curation_concerns 0.1.0 → 0.2.0

data/spec/controllers/curation_concerns/collections_controller_spec.rb

@@ -7,20 +7,20 @@ describe CollectionsController do
   end
 
   let(:user) { FactoryGirl.create(:user) }
-  let(:asset1) { FactoryGirl.build(:generic_work, title: ["First of the Assets"], user: user) }
-  let(:asset2) { FactoryGirl.build(:generic_work, title: ["Second of the Assets"], user: user, depositor: user.user_key) }
-  let(:asset3) { FactoryGirl.build(:generic_work, title: ["Third of the Assets"]) }
-  let!(:asset4) { FactoryGirl.create(:generic_work, title: ["Fourth of the Assets"], user: user) }
-  let(:bogus_depositor_asset) { FactoryGirl.create(:generic_work, title: ["Bogus Asset"], depositor: 'abc') }
-  let(:collection_attrs) { FactoryGirl.attributes_for(:collection, title: "My First Collection ", description: "The Description\r\n\r\nand more") }
-  let(:collection) { FactoryGirl.create(:collection, title: "Collection Title", user: user) }
+  let(:asset1) { FactoryGirl.build(:generic_work, title: ['First of the Assets'], user: user) }
+  let(:asset2) { FactoryGirl.build(:generic_work, title: ['Second of the Assets'], user: user, depositor: user.user_key) }
+  let(:asset3) { FactoryGirl.build(:generic_work, title: ['Third of the Assets']) }
+  let!(:asset4) { FactoryGirl.create(:generic_work, title: ['Fourth of the Assets'], user: user) }
+  let(:bogus_depositor_asset) { FactoryGirl.create(:generic_work, title: ['Bogus Asset'], depositor: 'abc') }
+  let(:collection_attrs) { FactoryGirl.attributes_for(:collection, title: 'My First Collection ', description: "The Description\r\n\r\nand more") }
+  let(:collection) { FactoryGirl.create(:collection, title: 'Collection Title', user: user) }
 
   describe '#new' do
     before do
       sign_in user
     end
 
-    it 'should assign @collection' do
+    it 'assigns @collection' do
       get :new
       expect(assigns(:collection)).to be_kind_of(Collection)
     end
@@ -31,139 +31,156 @@ describe CollectionsController do
       sign_in user
     end
 
-    it "should create a Collection" do
-      expect {
-        post :create, collection: collection_attrs
-      }.to change{ Collection.count }.by(1)
+    it 'creates a Collection' do
+      expect do
+        post :create, collection: collection_attrs.merge(visibility: 'open')
+      end.to change { Collection.count }.by(1)
+      expect(assigns[:collection].visibility).to eq 'open'
     end
 
-    it "should remove blank strings from params before creating Collection" do
-      expect {
-        post :create, collection: collection_attrs.merge(creator: [""])
-      }.to change{ Collection.count }.by(1)
-      expect(assigns[:collection].title).to eq("My First Collection ")
+    it 'removes blank strings from params before creating Collection' do
+      expect do
+        post :create, collection: collection_attrs.merge(creator: [''])
+      end.to change { Collection.count }.by(1)
+      expect(assigns[:collection].title).to eq('My First Collection ')
       expect(assigns[:collection].creator).to eq([])
     end
 
-    it "should create a Collection with files I can access" do
-      [ asset1, asset2 ].map(&:save) # bogus_depositor_asset is already saved
-      expect {
+    it 'creates a Collection with files I can access' do
+      [asset1, asset2].map(&:save) # bogus_depositor_asset is already saved
+      expect do
         post :create, collection: collection_attrs,
-          batch_document_ids: [asset1.id, asset2.id, bogus_depositor_asset.id]
-      }.to change{ Collection.count }.by(1)
+                      batch_document_ids: [asset1.id, asset2.id, bogus_depositor_asset.id]
+      end.to change { Collection.count }.by(1)
       collection = assigns(:collection)
       expect(collection.members).to match_array [asset1, asset2]
     end
 
-    it "should add docs to the collection if a batch id is provided and add the collection id to the documents in the collection" do
+    it 'adds docs to the collection if a batch id is provided and add the collection id to the documents in the collection' do
       asset1.save
       post :create, batch_document_ids: [asset1.id], collection: collection_attrs
       expect(assigns[:collection].members).to eq [asset1]
 
