feat: align user assignments endpoint with inline assignments shape

[BryanttV]

Closes #511

Description

GET /api/authz/v1/users/{username}/assignments/ (TeamMemberAssignmentsAPIView) returned a different assignment shape than the inline assignments array of GET /api/authz/v1/users/ introduced in #451 (ADR 0024). As a result, the Team Member detail view could only label scopes with their raw key (e.g. lib:Org1:LIB1).

This PR makes both endpoints return the same assignment shape.

Changes

• TeamMemberAssignmentsAPIView now serializes with TeamMemberAssignmentInlineSerializer, so both endpoints share one serializer and cannot drift apart again.
  • Added: scope_display_name (CourseOverview.display_name for courses, learning_package.title for libraries).
  • Removed: is_superadmin.
• Display names are resolved in bulk, after pagination, with get_scope_display_name_map: one batched lookup per scope type per page, no N+1 queries. Glob scopes, superadmin entries and missing courses/libraries return "", the same as GET /api/authz/v1/users/. scope remains the stable machine identifier.
• New helper inject_scope_display_names in rest_api/utils.py, used by both TeamMembersAPIView and TeamMemberAssignmentsAPIView. It replaces the block that was previously inlined in TeamMembersAPIView. It lives next to the other helpers that operate on serialized dicts (sort_assignments, filter_users, ...), and api/utils.py is left as the domain layer.
• Docstring and apidocs schema of the view updated.
• ADR 0024 updated: it no longer says that this endpoint omits scope_display_name.

Filtering (orgs, roles), sorting, and pagination behave as before. GET /api/authz/v1/assignments/ (AssignmentsAPIView) is not modified.

Response example

{
  "count": 2,
  "next": null,
  "previous": null,
  "results": [
    {
      "role": "library_admin",
      "org": "Org1",
      "scope": "lib:Org1:LIB1",
      "scope_display_name": "Intro to CS Library",
      "permission_count": 11
    },
    {
      "role": "library_author",
      "org": "Org1",
      "scope": "lib:Org1:*",
      "scope_display_name": "",
      "permission_count": 9
    }
  ]
}

Breaking change

is_superadmin is no longer returned by GET /api/authz/v1/users/{username}/assignments/. Clients reading that field must stop relying on it. This is noted in the changelog and ADR 0024.

Testing instructions

1. Create a library and a course, and assign roles to a user in:
   • a specific library (lib:Org1:LIB1) and a specific course (course-v1:Org1+CS101+2024)
   • an org-level glob (lib:Org1:*) and a platform-level glob (lib:*)
2. As a user with team view permissions, call GET /api/authz/v1/users/<username>/assignments/.
3. Check that every result has scope_display_name and no is_superadmin. The library and course show their title and display name. The globs and the missing library show "".
4. Check that orgs, roles, sort_by, order, page, and page_size still work.

Merge checklist

Check off if complete or not applicable:

• Documentation updated (not only docstrings)
• Fixup commits are squashed away
• Unit tests added/updated
• Manual testing instructions provided
• Noted any: Concerns, dependencies, migration issues, deadlines, tickets

[openedx-webhooks]

Thanks for the pull request, @BryanttV!

This repository is currently maintained by @openedx/committers-openedx-authz.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

• If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
  • This process (including the steps you'll need to take) is documented here.
• If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

• Dependencies

  This PR must be merged before / after / at the same time as ...

• Blockers

  This PR is waiting for OEP-1234 to be accepted.

• Timeline information

  This PR must be merged by XX date because ...

• Partner information

  This is for a course on edx.org.

• Supporting documentation
• Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

Details

---

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

• Overview of Review Process for Community Contributions
• Pull Request Status Guide
• Making changes to your pull request

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

• The size and impact of the changes that it introduces
• The need for product review
• Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

[rodmgwgu]

@BryanttV wouldn't removing is_superadmin from the response break the current frontend behavior? or has this been changed in the frontend too?

[rodmgwgu]

Thanks for this! It's looking good, just added some comments to take into account.

[rodmgwgu]

This will need updating before we merge, we are currently at 1.28.0.

[rodmgwgu]

It sounds to me that this comment about is_superadmin is out of place, I think we don't need to mention it as it will no longer be in the code and could be confusing for someone without the historical context.

[rodmgwgu]

Would it make sense to define a dataclass to pass instead of a dict (for the assignments param)? To make this more type safe.

[rodmgwgu]

Tested in my local and it's working as described. Thanks!

[carlos-marquez-wgu]

Tested in my local with the current changes of admin-console, works great, thanks!

Page is stil working, no errors

Screenshots

Endpoint body response

{
    "count": 4,
    "next": null,
    "previous": null,
    "results": [
        {
            "role": "course_staff",
            "org": "CORG",
            "scope": "course-v1:CORG+*",
            "permission_count": 31,
            "scope_display_name": ""
        },
        {
            "role": "course_staff",
            "org": "CORG",
            "scope": "course-v1:CORG+CARLOS101+2026_2",
            "permission_count": 31,
            "scope_display_name": "My Course"
        },
        {
            "role": "library_user",
            "org": "CORG",
            "scope": "lib:CORG:*",
            "permission_count": 3,
            "scope_display_name": ""
        },
        {
            "role": "library_user",
            "org": "CORG",
            "scope": "lib:CORG:LIB101",
            "permission_count": 3,
            "scope_display_name": "MyLibrary"
        }
    ]
}