No updates to ACLs for existing series in Opencast

[reiferschris]

Describe the bug
When new members are added to a course with permissions that require write privileges (e.g. edit in Opencast ACLs (ROLE_USER_XYZ read write) the opencast series is never updated.
I'm fairly certain that this mechanism could be triggered in the past when the opencast object was deleted in ilias and inserted again by adding a new opencast object and selecting the existing series.

To Reproduce
Steps to reproduce the behavior:

1. Create a new opencast series in an ilias course
2. Check the applied ACL in Opencast (expectation: all users with roles that have permission to edit videos, e.g. all course admins)
3. Add a new course member with a role that has permission to edit videos
4. Delete the opencast object in ilias (the series still exists in Opencast)
5. Create a new opencast object but choose existing series and select the series from before
6. Check the ACLs in Opencast again, they should be updated to reflect the newly added members but were not

Expected behavior
There should be a mechanism that updates ACLs on existing series in opencast so new course members get ACL entries to edit videos.
In the community meeting other methods were discussed (event based trigger, time based trigger)

Special case: Since opencast series can be linked in multiple courses special care must be taken. Simply overwriting the ACLs wouldn't suffice.
The details of this can be discussed if we decide to bring this functionality back, which I'm very much in favor of.

Screenshots
If applicable, add screenshots to help explain your problem.

Log
If you have it please attach the relevant log.

Environment (please complete the following information):

• ILIAS version: [9.20, current review app]
• PHP version: [-]
• Plugin version: [9.3.1, current review app]
• Opencast version [13 and opencast-ilias-community-version]
• Browser: [firefox]

Additional context
It might very well be possible that I'm hallucinating that this ever worked. Though I have to colleagues who would also vouch that at least this trick used to work.
Please let me know if you need more info or if something is unclear.

[marcusm7]

• Question: Is this topic still relevant when JWT is used to control the access to Opencast functions and roles? If JWT allows Opencast to trust Ilias with the access control decisions, would ACLs be obsolete? It's a real question, I'm unsure, since i.e. octoka covers static artifacts only, but not editor and studio and OC itself can handle just one JWT-endpoint right now, if I understand it correctly. If so, I would suggest to keep the development efforts small, since it only has to work until JWT-auth is in place. I.e. would manual remove and re-add the xoct-element after course membership changes be feasible?

• Scripts/ Ilias-Tasks? The Ilias-Cronjob functionality comes to mind. If it is known that new course members are added once per day or once per semester, there is no need to run an update job once per hour for all xoct-elements. But if course modifications are frequent, it could still be done. I'm arguing agains a fixed frequent cyclic update functionality here, because Ilias installations are different.

• A Trigger/ hook on-course-membership-change would still be preferable.

• Functionality:

  • the OC-series should have ACLs for any course admin and tutor from each ilias course which contains a xoct-series reference to it. This is expected by the ilias course admins and tutors (run editor, run studio, delete video, run workflows,...) - otherwise support request will arise or the acceptance will fall and alternatives are searched.
  • The ACLs should be added ASAP, because the course admins/ tutors would expect it. The Best solution would be imo if a on-course-members-changed could be invoked. Script otherwise.
  • the xoct plugin should not remove ACLs it did not grant beforehand. Easiest solution would be to only add ACLs but never remove them - which is problematic when a tutor/ admin is removed from a course - but it would be easier :D. Removing other/ foreign ACLs could affect other courses and manually created ACLs?