blacklight-access_controls 0.1.0

data/lib/blacklight/access_controls/enforcement.rb

@@ -0,0 +1,103 @@
+module Blacklight
+  module AccessControls
+    module Enforcement
+      extend ActiveSupport::Concern
+
+      included do
+        attr_writer :current_ability
+        class_attribute :solr_access_filters_logic
+
+        # Set defaults. Each symbol identifies a _method_ that must be in
+        # this class, taking one parameter (permission_types)
+        # Can be changed in local apps or by plugins, eg:
+        # CatalogController.include ModuleDefiningNewMethod
+        # CatalogController.solr_access_filters_logic += [:new_method]
+        # CatalogController.solr_access_filters_logic.delete(:we_dont_want)
+        self.solr_access_filters_logic = [:apply_group_permissions, :apply_user_permissions]
+
+        # Apply appropriate access controls to all solr queries
+        self.default_processor_chain += [:add_access_controls_to_solr_params] if respond_to?(:default_processor_chain)
+      end
+
+      def current_ability
+        @current_ability || raise("current_ability has not been set on #{self}")
+      end
+
+      protected
+
+      def gated_discovery_filters(permission_types = discovery_permissions, ability = current_ability)
+        user_access_filters = []
+
+        # Grant access based on user id & group
+        solr_access_filters_logic.each do |method_name|
+          user_access_filters += send(method_name, permission_types, ability)
+        end
+        user_access_filters
+      end
+
+      #
+      # Solr query modifications
+      #
+
+      # Set solr_parameters to enforce appropriate permissions
+      # * Applies a lucene query to the solr :q parameter for gated discovery
+      # * Uses public_qt search handler if user does not have "read" permissions
+      # @param solr_parameters the current solr parameters
+      def add_access_controls_to_solr_params(solr_parameters)
+        apply_gated_discovery(solr_parameters)
+      end
+
+      # Which permission levels (logical OR) will grant you the ability to discover documents in a search.
+      # Override this method if you want it to be something other than the default
+      def discovery_permissions
+        @discovery_permissions ||= ["discover","read"]
+      end
+      def discovery_permissions= (permissions)
+        @discovery_permissions = permissions
+      end
+
+      # Controller before filter that sets up access-controlled lucene query in order to provide gated discovery behavior
+      # @param solr_parameters the current solr parameters
+      def apply_gated_discovery(solr_parameters)
+        solr_parameters[:fq] ||= []
+        solr_parameters[:fq] << gated_discovery_filters.join(" OR ")
+        Rails.logger.debug("Solr parameters: #{ solr_parameters.inspect }")
+      end
+
+      def apply_group_permissions(permission_types, ability = current_ability)
+        # for groups
+        user_access_filters = []
+        ability.user_groups.each_with_index do |group, i|
+          permission_types.each do |type|
+            user_access_filters << escape_filter(solr_field_for(type, 'group'), group)
+          end
+        end
+        user_access_filters
+      end
+
+      def apply_user_permissions(permission_types, ability = current_ability)
+        # for individual user access
+        user_access_filters = []
+        user = ability.current_user
+        if user && user.user_key.present?
+          permission_types.each do |type|
+            user_access_filters << escape_filter(solr_field_for(type, 'user'), user.user_key)
+          end
+        end
+        user_access_filters
+      end
+
+      # Find the name of the solr field for this type of permission.
+      # e.g. "read_access_group_ssim" or "discover_access_person_ssim".
+      def solr_field_for(permission_type, permission_category)
+        method_name = "#{permission_type}_#{permission_category}_field".to_sym
+        Blacklight::AccessControls.config.send(method_name)
+      end
+
+      def escape_filter(key, value)
+        [key, value.gsub(/[ :\/]/, ' ' => '\ ', '/' => '\/', ':' => '\:')].join(':')
+      end
+
+    end
+  end
+end

data/lib/blacklight/access_controls/permissions_cache.rb

@@ -0,0 +1,19 @@
+class Blacklight::AccessControls::PermissionsCache
+
+  def initialize
+    clear 
+  end
+
+  def get(pid)
+    @cache[pid]
+  end
+
+  def put(pid, doc)
+    @cache[pid] = doc 
+  end
+
+  def clear
+    @cache = {}
+  end
+
+end

