feat: add filters to support logistration integration

[pwnage101]

• Added new authentication architecture subdomain, and ADR to explain why it is needed.
• Added six new authentication-related filters:
  • LogistrationViewContextGenerated
  • AuthnMFEContextGenerated
  • LoginAltRedirectURLRequested
  • LoginFormGenerated
  • RegistrationFormGenerated
  • LogistrationViewRenderCompleted
• Added several new structural types:
  • FormDescriptionProtocol - declares the minimal surface the form filters pass to pipeline steps.
  • ProviderConfigProtocol - declares the minimal surface of the third-party auth provider configuration that the form filters pass to pipeline steps.
  • RunningPipeline - authentication pipeline state.

ENT-11568

---

Integration Testing

See openedx/edx-enterprise#2551 (comment)

---

Related:

• feat: add multiple SSO tenants during devstack provisioning edx-enterprise#2662
• feat: add filters to support logistration integration #337
• feat: add pipeline steps for logistration filters edx-enterprise#2551
• feat: replace enterprise logistration logic with openedx-filters hooks edx/edx-platform#407
• feat: replace enterprise logistration logic with openedx-filters hooks openedx-platform#38105
• fix: Finally replace awkward one-liner to create system-wide enterprise role assignments edx/devstack#227

[Copilot]

Pull request overview

This PR extends the openedx_filters.learning public filter surface to support “logistration” (combined login/registration) and related auth flows, aligning the filters library with new integration points in edx-platform/enterprise.

Changes:

• Added six new learning filters for logistration context/response customization, MFE redirect control, post-login redirect override, and TPA form overrides.
• Added two structural Protocol types (FormDescriptionProtocol, ProviderConfigProtocol) to document the minimal interface passed to pipeline steps.
• Added/updated test coverage for the new filters, and bumped package version + changelog entry.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
openedx_filters/learning/filters.py	Adds new logistration/auth-related filters and protocol structural types.
openedx_filters/learning/tests/test_filters.py	Adds unit tests validating new filters’ filter_type values and passthrough/exception behavior.
openedx_filters/init.py	Bumps package version to 3.9.0.
CHANGELOG.rst	Adds a 3.9.0 changelog entry describing the new filters and protocols.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[iloveagent57]

Looks good, one small suggestion to DRY things up a tiny bit.

[pwnage101]

@felipemontoya or @feanil could use one of your eyes on this big one.

The full ADR may be the best way to catch up, and there's a diagram in there too: https://github.com/openedx/edx-enterprise/blob/abd13d1be582e5c51f57373608d67032c96d4056/docs/decisions/0016-logistration-filters.md

[felipemontoya]

I think this work is good and overall very needed in the login/registration extensibility story. Thanks for putting this together @pwnage101. Now that I understand the context, new review should be quicker.

[pwnage101]

@felipemontoya Awesome feedback! I just updated this PR to incorporate all of your feedback, with the exception of one:

I opted not to create a consolidated ContextGenerated filter. The reality of the two "context" dictionaries is that the shape differs between the legacy template context and the AuthN MFE context, so their processing cannot be safely collapsed under one filter. With extra work on the MFE, we could bring the two context dicts into alignment, but that is out of scope.

But, that did make me realize that I was completely missing an AuthnMFEContextGenerated filter, so I added that.

Additionally I created a new architecture subdomain called "Authentication", and added a new ADR (0008) to justify it.

Here's a quick overview of the 6 new authentication filters, plus the 2 pre-existing ones which still live under the "Learning" subdomain:

Class	Type
LogistrationViewContextGenerated	org.openedx.authentication.logistration_view.context.generated.v1
LogistrationViewRenderCompleted	org.openedx.authentication.logistration_view.render.completed.v1
AuthnMFEContextGenerated	org.openedx.authentication.mfe.context.generated.v1
LoginFormGenerated	org.openedx.authentication.login.form.generated.v1
RegistrationFormGenerated	org.openedx.authentication.registration.form.generated.v1
LoginAltRedirectURLRequested	org.openedx.authentication.login.alt_redirect_url.requested.v1
StudentRegistrationRequested	org.openedx.learning.student.registration.requested.v1
StudentLoginRequested	org.openedx.learning.student.login.requested.v1

For the platform reference, you'll need to refer to edx/edx-platform#407

[pwnage101]

markdown support for docs is needed because on Github only markdown supports mermaid rendering.

[felipemontoya]

@mariajgrimaldi this makes sense to me, but I'll like to know your thoughs. Should this mean that we also add a similar subdomain in events?

[ssurendrannair]

Approved — Looks good to me.
One suggestion for follow-up: consider adding negative-path tests for malformed or unexpected filter outputs. Since these filters are extension points in the authentication flow, validating failure scenarios would strengthen the contract and help catch regressions as new implementations are added.

[felipemontoya]

Thanks for all the work @pwnage101 writing and refactoring after review. I think this PR has reached a very good form now.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 19 changed files in this pull request and generated 2 comments.

Suppressed comments (2)

openedx_filters/filters.py:62

• The pipeline runner treats any non-dict return value (including custom sentinel objects) as a signal to stop execution (OpenEdxPublicFilter.run_pipeline checks isinstance(result, dict)). However, PipelineStep.run_filter is annotated as returning only dict[str, Any] | None, which conflicts with the documented “object different from a dict” return and will cause type checkers to flag legitimate pipeline-step implementations.

    # The explicit ``return None`` below is required by static type checkers, which treat an
    # implicit fall-through as a missing return whenever a return type is annotated.
    def run_filter(  # pylint: disable=useless-return
        self, *args: Any, **kwargs: Any,
    ) -> dict[str, Any] | None:

openedx_filters/authentication/types.py:90

• PR description says only one new structural type (FormDescriptionProtocol), but this PR also introduces ProviderConfigProtocol in the same module. Please update the PR description (or reconcile the scope) so it matches the shipped public surface.

class ProviderConfigProtocol(Protocol):
    """
    Structural interface of the third-party auth provider configuration.

    Only the minimal surface consumed by pipeline steps is declared here. Pipeline steps