", PlatformCourseOverviewGlobData),
         ("lib:edX:Demo", ContentLibraryData),
@@ -537,8 +543,11 @@ def test_is_platform_glob(self, namespace, external_key, expected):
     def test_platform_glob_registration_does_not_override_scope_registry(self):
         """Platform globs register separately; concrete scopes keep scope_registry entries."""
         self.assertIs(ScopeData.scope_registry["course-v1"], CourseOverviewData)
+        self.assertIs(ScopeData.scope_registry["lib"], ContentLibraryData)
         self.assertIs(ScopeMeta.platform_glob_registry["course-v1"], PlatformCourseOverviewGlobData)
+        self.assertIs(ScopeMeta.platform_glob_registry["lib"], PlatformContentLibraryGlobData)
         self.assertNotIn(PlatformCourseOverviewGlobData, ScopeData.scope_registry.values())
+        self.assertNotIn(PlatformContentLibraryGlobData, ScopeData.scope_registry.values())
 
     def test_platform_glob_resolves_before_org_glob_for_course_namespace(self):
         """course-v1:* is a platform glob; course-v1:Org+* remains an org glob."""
@@ -557,16 +566,32 @@ def test_dynamic_instantiation_via_external_key_for_platform_glob(self):
         self.assertEqual(scope.external_key, "course-v1:*")
         self.assertEqual(scope.namespaced_key, "course-v1^course-v1:*")
 
+    def test_platform_glob_resolves_before_org_glob_for_lib_namespace(self):
+        """lib:* is a platform glob; lib:Org:* remains an org glob."""
+        self.assertIs(ScopeMeta.get_subclass_by_external_key("lib:*"), PlatformContentLibraryGlobData)
+        self.assertIs(ScopeMeta.get_subclass_by_external_key("lib:DemoX:*"), OrgContentLibraryGlobData)
+        self.assertIs(ScopeMeta.get_subclass_by_namespaced_key("lib^lib:*"), PlatformContentLibraryGlobData)
+        self.assertIs(ScopeMeta.get_subclass_by_namespaced_key("lib^lib:DemoX:*"), OrgContentLibraryGlobData)
+
+    def test_dynamic_instantiation_via_external_key_for_lib_platform_glob(self):
+        """ScopeData(external_key='lib:*') instantiates PlatformContentLibraryGlobData."""
+        scope = ScopeData(external_key="lib:*")
+
+        self.assertIsInstance(scope, PlatformContentLibraryGlobData)
+        self.assertEqual(scope.external_key, "lib:*")
+        self.assertEqual(scope.namespaced_key, "lib^lib:*")
+
     def test_get_subclass_by_external_key_unknown_platform_glob_raises_value_error(self):
         """Namespace:* without a registered platform glob subclass raises ValueError."""
         with self.assertRaisesRegex(ValueError, "Unknown platform glob scope"):
-            ScopeMeta.get_subclass_by_external_key("lib:*")
+            ScopeMeta.get_subclass_by_external_key("ccx-v1:*")
 
     def test_get_all_registered_scopes_includes_platform_glob(self):
         """get_all_registered_scopes returns platform glob subclasses."""
         registered = ScopeMeta.get_all_registered_scopes()
 
         self.assertIn(PlatformCourseOverviewGlobData, registered)
+        self.assertIn(PlatformContentLibraryGlobData, registered)
         self.assertIn(OrgCourseOverviewGlobData, registered)
         self.assertIn(CourseOverviewData, registered)
 
@@ -1157,3 +1182,77 @@ def test_get_all_platform_glob_namespaces(self):
 
