blacklight-access_controls 0.6.2 → 0.7.0.rc1

data/solr_conf/conf/schema.xml

@@ -337,9 +337,6 @@
  <!-- field for the QueryParser to use when an explicit fieldname is absent -->
  <!--  <defaultSearchField>text</defaultSearchField> -->
 
- <!-- SolrQueryParser configuration: defaultOperator="AND|OR" -->
- <solrQueryParser defaultOperator="OR"/>
-
   <!-- copyField commands copy one field to another at the time a document
         is added to the index.  It's used either to index the same field differently,
         or to add multiple fields to the same field for easier/faster searching.  -->

data/spec/factories/user.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-FactoryGirl.define do
+FactoryBot.define do
   factory :user do
     sequence(:email) { |n| "user_#{n}@example.com" }
     password 'password'

data/spec/spec_helper.rb

@@ -7,13 +7,13 @@ EngineCart.load_application!
 
 require 'blacklight-access_controls'
 
-require 'factory_girl_rails'
+require 'factory_bot_rails'
 require 'database_cleaner'
 
 Dir['./spec/support/**/*.rb'].sort.each { |f| require f }
 
 RSpec.configure do |config|
-  config.include FactoryGirl::Syntax::Methods
+  config.include FactoryBot::Syntax::Methods
 
   config.include SolrSupport
 
@@ -21,12 +21,12 @@ RSpec.configure do |config|
     DatabaseCleaner.clean_with :truncation
   end
 
-  config.before(:each) do
+  config.before do
     DatabaseCleaner.strategy = :transaction
     DatabaseCleaner.start
   end
 
-  config.after(:each) do
+  config.after do
     DatabaseCleaner.clean
   end
 end

data/spec/unit/ability_spec.rb

@@ -3,38 +3,40 @@
 require 'cancan/matchers'
 
 describe Ability do
-  let(:ability) { Ability.new(user) }
+  let(:ability) { described_class.new(user) }
 
   describe 'class methods' do
     it 'has keys for access control fields' do
-      expect(Ability.read_group_field).to eq 'read_access_group_ssim'
-      expect(Ability.read_user_field).to eq 'read_access_person_ssim'
-      expect(Ability.discover_group_field).to eq 'discover_access_group_ssim'
-      expect(Ability.discover_user_field).to eq 'discover_access_person_ssim'
-      expect(Ability.download_group_field).to eq 'download_access_group_ssim'
-      expect(Ability.download_user_field).to eq 'download_access_person_ssim'
+      expect(described_class.read_group_field).to eq 'read_access_group_ssim'
+      expect(described_class.read_user_field).to eq 'read_access_person_ssim'
+      expect(described_class.discover_group_field).to eq 'discover_access_group_ssim'
+      expect(described_class.discover_user_field).to eq 'discover_access_person_ssim'
+      expect(described_class.download_group_field).to eq 'download_access_group_ssim'
+      expect(described_class.download_user_field).to eq 'download_access_person_ssim'
     end
   end
 
   describe 'Given an asset that has been made publicly discoverable' do
-    let(:asset) { SolrDocument.new(id: 'public_discovery',
-                                   discover_access_group_ssim: ['public']) }
+    let(:asset) do
+      SolrDocument.new(id: 'public_discovery',
+                       discover_access_group_ssim: ['public'])
+    end
 
     context 'Then a not-signed-in user' do
-      let(:user) { nil }
-
       subject { ability }
 
+      let(:user) { nil }
+
       it { is_expected.to     be_able_to(:discover, asset) }
       it { is_expected.not_to be_able_to(:read, asset) }
       it { is_expected.not_to be_able_to(:download, asset) }
     end
 
     context 'Then a registered user' do
-      let(:user) { create(:user) }
-
       subject { ability }
 
