diff --git a/.github/workflows/add-depr-ticket-to-depr-board.yml b/.github/workflows/add-depr-ticket-to-depr-board.yml
deleted file mode 100644
index 250e394abc11..000000000000
--- a/.github/workflows/add-depr-ticket-to-depr-board.yml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Run the workflow that adds new tickets that are either:
-# - labelled "DEPR"
-# - title starts with "[DEPR]"
-# - body starts with "Proposal Date" (this is the first template field)
-# to the org-wide DEPR project board
-
-name: Add newly created DEPR issues to the DEPR project board
-
-on:
-  issues:
-    types: [opened]
-
-jobs:
-  routeissue:
-    uses: openedx/.github/.github/workflows/add-depr-ticket-to-depr-board.yml@master
-    secrets:
-      GITHUB_APP_ID: ${{ secrets.GRAPHQL_AUTH_APP_ID }}
-      GITHUB_APP_PRIVATE_KEY: ${{ secrets.GRAPHQL_AUTH_APP_PEM }}
-      SLACK_BOT_TOKEN: ${{ secrets.SLACK_ISSUE_BOT_TOKEN }}
diff --git a/.github/workflows/add-remove-label-on-comment.yml b/.github/workflows/add-remove-label-on-comment.yml
deleted file mode 100644
index 0f369db7d293..000000000000
--- a/.github/workflows/add-remove-label-on-comment.yml
+++ /dev/null
@@ -1,20 +0,0 @@
-# This workflow runs when a comment is made on the ticket
-# If the comment starts with "label: " it tries to apply
-# the label indicated in rest of comment.
-# If the comment starts with "remove label: ", it tries
-# to remove the indicated label.
-# Note: Labels are allowed to have spaces and this script does
-# not parse spaces (as often a space is legitimate), so the command
-# "label: really long lots of words label" will apply the
-# label "really long lots of words label"
-
-name: Allows for the adding and removing of labels via comment
-
-on:
-  issue_comment:
-    types: [created]
-
-jobs:
-  add_remove_labels:
-    uses: openedx/.github/.github/workflows/add-remove-label-on-comment.yml@master
-
diff --git a/.github/workflows/check-for-tutorial-prs.yml b/.github/workflows/check-for-tutorial-prs.yml
deleted file mode 100644
index 6920542ac187..000000000000
--- a/.github/workflows/check-for-tutorial-prs.yml
+++ /dev/null
@@ -1,35 +0,0 @@
-# This workflow detects PRs that make changes to lms/templates/dashboard.html
-# and only lms/templates/dashboard.html. This is the file that users are
-# guided through changing in the Open edX tutorial:
-# https://docs.openedx.org/en/latest/developers/quickstarts/first_openedx_pr.html#exercise-update-the-learner-dashboard
-
-# If this is the only file changed in the PR, we comment on the PR congratulating
-# the user and letting others know that this is not a community PR in need of
-# review. CODEOWNERS will tag a triaging team to provide reviews & ultimately
-# close the PR.
-
-name: Check for Tutorial PR
-description: Welcome contributors making their first PR from the tutorial
-on:
-  pull_request:
-    types: [opened]
-    paths:
-      - 'lms/templates/dashboard.html'
-
-jobs:
-  # Provide helpful bot comment
-  comment:
-    runs-on: ubuntu-latest
-    name: provide helpful bot comment
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: Comment PR
-        uses: thollander/actions-comment-pull-request@v1
-        with:
-          message: |
-            Thank you for your pull request! Congratulations on completing the Open edX tutorial! A team member will be by to take a look shortly.
-            To those watching community pull requests: No need to worry about this one, a tCRIL team member will be taking care of it.
-            For this PR's author: If this is a PR that is NOT coming from the Open edX tutorial, please comment and let us know to disregard this message.
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
\ No newline at end of file
diff --git a/.github/workflows/ci-static-analysis.yml b/.github/workflows/ci-static-analysis.yml
deleted file mode 100644
index 94b6b30600a8..000000000000
--- a/.github/workflows/ci-static-analysis.yml
+++ /dev/null
@@ -1,43 +0,0 @@
-name: Static analysis
-
-on: pull_request
-
-jobs:
-  tests:
-    name: Static analysis
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        python-version: ['3.8']
-        os: ['ubuntu-20.04']
-
-    steps:
-      - uses: actions/checkout@v2
-      - name: Set up Python
-        uses: actions/setup-python@v2
-        with:
-          python-version: ${{ matrix.python-version }}
-
-      - name: Install system requirements
-        run: sudo apt update && sudo apt install -y libxmlsec1-dev
-
-      - name: Install pip
-        run: python -m pip install -r requirements/pip.txt
-
-      - name: Get pip cache dir
-        id: pip-cache-dir
-        run: echo "::set-output name=dir::$(pip cache dir)"
-
-      - name: Cache pip dependencies
-        id: cache-dependencies
-        uses: actions/cache@v2
-        with:
-          path: ${{ steps.pip-cache-dir.outputs.dir }}
-          key: ${{ runner.os }}-pip-${{ hashFiles('requirements/edx/development.txt') }}
-          restore-keys: ${{ runner.os }}-pip-
-
-      - name: Install python dependencies
-        run: make dev-requirements
-
-      - name: Static code analysis
-        run: make check-types
diff --git a/.github/workflows/docker-compose.yml.mysqldbdump b/.github/workflows/docker-compose.yml.mysqldbdump
deleted file mode 100644
index 0853d250ff40..000000000000
--- a/.github/workflows/docker-compose.yml.mysqldbdump
+++ /dev/null
@@ -1,23 +0,0 @@
-version: '3'
-services:
-  mysql:
-    image: mysql:5.7
-    container_name: edx.devstack.mysql57
-    ports:
-      - '3306:3306'
-    environment:
-      MYSQL_ROOT_PASSWORD: ""
-      MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
-    volumes:
-      - ./init:/docker-entrypoint-initdb.d
-    healthcheck:
-      test: ["CMD", "mysqladmin" ,"ping", "-h", "localhost"]
-      timeout: 20s
-      retries: 10
-  edxapp:
-    image: edxops/edxapp:latest
-    command: bash -c 'source /edx/app/edxapp/edxapp_env && cd /edx/app/edxapp/edx-platform/ && paver update_db'
-    volumes:
-       - ../../:/edx/app/edxapp/edx-platform
-    depends_on:
-      - mysql
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
deleted file mode 100644
index e7d9e0c1fa8e..000000000000
--- a/.github/workflows/docker-publish.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-name: Push Docker Images
-
-on:
-  push:
-    branches:
-      - master
-jobs:
-  # Push image to GitHub Packages.