         self.assertIn("course-v1", platform_globs)
         self.assertIs(platform_globs["course-v1"], PlatformCourseOverviewGlobData)
+
+
+@ddt
+class TestPlatformContentLibraryGlobData(TestCase):
+    """Tests for the PlatformContentLibraryGlobData scope."""
+
+    PLATFORM_GLOB_EXTERNAL_KEY = "lib:*"
+    PLATFORM_GLOB_NAMESPACED_KEY = "lib^lib:*"
+
+    def test_build_external_key(self):
+        """build_external_key returns the platform-wide library glob pattern."""
+        self.assertEqual(PlatformContentLibraryGlobData.build_external_key(), self.PLATFORM_GLOB_EXTERNAL_KEY)
+
+    @data(
+        ("lib:*", True),
+        ("lib:DemoX:*", False),
+        ("lib:DemoX*", False),
+        ("lib:DemoX", False),
+        ("lib:*:*", False),
+        ("other:*", False),
+        ("course-v1:*", False),
+    )
+    @unpack
+    def test_validate_external_key(self, external_key, expected_valid):
+        """Validate platform-level library glob external keys."""
+        self.assertEqual(PlatformContentLibraryGlobData.validate_external_key(external_key), expected_valid)
+
+    def test_exists_always_true(self):
+        """exists() returns True without checking the database."""
+        scope = PlatformContentLibraryGlobData(external_key=self.PLATFORM_GLOB_EXTERNAL_KEY)
+
+        self.assertTrue(scope.exists())
+
+    def test_get_object_returns_none(self):
+        """Platform glob scopes do not map to a concrete domain object."""
+        scope = PlatformContentLibraryGlobData(external_key=self.PLATFORM_GLOB_EXTERNAL_KEY)
+
+        self.assertIsNone(scope.get_object())
+
+    def test_namespaced_key(self):
+        """namespaced_key includes namespace prefix and external key."""
+        scope = PlatformContentLibraryGlobData(external_key=self.PLATFORM_GLOB_EXTERNAL_KEY)
+
+        self.assertEqual(scope.namespaced_key, self.PLATFORM_GLOB_NAMESPACED_KEY)
+
+    def test_dynamic_instantiation_via_scope_data(self):
+        """ScopeData resolves lib:* to PlatformContentLibraryGlobData."""
+        scope = ScopeData(external_key=self.PLATFORM_GLOB_EXTERNAL_KEY)
+
+        self.assertIsInstance(scope, PlatformContentLibraryGlobData)
+        self.assertEqual(scope.external_key, self.PLATFORM_GLOB_EXTERNAL_KEY)
+
+    def test_get_admin_view_permission(self):
+        """View permission matches library team view permission."""
+        self.assertEqual(PlatformContentLibraryGlobData.get_admin_view_permission(), permissions.VIEW_LIBRARY_TEAM)
+
+    def test_get_admin_manage_permission(self):
+        """Manage permission matches library team manage permission."""
+        self.assertEqual(
+            PlatformContentLibraryGlobData.get_admin_manage_permission(),
+            permissions.MANAGE_LIBRARY_TEAM,
+        )
+
+    def test_is_platform_glob(self):
+        """Platform library glob is flagged as a platform-level glob scope."""
+        self.assertTrue(PlatformContentLibraryGlobData.IS_PLATFORM_GLOB)
+        self.assertFalse(PlatformContentLibraryGlobData.IS_ORG_GLOB)
+
+    def test_get_all_platform_glob_namespaces(self):
+        """Platform glob namespace is registered in ScopeMeta."""
+        platform_globs = ScopeMeta.get_all_platform_glob_namespaces()
+
+        self.assertIn("lib", platform_globs)
+        self.assertIs(platform_globs["lib"], PlatformContentLibraryGlobData)

openedx_authz/tests/api/test_roles.py

@@ -1536,9 +1536,7 @@ def test_subject_sees_assignments_in_accessible_scope(self):
         """
         all_assignments = get_all_subject_role_assignments()
 
-        visible = filter_role_assignments_visible_to_subject(
-            SubjectData(external_key="alice"), all_assignments
-        )
+        visible = filter_role_assignments_visible_to_subject(SubjectData(external_key="alice"), all_assignments)
 
         visible_scopes = {a.scope.external_key for a in visible}
         self.assertIn("lib:Org1:math_101", visible_scopes)
@@ -1551,9 +1549,7 @@ def test_subject_cannot_see_assignments_outside_accessible_scopes(self):
         """
         all_assignments = get_all_subject_role_assignments()
 
-        visible = filter_role_assignments_visible_to_subject(
-            SubjectData(external_key="alice"), all_assignments
-        )
+        visible = filter_role_assignments_visible_to_subject(SubjectData(external_key="alice"), all_assignments)
 
         visible_scopes = {a.scope.external_key for a in visible}
         self.assertNotIn("lib:Org2:physics_401", visible_scopes)
@@ -1567,9 +1563,7 @@ def test_subject_with_no_role_assignments_sees_nothing(self):
         """
         all_assignments = get_all_subject_role_assignments()
 
-        visible = filter_role_assignments_visible_to_subject(
-            SubjectData(external_key="unknown_user"), all_assignments
-        )
+        visible = filter_role_assignments_visible_to_subject(SubjectData(external_key="unknown_user"), all_assignments)
 
         self.assertEqual(visible, [])
 
@@ -1579,8 +1573,6 @@ def test_empty_candidate_list_returns_empty(self):
         Expected result:
             - Result is empty regardless of the subject's accessible scopes.
         """
-        visible = filter_role_assignments_visible_to_subject(
-            SubjectData(external_key="alice"), []
-        )
+        visible = filter_role_assignments_visible_to_subject(SubjectData(external_key="alice"), [])
 
         self.assertEqual(visible, [])