data/lib/blacklight/access_controls/permissions_query.rb

@@ -0,0 +1,53 @@
+module Blacklight::AccessControls
+  module PermissionsQuery
+    extend ActiveSupport::Concern
+
+    def permissions_doc(pid)
+      doc = cache.get(pid)
+      unless doc
+        doc = get_permissions_solr_response_for_doc_id(pid)
+        cache.put(pid, doc)
+      end
+      doc
+    end
+
+    def permissions_document_class
+      Blacklight::AccessControls::PermissionsSolrDocument
+    end
+
+    protected
+
+    # a solr query method
+    # retrieve a solr document, given the doc id
+    # Modeled on Blacklight::SolrHelper.get_permissions_solr_response_for_doc_id
+    # @param [String] id of the documetn to retrieve
+    # @param [Hash] extra_controller_params (optional)
+    def get_permissions_solr_response_for_doc_id(id=nil, extra_controller_params={})
+      raise Blacklight::Exceptions::InvalidSolrID.new("The application is trying to retrieve permissions without specifying an asset id") if id.nil?
+      solr_opts = permissions_solr_doc_params(id).merge(extra_controller_params)
+      response = Blacklight.default_index.connection.get('select', :params=> solr_opts)
+      solr_response = Blacklight::Solr::Response.new(response, solr_opts)
+
+      raise Blacklight::Exceptions::InvalidSolrID.new("The solr permissions search handler didn't return anything for id \"#{id}\"") if solr_response.docs.empty?
+      permissions_document_class.new(solr_response.docs.first, solr_response)
+    end
+
+    #
+    #  Solr integration
+    #
+
+    # returns a params hash with the permissions info for a single solr document
+    # If the id arg is nil, then the value is fetched from params[:id]
+    # This method is primary called by the get_permissions_solr_response_for_doc_id method.
+    # Modeled on Blacklight::SolrHelper.solr_doc_params
+    # @param [String] id of the documetn to retrieve
+    def permissions_solr_doc_params(id=nil)
+      id ||= params[:id]
+      # just to be consistent with the other solr param methods:
+      {
+        :qt => :permissions,
+        :id => id # this assumes the document request handler will map the 'id' param to the unique key field
+      }
+    end
+  end    
+end

data/lib/blacklight/access_controls/permissions_solr_document.rb

@@ -0,0 +1,2 @@
+class Blacklight::AccessControls::PermissionsSolrDocument < SolrDocument
+end

data/lib/blacklight/access_controls/user.rb

@@ -0,0 +1,23 @@
+# Injects behaviors into User model so that it will work with
+# Blacklight Access Controls.  By default, this module assumes
+# you are using the User model created by Blacklight, which uses
+# Devise.
+# To integrate your own User implementation into Blacklight,
+# override this module or define your own User model in
+# app/models/user.rb within your Blacklight application.
+
+module Blacklight
+  module AccessControls
+    module User
+      extend ActiveSupport::Concern
+
+      # This method should display the unique identifier for
+      # this user as defined by devise.  The unique identifier
+      # is what access controls will be enforced against.
+      def user_key
+        send(Devise.authentication_keys.first)
+      end
+
+    end
+  end
+end

data/lib/generators/blacklight/ability.rb

@@ -0,0 +1,4 @@
+class Ability
+  include CanCan::Ability
+  include Blacklight::AccessControls::Ability
+end

data/lib/generators/blacklight/access_controls_generator.rb

@@ -0,0 +1,49 @@
+module Blacklight
+  class AccessControlsGenerator < Rails::Generators::Base
+
+    desc "This generator makes the following changes to your application:
+
+1. Includes Blacklight::AccessControls::User in the User class.
+2. Includes Blacklight::AccessControls::Enforcement in the SearchBuilder class.
+3. Adds access controls to CatalogController.
+4. Adds Ability class."
+
+
+    source_root File.expand_path("..", __FILE__)
+
+    def add_access_controls_to_user
+      say_status('status', 'ADD ACCESS CONTROLS TO USER', :yellow)
+      insert_into_file 'app/models/user.rb',
+        "  include Blacklight::AccessControls::User\n\n",
+        after: "include Blacklight::User\n"
+    end
+
+    def add_access_controls_to_search_builder
+      say_status('status', 'ADDING ACCESS CONTROLS TO SEARCH BUILDER', :yellow)
+      insert_into_file 'app/models/search_builder.rb',
+        "  include Blacklight::AccessControls::Enforcement\n",
+        before: "end"
+    end
+
+    def add_access_controls_to_catalog_controller
+      say_status('status', 'ADDING ACCESS CONTROLS TO CATALOG CONTROLLER', :yellow)
+
+      string_to_insert = <<-EOS
+  include Blacklight::AccessControls::Catalog
+
+  # Apply the blacklight-access_controls
+  before_filter :enforce_show_permissions, only: :show
+
+      EOS
+
+      insert_into_file 'app/controllers/catalog_controller.rb',
+        string_to_insert, after: "include Blacklight::Catalog\n"
+    end
+
+    def add_cancan_ability
+      say_status('status', 'ADDING CANCAN ABILITY', :yellow)
+      copy_file 'ability.rb', 'app/models/ability.rb'
+    end
+
+  end
+end

