bulkrax 9.5.0 → 10.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dd9cb038733c14b67261147e37dfe9087776846d22f327b3985761e58267c129
-  data.tar.gz: 46f82669413a304c2c8f511368f7a51e088908bf387fa617234597b26bea07e7
+  metadata.gz: ae568e80c3ac44aeeefdcbea1810035b250ab070cd7d72b82481f8ee878cda54
+  data.tar.gz: 2b927f012dce82c3fc5c60dc23877bbae24ef986efec97ae6ff6a9acc89f3d3d
 SHA512:
-  metadata.gz: fe9ef3f4391865d4f95f74fd2eb4f8e95f529963fbbd2d6439f907ace1908a5c70249d59f73c15593f2d237f3f653d945a458e50e3beaf3727928f6529614d76
-  data.tar.gz: 4413721e9203032f1bb03add7072ece3c58ec7ec8afcd51b103180b53ca8808df87de0c2793c6101646a8e7285058234cc76628e46c213eda4a62adbacb97b0f
+  metadata.gz: c198d55e37b8f4338a9ebe6a0042cada18f749f9dc0fead3fa9fd26b91f75a37a68f44a88e6a65e011c7c3a87183c77cf432a1e94d30027130ba6e2b090467f3
+  data.tar.gz: 9b72aaa5e796a76b804b011a532a91589486deee690488b9c514dc8e2ba5054e6a5a896387b30d2c3a6fbc8313ff4581ad4c473cc7c604166462e3cbfa4b1f8f

data/README.md

@@ -5,6 +5,25 @@ Bulkrax is a batteries included importer for Samvera applications. It currently
 
 ## Installation
 
+### Rails compatibility
+
+Existing Hyrax integration tests retain Rails 6.1 compatibility. Rails 8.1 is
+tested independently with a minimal Rails application: engine boot, routes,
+engine migrations, and persisted JSON/YAML serialization. This smoke coverage
+unblocks a subsequent Hyrax upgrade; it does **not** claim that current Hyrax
+releases support Rails 8.1, or exercise repository-backed import/export workflows.
+
+Run the standalone smoke suite from the Bulkrax checkout with a separate bundle:
+
+```bash
+BULKRAX_WITH_HYRAX=false RAILS_GEM_VERSION='~> 8.1.0' BUNDLE_PATH=vendor/rails81 bundle install
+BULKRAX_WITH_HYRAX=false RAILS_GEM_VERSION='~> 8.1.0' BUNDLE_PATH=vendor/rails81 bundle exec rspec spec/rails_compat
+```
+
+Hyrax remains enabled by default for the existing integration suite. Resolve the
+bundle again when switching modes; do not reuse a frozen lockfile from the other
+mode. Rails 8.1 requires Ruby 3.2 or newer and SQLite 2.1 or newer for this smoke app.
+
 ### Install Generator
 
 Add this line to your application's Gemfile:
@@ -24,6 +43,36 @@ $ rails db:migrate
 
 If using Sidekiq, set up queues for `import` and `export`.
 
+### Permissions
+
+Add Bulkrax's rules to your application's `app/models/ability.rb`:
+
+```ruby
+include Bulkrax::AbilityBehavior
+self.ability_logic += [:bulkrax_default_abilities]
+
+def can_import_works?
+  can_create_any_work?
+end
+
+def can_export_works?
+  can_create_any_work?
+end
+
+def can_admin_importers?
+  current_user.admin?
+end
+
+def can_admin_exporters?
+  current_user.admin?
+end
+```
+
+Replace the example predicates with your application's policy. By default, all
+four return `false`; permitted users manage only their own importers and
+exporters, while the admin predicates grant access to all records. Ensure
+existing importers and exporters have an owner (`user_id`).
+
 ### Bundle errors on ARM
 