-      asset_results = ActiveFedora::SolrService.instance.conn.get "select", params:{fq:["id:\"#{asset1.id}\""],fl:['id',Solrizer.solr_name(:collection)]}
-      expect(asset_results["response"]["numFound"]).to eq 1
+      asset_results = ActiveFedora::SolrService.instance.conn.get 'select', params: { fq: ["id:\"#{asset1.id}\""], fl: ['id'] }
+      expect(asset_results['response']['numFound']).to eq 1
 
-      doc = asset_results["response"]["docs"].first
-      expect(doc["id"]).to eq asset1.id
-
-      afterupdate = GenericWork.find(asset1.id)
-      expect(doc[Solrizer.solr_name(:collection)]).to eq afterupdate.to_solr[Solrizer.solr_name(:collection)]
+      doc = asset_results['response']['docs'].first
+      expect(doc['id']).to eq asset1.id
     end
-
   end
 
-  describe "#update" do
+  describe '#update' do
     before { sign_in user }
 
-    context "a collections members" do
+    context 'collection members' do
       before do
-        [ asset1, asset2 ].map(&:save) # bogus_depositor_asset is already saved
-        bogus_depositor_asset.apply_depositor_metadata(user.user_key)
-        bogus_depositor_asset.save
+        [asset1, asset2].map(&:save) # bogus_depositor_asset is already saved
+        collection.members = [asset1, asset2]
+        collection.save!
       end
 
-      it "should set collection on members" do
-        put :update, id: collection,
-          collection: { members:"add" },
-          batch_document_ids: [ bogus_depositor_asset.id, asset1.id, asset2.id ]
+      # Collections are unordered by default, which disallows duplicates.
+      xit 'appends members to the collection in order, allowing duplicates' do
+        # TODO: Using size until count is fixed https://github.com/projecthydra-labs/activefedora-aggregation/issues/78
+        expect {
+          put :update, id: collection,
+                       collection: { members: 'add' },
+                       batch_document_ids: [asset2.id, asset1.id]
+        }.to change { collection.reload.members.size }.by(2)
         expect(response).to redirect_to routes.url_helpers.collection_path(collection)
-        expect(assigns[:collection].members).to match_array [ asset2, bogus_depositor_asset, asset1 ]
+        expect(assigns[:collection].members).to eq [asset1, asset2, asset2, asset1]
 
-        asset_results = ActiveFedora::SolrService.instance.conn.get "select", params:{fq:["id:\"#{asset2.id}\""],fl:['id',Solrizer.solr_name(:collection)]}
-        expect(asset_results["response"]["numFound"]).to eq 1
+        asset_results = ActiveFedora::SolrService.instance.conn.get 'select', params: { fq: ["id:\"#{asset2.id}\""], fl: ['id'] }
+        expect(asset_results['response']['numFound']).to eq 1
 
-        doc = asset_results["response"]["docs"].first
-        expect(doc["id"]).to eq asset2.id
+        doc = asset_results['response']['docs'].first
+        expect(doc['id']).to eq asset2.id
+      end
 
-        afterupdate = GenericWork.find(asset2.id)
-        expect(doc[Solrizer.solr_name(:collection)]).to eq afterupdate.to_solr[Solrizer.solr_name(:collection)]
+      it "adds members to the collection" do
+        expect {
+          put :update, id: collection,
+                       collection: { members: 'add' },
+                       batch_document_ids: [asset4.id]
+        }.to change { collection.reload.members.size }.by(1)
+        expect(response).to redirect_to routes.url_helpers.collection_path(collection)
+        expect(assigns[:collection].members).to eq [asset1, asset2, asset4]
 
-        put :update, id: collection,
-          collection: { members: "remove" },
-          batch_document_ids: [ asset2 ]
-        asset_results = ActiveFedora::SolrService.instance.conn.get "select", params:{fq:["id:\"#{asset2.id}\""],fl:['id',Solrizer.solr_name(:collection)]}
-        expect(asset_results["response"]["numFound"]).to eq 1
+        asset_results = ActiveFedora::SolrService.instance.conn.get 'select', params: { fq: ["id:\"#{asset2.id}\""], fl: ['id'] }
+        expect(asset_results['response']['numFound']).to eq 1
 