+      let(:user) { create(:user) }
+
       it { is_expected.to     be_able_to(:discover, asset) }
       it { is_expected.not_to be_able_to(:read, asset) }
       it { is_expected.not_to be_able_to(:download, asset) }
@@ -44,10 +46,10 @@ describe Ability do
       subject { ability }
 
       let(:user) { create(:user) }
-      let(:asset) {
+      let(:asset) do
         create_solr_doc(id: 'public_discovery',
                         discover_access_group_ssim: ['public'])
-      }
+      end
 
       # It should still work, even if we just pass in an ID
       it { is_expected.to     be_able_to(:discover, asset.id) }
@@ -57,24 +59,26 @@ describe Ability do
   end
 
   describe 'Given an asset that has been made publicly readable' do
-    let(:asset) { SolrDocument.new(id: 'public_read',
-                                   read_access_group_ssim: ['public']) }
+    let(:asset) do
+      SolrDocument.new(id: 'public_read',
+                       read_access_group_ssim: ['public'])
+    end
 
     context 'Then a not-signed-in user' do
-      let(:user) { nil }
-
       subject { ability }
 
+      let(:user) { nil }
+
       it { is_expected.to     be_able_to(:discover, asset) }
       it { is_expected.to     be_able_to(:read, asset) }
       it { is_expected.not_to be_able_to(:download, asset) }
     end
 
     context 'Then a registered user' do
-      let(:user) { create(:user) }
-
       subject { ability }
 
+      let(:user) { create(:user) }
+
       it { is_expected.to     be_able_to(:discover, asset) }
       it { is_expected.to     be_able_to(:read, asset) }
       it { is_expected.not_to be_able_to(:download, asset) }
@@ -84,10 +88,10 @@ describe Ability do
       subject { ability }
 
       let(:user) { create(:user) }
-      let(:asset) {
+      let(:asset) do
         create_solr_doc(id: 'public_read',
                         read_access_group_ssim: ['public'])
-      }
+      end
 
       # It should still work, even if we just pass in an ID
       it { is_expected.to     be_able_to(:discover, asset.id) }
@@ -98,14 +102,16 @@ describe Ability do
 
   describe 'Given an asset that has been made publicly downloadable' do
     let(:id) { 'public_download' }
-    let(:asset) { SolrDocument.new(id: id,
-                                   download_access_group_ssim: ['public']) }
+    let(:asset) do
+      SolrDocument.new(id: id,
+                       download_access_group_ssim: ['public'])
+    end
 
     context 'Then a not-signed-in user' do
-      let(:user) { nil }
-
       subject { ability }
 
+      let(:user) { nil }
+
       it { is_expected.to be_able_to(:discover, asset) }
       it { is_expected.to be_able_to(:read, asset) }
       it { is_expected.to be_able_to(:download, asset) }
@@ -125,10 +131,10 @@ describe Ability do
       subject { ability }
 
       let(:user) { create(:user) }
-      let(:asset) {
+      let(:asset) do
         create_solr_doc(id: id,
                         download_access_group_ssim: ['public'])
-      }
+      end
 
       # It should still work, even if we just pass in an ID
       it { is_expected.to be_able_to(:discover, asset.id) }
@@ -142,30 +148,30 @@ describe Ability do
     let(:asset) { SolrDocument.new(id: 'user_disco', discover_access_person_ssim: [user_with_access.email]) }
 
     context 'Then a not-signed-in user' do
-      let(:user) { nil }
-
       subject { ability }
 
+      let(:user) { nil }
+
       it { is_expected.not_to be_able_to(:discover, asset) }
       it { is_expected.not_to be_able_to(:read, asset) }
       it { is_expected.not_to be_able_to(:download, asset) }
     end
 
     context 'Then a different registered user' do
-      let(:user) { create(:user) }
-
       subject { ability }
 
+      let(:user) { create(:user) }
+
       it { is_expected.not_to be_able_to(:discover, asset) }
       it { is_expected.not_to be_able_to(:read, asset) }
       it { is_expected.not_to be_able_to(:download, asset) }
     end
 
     context 'Then that user' do
-      let(:user) { user_with_access }
-
       subject { ability }
 