 If posix-spawn is failing to bundle on an ARM based processor, try the following

data/app/controllers/bulkrax/application_controller.rb

@@ -4,5 +4,88 @@ module Bulkrax
   class ApplicationController < ::ApplicationController
     helper Rails.application.class.helpers
     protect_from_forgery with: :exception
+
+    # Rescue CanCan::AccessDenied in all Bulkrax controllers.  HTML requests are
+    # redirected to the host-app root with an alert; JSON requests receive a 403
+    # response.  Defining the handler here (rather than in individual controllers)
+    # keeps error handling in one place and consistent across all resources.
+    rescue_from CanCan::AccessDenied do |exception|
+      respond_to do |format|
+        format.html do
+          flash[:alert] = exception.message
+          redirect_to main_app.root_path
+        end
+        format.json { render json: { error: exception.message }, status: :forbidden }
+      end
+    end
+
+    protected
+
+    # Single auth before_action for ImportersController and ExportersController.
+    # Authenticates the request, then loads and authorizes the record targeted
+    # by the current action, assigning it to @importer / @exporter (derived
+    # from +klass+).
+    #
+    # * Authentication: API requests (see Bulkrax::API) use the token;
+    #   everything else uses authenticate_user!.
+    # * new/create: build a new record (from +<name>_params+ on create) and
+    #   authorize it. Skipped for API requests, which validate params and build
+    #   the record inside the action.
+    # * Member actions: find by :id or :<name>_id (e.g. continue, download,
+    #   entry_table) and authorize action_name. Custom actions resolve through
+    #   the alias_action mappings in Bulkrax::AbilityBehavior (e.g. :export_errors ->
+    #   :read, :continue -> :update).
+    # * Browser collection actions (no id param, e.g. index, *_table): check
+    #   the controller-supplied capability predicate. The action scopes records
+    #   with accessible_by after authorization. API collection actions remain
+    #   compatible until token-to-user wiring is available.
+    #
+    # @param klass [Class] Bulkrax::Importer or Bulkrax::Exporter
+    # @param collection_ability [Symbol] ability predicate for collection actions
+    def authenticate_and_authorize!(klass, collection_ability)
+      return unless authenticate_request!
+
+      name = klass.model_name.element
+      record = case action_name
+               when 'new', 'create'
+                 return if api_request?
+                 klass.new(action_name == 'create' ? send(:"#{name}_params") : {})
+               else
+                 id = params[:id] || params[:"#{name}_id"]
+                 return if id.blank? && api_request?
+                 return authorize_collection!(collection_ability) if id.blank?
+                 klass.find(id)
+               end
+      instance_variable_set(:"@#{name}", record)
+
+      # TODO(#1237): API requests have no current_user until the token is
+      # resolved to a user, so API actions addressed by :id (and entry_table)
+      # skip authorization to keep existing consumers working. Other
+      # :<name>_id actions are authorized.
+      return if api_request? && (params[:id].present? || action_name == 'entry_table')
+
+      authorize! action_name.to_sym, record
+    end
+
+    private
+
+    def authorize_collection!(ability_method)
+      return if current_ability.public_send(ability_method)
+
+      raise CanCan::AccessDenied, 'Not authorized'
+    end
+
+    # Overridden by Bulkrax::API in controllers that accept token-authenticated
+    # JSON requests.
+    def api_request?
+      false
+    end
+
+    # Returns false when authentication rendered or redirected, so the caller
+    # can halt.
+    def authenticate_request!
+      api_request? ? token_authenticate! : authenticate_user!
+      !performed?
+    end
   end
 end

data/app/controllers/bulkrax/entries_controller.rb

@@ -2,10 +2,9 @@
 
 module Bulkrax
   class EntriesController < ApplicationController
-    include Hyrax::ThemedLayoutController if defined?(::Hyrax)
+    include Hyrax::ThemedLayoutController if Bulkrax.hyrax_loaded?
     before_action :authenticate_user!
-    before_action :check_permissions
-    with_themed_layout 'dashboard' if defined?(::Hyrax)
+    with_themed_layout 'dashboard' if Bulkrax.hyrax_loaded?
 
