It would be beneficial to create dedicated context levels so that management and assignment permissions can be deleted for particular cohorts instead of all cohorts in a category and subcategories.

Implementation

The view permissions should be kept at the system/category/course cohort because it is already complicated enough and it would be better to improve it later in a separate issue.

While implemented this patch and adding new test coverage I have found and fixed a few related bugs:

• external API for adding and removing cohort members was incorrectly allowing operation with moodle/cohort:manage instead of only moodle/cohort:assign
• the inline editing of idnumbers did not check for duplicates, empty cohort idnumber was using both null and empty string - solution was to add unique database index and appropriate duplicate checks into low level APIs

Changes for end users

There is a new 3rd level navigation when editing cohort details with links to role assignments and permissions in new cohort context - only moodle/cohort:manage and moodle/assign permissions are compatible with the new cohort context.

Changes for developers

To get context for management of cohort use this code:

$cohortcontext = \context_cohort::instance($cohort->id);