atlas_rb 1.8.6 → 1.8.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c3cb4c5a2d7eb16f4647817a9afc282ce6ebb34d9a8b46c7bfaefa304373317f
-  data.tar.gz: 2524726c4bcc1d24bc0a51f812dde391da066ec5b65540ec3c91d8f37d7d4724
+  metadata.gz: 790f093dac74f6f06ec40f1be385888d0acb3123901f2056b39996ab8050e1ef
+  data.tar.gz: 5137778cc466b711c9862ab661d849b795142429b3507cc3e4a2549c8ccf7813
 SHA512:
-  metadata.gz: 77c312024d884794f49976c38d1cc53ea949db0e1e24f24f016f104158509d219ec0517deb29567176ce5e53a9e971d9ec11996cba4f77fc4fe2050be3965e9a
-  data.tar.gz: e8d194e9632802f871cbd89efb7625a6ca633643f119d4aefaab306aecde4719b098e2e78578f862b190c9d2172a0ada3208976ddb600d6c2a4c8de6bfb413d4
+  metadata.gz: f3244e997c783521e0a86b49cdfe2cd471ad744cca7399d4497d2a250102bb3c51f3f92c6d54b17d6137171baa355fe9f4ff42464565641efbb7fc7e83e489c3
+  data.tar.gz: 676ec01145ceb6773fa6ed13eda23a40949ef1ccaf7e984576fd00988169bdd19ae1710dc7f06f72b48f48165224aa57b585e1d9bdcd74c64038f58cb96f4b05

data/.version

@@ -1 +1 @@
-1.8.6
+1.8.8

data/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## 1.8.8
+
+### Added — type-agnostic current MODS (`Resource.mods`)
+
+New polymorphic wrapper `AtlasRb::Resource.mods(id, kind = nil, …)` for Atlas's
+`GET /resources/:id/mods` — fetch the current descriptive MODS of any Modsable
+resource (Work / Collection / Community) by NOID, without knowing its type.
+Returns the raw response body, mirroring the typed `Work.mods` / `Collection.mods`
+/ `Community.mods`; output is byte-identical to the typed routes. `kind` omitted
+yields the JSON projection (server default); pass `"xml"` for MODS XML.
+
+Collapses the `children → find_many (for klass) → dispatch-by-klass` two-step a
+bulk MODS exporter needed just to pick the typed MODS URL down to one call per
+member. `404` (unknown id / non-Modsable / no MODS) comes back as an empty body.
+
+## 1.8.7
+
+### Added — personal-access token lifecycle (`System::Token.mint` / `.revoke`)
+
+New system-context binding for the `POST /nuid` / `DELETE /nuid` endpoints so a
+host app can mint and revoke a user's personal-access JWT (`ATLAS_JWT`, BYO-JWT
+mode). Both are :system-gated on Atlas ("minting for an arbitrary NUID is
+'become anyone'"), so they authenticate via `FaradayHelper#system_connection`
+(hard-pinned system token + `User: NUID` header) — never the ambient-user
+relay-signing path — mirroring `System::User`.
+
+- `AtlasRb::System::Token.mint(nuid:)` → the JWT (`String`), or `nil` when the
+  NUID has no Atlas User row (404). The token is full-privilege for that user,
+  1-week TTL, single-jti.
+- `AtlasRb::System::Token.revoke(nuid:)` → `true` on success (204), `false` on
+  404. Rotates the user's jti (single-jti model → all outstanding tokens die at
+  once). "Regenerate" is `revoke` followed by a fresh `mint`.
+
+Unblocks Cerberus's "My DRS → Programmatic access" section (generate / regenerate
+/ revoke), gated to the `northeastern:drs:repository:api` Grouper group.
+
 ## 1.8.5
 
 ### Fixed — `find` returns a tombstone (`410`) instead of raising

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    atlas_rb (1.8.6)
+    atlas_rb (1.8.8)
       faraday (~> 2.7)
       faraday-follow_redirects (~> 0.3.0)
       faraday-multipart (~> 1)