     def show
       if params[:importer_id].present?
@@ -17,6 +16,8 @@ module Bulkrax
 
     def update
       @entry = Entry.find(params[:id])
+      authorize! :update, @entry
+
       type = case @entry.type.downcase
              when /fileset/
                'file_set'
@@ -25,8 +26,8 @@ module Bulkrax
              else
                'work'
              end
-      item = @entry.importerexporter
       # do not run counters as it loads the whole parser
+      item = @entry.importerexporter
       current_run = item.current_run(skip_counts: true)
       @entry.set_status_info('Pending', current_run)
       ScheduleRelationshipsJob.set(wait: 5.minutes).perform_later(importer_id: @entry.importer.id)
@@ -44,6 +45,9 @@ module Bulkrax
 
     def destroy
       @entry = Entry.find(params[:id])
+      authorize! :destroy, @entry
+
+      item = @entry.importerexporter
       @status = ""
       begin
         work = @entry.factory&.find
@@ -59,7 +63,6 @@ module Bulkrax
         @status = "Error: #{e.message}"
       end
 
-      item = @entry.importerexporter
       entry_path = item.class.to_s.include?('Importer') ? bulkrax.importer_entry_path(item.id, @entry.id) : bulkrax.exporter_entry_path(item.id, @entry.id)
 
       redirect_back fallback_location: entry_path, notice: @status
@@ -70,9 +73,11 @@ module Bulkrax
     # GET /importers/1/entries/1
     def show_importer
       @importer = Importer.find(params[:importer_id])
-      @entry = Entry.find(params[:id])
+      authorize! :read, @importer
+      @entry = @importer.entries.find(params[:id])
+      authorize! :read, @entry
 
-      return unless defined?(::Hyrax)
+      return unless Bulkrax.hyrax_loaded?
       add_breadcrumb t(:'hyrax.controls.home'), main_app.root_path
       add_breadcrumb t(:'hyrax.dashboard.breadcrumbs.admin'), hyrax.dashboard_path
       add_breadcrumb t(:'bulkrax.headings.importers'), bulkrax.importers_path
@@ -83,18 +88,16 @@ module Bulkrax
     # GET /exporters/1/entries/1
     def show_exporter
       @exporter = Exporter.find(params[:exporter_id])
-      @entry = Entry.find(params[:id])
+      authorize! :read, @exporter
+      @entry = @exporter.entries.find(params[:id])
+      authorize! :read, @entry
 
-      return unless defined?(::Hyrax)
+      return unless Bulkrax.hyrax_loaded?
       add_breadcrumb t(:'hyrax.controls.home'), main_app.root_path
       add_breadcrumb t(:'hyrax.dashboard.breadcrumbs.admin'), hyrax.dashboard_path
       add_breadcrumb t(:'bulkrax.headings.exporters'), bulkrax.exporters_path
       add_breadcrumb @exporter.name, bulkrax.exporter_path(@exporter.id)
       add_breadcrumb @entry.id
     end
-
-    def check_permissions
-      raise CanCan::AccessDenied unless current_ability.can_import_works? || current_ability.can_export_works?
-    end
   end
 end

data/app/controllers/bulkrax/exporters_controller.rb

@@ -2,33 +2,38 @@
 
 module Bulkrax
   class ExportersController < ApplicationController
-    include Hyrax::ThemedLayoutController if defined?(::Hyrax)
+    include Hyrax::ThemedLayoutController if Bulkrax.hyrax_loaded?
     include Bulkrax::DownloadBehavior
     include Bulkrax::DatatablesBehavior
-    before_action :authenticate_user!
-    before_action :check_permissions
-    before_action :set_exporter, only: [:show, :entry_table, :edit, :update, :destroy]
-    with_themed_layout 'dashboard' if defined?(::Hyrax)
+
+    # Authentication, record loading and authorization for every action.
+    before_action(except: [:download]) { authenticate_and_authorize!(Bulkrax::Exporter, :can_export_works?) }
+
+    with_themed_layout 'dashboard' if Bulkrax.hyrax_loaded?
 
