Description

Authorization endpoints (validate/me, and role assignment/removal in RoleUserAPIView) currently rely solely on Casbin permission checks. They have no way to account for the effective authz.enable_course_authoring waffle flag state for a given course scope.

As a result, a stale Casbin assignment can cause these endpoints to approve a permission check, or allow a role to be assigned or removed, for a course scope whose course-authoring flag is actually off. This creates a mismatch between what the authorization layer reports and what should actually be available/actionable for that scope.

There's currently no clean way to plug course-authoring-specific scope visibility logic into these shared authorization endpoints without either hardcoding course-authoring concerns into the shared authorization code, or duplicating checks across each endpoint.