data/lib/atlas_rb/resource.rb

@@ -170,6 +170,38 @@ module AtlasRb
       ))
     end
 
+    # Fetch the CURRENT MODS of any Modsable resource by NOID — the polymorphic
+    # sibling of {Work.mods} / {Collection.mods} / {Community.mods}. Wraps
+    # `GET /resources/<id>/mods[.kind]` and returns the **raw response body**
+    # (not parsed), mirroring the typed wrappers. Lets a caller holding only a
+    # NOID (no type) fetch descriptive MODS in one call, instead of resolving
+    # the klass first to pick the typed route — e.g. a bulk Collection/Set MODS
+    # export that has bare member NOIDs from {Collection.children}.
+    #
+    # @param id [String] an Atlas resource ID (NOID).
+    # @param kind [String, nil] response-format extension: omit for the JSON
+    #   projection (the server default), or pass `"xml"` for MODS XML (`"json"`
+    #   / `"html"` also accepted). Output is byte-identical to the typed route
+    #   for the resolved type.
+    # @param nuid [String, nil] optional acting user's NUID. On the relay-signing
+    #   path it is signed into the assertion `sub`; on the BYO-JWT (`ATLAS_JWT`)
+    #   path it is ignored (identity lives in the token).
+    # @param on_behalf_of [String, nil] optional NUID for the `On-Behalf-Of`
+    #   header. Falls through to {AtlasRb.config}.default_on_behalf_of when omitted.
+    # @return [String, nil] the raw MODS body (XML or JSON per `kind`). The
+    #   server returns `404` (empty body) for an unknown id, a non-Modsable
+    #   resource, or one with no MODS.
+    #
+    # @example Bulk-export a Set's members' MODS without klass dispatch
+    #   AtlasRb::Collection.children(set_id).each do |noid|
+    #     xml = AtlasRb::Resource.mods(noid, "xml")
+    #   end
+    def self.mods(id, kind = nil, nuid: nil, on_behalf_of: nil)
+      connection({}, nuid, on_behalf_of: on_behalf_of).get(
+        '/resources/' + id + '/mods' + (kind.present? ? ".#{kind}" : '')
+      )&.body
+    end
+
     # List the retained MODS versions for a resource.
     #
     # Wraps Atlas's `GET /resources/<id>/mods/versions`, which returns the

data/lib/atlas_rb/system/token.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module AtlasRb
+  module System
+    # Personal-access token lifecycle — mint and revoke the 1-week JWT a real
+    # person exports as `ATLAS_JWT` to drive atlas_rb / curl against Atlas
+    # headless (BYO-JWT mode, see {AtlasRb::FaradayHelper}). Cerberus's "My DRS
+    # → Programmatic access" section calls these post-SSO and hands the token
+    # to the librarian; the token is never persisted by Cerberus.
+    #
+    # ## Why a separate class from {System::User}
+    #
+    # Token lifecycle is a distinct concern from SSO user provisioning: minting
+    # a bearer credential for someone is "become anyone," which is exactly why
+    # both Atlas endpoints are :system-gated (`authorize! :mint_token, User`).
+    # Keeping it in its own class keeps that carve-out legible rather than
+    # burying it among provisioning methods.
+    #
+    # Both methods authenticate via {FaradayHelper#system_connection} — the
+    # hard-pinned system token + `User: NUID` header — so there is no way to
+    # issue them as a regular user. This is never the ambient-user
+    # relay-signing path.
+    class Token
+      extend AtlasRb::FaradayHelper
+
+      # Mint a personal-access JWT for a real person (`POST /nuid`).
+      # System-gated. The returned token authenticates as `nuid` in BYO-JWT
+      # mode (Atlas resolves identity from the token's `sub`, ignores any
+      # `User:` / `On-Behalf-Of` header, and refuses `:system`/`:anonymous`).
+      # Full-privilege for that user, 1-week TTL, single-jti.
+      #
+      # @param nuid [String] the NUID the token will act as.
+      # @return [String, nil] the JWT, or nil when the NUID has no Atlas User
+      #   row (404) — a clean "no such user" signal for the caller to surface.
+      def self.mint(nuid:)
+        response = system_connection.post("/nuid", { nuid: nuid }.to_json)
+        return nil if response.status == 404
+
+        AtlasRb::Mash.new(JSON.parse(response.body))["token"]
+      end
+
+      # Revoke every outstanding token for a user (`DELETE /nuid`) by rotating
+      # its jti. System-gated. Single-jti model → all-or-nothing: every token
+      # the user holds dies at once. "Regenerate" on the Cerberus side is
+      # {.revoke} followed by a fresh {.mint}.
+      #
+      # The NUID rides as a query param (`system_connection`'s params hash) so
+      # this sidesteps DELETE-with-body handling; Atlas reads it from
+      # `params[:nuid]` either way.
+      #
+      # @param nuid [String] the NUID whose tokens to invalidate.
+      # @return [Boolean] true on success (204), false when the NUID has no
+      #   Atlas User row (404).
+      def self.revoke(nuid:)
+        system_connection({ nuid: nuid }).delete("/nuid").status == 204
+      end
+    end
+  end
+end

data/lib/atlas_rb.rb

@@ -30,6 +30,7 @@ require_relative "atlas_rb/admin/collection"
 require_relative "atlas_rb/admin/community"
 require_relative "atlas_rb/system"
 require_relative "atlas_rb/system/user"
+require_relative "atlas_rb/system/token"
 require_relative "atlas_rb/audit_event"
 
 # Ruby client for the Atlas API — Northeastern University's institutional

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: atlas_rb
 version: !ruby/object:Gem::Version
-  version: 1.8.6
+  version: 1.8.8
 platform: ruby
 authors:
 - David Cliff
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-07-03 00:00:00.000000000 Z
+date: 2026-07-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -150,6 +150,7 @@ files:
 - lib/atlas_rb/person.rb
 - lib/atlas_rb/resource.rb
 - lib/atlas_rb/system.rb
+- lib/atlas_rb/system/token.rb
 - lib/atlas_rb/system/user.rb
 - lib/atlas_rb/user.rb
 - lib/atlas_rb/version.rb