Here's a summary of the problem:

• If there is a case where you want to give some users moodle/course:view at site or category level, to allow them basic access to see all courses but not do much else;

• Then there is no way in standard Moodle to give those users 'timed' access to capabilities (e.g. forum moderation) within these courses;

• Because time restrictions are only available on enrolments, and do not apply to role assignments.

The first 'if' is standard usage for staff at this institution. I assume it might also happen for others.

Here's a longer explanation:

In 2.x, the 'timeend' and 'timestart' features were removed from the role_assignments table, and added to the user_enrolments table instead. In other words, supposing you want a student to have access to a course until 1st March, you would do this as follows:

1. Add the Student role assignment for the user on the course.
2. Add a user enrolment for the user on the course, with timeend set to 1st March.

From 1st March, the role assignment will remain but the enrolment will no longer be active. This means the student is not permitted to view the course, so it doesn't matter what roles they have on it.

The problem comes with teachers. At the OU, teachers have access to view ALL courses with some basic permissions (for example they can see the main page and resources, but can't go into forums). In order to achieve this, teachers are given a role at site level which includes the moodle/course:view capability.

Now suppose that a teachers is actually supposed to tutor a course. They will get the Teacher role on that course (which gives them permission to participate in and moderate forums, for instance), and an enrolment on the course. The enrolment will be set to expire at the point when they are no longer tutoring the course.

When this expiry happens, the enrolment stops working as intended. The problem is that this has no effect because unless they have quit working for the us entirely, they will still have the moodle/course:view permission and they still have the Teacherrole on the course.

In Moodle 1.9 this situation worked correctly because it was possible to set timeend and timestart for roles, not just enrolments. As a result, the Teacher role assignment expired, and although the tutor was still able to view the course website (because they have access to view all websites) they lost their Teacher permissions, as expected.

I am not sure how best to solve this problem.