     # GET /exporters
     def index
       # NOTE: We're paginating this in the browser.
-      @exporters = Exporter.order(created_at: :desc).all
+      @exporters = Exporter.accessible_by(current_ability).order(created_at: :desc)
 
-      add_exporter_breadcrumbs if defined?(::Hyrax)
+      add_exporter_breadcrumbs if Bulkrax.hyrax_loaded?
     end
 
     def exporter_table
-      @exporters = Exporter.order(table_order).page(table_page).per(table_per_page)
+      @exporters = Exporter.accessible_by(current_ability)
       @exporters = @exporters.where(exporter_table_search) if exporter_table_search.present?
+      # Count the filtered relation before applying pagination so the UI receives
+      # the total number of matching exporters, not just the total number of exporters.
+      filtered_count = @exporters.count
+      @exporters = @exporters.order(table_order).page(table_page).per(table_per_page)
       respond_to do |format|
-        format.json { render json: format_exporters(@exporters) }
+        format.json { render json: format_exporters(@exporters, filtered_count) }
       end
     end
 
     # GET /exporters/1
     def show
-      if defined?(::Hyrax)
+      if Bulkrax.hyrax_loaded?
         add_exporter_breadcrumbs
         add_breadcrumb @exporter.name
       end
@@ -45,15 +50,14 @@ module Bulkrax
 
     # GET /exporters/new
     def new
-      @exporter = Exporter.new
-      return unless defined?(::Hyrax)
+      return unless Bulkrax.hyrax_loaded?
       add_exporter_breadcrumbs
       add_breadcrumb t(:'bulkrax.headings.new_exporter')
     end
 
     # GET /exporters/1/edit
     def edit
-      if defined?(::Hyrax)
+      if Bulkrax.hyrax_loaded?
         add_exporter_breadcrumbs
         add_breadcrumb @exporter.name, bulkrax.exporter_path(@exporter.id)
         add_breadcrumb t(:'bulkrax.headings.edit_exporter')
@@ -65,7 +69,7 @@ module Bulkrax
 
     # POST /exporters
     def create
-      @exporter = Exporter.new(exporter_params)
+      @exporter.user_id = current_user.id
       field_mapping_params
 
       if @exporter.save
@@ -107,25 +111,21 @@ module Bulkrax
     # GET /exporters/1/download
     def download
       @exporter = Exporter.find(params[:exporter_id])
+      authorize! :read, @exporter
       send_content
     end
 
     private
 
-    # Use callbacks to share common setup or constraints between actions.
-    def set_exporter
-      @exporter = Exporter.find(params[:id] || params[:exporter_id])
-    end
-
     # Only allow a trusted parameters through.
     def exporter_params
       params[:exporter][:export_source] = params[:exporter]["export_source_#{params[:exporter][:export_from]}".to_sym]
       if params[:exporter][:date_filter] == "1"
-        params.fetch(:exporter).permit(:name, :user_id, :export_source, :export_from, :export_type, :generated_metadata,
+        params.fetch(:exporter).permit(:name, :export_source, :export_from, :export_type, :generated_metadata,
                                        :include_thumbnails, :parser_klass, :limit, :start_date, :finish_date, :work_visibility,
                                        :workflow_status, field_mapping: {})
       else
-        params.fetch(:exporter).permit(:name, :user_id, :export_source, :export_from, :export_type, :generated_metadata,
+        params.fetch(:exporter).permit(:name, :export_source, :export_from, :export_type, :generated_metadata,
                                        :include_thumbnails, :parser_klass, :limit, :work_visibility, :workflow_status,
                                        field_mapping: {}).merge(start_date: nil, finish_date: nil)
       end
@@ -149,9 +149,5 @@ module Bulkrax
     def file_path
       "#{@exporter.exporter_export_zip_path}/#{params['exporter']['exporter_export_zip_files']}"
     end
-
-    def check_permissions
-      raise CanCan::AccessDenied unless current_ability.can_export_works?
-    end
   end
 end

data/app/controllers/bulkrax/guided_imports_controller.rb

@@ -2,19 +2,19 @@
 
 module Bulkrax
   class GuidedImportsController < ::Bulkrax::ApplicationController
-    include Hyrax::ThemedLayoutController if defined?(::Hyrax)
+    include Hyrax::ThemedLayoutController if Bulkrax.hyrax_loaded?
     include Bulkrax::GuidedImportDemoScenarios if Bulkrax.config.guided_import_demo_scenarios_enabled
     include Bulkrax::ImporterFileHandler
     helper Bulkrax::ImportersHelper
 
     before_action :authenticate_user!
-    before_action :check_permissions
-    with_themed_layout 'dashboard' if defined?(::Hyrax)
+    before_action { authorize! :create, Bulkrax::Importer }
+    with_themed_layout 'dashboard' if Bulkrax.hyrax_loaded?
 