-        doc = asset_results["response"]["docs"].first
-        expect(doc["id"]).to eq asset2.id
+        doc = asset_results['response']['docs'].first
+        expect(doc['id']).to eq asset2.id
+      end
 
-        afterupdate = GenericWork.find(asset2.id)
-        expect(doc[Solrizer.solr_name(:collection)]).to be_nil
+      it "removes members from the collection" do
+        # TODO: Using size until count is fixed https://github.com/projecthydra-labs/activefedora-aggregation/issues/78
+        expect {
+          put :update, id: collection,
+                       collection: { members: 'remove' },
+                       batch_document_ids: [asset2]
+        }.to change { collection.reload.members.size }.by(-1)
+        asset_results = ActiveFedora::SolrService.instance.conn.get 'select', params: { fq: ["id:\"#{asset2.id}\""], fl: ['id'] }
+        expect(asset_results['response']['numFound']).to eq 1
+
+        doc = asset_results['response']['docs'].first
+        expect(doc['id']).to eq asset2.id
       end
     end
 
-    context "updating a collections metadata" do
-      it "should save the metadata" do
-        put :update, id: collection, collection: { creator: ['Emily'] }
+    context 'updating a collections metadata' do
+      it 'saves the metadata' do
+        put :update, id: collection, collection: { creator: ['Emily'], visibility: 'open' }
         collection.reload
         expect(collection.creator).to eq ['Emily']
+        expect(collection.visibility).to eq 'open'
       end
 
-      it "should remove blank strings from params before updating Collection metadata" do
-        put :update, id: collection, collection: collection_attrs.merge(creator: [""])
-        expect(assigns[:collection].title).to eq("My First Collection ")
+      it 'removes blank strings from params before updating Collection metadata' do
+        put :update, id: collection, collection: collection_attrs.merge(creator: [''])
+        expect(assigns[:collection].title).to eq('My First Collection ')
         expect(assigns[:collection].creator).to eq([])
       end
-
     end
   end
 
-  describe "#show" do
-
-    context "when signed in" do
+  describe '#show' do
+    context 'when signed in' do
       before do
         sign_in user
-        [ asset1, asset2, asset3 ].map { |a| a.apply_depositor_metadata(user); a.save }
-        collection.members = [ asset1, asset2, asset3 ]
+        [asset1, asset2, asset3].map do |a|
+          a.apply_depositor_metadata(user)
+          a.save
+        end
+        collection.members = [asset1, asset2, asset3]
         collection.save
       end
 
-      it "should return the collection and its members" do
+      it 'returns the collection and its members' do
         get :show, id: collection
         expect(response).to be_successful
         expect(assigns[:presenter]).to be_kind_of CurationConcerns::CollectionPresenter
-        expect(assigns[:collection].title).to eq collection.title
+        expect(assigns[:presenter].title).to eq collection.title
         expect(assigns[:member_docs].map(&:id)).to match_array [asset1, asset2, asset3].map(&:id)
       end
     end
 
-    context "not signed in" do
+    context 'not signed in' do
       before do
-        collection.members = [ asset1, asset2, asset3 ]
+        collection.members = [asset1, asset2, asset3]
         collection.save
       end
-      it "should force me to log in" do
+      it 'forces me to log in' do
         get :show, id: collection
         expect(response).to redirect_to(main_app.new_user_session_path)
       end
     end
   end
 
-  describe "#edit" do
-
+  describe '#edit' do
     before { sign_in user }
 
-    it "should not show flash" do
+    it 'does not show flash' do
       get :edit, id: collection
       expect(flash[:notice]).to be_nil
     end