-  # See also https://docs.docker.com/docker-hub/builds/
-  push:
-    runs-on: ubuntu-latest
-    if: github.event_name == 'push'
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v2
-
-      - name: Build and Push docker image
-        env:
-          DOCKERHUB_PASSWORD: ${{ secrets.DOCKERHUB_PASSWORD }}
-          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
-        run : make docker_push
diff --git a/.github/workflows/docs-build-check.yml b/.github/workflows/docs-build-check.yml
deleted file mode 100644
index 10dd000ce0e2..000000000000
--- a/.github/workflows/docs-build-check.yml
+++ /dev/null
@@ -1,50 +0,0 @@
-name: Docs build
-
-on:
-  pull_request:
-  push:
-    branches:
-      - master
-
-jobs:
-  tests:
-    name: Docs build
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        python-version: ['3.8']
-        os: ['ubuntu-20.04']
-
-    steps:
-      - uses: actions/checkout@v2
-      - name: Set up Python
-        uses: actions/setup-python@v2
-        with:
-          python-version: ${{ matrix.python-version }}
-
-      - name: Install system requirements
-        run: sudo apt update && sudo apt install -y libxmlsec1-dev
-
-      - name: Install pip
-        run: python -m pip install -r requirements/pip.txt
-
-      - name: Get pip cache dir
-        id: pip-cache-dir
-        run: echo "::set-output name=dir::$(pip cache dir)"
-
-      - name: Cache pip dependencies
-        id: cache-dependencies
-        uses: actions/cache@v2
-        with:
-          path: ${{ steps.pip-cache-dir.outputs.dir }}
-          key: ${{ runner.os }}-pip-${{ hashFiles('requirements/edx/development.txt') }}
-          restore-keys: ${{ runner.os }}-pip-
-
-      - name: Install python dependencies
-        run: make dev-requirements
-
-      - name: Install docs requirements
-        run: pip install -r requirements/edx/doc.txt
-
-      - name: Docs build
-        run: make docs
diff --git a/.github/workflows/js-tests.yml b/.github/workflows/js-tests.yml
deleted file mode 100644
index 0a9dacaaae63..000000000000
--- a/.github/workflows/js-tests.yml
+++ /dev/null
@@ -1,85 +0,0 @@
-name: Javascript tests
-
-on:
-  pull_request:
-    branches:
-      - master
-  push:
-    branches:
-      - master
-
-jobs:
-  run_tests:
-    name: JS
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [ ubuntu-20.04 ]
-        node-version: [ 16 ]
-        python-version: [ 3.8 ]
-
-    steps:
-
-    - uses: actions/checkout@v2
-    - name: Fetch master to compare coverage
-      run: git fetch --depth=1 origin master
-
-    - name: Setup Node
-      uses: actions/setup-node@v2
-      with:
-        node-version: ${{ matrix.node-version }}
-
-    - name: Setup npm
-      run: npm i -g npm@8.5.x
-
-    - name: Install Firefox 61.0
-      run: |
-        sudo apt-get purge firefox
-        wget "https://ftp.mozilla.org/pub/firefox/releases/61.0/linux-x86_64/en-US/firefox-61.0.tar.bz2"
-        tar -xjf firefox-61.0.tar.bz2
-        sudo mv firefox /opt/firefox
-        sudo ln -s /opt/firefox/firefox /usr/bin/firefox
-
-    - name: Install Required System Packages
-      run: sudo apt-get update && sudo apt-get install libxmlsec1-dev ubuntu-restricted-extras xvfb
-
-    - name: Setup Python
-      uses: actions/setup-python@v2
-      with:
-        python-version: ${{ matrix.python-version }}
-
-    - name: Get pip cache dir
-      id: pip-cache-dir
-      run: |
-        echo "::set-output name=dir::$(pip cache dir)"
-
-    - name: Cache pip dependencies
-      id: cache-dependencies
-      uses: actions/cache@v2
-      with:
-        path: ${{ steps.pip-cache-dir.outputs.dir }}
-        key: ${{ runner.os }}-pip-${{ hashFiles('requirements/edx/base.txt') }}
-        restore-keys: ${{ runner.os }}-pip-
-
-    - name: Install Required Python Dependencies
-      run: |
-        make base-requirements
-
-    - uses: c-hive/gha-npm-cache@v1
-    - name: Run JS Tests
-      env:
-        TEST_SUITE: js-unit
-        SCRIPT_TO_RUN: ./scripts/generic-ci-tests.sh
-      run: |
-        npm install -g jest
-        xvfb-run --auto-servernum ./scripts/all-tests.sh
-
-    - name: Save Job Artifacts
-      uses: actions/upload-artifact@v3
-      with:
-        name: Build-Artifacts
-        path: |
-          reports/**/*
-          test_root/log/*.png
-          test_root/log/*.log
-          **/TEST-*.xml
diff --git a/.github/workflows/lint-imports.yml b/.github/workflows/lint-imports.yml
deleted file mode 100644
index 63caae452f3a..000000000000
--- a/.github/workflows/lint-imports.yml
+++ /dev/null
@@ -1,52 +0,0 @@
-name: Lint Python Imports
-
-on:
-  pull_request:
-  push:
-    branches:
-      - master
-
-jobs:
-
-  lint-imports:
-    name: Lint Python Imports
-    runs-on: ubuntu-20.04
-
-    steps:
-      - name: Check out branch
-        uses: actions/checkout@v2
-
-      - name: Set up Python
-        uses: actions/setup-python@v2
-        with:
-          python-version: '3.8'
-
-      - name: Install system requirements
-        run: sudo apt update && sudo apt install -y libxmlsec1-dev
-
-      - name: Install pip
-        run: python -m pip install -r requirements/pip.txt
-
-      - name: Get pip cache dir
-        id: pip-cache-dir
-        run: echo "::set-output name=dir::$(pip cache dir)"
-
-      - name: Cache pip dependencies
-        id: cache-dependencies
-        uses: actions/cache@v2
-        with:
-          path: ${{ steps.pip-cache-dir.outputs.dir }}
-          key: ${{ runner.os }}-pip-${{ hashFiles('requirements/edx/development.txt') }}
-          restore-keys: ${{ runner.os }}-pip-
-
-      - name: Install python dependencies
-        run: pip install -r requirements/edx/development.txt
-
-      # As long there are sub-projects[1] in edx-platform, we analyze each
-      # project separately here, in order to make import-linting errors easier
-      # to pinpoint.