+      let(:user) { user_with_access }
+
       it { is_expected.to     be_able_to(:discover, asset) }
       it { is_expected.not_to be_able_to(:read, asset) }
       it { is_expected.not_to be_able_to(:download, asset) }
@@ -177,30 +183,30 @@ describe Ability do
     let(:asset) { SolrDocument.new(id: 'user_read', read_access_person_ssim: [user_with_access.email]) }
 
     context 'Then a not-signed-in user' do
-      let(:user) { nil }
-
       subject { ability }
 
+      let(:user) { nil }
+
       it { is_expected.not_to be_able_to(:discover, asset) }
       it { is_expected.not_to be_able_to(:read, asset) }
       it { is_expected.not_to be_able_to(:download, asset) }
     end
 
     context 'Then a different registered user' do
-      let(:user) { create(:user) }
-
       subject { ability }
 
+      let(:user) { create(:user) }
+
       it { is_expected.not_to be_able_to(:discover, asset) }
       it { is_expected.not_to be_able_to(:read, asset) }
       it { is_expected.not_to be_able_to(:download, asset) }
     end
 
     context 'Then that user' do
-      let(:user) { user_with_access }
-
       subject { ability }
 
+      let(:user) { user_with_access }
+
       it { is_expected.to     be_able_to(:discover, asset) }
       it { is_expected.to     be_able_to(:read, asset) }
       it { is_expected.not_to be_able_to(:download, asset) }
@@ -212,30 +218,30 @@ describe Ability do
     let(:asset) { SolrDocument.new(id: 'user_read', download_access_person_ssim: [user_with_access.email]) }
 
     context 'Then a not-signed-in user' do
-      let(:user) { nil }
-
       subject { ability }
 
+      let(:user) { nil }
+
       it { is_expected.not_to be_able_to(:discover, asset) }
       it { is_expected.not_to be_able_to(:read, asset) }
       it { is_expected.not_to be_able_to(:download, asset) }
     end
 
     context 'Then a different registered user' do
-      let(:user) { create(:user) }
-
       subject { ability }
 
+      let(:user) { create(:user) }
+
       it { is_expected.not_to be_able_to(:discover, asset) }
       it { is_expected.not_to be_able_to(:read, asset) }
       it { is_expected.not_to be_able_to(:download, asset) }
     end
 
     context 'Then that user' do
-      let(:user) { user_with_access }
-
       subject { ability }
 
+      let(:user) { user_with_access }
+
       it { is_expected.to be_able_to(:discover, asset) }
       it { is_expected.to be_able_to(:read, asset) }
       it { is_expected.to be_able_to(:download, asset) }
@@ -249,13 +255,13 @@ describe Ability do
   end
 
   describe '#guest_user' do
-    let(:user) { nil }
-
     subject { ability.guest_user }
 
+    let(:user) { nil }
+
     it 'is a new user' do
       expect(subject).to be_a User
-      expect(subject.new_record?).to be_truthy
+      expect(subject).to be_new_record
     end
   end
 
@@ -275,17 +281,17 @@ describe Ability do
     end
 
     context 'a user with groups' do
-      let(:user) { double(groups: %w(group1 group2), new_record?: false) }
+      let(:user) { double(groups: %w[group1 group2], new_record?: false) }
 
       it { is_expected.to include('group1', 'group2') }
     end
   end
 
   describe 'with a custom method' do
-    let(:user) { create(:user) }
-
     subject { MyAbility.new(user) }
 
+    let(:user) { create(:user) }
+
     before do
       class MyAbility
         include Blacklight::AccessControls::Ability