     # trigger form to allow upload
     def new
       @importer = Importer.new
-      return unless defined?(::Hyrax)
+      return unless Bulkrax.hyrax_loaded?
       add_importer_breadcrumbs
       add_breadcrumb I18n.t('bulkrax.importer.guided_import.breadcrumb')
     end
@@ -169,9 +169,5 @@ module Bulkrax
       add_breadcrumb t(:'hyrax.dashboard.breadcrumbs.admin'), hyrax.dashboard_path
       add_breadcrumb t(:'bulkrax.headings.importers'), bulkrax.importers_path
     end
-
-    def check_permissions
-      raise CanCan::AccessDenied unless current_ability.can_import_works?
-    end
   end
 end

data/app/controllers/bulkrax/importers_controller.rb

@@ -3,7 +3,7 @@
 module Bulkrax
   # rubocop:disable Metrics/ClassLength
   class ImportersController < ::Bulkrax::ApplicationController
-    include Hyrax::ThemedLayoutController if defined?(::Hyrax)
+    include Hyrax::ThemedLayoutController if Bulkrax.hyrax_loaded?
     include Bulkrax::DownloadBehavior
     include Bulkrax::API
     include Bulkrax::DatatablesBehavior
@@ -11,29 +11,39 @@ module Bulkrax
     include Bulkrax::ImporterFileHandler
 
     protect_from_forgery unless: -> { api_request? }
-    before_action :token_authenticate!, if: -> { api_request? }, only: [:create, :update, :delete]
-    before_action :authenticate_user!, unless: -> { api_request? }
-    before_action :check_permissions
-    before_action :set_importer, only: [:show, :entry_table, :edit, :update, :destroy, :original_file]
-    with_themed_layout 'dashboard' if defined?(::Hyrax)
+    # Authentication, record loading and authorization for every action.
+    before_action { authenticate_and_authorize!(Bulkrax::Importer, :can_import_works?) }
+    with_themed_layout 'dashboard' if Bulkrax.hyrax_loaded?
 
     # GET /importers
     def index
       # NOTE: We're paginating this in the browser.
       if api_request?
+        # TODO(#1237): Scope API index by token owner once token-to-user wiring
+        # is in place. Until then, API clients see all importers
+        # to preserve backward-compatibility with existing API consumers.
         @importers = Importer.order(created_at: :desc).all
         json_response('index')
-      elsif defined?(::Hyrax)
+      elsif Bulkrax.hyrax_loaded?
         add_importer_breadcrumbs
       end
     end
 
     def importer_table
       order = table_order.presence || Arel.sql('last_imported_at DESC NULLS LAST')
-      @importers = Importer.order(order).page(table_page).per(table_per_page)
+      # TODO(#1237): API requests bypass ownership scoping here too.
+      @importers = if api_request?
+                     Importer.all
+                   else
+                     Importer.accessible_by(current_ability)
+                   end
       @importers = @importers.where(importer_table_search) if importer_table_search.present?
+      # Count the filtered relation before applying pagination so the UI receives
+      # the total number of matching importers, not just the total number of importers.
+      filtered_count = @importers.count
+      @importers = @importers.order(order).page(table_page).per(table_per_page)
       respond_to do |format|
-        format.json { render json: format_importers(@importers) }
+        format.json { render json: format_importers(@importers, filtered_count) }
       end
     end
 
@@ -41,7 +51,7 @@ module Bulkrax
     def show
       if api_request?
         json_response('show')
-      elsif defined?(::Hyrax)
+      elsif Bulkrax.hyrax_loaded?
         add_importer_breadcrumbs
         add_breadcrumb @importer.name
       end
@@ -58,10 +68,9 @@ module Bulkrax
 
