Three levels of user permissions for content libraries:

Admin ("Instructor") - Can edit and assign permissions to other users
Normal ("Staff") - Can edit
User - Can view the library and use content from it but cannot edit it or its blocks.

common/djangoapps/student/auth.py

@@ -6,9 +6,10 @@ to decide whether to check course creator role, and other such functions.
 """
 from django.core.exceptions import PermissionDenied
 from django.conf import settings
+from opaque_keys.edx.locator import LibraryLocator
 
 from student.roles import GlobalStaff, CourseCreatorRole, CourseStaffRole, CourseInstructorRole, CourseRole, \
-    CourseBetaTesterRole, OrgInstructorRole, OrgStaffRole
+    CourseBetaTesterRole, OrgInstructorRole, OrgStaffRole, LibraryUserRole, OrgLibraryUserRole
 
 
 def has_access(user, role):
@@ -40,9 +41,9 @@ def has_access(user, role):
     return False
 
 
-def has_course_author_access(user, course_key, role=CourseStaffRole):
+def has_studio_write_access(user, course_key, role=CourseStaffRole):
     """
-    Return True if user has studio (write) access to the given course.
+    Return True if user has studio write access to the given course.
     Note that the CMS permissions model is with respect to courses.
     There is a super-admin permissions if user.is_staff is set.
     Also, since we're unifying the user database between LMS and CAS,
@@ -64,6 +65,30 @@ def has_course_author_access(user, course_key, role=CourseStaffRole):
     return has_access(user, role(course_key.for_branch(None)))
 
 
+def has_course_author_access(*args, **kwargs):
+    """
+    Old name for has_studio_author_access
+    """
+    return has_studio_read_access(*args, **kwargs)
+
+
+def has_studio_read_access(user, course_key):
+    """
+    Return True iff user is allowed to view this course/library in studio.
+    Will also return True if user has write access in studio (has_course_author_access)
+
+    There is currently no such thing as read-only course access in studio, but
+    there is read-only access to content libraries.
+    """
+    if has_studio_write_access(user, course_key):
+        return True  # Global, Org, or Course "Instructors" and "Staff" can read and write
+    if isinstance(course_key, LibraryLocator):
+        if OrgLibraryUserRole(org=course_key.org).has_user(user):
+            return True  # User has read-only access to all libraries in this organization
+        return LibraryUserRole(course_key.for_branch(None)).has_user(user)  # User has read-only access this library
+    return False
+
+
 def add_users(caller, role, *users):
     """
     The caller requests adding the given users to the role. Checks that the caller

common/djangoapps/student/roles.py

@@ -219,6 +219,17 @@ class CourseBetaTesterRole(CourseRole):
         super(CourseBetaTesterRole, self).__init__(self.ROLE, *args, **kwargs)
 
 
+class LibraryUserRole(CourseRole):
+    """
+    A user who can view a library and import content from it, but not edit it.
+    Used in Studio only.
+    """
+    ROLE = 'library_user'
+
+    def __init__(self, *args, **kwargs):
+        super(LibraryUserRole, self).__init__(self.ROLE, *args, **kwargs)
+
+
 class OrgStaffRole(OrgRole):
     """An organization staff member"""
     def __init__(self, *args, **kwargs):
@@ -231,6 +242,17 @@ class OrgInstructorRole(OrgRole):
         super(OrgInstructorRole, self).__init__('instructor', *args, **kwargs)
 
 
+class OrgLibraryUserRole(OrgRole):
+    """
+    A user who can view any libraries in an org and import content from them, but not edit them.
+    Used in Studio only.
+    """
+    ROLE = LibraryUserRole.ROLE
+
+    def __init__(self, *args, **kwargs):
+        super(OrgLibraryUserRole, self).__init__(self.ROLE, *args, **kwargs)
+
+
 class CourseCreatorRole(RoleBase):
     """
     This is the group of people who have permission to create new courses (we may want to eventually