As course staff I can see retricted content from group A from the sidebar when masquerading as group B

[mariajgrimaldi]

Description

This was first reported in a thread of comments on this issue: openedx/frontend-app-authoring#1013, so we're opening it here since it's related to the sidebar behavior and not to course authoring.

Maria's comment:

I played around with content groups and the side bar, and here's what I found:

• As course staff, I configure a unit in a live subsection as visible for Content Group A
• Using masquerading in the LMS, I attempted to view the units from the Content Group A and Content Group B pov:

Screencast.from.02-06-24.11.00.04.webm

Although I cannot see the unit when viewing as Content Group B from the sidebar, I cannot see it with Content Group A either. The course outline behaves correctly.

• As a student, I review the course material using the sidebar.

Screencast.from.02-06-24.11.04.54.webm

As you see, as a student, I cannot see the unit in the sidebar cause I'm not part of the cohort associated with the content group. After the course's staff adds the student, I see the unit in the sidebar.

According to my tests, masquerading is not working correctly, but the rest seems to work as expected. Was this scenario what you described? I didn't quite understand the report, so I need some clarification.

Thank you!

Originally posted by @mariajgrimaldi in openedx/frontend-app-authoring#1013 (comment)

Chelsea's comment:

To me this might be a bug with how masquerading + the sidebar works when a staff user masquerades as a particular Group member to view course content. In the screenshot below, I created 2 content groups (A and B). I hid the unit shown below from content Group B. When I view the course as Group B, I still see the unit name of the course that's hidden in the sidebar nav, but I am shown a message that says the content is unavailable to me. Not great, but not absolutely terrible.

The good news is I can confirm what Maria says above, this only happens when I masquerade as Group X or Group Y. It doesn't happen live for members in these groups when those members are logged in. It also doesn't happen when I masquerade as a particular individual user in a user group (that masquerading works just fine).

Originally posted by @crathbun428 in openedx/frontend-app-authoring#1013 (comment)