data/solr_conf/conf/admin-extra.html

@@ -0,0 +1,24 @@
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+<!-- The content of this page will be statically included into the top-
+right box of the cores overview page. Uncomment this as an example to 
+see there the content will show up.
+
+<img src="img/ico/construction.png"> This line will appear at the top-
+right box on collection1's Overview
+-->

data/solr_conf/conf/admin-extra.menu-bottom.html

@@ -0,0 +1,25 @@
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+<!-- admin-extra.menu-bottom.html -->
+<!--
+<li>
+  <a href="#" style="background-image: url(img/ico/construction.png);">
+    LAST ITEM
+  </a>
+</li>
+-->

data/solr_conf/conf/admin-extra.menu-top.html

@@ -0,0 +1,25 @@
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+<!-- admin-extra.menu-top.html -->
+<!--
+<li>
+  <a href="#" style="background-image: url(img/ico/construction.png);">
+    FIRST ITEM
+  </a>
+</li>
+-->

data/solr_conf/conf/clustering/carrot2/kmeans-attributes.xml

@@ -0,0 +1,19 @@
+<!-- 
+  Default configuration for the bisecting k-means clustering algorithm.
+  
+  This file can be loaded (and saved) by Carrot2 Workbench.
+  http://project.carrot2.org/download.html
+-->
+<attribute-sets default="attributes">
+    <attribute-set id="attributes">
+      <value-set>
+        <label>attributes</label>
+          <attribute key="MultilingualClustering.defaultLanguage">
+            <value type="org.carrot2.core.LanguageCode" value="ENGLISH"/>
+          </attribute>
+          <attribute key="MultilingualClustering.languageAggregationStrategy">
+            <value type="org.carrot2.text.clustering.MultilingualClustering$LanguageAggregationStrategy" value="FLATTEN_MAJOR_LANGUAGE"/>
+          </attribute>
+      </value-set>
+  </attribute-set>
+</attribute-sets>

data/solr_conf/conf/clustering/carrot2/lingo-attributes.xml

@@ -0,0 +1,24 @@
+<!-- 
+  Default configuration for the Lingo clustering algorithm.
+
+  This file can be loaded (and saved) by Carrot2 Workbench.
+  http://project.carrot2.org/download.html
+-->
+<attribute-sets default="attributes">
+    <attribute-set id="attributes">
+      <value-set>
+        <label>attributes</label>
+          <!-- 
+          The language to assume for clustered documents.
+          For a list of allowed values, see: 
+          http://download.carrot2.org/stable/manual/#section.attribute.lingo.MultilingualClustering.defaultLanguage
+          -->
+          <attribute key="MultilingualClustering.defaultLanguage">
+            <value type="org.carrot2.core.LanguageCode" value="ENGLISH"/>
+          </attribute>
+          <attribute key="LingoClusteringAlgorithm.desiredClusterCountBase">
+            <value type="java.lang.Integer" value="20"/>
+          </attribute>
+      </value-set>
+  </attribute-set>
+</attribute-sets>

data/solr_conf/conf/clustering/carrot2/stc-attributes.xml

@@ -0,0 +1,19 @@
+<!-- 
+  Default configuration for the STC clustering algorithm.
+
+  This file can be loaded (and saved) by Carrot2 Workbench.
+  http://project.carrot2.org/download.html
+-->
+<attribute-sets default="attributes">
+    <attribute-set id="attributes">
+      <value-set>
+        <label>attributes</label>
+          <attribute key="MultilingualClustering.defaultLanguage">
+            <value type="org.carrot2.core.LanguageCode" value="ENGLISH"/>
+          </attribute>
+          <attribute key="MultilingualClustering.languageAggregationStrategy">
+            <value type="org.carrot2.text.clustering.MultilingualClustering$LanguageAggregationStrategy" value="FLATTEN_MAJOR_LANGUAGE"/>
+          </attribute>
+      </value-set>
+  </attribute-set>
+</attribute-sets>