-      #
-      #  [1] https://openedx.atlassian.net/browse/BOM-2579
-
-      - name: Analyze imports (repo root)
-        run: make lint-imports
diff --git a/.github/workflows/lockfileversion-check.yml b/.github/workflows/lockfileversion-check.yml
deleted file mode 100644
index 42312e8cbf2d..000000000000
--- a/.github/workflows/lockfileversion-check.yml
+++ /dev/null
@@ -1,13 +0,0 @@
-#check package-lock file version
-
-name: Lockfile Version check
-
-on:
-  push:
-    branches:
-    - master
-  pull_request:
-
-jobs:
-  version-check:
-    uses: openedx/.github/.github/workflows/lockfileversion-check.yml@master
diff --git a/.github/workflows/migrations-check.yml b/.github/workflows/migrations-check.yml
deleted file mode 100644
index cdd3020e3890..000000000000
--- a/.github/workflows/migrations-check.yml
+++ /dev/null
@@ -1,105 +0,0 @@
-name: Check Django Migrations
-
-on:
-  workflow_dispatch:
-  pull_request:
-  push:
-    branches:
-      - master
-
-jobs:
-  check_migrations:
-    name: check migrations
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [ ubuntu-20.04 ]
-        python-version: [ 3.8 ]
-        mongo-version: ["4"]
-        mysql-version: ["5.7", "8"]
-    services:
-      mongo:
-        image: mongo:${{ matrix.mongo-version }}
-        ports:
-          - 27017:27017
-        # Note: Calling mongo here only works with mongo 4, in newer versions of mongo
-        # we'll have to use `mongosh`
-        options: >-
-          --health-cmd "mongo --quiet --eval 'db.runCommand(\"ping\")'"
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 3
-      mysql:
-        image: mysql:${{ matrix.mysql-version }}
-        ports:
-          - 3306:3306
-        env:
-          MYSQL_DATABASE: "edxapp"
-          MYSQL_USER: "edxapp001"
-          MYSQL_PASSWORD: "password"
-          MYSQL_RANDOM_ROOT_PASSWORD: true
-        options: >-
-          --health-cmd "mysqladmin ping"
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 3
-    steps:
-    - name: Setup mongodb user
-      run: |
-        mongosh edxapp --eval '
-          db.createUser(
-            {
-              user: "edxapp",
-              pwd:  "password",
-              roles: [
-                   { role: "readWrite", db: "edxapp" },
-              ]
-            }
-          );
-        '
-
-    - name: Verify mongo and mysql db credentials
-      run: |
-        mysql -h 127.0.0.1 -uedxapp001 -ppassword -e "select 1;" edxapp
-        mongosh --host 127.0.0.1 --username edxapp --password password --eval 'use edxapp; db.adminCommand("ping");' edxapp
-
-    - name: Checkout repo
-      uses: actions/checkout@v2
-
-    - name: Setup Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v2
-      with:
-        python-version: ${{ matrix.python-version }}
-
-    - name: Install system Packages
-      run: |
-        sudo apt-get update
-        make ubuntu-requirements
-
-    - name: Get pip cache dir
-      id: pip-cache-dir
-      run: |
-        echo "::set-output name=dir::$(pip cache dir)"
-
-    - name: Cache pip dependencies
-      id: cache-dependencies
-      uses: actions/cache@v2
-      with:
-        path: ${{ steps.pip-cache-dir.outputs.dir }}
-        key: ${{ runner.os }}-pip-${{ hashFiles('requirements/edx/development.txt') }}
-        restore-keys: ${{ runner.os }}-pip-
-
-    - name: Install Python dependencies
-      run: |
-        make dev-requirements
-
-    - name: Run Tests
-      env:
-        LMS_CFG: lms/envs/minimal.yml
-        # This is from the LMS dir on purpose since we don't need anything different for the CMS yet.
-        STUDIO_CFG: lms/envs/minimal.yml
-      run: |
-        echo "Running the LMS migrations."
-        ./manage.py lms migrate
-        echo "Running the CMS migrations."
-        ./manage.py cms migrate
diff --git a/.github/workflows/pr-automerge-open-release.yml b/.github/workflows/pr-automerge-open-release.yml
deleted file mode 100644
index 25af91e0527f..000000000000
--- a/.github/workflows/pr-automerge-open-release.yml
+++ /dev/null
@@ -1,24 +0,0 @@
-# Enable automerging for named release branches.
-# See the reusable workflow for details:
-# https://github.com/openedx/.github/.github/workflows/pr-automerge-open-release.yml
-
-name: Automerge BTR open-release PRs
-
-on:
-  issue_comment:
-    branches:
-      - open-release/*
-    types:
-      - created
-      - edited
-  pull_request_target:
-    branches:
-      - open-release/*
-    types:
-      - opened
-      - edited
-      - ready_for_review
-
-jobs:
-  automerge:
-    uses: openedx/.github/.github/workflows/pr-automerge-open-release.yml@master
diff --git a/.github/workflows/publish-ci-docker-image.yml b/.github/workflows/publish-ci-docker-image.yml
deleted file mode 100644
index e716c7d15340..000000000000
--- a/.github/workflows/publish-ci-docker-image.yml
+++ /dev/null
@@ -1,35 +0,0 @@
-name: Push CI Runner Docker Image
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: "0 1 * * 3"
-
-jobs:
-  push:
-    runs-on: ubuntu-20.04
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v2
-
-      - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v1
-        with:
-          aws-access-key-id: ${{ secrets.TOOLS_EDX_ECR_USER_AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.TOOLS_EDX_ECR_USER_AWS_SECRET_ACCESS_KEY }}
-          aws-region: us-east-1
-
-      - name: Log in to ECR
-        id: login-ecr
-        uses: aws-actions/amazon-ecr-login@v1
-
-      - name: Build, tag, and push image to Amazon ECR
-        env:
-          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
-          ECR_REPOSITORY: actions-runner
-          IMAGE_TAG: latest
-        run: |
-          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG -f scripts/ci-runner.Dockerfile .
