Task – RBAC AuthZ – Waffle flag - Automatic Migration Trigger

[dwong2708]

Once the migration scripts are completed, the next step is to integrate them with the course authorization flag so that migrations are triggered automatically when the flag is changed.

The behavior is defined as follows:

• The migration scripts must always be executed with the --delete flag.
• It is assumed that equivalent roles exist between the legacy authorization system and the AuthZ system.
• The migration process will run synchronously when the flag is updated.
• When the flag is enabled, roles are migrated from the legacy CourseAccessRole model to AuthZ role assignments.
• When the flag is disabled, roles are migrated from AuthZ role assignments back to the legacy CourseAccessRole model.

This approach ensures that role assignments exist in only one authorization system at a time, which is required for the compatibility layer to function correctly and to avoid inconsistent authorization behavior.