data/spec/controllers/curation_concerns/file_sets_controller_json_spec.rb

@@ -0,0 +1,106 @@
+require 'spec_helper'
+
+describe CurationConcerns::FileSetsController do
+  let(:user) { create(:user) }
+  let(:parent) { create(:generic_work, edit_users: [user.user_key], visibility: Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PUBLIC) }
+  let(:file_set) do
+    create(:file_set, user: user).tap do |file_set|
+      parent.members << file_set
+    end
+  end
+  let(:file) { fixture_file_upload('/world.png', 'image/png') }
+  let(:empty_file) { fixture_file_upload('/empty_file.txt', 'text/plain') }
+
+  before { sign_in user }
+
+  context "JSON" do
+    let(:resource) { file_set }
+    let(:resource_request) { get :show, id: resource, format: :json }
+    subject { response }
+    describe "unauthorized" do
+      before do
+        sign_out user
+        resource_request
+      end
+      it { is_expected.to respond_unauthorized }
+    end
+    describe "forbidden" do
+      before do
+        sign_in create(:user)
+        resource_request
+      end
+      it { is_expected.to respond_forbidden }
+    end
+    describe 'not found' do
+      before { get :show, id: "non-existent-pid", format: :json }
+      it { is_expected.to respond_not_found(description: 'Object non-existent-pid not found in solr') }
+    end
+
+    describe 'created' do
+      it "returns 201, renders jq_upload json template and sets location header" do
+        expect(controller.send(:actor)).to receive(:create_metadata).with(nil, parent, hash_including(:files, title: ['a title']))
+        expect(controller.send(:actor)).to receive(:create_content).with(file).and_return(true)
+
+        allow_any_instance_of(FileSet).to receive(:persisted?).and_return(true)
+        allow_any_instance_of(FileSet).to receive(:to_param).and_return('999')
+
+        post :create, file_set: { title: ['a title'], files: [file] }, parent_id: parent.id, format: :json
+
+        expect(assigns[:file_set]).to be_instance_of ::FileSet # this object is used by the jbuilder template
+        expect(controller).to render_template('curation_concerns/file_sets/jq_upload')
+        expect(response.status).to eq 201
+        created_resource = controller.curation_concern
+        expect(response.location).to eq main_app.curation_concerns_file_set_path(created_resource)
+      end
+    end
+    describe 'failed create: no file' do
+      before { post :create, file_set: { title: ["foo"] }, parent_id: parent.id, format: :json }
+      it { is_expected.to respond_bad_request(message: 'Error! No file to save') }
+    end
+    describe 'failed create: bad file' do
+      before { post :create, file_set: { files: ['not a file'] }, parent_id: parent.id, format: :json }
+      it { is_expected.to respond_bad_request(message: 'Error! No file for upload', description: 'unknown file') }
+    end
+    describe 'failed create: empty file' do
+      before { post :create, file_set: { files: [empty_file] }, parent_id: parent.id, format: :json }
+      it { is_expected.to respond_unprocessable_entity(errors: { files: "#{empty_file.original_filename} has no content! (Zero length file)" }, description: I18n.t('curation_concerns.api.unprocessable_entity.empty_file')) }
+    end
+    describe 'failed create: solr error' do
+      before do
+        allow(controller).to receive(:process_file).and_raise(RSolr::Error::Http.new(controller.request, response))
+        post :create, file_set: { files: [file] }, parent_id: parent.id, format: :json
+      end
+      it { is_expected.to respond_internal_error(message: 'Error occurred while creating generic file.') }
+    end
+    describe 'found' do
+      before { resource_request }
+      it "returns json of the work" do
+        expect(assigns[:file_set]).to be_instance_of ::FileSet # this object is used by the jbuilder template
+        expect(controller).to render_template('curation_concerns/file_sets/show')
+        expect(response.code).to eq "200"
+      end
+    end
+    describe 'updated' do
+      before { put :update, id: resource, file_set: { title: ['updated title'] }, format: :json }
+      it "returns json of updated work and sets location header" do
+        expect(assigns[:file_set]).to be_instance_of ::FileSet # this object is used by the jbuilder template
+        expect(controller).to render_template('curation_concerns/file_sets/show')
+        expect(response.status).to eq 200
+        created_resource = assigns[:file_set]
+        expect(response.location).to eq main_app.curation_concerns_file_set_path(created_resource)
+      end
+    end
+    describe 'failed update' do
+      before {
+        expect(controller).to receive(:update_metadata) do
+          controller.curation_concern.errors.add(:some_field, "This is not valid. Fix it.")
+          false
+        end
+        post :update, id: resource, file_set: { title: nil, depositor: nil }, format: :json
+      }
+      it "returns 422 and the errors" do
+        expect(response).to respond_unprocessable_entity(errors: { "some_field": ["This is not valid. Fix it."] })
+      end
+    end
+  end
+end