-          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
-
diff --git a/.github/workflows/self-assign-issue.yml b/.github/workflows/self-assign-issue.yml
deleted file mode 100644
index 37522fd57b1b..000000000000
--- a/.github/workflows/self-assign-issue.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-# This workflow runs when a comment is made on the ticket
-# If the comment starts with "assign me" it assigns the author to the
-# ticket (case insensitive)
-
-name: Assign comment author to ticket if they say "assign me"
-on:
-  issue_comment:
-    types: [created]
-
-jobs:
-  self_assign_by_comment:
-    uses: openedx/.github/.github/workflows/self-assign-issue.yml@master
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
deleted file mode 100644
index 704ff778a1b1..000000000000
--- a/.github/workflows/shellcheck.yml
+++ /dev/null
@@ -1,32 +0,0 @@
-# Run ShellCheck on PRs and master
-
-# For more context, see:
-# https://github.com/openedx/.github/blob/master/docs/decisions/0001-shellcheck.rst
-
-name: ShellCheck
-
-on:
-  pull_request:
-  push:
-    branches:
-    - master
-
-permissions:
-  contents: read
-
-jobs:
-  shellcheck:
-    strategy:
-      matrix:
-        os: ["ubuntu", "macos"]
-    uses: openedx/.github/.github/workflows/shellcheck.yml@master
-    with:
-      # For details on the meaning of each of these arguments, see:
-      # https://github.com/openedx/.github/blob/master/.github/workflows/shellcheck.yml
-      # We exclude `./node_modules/*` by default because we want people to easily be able to
-      # copy and run the command locally.  Local copies of most of our services have a `./node_modules`
-      # directory that we want to ignore.
-      exclude-patterns: "./node_modules/*"
-      operating-system: "${{ matrix.os }}"
-      shellcheck-version: "v0.9.0"
-      #shellcheck-options: ""
diff --git a/.github/workflows/static-assets-check.yml b/.github/workflows/static-assets-check.yml
deleted file mode 100644
index 6bc878102e93..000000000000
--- a/.github/workflows/static-assets-check.yml
+++ /dev/null
@@ -1,72 +0,0 @@
-name: static assets check for lms and cms
-
-on:
-  pull_request:
-  push:
-    branches:
-      - master
-
-jobs:
-  static_assets_check:
-    name: static-assets-check
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [ ubuntu-20.04 ]
-        python-version: [ 3.8 ]
-        node-version: [ 16 ]
-        npm-version: [ 8.5.x ]
-
-    steps:
-    - name: Checkout repo
-      uses: actions/checkout@v2
-
-    - name: Setup Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v2
-      with:
-        python-version: ${{ matrix.python-version }}
-
-    - name: Install system Packages
-      run: |
-        sudo apt-get update
-        sudo apt-get install libxmlsec1-dev pkg-config
-
-    - name: Setup Node
-      uses: actions/setup-node@v2
-      with:
-        node-version: ${{ matrix.node-version }}
-
-    - name: Setup npm
-      run: npm i -g npm@${{ matrix.npm-version }}
-
-    - name: Get pip cache dir
-      id: pip-cache-dir
-      run: |
-        echo "::set-output name=dir::$(pip cache dir)"
-
-    - name: Cache pip dependencies
-      id: cache-dependencies
-      uses: actions/cache@v2
-      with:
-        path: ${{ steps.pip-cache-dir.outputs.dir }}
-        key: ${{ runner.os }}-pip-${{ hashFiles('requirements/edx/development.txt') }}
-        restore-keys: ${{ runner.os }}-pip-
-
-    - name: Install Required Python Dependencies
-      run: |
-        make base-requirements
-
-    - name: Initiate Mongo DB Service
-      run: sudo systemctl start mongod
-
-    - name: Add node_modules bin to $Path
-      run: echo $GITHUB_WORKSPACE/node_modules/.bin >> $GITHUB_PATH
-
-    - name: Run Static Assets Check
-      env:
-        LMS_CFG: lms/envs/bok_choy.yml
-        CMS_CFG: cms/envs/bok_choy.yml
-
-      run: |
-        paver update_assets lms
-        paver update_assets cms
diff --git a/.github/workflows/unit-test-shards.json b/.github/workflows/unit-test-shards.json
deleted file mode 100644
index 6be046dfb3dd..000000000000
--- a/.github/workflows/unit-test-shards.json
+++ /dev/null
@@ -1,278 +0,0 @@
-{
-  "lms-1": {
-    "settings": "lms.envs.test",
-    "paths": [
-      "lms/djangoapps/badges/",
-      "lms/djangoapps/branding/",
-      "lms/djangoapps/bulk_email/",
-      "lms/djangoapps/bulk_enroll/",
-      "lms/djangoapps/bulk_user_retirement/",
-      "lms/djangoapps/ccx/",
-      "lms/djangoapps/certificates/",
-      "lms/djangoapps/commerce/"
-    ]
-  },
-  "lms-2": {
-    "settings": "lms.envs.test",
-    "paths": [
-      "lms/djangoapps/course_api/",
-      "lms/djangoapps/course_blocks/",
-      "lms/djangoapps/course_goals/",
-      "lms/djangoapps/course_home_api/",
-      "lms/djangoapps/course_wiki/",
-      "lms/djangoapps/coursewarehistoryextended/",
-      "lms/djangoapps/debug/"
-    ]
-  },
-  "lms-3": {
-    "settings": "lms.envs.test",
-    "paths": [
-      "lms/djangoapps/courseware/"
-    ]
-  },
-  "lms-4": {
-    "settings": "lms.envs.test",
-    "paths": [
-      "lms/djangoapps/discussion/",
-      "lms/djangoapps/edxnotes/",
-      "lms/djangoapps/email_marketing/",
-      "lms/djangoapps/experiments/"
-    ]
-  },
-  "lms-5": {
-    "settings": "lms.envs.test",
-    "paths": [
-      "lms/djangoapps/gating/",
-      "lms/djangoapps/grades/",
-      "lms/djangoapps/instructor/",
-      "lms/djangoapps/instructor_analytics/"
-    ]
-  },
-  "lms-6": {
-    "settings": "lms.envs.test",
-    "paths": [
-      "lms/djangoapps/instructor_task/",
-      "lms/djangoapps/learner_dashboard/",
-      "lms/djangoapps/learner_home/",
