feat: add view permissions for advanced settings, certificates, group…

… configurations, and library updates (#385)

Add four new read-only view permissions:

- courses.view_advanced_settings
- courses.view_certificates
- courses.view_group_configurations
- courses.view_library_updates

All four are granted to all four course roles (Admin, Staff, Editor, Auditor).
Previously, users without the corresponding manage_* permissions were completely
blocked from viewing these pages.

Closes #328, Closes #329, Closes #386, Closes #387

feat: support role assignment for scopes that don't exist yet (#369)

fix: scope AdminConsoleOrgsAPIView to the user's assigned orgs (#356)

* Scope AdminConsoleOrgsAPIView to the user's assigned orgs

The org filter endpoint returned every active org regardless of the
requesting user's actual course/library role assignments. Now it's
limited to orgs the user has a role in (via specific or org-level glob
scopes), with staff/superusers still seeing everything.

* Grant platform-glob role holders full org visibility in AdminConsoleOrgsAPIView

Users with a role at a platform-level glob scope (all courses or all libraries)
have no single org to derive, so they previously saw zero orgs instead of every
org they can actually manage. Adds RoleAssignmentData.filter_platform_glob_assignments
to check this without duplicating scope-type logic in the REST API layer.

See #347 for standardizing the
staff/superuser and platform-access checks duplicated across call sites.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

fix: drop superadmin entries for user assigments endpoint (#370)

* fix: drop superadmin entries for user assigments endpoint

* chore: version bump 1.21.2

* refactor: implement feedback

fix: update missmatch param in queryset_builder for scopes (#367)

_get_allowed_scope_queryset is generic over two builders whose first parameter differs by design — _get_courses_queryset(allowed_ids=…) vs _get_libraries_queryset(allowed_pairs=…) (libraries key on org+slug pairs). The normal path (line 848) passes that arg positionally, so it works for both. But the platform-access shortcut at line 843 passed it as the keyword allowed_ids=None, which the libraries builder doesn't accept; hence the TypeError, triggered only when the requesting user has platform-wide access.

feat: add waffle flag states rest api and util (#358)

* feat: add waffle flag states rest api and util

* fix: address PR #358 review comments on get_waffle_flag_states

- get_waffle_flag_states used a manual Flag query for the global tier
instead of enable_authz_course_authoring, and returned flat booleans for
org/course overrides instead of the actual affected orgs/courses, split
by whether the override forces the flag on or off.

- Adds test coverage for get_waffle_flag_states and WaffleFlagStatesAPIView,
and an ADR documenting why this endpoint (issue #358) supersedes PR #361's
approach of enforcing the flag cascade inside release-blocking endpoints.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix: rollback to use Flag instead of enable_authz_course_authoring,
because that needs an argument

* fix: quality tests

* docs: bumpversion to 1.21.0

* docs: update the adr

---------

Co-authored-by: Maria Grimaldi <maria.grimaldi@edunext.co>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

docs: use patch instead of minor for fix (#351)

feat: make scope optional for user action validation (#348)

* feat: make scope optional for action validation

* refactor: address review feedback

feat: add get_user_role_assignments_per_scope_type api function (#339)

* feat: add get_user_role_assignments_per_scope_type api function

* chore: bump version to 1.19.0

feat: add platform-level glob scope for content libraries (#333)

* feat: add PlatformContentLibraryGlobData scope and related tests

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: run make format

* chore: bump version to 1.18.0

* test: enhance library role assignment tests

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>