data/solr_conf/conf/currency.xml

@@ -0,0 +1,67 @@
+<?xml version="1.0" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+<!-- Example exchange rates file for CurrencyField type named "currency" in example schema -->
+
+<currencyConfig version="1.0">
+  <rates>
+    <!-- Updated from http://www.exchangerate.com/ at 2011-09-27 -->
+    <rate from="USD" to="ARS" rate="4.333871" comment="ARGENTINA Peso" />
+    <rate from="USD" to="AUD" rate="1.025768" comment="AUSTRALIA Dollar" />
+    <rate from="USD" to="EUR" rate="0.743676" comment="European Euro" />
+    <rate from="USD" to="BRL" rate="1.881093" comment="BRAZIL Real" />
+    <rate from="USD" to="CAD" rate="1.030815" comment="CANADA Dollar" />
+    <rate from="USD" to="CLP" rate="519.0996" comment="CHILE Peso" />
+    <rate from="USD" to="CNY" rate="6.387310" comment="CHINA Yuan" />
+    <rate from="USD" to="CZK" rate="18.47134" comment="CZECH REP. Koruna" />
+    <rate from="USD" to="DKK" rate="5.515436" comment="DENMARK Krone" />
+    <rate from="USD" to="HKD" rate="7.801922" comment="HONG KONG Dollar" />
+    <rate from="USD" to="HUF" rate="215.6169" comment="HUNGARY Forint" />
+    <rate from="USD" to="ISK" rate="118.1280" comment="ICELAND Krona" />
+    <rate from="USD" to="INR" rate="49.49088" comment="INDIA Rupee" />
+    <rate from="USD" to="XDR" rate="0.641358" comment="INTNL MON. FUND SDR" />
+    <rate from="USD" to="ILS" rate="3.709739" comment="ISRAEL Sheqel" />
+    <rate from="USD" to="JPY" rate="76.32419" comment="JAPAN Yen" />
+    <rate from="USD" to="KRW" rate="1169.173" comment="KOREA (SOUTH) Won" />
+    <rate from="USD" to="KWD" rate="0.275142" comment="KUWAIT Dinar" />
+    <rate from="USD" to="MXN" rate="13.85895" comment="MEXICO Peso" />
+    <rate from="USD" to="NZD" rate="1.285159" comment="NEW ZEALAND Dollar" />
+    <rate from="USD" to="NOK" rate="5.859035" comment="NORWAY Krone" />
+    <rate from="USD" to="PKR" rate="87.57007" comment="PAKISTAN Rupee" />
+    <rate from="USD" to="PEN" rate="2.730683" comment="PERU Sol" />
+    <rate from="USD" to="PHP" rate="43.62039" comment="PHILIPPINES Peso" />
+    <rate from="USD" to="PLN" rate="3.310139" comment="POLAND Zloty" />
+    <rate from="USD" to="RON" rate="3.100932" comment="ROMANIA Leu" />
+    <rate from="USD" to="RUB" rate="32.14663" comment="RUSSIA Ruble" />
+    <rate from="USD" to="SAR" rate="3.750465" comment="SAUDI ARABIA Riyal" />
+    <rate from="USD" to="SGD" rate="1.299352" comment="SINGAPORE Dollar" />
+    <rate from="USD" to="ZAR" rate="8.329761" comment="SOUTH AFRICA Rand" />
+    <rate from="USD" to="SEK" rate="6.883442" comment="SWEDEN Krona" />
+    <rate from="USD" to="CHF" rate="0.906035" comment="SWITZERLAND Franc" />
+    <rate from="USD" to="TWD" rate="30.40283" comment="TAIWAN Dollar" />
+    <rate from="USD" to="THB" rate="30.89487" comment="THAILAND Baht" />
+    <rate from="USD" to="AED" rate="3.672955" comment="U.A.E. Dirham" />
+    <rate from="USD" to="UAH" rate="7.988582" comment="UKRAINE Hryvnia" />
+    <rate from="USD" to="GBP" rate="0.647910" comment="UNITED KINGDOM Pound" />
+    
+    <!-- Cross-rates for some common currencies -->
+    <rate from="EUR" to="GBP" rate="0.869914" />  
+    <rate from="EUR" to="NOK" rate="7.800095" />  
+    <rate from="GBP" to="NOK" rate="8.966508" />  
+  </rates>
+</currencyConfig>