-      "lms/djangoapps/learner_recommendations/",
-      "lms/djangoapps/lms_initialization/",
-      "lms/djangoapps/lms_xblock/",
-      "lms/djangoapps/lti_provider/",
-      "lms/djangoapps/mailing/",
-      "lms/djangoapps/mobile_api/",
-      "lms/djangoapps/monitoring/",
-      "lms/djangoapps/ora_staff_grader/",
-      "lms/djangoapps/program_enrollments/",
-      "lms/djangoapps/rss_proxy/",
-      "lms/djangoapps/save_for_later/",
-      "lms/djangoapps/static_template_view/",
-      "lms/djangoapps/staticbook/",
-      "lms/djangoapps/support/",
-      "lms/djangoapps/survey/",
-      "lms/djangoapps/teams/",
-      "lms/djangoapps/tests/",
-      "lms/djangoapps/user_tours/",
-      "lms/djangoapps/verify_student/",
-      "lms/djangoapps/mfe_config_api/",
-      "lms/envs/",
-      "lms/lib/",
-      "lms/tests.py"
-    ]
-  },
-  "openedx-1": {
-    "settings": "lms.envs.test",
-    "paths": [
-      "openedx/core/djangoapps/ace_common/",
-      "openedx/core/djangoapps/cors_csrf/",
-      "openedx/core/djangoapps/agreements/",
-      "openedx/core/djangoapps/api_admin/",
-      "openedx/core/djangoapps/auth_exchange/",
-      "openedx/core/djangoapps/bookmarks/",
-      "openedx/core/djangoapps/cache_toolbox/",
-      "openedx/core/djangoapps/catalog/",
-      "openedx/core/djangoapps/ccxcon/",
-      "openedx/core/djangoapps/commerce/",
-      "openedx/core/djangoapps/common_initialization/",
-      "openedx/core/djangoapps/common_views/",
-      "openedx/core/djangoapps/config_model_utils/",
-      "openedx/core/djangoapps/content/",
-      "openedx/core/djangoapps/content_libraries/",
-      "openedx/core/djangoapps/contentserver/",
-      "openedx/core/djangoapps/cookie_metadata/",
-      "openedx/core/djangoapps/course_apps/",
-      "openedx/core/djangoapps/course_date_signals/",
-      "openedx/core/djangoapps/course_groups/",
-      "openedx/core/djangoapps/courseware_api/",
-      "openedx/core/djangoapps/crawlers/",
-      "openedx/core/djangoapps/credentials/",
-      "openedx/core/djangoapps/credit/",
-      "openedx/core/djangoapps/course_live/",
-      "openedx/core/djangoapps/dark_lang/",
-      "openedx/core/djangoapps/debug/",
-      "openedx/core/djangoapps/demographics/",
-      "openedx/core/djangoapps/discussions/",
-      "openedx/core/djangoapps/django_comment_common/",
-      "openedx/core/djangoapps/embargo/",
-      "openedx/core/djangoapps/enrollments/",
-      "openedx/core/djangoapps/external_user_ids/"
-    ]
-  },
-  "openedx-2": {
-    "settings": "lms.envs.test",
-    "paths": [
-      "openedx/core/djangoapps/geoinfo/",
-      "openedx/core/djangoapps/header_control/",
-      "openedx/core/djangoapps/heartbeat/",
-      "openedx/core/djangoapps/lang_pref/",
-      "openedx/core/djangoapps/models/",
-      "openedx/core/djangoapps/monkey_patch/",
-      "openedx/core/djangoapps/oauth_dispatch/",
-      "openedx/core/djangoapps/olx_rest_api/",
-      "openedx/core/djangoapps/password_policy/",
-      "openedx/core/djangoapps/plugin_api/",
-      "openedx/core/djangoapps/plugins/",
-      "openedx/core/djangoapps/profile_images/",
-      "openedx/core/djangoapps/programs/",
-      "openedx/core/djangoapps/safe_sessions/",
-      "openedx/core/djangoapps/schedules/",
-      "openedx/core/djangoapps/service_status/",
-      "openedx/core/djangoapps/session_inactivity_timeout/",
-      "openedx/core/djangoapps/signals/",
-      "openedx/core/djangoapps/site_configuration/",
-      "openedx/core/djangoapps/system_wide_roles/",
-      "openedx/core/djangoapps/theming/",
-      "openedx/core/djangoapps/user_api/",
-      "openedx/core/djangoapps/user_authn/",
-      "openedx/core/djangoapps/util/",
-      "openedx/core/djangoapps/verified_track_content/",
-      "openedx/core/djangoapps/video_config/",
-      "openedx/core/djangoapps/video_pipeline/",
-      "openedx/core/djangoapps/waffle_utils/",
-      "openedx/core/djangoapps/xblock/",
-      "openedx/core/djangoapps/xmodule_django/",
-      "openedx/core/djangoapps/zendesk_proxy/",
-      "openedx/core/djangolib/",
-      "openedx/core/lib/",
-      "openedx/core/tests/",
-      "openedx/features/",
-      "openedx/testing/",
-      "openedx/tests/"
-    ]
-  },
-  "openedx-3": {
-    "settings": "cms.envs.test",
-    "paths": [
-      "openedx/core/djangoapps/ace_common/",
-      "openedx/core/djangoapps/cors_csrf/",
-      "openedx/core/djangoapps/agreements/",
-      "openedx/core/djangoapps/api_admin/",
-      "openedx/core/djangoapps/auth_exchange/",
-      "openedx/core/djangoapps/bookmarks/",
-      "openedx/core/djangoapps/cache_toolbox/",
-      "openedx/core/djangoapps/catalog/",
-      "openedx/core/djangoapps/ccxcon/",
-      "openedx/core/djangoapps/commerce/",
-      "openedx/core/djangoapps/common_initialization/",
-      "openedx/core/djangoapps/common_views/",
-      "openedx/core/djangoapps/config_model_utils/",
-      "openedx/core/djangoapps/content/",
-      "openedx/core/djangoapps/content_libraries/",
-      "openedx/core/djangoapps/contentserver/",
-      "openedx/core/djangoapps/cookie_metadata/",
-      "openedx/core/djangoapps/course_apps/",
-      "openedx/core/djangoapps/course_date_signals/",
-      "openedx/core/djangoapps/course_groups/",
-      "openedx/core/djangoapps/courseware_api/",
-      "openedx/core/djangoapps/crawlers/",
-      "openedx/core/djangoapps/credentials/",
-      "openedx/core/djangoapps/credit/",
-      "openedx/core/djangoapps/dark_lang/",
-      "openedx/core/djangoapps/debug/",
-      "openedx/core/djangoapps/demographics/",
