Library asset URLs (images, etc.) embedded in reviewed content still 403 for course_id bypass #473

Description

When a Course Auditor (or anyone else holding courses.view_library_updates but no direct library permission) reviews pending library changes, static assets referenced inside the reviewed content (images, etc.) still return 403, even after #441's fix in openedx/openedx-platform#39107.

Reported by @dcoa while testing that PR: openedx/openedx-platform#39107 (comment)

Current behavior

Opening the "review pending changes" modal for a component with an embedded image shows a broken image. The failing request is:

GET /library_assets/component_versions/<uuid>/static/<path>

(LibraryComponentAssetView, in openedx/core/djangoapps/content_libraries/rest_api/blocks.py), which still only checks CAN_VIEW_THIS_CONTENT_LIBRARY on the library, with no course-level bypass.

Why this needs a different fix than #441

The three endpoints fixed in #39107 are called directly by the frontend, which controls the query params it sends, including the new course_id param used to verify a real upstream link.

This asset URL is different: it's generated by the browser resolving an <img src="..."> (or similar) that's already baked into the HTML rendered by embed_block_view. That URL is built in openedx/core/djangoapps/xblock/runtime/openedx_content_runtime.py's _absolute_url_for_asset(), via reverse('content_libraries:library-assets', ...), with no access to the current request or any course_id at all, since it happens during content rendering/substitution, not as a request our frontend controls.

A real fix needs to:

1. Thread the course_id from the original request into the runtime when it's constructed (load_block / get_runtime).
2. Have _absolute_url_for_asset append it as a query param to every asset URL it generates.
3. Have LibraryComponentAssetView resolve the component_version back to its LibraryUsageLocatorV2/container, and apply the same UpstreamLink-based verification added in #39107 (not just trust the course_id, verify the downstream is actually linked to this component).

Steps to reproduce

1. Create a course and a content library with a component that references a static asset (e.g. an HTML component with an embedded image).
2. Link that component into a course unit, then update it in the library so it has pending changes.
3. As a user with only courses.view_library_updates in the course (e.g. Course Auditor) and no direct library permission, open the "review pending changes" modal for that unit.
4. The embedded asset (image) fails to load; the network request to /library_assets/component_versions/.../static/... returns 403.

Related

• openedx-authz#441
• fix: let course_id bypass library access when reviewing pending updates openedx-platform#39107 (fixes the container/children/embed endpoints, not this one)