     # GET /importers/new
     def new
-      @importer = Importer.new
       if api_request?
         json_response('new')
-      elsif defined?(::Hyrax)
+      elsif Bulkrax.hyrax_loaded?
         add_importer_breadcrumbs
         add_breadcrumb t(:'bulkrax.headings.new_importer')
       end
@@ -81,7 +90,7 @@ module Bulkrax
     def edit
       if api_request?
         json_response('edit')
-      elsif defined?(::Hyrax)
+      elsif Bulkrax.hyrax_loaded?
         add_importer_breadcrumbs
         add_breadcrumb @importer.name, bulkrax.importer_path(@importer.id)
         add_breadcrumb t(:'bulkrax.headings.edit_importer')
@@ -95,12 +104,14 @@ module Bulkrax
       # rubocop:disable Style/IfInsideElse
       if api_request?
         return return_json_response unless valid_create_params?
+        # authenticate_and_authorize! doesn't build for API requests; build it here
+        @importer ||= Importer.new(importer_params)
       end
+      @importer.user_id = current_user.id
       uploads = uploaded_files_scope
       file = file_param
       cloud_files = cloud_params
 
-      @importer = Importer.new(importer_params)
       field_mapping_params
       @importer.validate_only = true if params[:commit] == 'Create and Validate'
       # the following line is needed to handle updating remote files of a FileSet
@@ -177,7 +188,6 @@ module Bulkrax
 
     # PUT /importers/1
     def continue
-      @importer = Importer.find(params[:importer_id])
       params[:importer] = { name: @importer.name }
       @importer.validate_only = false
       update
@@ -185,8 +195,7 @@ module Bulkrax
 
     # GET /importer/1/upload_corrected_entries
     def upload_corrected_entries
-      @importer = Importer.find(params[:importer_id])
-      return unless defined?(::Hyrax)
+      return unless Bulkrax.hyrax_loaded?
       add_breadcrumb t(:'hyrax.controls.home'), main_app.root_path
       add_breadcrumb t(:'hyrax.dashboard.breadcrumbs.admin'), hyrax.dashboard_path
       add_breadcrumb t(:'bulkrax.headings.importers'), bulkrax.importers_path
@@ -197,7 +206,6 @@ module Bulkrax
     # POST /importer/1/upload_corrected_entries_file
     def upload_corrected_entries_file
       file = params[:importer][:parser_fields].delete(:file)
-      @importer = Importer.find(params[:importer_id])
       if file.present?
         @importer[:parser_fields]['partial_import_file_path'] = @importer.parser.write_partial_import_file(file)
         @importer.save
@@ -242,18 +250,12 @@ module Bulkrax
 
     # GET /importers/1/export_errors
     def export_errors
-      @importer = Importer.find(params[:importer_id])
       @importer.write_errored_entries_file
       send_content
     end
 
     private
 
-    # Use callbacks to share common setup or constraints between actions.
-    def set_importer
-      @importer = Importer.find(params[:id] || params[:importer_id])
-    end
-
     def importable_params
       params.except(:selected_files)
     end
@@ -267,7 +269,6 @@ module Bulkrax
       importable_params.require(:importer).permit(
         :name,
         :admin_set_id,
-        :user_id,
         :frequency,
         :parser_klass,
         :limit,
@@ -365,10 +366,6 @@ module Bulkrax
       end
       @importer.save
     end
-
-    def check_permissions
-      raise CanCan::AccessDenied unless current_ability.can_import_works?
-    end
   end
   # rubocop:enable Metrics/ClassLength
 end

data/app/controllers/concerns/bulkrax/datatables_behavior.rb

@@ -83,7 +83,7 @@ module Bulkrax
       @exporter_table_search
     end
 
-    def format_importers(importers)
+    def format_importers(importers, filtered_count = Bulkrax::Importer.accessible_by(current_ability).count)
       result = importers.map do |i|
         {
           name: view_context.link_to(i.name, view_context.importer_path(i)),
@@ -102,12 +102,12 @@ module Bulkrax
       end
       {
         data: result,
-        recordsTotal: Bulkrax::Importer.count,
-        recordsFiltered: Bulkrax::Importer.count
+        recordsTotal: api_request? ? Bulkrax::Importer.count : Bulkrax::Importer.accessible_by(current_ability).count,
+        recordsFiltered: filtered_count
       }
     end
 