data/spec/controllers/curation_concerns/file_sets_controller_spec.rb

@@ -0,0 +1,237 @@
+require 'spec_helper'
+
+describe CurationConcerns::FileSetsController do
+  let(:user) { create(:user) }
+  let(:file) { fixture_file_upload('files/image.png', 'image/png') }
+  let(:parent) { create(:generic_work, edit_users: [user.user_key], visibility: Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PUBLIC) }
+
+  context 'when signed in' do
+    before { sign_in user }
+
+    describe '#create' do
+      before do
+        FileSet.destroy_all
+      end
+
+      context 'on the happy path' do
+        let(:date_today) { DateTime.now }
+
+        before do
+          allow(DateTime).to receive(:now).and_return(date_today)
+        end
+
+        it 'calls the actor to create metadata and content' do
+          expect(controller.send(:actor)).to receive(:create_metadata).with(nil, parent, files: [file], title: ['test title'], visibility: 'restricted')
+          expect(controller.send(:actor)).to receive(:create_content).with(file).and_return(true)
+          xhr :post, :create, parent_id: parent,
+                              file_set: { files: [file],
+                                          title: ['test title'],
+                                          visibility: 'restricted' }
+          expect(response).to be_success
+          expect(flash[:error]).to be_nil
+        end
+      end
+
+      context "on something that isn't a file" do
+        # Note: This is a duplicate of coverage in file_sets_controller_json_spec.rb
+        it 'renders error' do
+          xhr :post, :create, parent_id: parent, file_set: { files: ['hello'] },
+                              permission: { group: { 'public' => 'read' } }, terms_of_service: '1'
+          expect(response.status).to eq 400
+          msg = JSON.parse(response.body)['message']
+          expect(msg).to match(/no file for upload/i)
+        end
+      end
+
+      subject { create(:file_set) }
+      let(:file_path) { fixture_path + '/small_file.txt' }
+
+      context 'when the file has a virus' do
+        before do
+          allow(subject).to receive(:warn) # suppress virus warnings
+          allow(ClamAV.instance).to receive(:scanfile).and_return('EL CRAPO VIRUS')
+          of = subject.build_original_file
+          of.content = File.open(file_path)
+        end
+        it 'populates the errors hash during validation' do
+          expect(subject).to_not be_valid
+          expect(subject.errors.messages[:base].first).to match(/A virus was found in .*: EL CRAPO VIRUS/)
+        end
+      end
+
+      context 'when solr is down' do
+        before do
+          allow(controller.send(:actor)).to receive(:create_metadata)
+          allow(controller.send(:actor)).to receive(:create_content).with(file).and_raise(RSolr::Error::Http.new({}, {}))
+        end
+
+        it 'errors out of create after on continuous rsolr error' do
+          xhr :post, :create, parent_id: parent, file_set: { files: [file] },
+                              permission: { group: { 'public' => 'read' } }, terms_of_service: '1'
+          expect(response.body).to include('Error occurred while creating generic file.')
+        end
+      end
+    end
+
+    describe 'destroy' do
+      let(:file_set) do
+        file_set = FileSet.create! do |gf|
+          gf.apply_depositor_metadata(user)
+        end
+        parent.ordered_members << file_set
+        parent.save
+        file_set
+      end
+
+      it 'deletes the file' do
+        expect(FileSet.find(file_set.id)).to be_kind_of FileSet
+        delete :destroy, id: file_set
+        expect { FileSet.find(file_set.id) }.to raise_error Ldp::Gone
+        expect(response).to redirect_to main_app.curation_concerns_generic_work_path(parent)
+      end
+    end
+
+    describe 'update' do
+      let!(:file_set) do
+        file_set = FileSet.new.tap do |gf|
+          gf.apply_depositor_metadata(user)
+          gf.visibility = Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE
+          gf.save!
+        end
+        parent.ordered_members << file_set
+        parent.save
+        file_set
+      end
+
+      after do
+        file_set.destroy
+      end
+
+      context 'updating metadata' do
+        it 'is successful and update attributes' do
+          post :update, id: file_set, file_set:
+            { title: ['new_title'], tag: [''], permissions_attributes: [{ type: 'person', name: 'archivist1', access: 'edit' }] }
+          expect(response).to redirect_to main_app.curation_concerns_file_set_path(file_set)
+          expect(assigns[:file_set].title).to eq(['new_title'])
+        end
+
+        it 'goes back to edit on an error' do
+          allow_any_instance_of(FileSet).to receive(:valid?).and_return(false)
+          post :update, id: file_set, file_set:
+            { title: ['new_title'], tag: [''], permissions_attributes: [{ type: 'person', name: 'archivist1', access: 'edit' }] }
+          expect(response.status).to eq 422
+          expect(response).to render_template('edit')
+          expect(assigns[:file_set]).to eq file_set
+        end
+
+        context 'updating visibility' do
+          it 'applies public' do
+            new_visibility = Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PUBLIC
+            post :update, id: file_set, file_set: { visibility: new_visibility, embargo_release_date: '' }
+            expect(file_set.reload.visibility).to eq new_visibility
+          end
+
+          it 'applies embargo' do
+            post :update, id: file_set, file_set: {
+              visibility: 'embargo',
+              visibility_during_embargo: 'restricted',
+              embargo_release_date: '2099-09-05',
+              visibility_after_embargo: 'open',
+              visibility_during_lease: 'open',
+              lease_expiration_date: '2099-09-05',
+              visibility_after_lease: 'restricted'
+            }
+            file_set.reload
+            expect(file_set).to be_under_embargo
+            expect(file_set).to_not be_active_lease
+          end
+        end
+      end
+
+      context 'updating file content' do
+        it 'is successful' do
+          expect(IngestFileJob).to receive(:perform_later)
+          expect(CharacterizeJob).to receive(:perform_later).with(file_set.id, kind_of(String))
+          post :update, id: file_set, file_set: { files: [file] }
+          expect(response).to redirect_to main_app.curation_concerns_file_set_path(file_set)
+        end
+      end
+
+      context 'restoring an old version' do
+        before do
+          # don't run characterization jobs
+          allow(CharacterizeJob).to receive(:perform_later)
+          # Create version 1
+          Hydra::Works::AddFileToFileSet.call(file_set, File.open(fixture_file_path('small_file.txt')), :original_file)
+          # Create version 2
+          Hydra::Works::AddFileToFileSet.call(file_set, File.open(fixture_file_path('curation_concerns_generic_stub.txt')), :original_file)
+        end
+
+        # TODO: This test should move into the FileSetActor spec and just ensure the actor is called.
+        it 'is successful' do
+          expect(file_set.latest_content_version.label).to eq('version2')
+          expect(file_set.original_file.content).to eq("This is a test fixture for curation_concerns: <%= @id %>.\n")
+          post :update, id: file_set, revision: 'version1'
+          expect(response).to redirect_to main_app.curation_concerns_file_set_path(file_set)
+          reloaded = file_set.reload.original_file
+          expect(reloaded.versions.last.label).to eq 'version3'
+          expect(reloaded.content).to eq "small\n"
+          expect(reloaded.mime_type).to eq 'text/plain'
+        end
+      end
+    end
+  end
+
+  context 'someone elses (public) files' do
+    let(:creator) { create(:user, email: 'archivist1@example.com') }
+    let(:public_file_set) { create(:file_set, user: creator, read_groups: ['public']) }
+    before { sign_in user }
+
+    describe '#edit' do
+      it 'gives me the unauthorized page' do
+        get :edit, id: public_file_set
+        expect(response.code).to eq '401'
+        expect(response).to render_template(:unauthorized)
+      end
+    end
+
+    describe '#show' do
+      it 'allows access to the file' do
+        get :show, id: public_file_set
+        expect(response).to be_success
+      end
+    end
+  end
+
+  context 'when not signed in' do
+    let(:private_file_set) { create(:file_set) }
+    let(:public_file_set) { create(:file_set, read_groups: ['public']) }
+
+    describe '#edit' do
+      it 'requires login' do
+        get :edit, id: public_file_set
+        expect(response).to fail_redirect_and_flash(main_app.new_user_session_path, 'You are not authorized to access this page.')
+      end
+    end
+
+    describe '#show' do
+      it 'denies access to private files' do
+        get :show, id: private_file_set
+        expect(response).to fail_redirect_and_flash(main_app.new_user_session_path, 'You are not authorized to access this page.')
+      end
+
+      it 'allows access to public files' do
+        expect(controller).to receive(:additional_response_formats).with(ActionController::MimeResponds::Collector)
+        get :show, id: public_file_set
+        expect(response).to be_success
+      end
+    end
+
+    describe '#new' do
+      it 'does not let the user submit' do
+        get :new, parent_id: parent
+        expect(response).to fail_redirect_and_flash(main_app.new_user_session_path, 'You are not authorized to access this page.')
+      end
+    end
+  end
+end