data/spec/unit/blacklight/access_controls/search_builder_spec.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+RSpec.describe Blacklight::AccessControls::SearchBuilder do
+  subject { search_builder }
+
+  let(:search_builder) do
+    described_class.new(controller, ability: ability)
+  end
+  let(:controller) { double }
+  let(:user) { User.new }
+  let(:ability) { Ability.new(user) }
+
+  describe '#discovery_permissions' do
+    subject { search_builder.default_permission_types }
+
+    it { is_expected.to eq %w[discover read] }
+  end
+
+  describe '#apply_gated_discovery' do
+    let(:fq_first) do
+      solr_parameters = {}
+      search_builder.send(:apply_gated_discovery, solr_parameters)
+      solr_parameters[:fq].first
+    end
+
+    describe 'logger' do
+      # Expectation will be triggered by Ability class (that calls Rails.logger.debug earlier). So we double Ability to avoid false positive.
+      let(:ability) { instance_double(Ability, user_groups: [], current_user: user) }
+
+      it 'is called with debug' do
+        expect(Rails.logger).to receive(:debug).with(/^Solr parameters/)
+        search_builder.send(:apply_gated_discovery, {})
+      end
+    end
+
+    context 'Given I am not logged in' do
+      it "Then I should be treated as a member of the 'public' group" do
+        expect(fq_first).to eq '({!terms f=discover_access_group_ssim}public) OR ({!terms f=read_access_group_ssim}public)'
+      end
+
+      it "Then I should not be treated as a member of the 'registered' group" do
+        expect(fq_first).not_to match(/registered/)
+      end
+    end
+
+    context 'Given I am a registered user' do
+      let(:groups) { %w[faculty africana-faculty] }
+      let(:user) do
+        create(:user).tap do |u|
+          allow(u).to receive(:groups) { groups }
+        end
+      end
+
+      it 'searches for my user key in discover and read fields' do
+        expect(fq_first).to match(/discover_access_person_ssim\:#{user.user_key}/)
+        expect(fq_first).to match(/read_access_person_ssim\:#{user.user_key}/)
+      end
+
+      it 'searches for my groups' do
+        expect(fq_first).to match(/\{!terms f=discover_access_group_ssim\}public,faculty,africana-faculty,registered/)
+        expect(fq_first).to match(/\{!terms f=read_access_group_ssim\}public,faculty,africana-faculty,registered/)
+      end
+
+      it 'does not build empty clauses' do
+        expect(search_builder).to receive(:apply_user_permissions).and_return(['({!terms f=discover_access_group_ssim}public,faculty,africana-faculty,registered)', '', nil])
+        expect(fq_first).not_to match(/ OR $/) # i.e. doesn't end w/ empty
+      end
+
+      context 'slashes in the group names' do
+        let(:groups) { ['abc/123', 'cde/567'] }
+
+        it 'does not escape slashes' do
+          expect(fq_first).to match(%r{\{!terms f=discover_access_group_ssim\}public,abc/123,cde/567,registered})
+          expect(fq_first).to match(%r{\{!terms f=read_access_group_ssim\}public,abc/123,cde/567,registered})
+        end
+      end
+
+      context 'spaces in the group names' do
+        let(:groups) { ['abc 123', 'cd/e 567'] }
+
+        it 'does not escape spaces in group names' do
+          expect(fq_first).to match(%r{\{!terms f=discover_access_group_ssim\}public,abc 123,cd/e 567,registered})
+          expect(fq_first).to match(%r{\{!terms f=read_access_group_ssim\}public,abc 123,cd/e 567,registered})
+        end
+      end
+
+      context 'colons in the groups names' do
+        let(:groups) { ['abc:123', 'cde:567'] }
+
+        it 'does not escape colons' do
+          expect(fq_first).to match(/\{!terms f=discover_access_group_ssim\}public,abc:123,cde:567,registered/)
+          expect(fq_first).to match(/\{!terms f=read_access_group_ssim\}public,abc:123,cde:567,registered/)
+        end
+      end
+    end
+  end
+
+  describe '#apply_user_permissions' do
+    describe 'when the user is a guest user (user key nil)' do
+      it 'does not create filters' do
+        expect(search_builder.send(:apply_user_permissions)).to eq []
+      end
+    end
+
+    describe 'when the user is a guest user (user key empty string)' do
+      let(:user) { User.new(email: '') }
+
+      it 'does not create filters' do
+        expect(search_builder.send(:apply_user_permissions)).to eq []
+      end
+    end
+  end
+end