-    def format_exporters(exporters)
+    def format_exporters(exporters, filtered_count = Bulkrax::Exporter.accessible_by(current_ability).count)
       result = exporters.map do |e|
         {
           name: view_context.link_to(e.name, view_context.exporter_path(e)),
@@ -119,8 +119,8 @@ module Bulkrax
       end
       {
         data: result,
-        recordsTotal: Bulkrax::Exporter.count,
-        recordsFiltered: Bulkrax::Exporter.count
+        recordsTotal: Bulkrax::Exporter.accessible_by(current_ability).count,
+        recordsFiltered: filtered_count
       }
     end
 
@@ -146,8 +146,10 @@ module Bulkrax
     def entry_util_links(e, item)
       links = []
       links << view_context.link_to(view_context.raw('<span class="fa fa-info-circle"></span>'), view_context.item_entry_path(item, e))
-      links << "<a class='fa fa-repeat' data-toggle='modal' data-target='#bulkraxItemModal' data-entry-id='#{e.id}'></a>" if view_context.an_importer?(item)
-      links << view_context.link_to(view_context.raw('<span class="fa fa-trash"></span>'), view_context.item_entry_path(item, e), method: :delete, data: { confirm: 'This will delete the entry and any work associated with it. Are you sure?' })
+      if can?(:update, item)
+        links << "<a class='fa fa-repeat' data-toggle='modal' data-target='#bulkraxItemModal' data-entry-id='#{e.id}'></a>" if view_context.an_importer?(item)
+        links << view_context.link_to(view_context.raw('<span class="fa fa-trash"></span>'), view_context.item_entry_path(item, e), method: :delete, data: { confirm: 'This will delete the entry and any work associated with it. Are you sure?' })
+      end
       links.join(" ")
     end
 
@@ -166,16 +168,20 @@ module Bulkrax
     def importer_util_links(i)
       links = []
       links << view_context.link_to(view_context.raw('<span class="fa fa-info-circle"></span>'), importer_path(i))
-      links << view_context.link_to(view_context.raw('<span class="fa fa-pencil"></span>'), edit_importer_path(i))
-      links << view_context.link_to(view_context.raw('<span class="fa fa-remove"></span>'), i, method: :delete, data: { confirm: 'Are you sure?' })
+      if can?(:update, i)
+        links << view_context.link_to(view_context.raw('<span class="fa fa-pencil"></span>'), edit_importer_path(i))
+        links << view_context.link_to(view_context.raw('<span class="fa fa-remove"></span>'), i, method: :delete, data: { confirm: 'Are you sure?' })
+      end
       links.join(" ")
     end
 
     def exporter_util_links(i)
       links = []
       links << view_context.link_to(view_context.raw('<span class="fa fa-info-circle"></span>'), exporter_path(i))
-      links << view_context.link_to(view_context.raw('<span class="fa fa-pencil"></span>'), edit_exporter_path(i), data: { turbolinks: false })
-      links << view_context.link_to(view_context.raw('<span class="fa fa-remove"></span>'), i, method: :delete, data: { confirm: 'Are you sure?' })
+      if can?(:update, i)
+        links << view_context.link_to(view_context.raw('<span class="fa fa-pencil"></span>'), edit_exporter_path(i), data: { turbolinks: false })
+        links << view_context.link_to(view_context.raw('<span class="fa fa-remove"></span>'), i, method: :delete, data: { confirm: 'Are you sure?' })
+      end
       links.join(" ")
     end
 

data/app/controllers/concerns/bulkrax/importer_file_handler.rb

@@ -43,7 +43,7 @@ module Bulkrax
     end
 
     def uploaded_files_scope
-      return [] unless defined?(::Hyrax)
+      return [] unless Bulkrax.hyrax_loaded?
 
       base = Hyrax::UploadedFile.where(id: params[:uploaded_files])
       if respond_to?(:current_user) && current_user.present?

data/app/factories/bulkrax/object_factory.rb

@@ -168,8 +168,8 @@ module Bulkrax
     end
 
     def self.solr_name(field_name)
-      if defined?(Hyrax)
-        Hyrax.index_field_mapper.solr_name(field_name)
+      if defined?(Hyrax) && Hyrax.respond_to?(:config) && Hyrax.config.respond_to?(:index_field_mapper)
+        Hyrax.config.index_field_mapper.solr_name(field_name)
       else
         ActiveFedora.index_field_mapper.solr_name(field_name)
       end