Support multiple course owners

[troeger]

If you want to have multiple people being able to create / edit assignments, this is not directly possible. The problem comes from the underlying permission model - only people with course owner rights can do that in general. However, this permission is only given if you own at least one course directly. Users seem to work around this problem by giving non-course-owning users the course owner permission directly (right, @thehappyhippo ?). This is bad, since now they can edit all courses, just to be able to edit assignments for one course.

The permission system must be re-architected accordingly. General student tutor / course owner permissions per user make no sense at all, since all of this is course-specific at the end.

Proposal:

• Support multiple course owners per course.
• Course owners can change course properties and assignments.
• Student tutors remain as they are, so they can only work on course-specific submissions.
• Django permission (groups?) are created per course and are automatically assigned to users. This ensures that all the Django backend access magic still works. If this all works, then they can become invisible / read-only in the user editing dialog.

There might be a Django package to work with fine-grained authorization roles in such a way. Check that.

I tag this as a bug, since multiple assignment-changing tutors are currently only possible through the workaround described above.

[troeger]

Another option would be to stick to our own principles, and remove the security distinuishing in the backend completely. If you have staff status, you have all the rights (in your courses).

[krono]

+1 on multiple owners :)