-      "openedx/core/djangoapps/discussions/",
-      "openedx/core/djangoapps/django_comment_common/",
-      "openedx/core/djangoapps/embargo/",
-      "openedx/core/djangoapps/enrollments/",
-      "openedx/core/djangoapps/external_user_ids/"
-    ]
-  },
-  "openedx-4": {
-    "settings": "cms.envs.test",
-    "paths": [
-      "openedx/core/djangoapps/content_tagging/",
-      "openedx/core/djangoapps/geoinfo/",
-      "openedx/core/djangoapps/header_control/",
-      "openedx/core/djangoapps/heartbeat/",
-      "openedx/core/djangoapps/lang_pref/",
-      "openedx/core/djangoapps/models/",
-      "openedx/core/djangoapps/monkey_patch/",
-      "openedx/core/djangoapps/oauth_dispatch/",
-      "openedx/core/djangoapps/olx_rest_api/",
-      "openedx/core/djangoapps/password_policy/",
-      "openedx/core/djangoapps/plugin_api/",
-      "openedx/core/djangoapps/plugins/",
-      "openedx/core/djangoapps/profile_images/",
-      "openedx/core/djangoapps/programs/",
-      "openedx/core/djangoapps/safe_sessions/",
-      "openedx/core/djangoapps/schedules/",
-      "openedx/core/djangoapps/service_status/",
-      "openedx/core/djangoapps/session_inactivity_timeout/",
-      "openedx/core/djangoapps/signals/",
-      "openedx/core/djangoapps/site_configuration/",
-      "openedx/core/djangoapps/system_wide_roles/",
-      "openedx/core/djangoapps/theming/",
-      "openedx/core/djangoapps/user_api/",
-      "openedx/core/djangoapps/user_authn/",
-      "openedx/core/djangoapps/util/",
-      "openedx/core/djangoapps/verified_track_content/",
-      "openedx/core/djangoapps/video_config/",
-      "openedx/core/djangoapps/video_pipeline/",
-      "openedx/core/djangoapps/waffle_utils/",
-      "openedx/core/djangoapps/xblock/",
-      "openedx/core/djangoapps/xmodule_django/",
-      "openedx/core/djangoapps/zendesk_proxy/",
-      "openedx/core/lib/",
-      "openedx/tests/"
-    ]
-  },
-  "cms-1": {
-    "settings": "cms.envs.test",
-    "paths": [
-      "cms/djangoapps/api/",
-      "cms/djangoapps/cms_user_tasks/",
-      "cms/djangoapps/coursegraph/",
-      "cms/djangoapps/course_creators/",
-      "cms/djangoapps/export_course_metadata/",
-      "cms/djangoapps/maintenance/",
-      "cms/djangoapps/models/",
-      "cms/djangoapps/pipeline_js/",
-      "cms/djangoapps/xblock_config/",
-      "cms/envs/",
-      "cms/lib/"
-    ]
-  },
-  "cms-2": {
-    "settings": "cms.envs.test",
-    "paths": [
-      "cms/djangoapps/contentstore/"
-    ]
-  },
-  "common-1": {
-    "settings": "lms.envs.test",
-    "paths": [
-      "common/djangoapps/"
-    ]
-  },
-  "common-2": {
-    "settings": "cms.envs.test",
-    "paths": [
-      "common/djangoapps/"
-    ]
-  },
-  "xmodule-1": {
-    "settings": "lms.envs.test",
-    "paths": [
-      "xmodule/"
-    ]
-  }
-}
diff --git a/.github/workflows/unit-tests-gh-hosted.yml b/.github/workflows/unit-tests-gh-hosted.yml
deleted file mode 100644
index 80a6a4e53a08..000000000000
--- a/.github/workflows/unit-tests-gh-hosted.yml
+++ /dev/null
@@ -1,122 +0,0 @@
-name: unit-tests-gh-hosted
-
-on:
-  pull_request:
-  push:
-    branches:
-      - master
-      - open-release/lilac.master
-
-jobs:
-  run-test:
-    if: (github.repository != 'openedx/edx-platform' && github.repository != 'edx/edx-platform-private') || (github.repository == 'openedx/edx-platform' && (startsWith(github.base_ref, 'open-release') == true))
-    runs-on: ubuntu-20.04
-    strategy:
-      fail-fast: false
-      matrix:
-        python-version: [ '3.8' ]
-        django-version:
-          - "pinned"
-        # When updating the shards, remember to make the same changes in
-        # .github/workflows/unit-tests.yml
-        shard_name:
-          - "lms-1"
-          - "lms-2"
-          - "lms-3"
-          - "lms-4"
-          - "lms-5"
-          - "lms-6"
-          - "openedx-1"
-          - "openedx-2"
-          - "openedx-3"
-          - "openedx-4"
-          - "cms-1"
-          - "cms-2"
-          - "common-1"
-          - "common-2"
-          - "xmodule-1"
-    name: gh-hosted-python-${{ matrix.python-version }},django-${{ matrix.django-version }},${{ matrix.shard_name }}
-    steps:
-      - uses: actions/checkout@v2
-
-      - name: Install Required System Packages
-        run: sudo apt-get update && sudo apt-get install libxmlsec1-dev lynx
-
-      - name: Start MongoDB
-        uses: supercharge/mongodb-github-action@1.7.0
-        with:
-          mongodb-version: 4.4
-
-      - name: Setup Python
-        uses: actions/setup-python@v2
-        with:
-          python-version: ${{ matrix.python-version }}
-
-      - name: Get pip cache dir
-        id: pip-cache-dir
-        run: |
-          echo "::set-output name=dir::$(pip cache dir)"
-
-      - name: Cache pip dependencies
-        id: cache-dependencies
-        uses: actions/cache@v2
-        with:
-          path: ${{ steps.pip-cache-dir.outputs.dir }}
-          key: ${{ runner.os }}-pip-${{ hashFiles('requirements/edx/testing.txt') }}
-          restore-keys: ${{ runner.os }}-pip-
-
-      - name: Install Required Python Dependencies
-        env:
-          PIP_SRC: ${{ runner.temp }}
-        run: |
-          make test-requirements
-          if [[ "${{ matrix.django-version }}" != "pinned" ]]; then
-            pip install "django~=${{ matrix.django-version }}.0"
-            pip check # fail if this test-reqs/Django combination is broken
-          fi
-
-      - name: Setup and run tests
-        uses: ./.github/actions/unit-tests
-
-  collect-and-verify:
-    if: (github.repository != 'openedx/edx-platform' && github.repository != 'edx/edx-platform-private') || (github.repository == 'openedx/edx-platform' && (startsWith(github.base_ref, 'open-release') == true))
-    runs-on: ubuntu-20.04
-    strategy:
-      matrix:
-        python-version: [ '3.8' ]
-        django-version:
-          - "pinned"
-    steps:
-      - uses: actions/checkout@v2
-
-      - name: Install Required System Packages
-        run: sudo apt-get update && sudo apt-get install libxmlsec1-dev
-
-      - name: Setup Python
-        uses: actions/setup-python@v2
-        with:
-          python-version: ${{ matrix.python-version }}
-
-      - name: Get pip cache dir
-        id: pip-cache-dir
-        run: |
-          echo "::set-output name=dir::$(pip cache dir)"
-
-      - name: Cache pip dependencies
-        id: cache-dependencies
-        uses: actions/cache@v2
-        with:
-          path: ${{ steps.pip-cache-dir.outputs.dir }}
-          key: ${{ runner.os }}-pip-${{ hashFiles('requirements/edx/testing.txt') }}
-          restore-keys: ${{ runner.os }}-pip-
-
-      - name: Install Required Python Dependencies
-        run: |
-          make test-requirements
-          if [[ "${{ matrix.django-version }}" != "pinned" ]]; then
-            pip install "django~=${{ matrix.django-version }}.0"
-            pip check # fail if this test-reqs/Django combination is broken
-          fi
-
-      - name: verify unit tests count
-        uses: ./.github/actions/verify-tests-count
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
deleted file mode 100644
index c66c30d7be6f..000000000000
--- a/.github/workflows/unit-tests.yml
+++ /dev/null
@@ -1,155 +0,0 @@
-name: unit-tests
-
-on:
-  pull_request:
-  push:
-    branches:
-      - master
-
-jobs:
-  run-tests:
-    name: python-${{ matrix.python-version }},django-${{ matrix.django-version }},${{ matrix.shard_name }}
-    if: (github.repository == 'edx/edx-platform-private') || (github.repository == 'openedx/edx-platform' && (startsWith(github.base_ref, 'open-release') == false))
-    runs-on: [ edx-platform-runner ]
-    strategy:
-      matrix:
-        python-version:
-          - "3.8"
-        django-version:
-          - "pinned"
-          #- "4.0"
-        # When updating the shards, remember to make the same changes in
-        # .github/workflows/unit-tests-gh-hosted.yml
-        shard_name:
-          - "lms-1"
-          - "lms-2"
-          - "lms-3"
-          - "lms-4"
-          - "lms-5"
-          - "lms-6"
-          - "openedx-1"
-          - "openedx-2"
-          - "openedx-3"
-          - "openedx-4"
-          - "cms-1"
-          - "cms-2"
-          - "common-1"
-          - "common-2"
-          - "xmodule-1"
-    # We expect Django 4.0 to fail, so don't stop when it fails.
-    continue-on-error: ${{ matrix.django-version == '4.0' }}
-
-    steps:
-      - name: sync directory owner
-        run: sudo chown runner:runner -R .*
-
-      - name: checkout repo
-        uses: actions/checkout@v3
-
-      - name: start mongod server for tests
-        run: |
-          sudo mkdir -p /data/db
-          sudo chmod -R a+rw /data/db
-          mongod &
-
-      - name: install requirements
-        run: |
-          sudo make test-requirements
-          if [[ "${{ matrix.django-version }}" != "pinned" ]]; then
-            sudo pip install "django~=${{ matrix.django-version }}.0"
-            sudo pip check # fail if this test-reqs/Django combination is broken
-          fi
-
-      - name: list installed package versions
-        run: |
-          sudo pip freeze
-
-      - name: Setup and run tests
-        uses: ./.github/actions/unit-tests
-
-      - name: Renaming coverage data file
-        run: |
-          mv reports/.coverage reports/${{ matrix.shard_name }}.coverage
-
-      - name: Upload coverage
-        uses: actions/upload-artifact@v3
-        with:
-          name: coverage
-          path: reports/${{matrix.shard_name}}.coverage
-
-  # This job aggregates test results. It's the required check for branch protection.
-  # https://github.com/marketplace/actions/alls-green#why
-  # https://github.com/orgs/community/discussions/33579
-  success:
-    name: Tests successful
-    if: (github.repository == 'edx/edx-platform-private') || (github.repository == 'openedx/edx-platform' && (startsWith(github.base_ref, 'open-release') == false))
-    needs:
-      - run-tests
-    runs-on: ubuntu-latest
-    steps:
-      - name: Decide whether the needed jobs succeeded or failed
-        # uses: re-actors/alls-green@v1.2.1
-        uses: re-actors/alls-green@13b4244b312e8a314951e03958a2f91519a6a3c9
-        with:
-          jobs: ${{ toJSON(needs) }}
-
-  compile-warnings-report:
-    runs-on: [ edx-platform-runner ]
-    needs: [ run-tests ]
-    steps:
-      - name: sync directory owner
-        run: sudo chown runner:runner -R .*
-      - uses: actions/checkout@v3
-      - name: collect pytest warnings files
-        uses: actions/download-artifact@v2
-        with:
-          name: pytest-warnings-json
-          path: test_root/log
-
-      - name: display structure of downloaded files
-        run: ls -la test_root/log
-
-      - name: compile warnings report
-        run: |
-          python openedx/core/process_warnings.py --dir-path test_root/log --html-path reports/pytest_warnings/warning_report_all.html
-
-      - name: save warning report
-        if: success()
-        uses: actions/upload-artifact@v3
-        with:
-          name: pytest-warning-report-html
-          path: |
-            reports/pytest_warnings/warning_report_all.html
-
-  # Combine and upload coverage reports.
-  coverage:
-    needs: run-tests
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        python-version: [ 3.8 ]
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v3
-
-      - name: Setup Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v4
-        with:
-          python-version: ${{ matrix.python-version }}
-
-      - name: Download all artifacts
-        uses: actions/download-artifact@v3
-        with:
-          name: coverage
-          path: reports
-
-      - name: Install Python dependencies
-        run: |
-          pip install -r requirements/edx/coverage.txt
-
-      - name: Run coverage
-        run: |
-          coverage combine reports/*
-          coverage report
-          coverage xml
-      - uses: codecov/codecov-action@v3
diff --git a/.github/workflows/upgrade-python-requirements.yml b/.github/workflows/upgrade-python-requirements.yml
deleted file mode 100644
index 911c6f0e51da..000000000000
--- a/.github/workflows/upgrade-python-requirements.yml
+++ /dev/null
@@ -1,25 +0,0 @@
-name: Upgrade Requirements
-
-on:
-  schedule:
-     - cron: "0 2 * * 2"
-  workflow_dispatch:
-     inputs:
-       branch:
-         description: 'Target branch to create requirements PR against'
-         required: true
-         default: 'master'
-jobs:
-   call-upgrade-python-requirements-workflow:
-    with:
-       branch: ${{ github.event.inputs.branch }}
-       team_reviewers: "arbi-bom"
-       email_address: arbi-bom@edx.org
-       send_success_notification: false
-    secrets:
-       requirements_bot_github_token: ${{ secrets.REQUIREMENTS_BOT_GITHUB_TOKEN }}
-       requirements_bot_github_email: ${{ secrets.REQUIREMENTS_BOT_GITHUB_EMAIL }}
-       edx_smtp_username: ${{ secrets.EDX_SMTP_USERNAME }}
-       edx_smtp_password: ${{ secrets.EDX_SMTP_PASSWORD }}
-    uses: openedx/.github/.github/workflows/upgrade-python-requirements.yml@master
-
diff --git a/.github/workflows/verify-dunder-init.yml b/.github/workflows/verify-dunder-init.yml
deleted file mode 100644
index aefc0f53b6f5..000000000000
--- a/.github/workflows/verify-dunder-init.yml
+++ /dev/null
@@ -1,26 +0,0 @@
-name: CI
-
-on:
-  pull_request:
-    branches:
-      - master
-
-jobs:
-
-  verify_dunder_init:
-
-    name: Verify __init__.py Files
-    runs-on: ubuntu-20.04
-
-    steps:
-
-    - name: Check out branch
-      uses: actions/checkout@v2
-
-    - name: Ensure git is installed
-      run: |
-        sudo apt-get update && sudo apt-get install git
-
-    - name: Verify __init__.py files exist
-      run: |
-        scripts/verify-dunder-init.sh
diff --git a/.github/workflows/verify-gha-unit-tests-count.yml b/.github/workflows/verify-gha-unit-tests-count.yml
deleted file mode 100644
index c68092942d70..000000000000
--- a/.github/workflows/verify-gha-unit-tests-count.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-name: verify unit tests count
-
-on:
-  pull_request:
-  push:
-    branches:
-      - master
-
-jobs:
-  collect-and-verify:
-    if: (github.repository == 'edx/edx-platform-private') || (github.repository == 'openedx/edx-platform' && (startsWith(github.base_ref, 'open-release') == false))
-    runs-on: [ edx-platform-runner ]
-    steps:
-      - name: sync directory owner
-        run: sudo chown runner:runner -R .*
-
-      - uses: actions/checkout@v2
-      - name: install requirements
-        run: |
-          sudo make test-requirements
-
-      - name: verify unit tests count
-        uses: ./.github/actions/verify-tests-count
diff --git a/lms/djangoapps/course_home_api/tests/test_permissions.py b/lms/djangoapps/course_home_api/tests/test_permissions.py
new file mode 100644
index 000000000000..5edac2f2d3d3
--- /dev/null
+++ b/lms/djangoapps/course_home_api/tests/test_permissions.py
@@ -0,0 +1,70 @@
+"""
+Tests for permissions defined in courseware.rules
+"""
+import ddt
+
+from common.djangoapps.student.roles import OrgStaffRole, CourseStaffRole
+from common.djangoapps.student.tests.factories import UserFactory
+from xmodule.modulestore.tests.django_utils import ModuleStoreTestCase  # lint-amnesty, pylint: disable=wrong-import-order
+from xmodule.modulestore.tests.factories import CourseFactory  # lint-amnesty, pylint: disable=wrong-import-order
+from lms.djangoapps.course_home_api.permissions import CAN_MASQUARADE_LEARNER_PROGRESS
+
+
+@ddt.ddt
+class PermissionTests(ModuleStoreTestCase):
+    """
+    Tests for permissions defined in courseware.rules
+    """
+    def setUp(self):
+        super().setUp()
+        self.user = UserFactory()
+        self.course = CourseFactory(org='org')
+        self.another_course = CourseFactory(org='org')
+
+    def tearDown(self):
+        super().tearDown()
+        self.user.delete()
+
+    @ddt.data(
+        (
+            True, None, None, True,
+            "Global staff users should have masquerade access",
+        ),
+        (
+            False, None, None, False,
+            "Non-staff users shouldn't have masquerade access",
+        ),
+        (
+            False, 'another_org', None, False,
+            "User with staff access on another org shouldn't have masquerade access",
+        ),
+        (
+            False, 'org', None, True,
+            "User with org-wide staff access should have masquerade access",
+        ),
+        (
+            False, None, 'another_course', False,
+            "User with staff access on another course shouldn't have masquerade access",
+        ),
+        (
+            False, None, 'course', True,
+            "User with staff access on the course should have masquerade access",
+        ),
+    )
+    @ddt.unpack
+    def test_can_masquerade_return_value(self, is_staff, org_role, course_role, expected_permission, description):
+        """
+        Test that only authorized users have masquerade access
+        """
+        self.user.is_staff = is_staff
+        self.user.save()
+        assert self.user.is_staff == is_staff
+
+        if org_role:
+            OrgStaffRole(org_role).add_users(self.user)
+
+        if course_role:
+            CourseStaffRole(getattr(self, course_role).id).add_users(self.user)
+
+        has_perm = self.user.has_perm(CAN_MASQUARADE_LEARNER_PROGRESS, self.course.id)
+        assert has_perm == expected_permission, description