curation_concerns 1.7.4 → 1.7.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 0264d3ffe1409c035fd9849f11c7ade0dc92c3c1
-  data.tar.gz: 912f6765b87b3ebe922ccc17ea4689925fe03acb
+  metadata.gz: 7cbc4d586d8a888783288ea71618e421913333e2
+  data.tar.gz: 4ed7bc09f54922ac00db7d241938468995f898a1
 SHA512:
-  metadata.gz: 24a1f4ca059a85819570ea0d2df252ab03e340fccb56e33d342f9af452272d60ac43677adb4b5aa374391fc07b01b36c3b30b060739941bc64c66294937dc2aa
-  data.tar.gz: a8ecc0679718f7c9f4f9e942c0fd2d97a25564a085e6bf7e5f6c1daf0714348a2ca95627af4218f61ea633dc8f4535ebc01fc83f5e8b05a560fa8fe71515691d
+  metadata.gz: 8c4172a085ae5540b7b771e33fb1633939ed428711a0512303ebdf4936d46b26c6dd15ed8bc666260a604078d56c875a9751740fd62173a938766a8550275637
+  data.tar.gz: 7260137bd947008030ac1c4786c623f31398903e8cfb7b0f811b3c12ea8a0b4d7018113ddb43656f4cd4d4ea72dcb30ab3ee798e34757dcefdd318c9573ccecd

data/app/actors/curation_concerns/actors/add_to_work_actor.rb

@@ -13,6 +13,14 @@ module CurationConcerns
 
       private
 
+        def ability
+          ::Ability.new(user)
+        end
+
+        def can_edit_both_works?(work)
+          ability.can?(:edit, work) && ability.can?(:edit, curation_concern)
+        end
+
         def add_to_works(new_work_ids)
           return true if new_work_ids.nil?
           (curation_concern.in_works_ids - new_work_ids).each do |old_id|
@@ -22,13 +30,17 @@ module CurationConcerns
             work.save
           end
 
-          # add to new
+          # add to new so long as the depositor for the parent and child matches, otherwise inject an error
           (new_work_ids - curation_concern.in_works_ids).each do |work_id|
             work = ::ActiveFedora::Base.find(work_id)
-            work.ordered_members << curation_concern
-            work.save
+            if can_edit_both_works?(work)
+              work.ordered_members << curation_concern
+              work.save
+            else
+              curation_concern.errors[:in_works_ids] << "Works can only be related to each other if user has ability to edit both."
+            end
           end
-          true
+          curation_concern.errors[:in_works_ids].empty?
         end
     end
   end

data/app/actors/curation_concerns/actors/apply_order_actor.rb

@@ -3,12 +3,19 @@ module CurationConcerns
     class ApplyOrderActor < AbstractActor
       def update(attributes)
         ordered_member_ids = attributes.delete(:ordered_member_ids)
-        sync_members(ordered_member_ids)
-        apply_order(ordered_member_ids) && next_actor.update(attributes)
+        sync_members(ordered_member_ids) && apply_order(ordered_member_ids) && next_actor.update(attributes)
       end
 
       private
 
+        def ability
+          ::Ability.new(user)
+        end
+
+        def can_edit_both_works?(work)
+          ability.can?(:edit, work) && ability.can?(:edit, curation_concern)
+        end
+
         def sync_members(ordered_member_ids)
           return true if ordered_member_ids.nil?
           existing_members_ids = curation_concern.ordered_member_ids
@@ -20,10 +27,14 @@ module CurationConcerns
 
           (ordered_member_ids - existing_members_ids).each do |work_id|
             work = ::ActiveFedora::Base.find(work_id)
-            curation_concern.ordered_members << work
+            if can_edit_both_works?(work)
+              curation_concern.ordered_members << work
+              curation_concern.save
+            else
+              curation_concern.errors[:ordered_member_ids] << "Works can only be related to each other if user has ability to edit both."
+            end
           end
-          curation_concern.save
-          true
+          curation_concern.errors[:ordered_member_ids].empty?
         end
 
         def apply_order(new_order)

data/app/forms/curation_concerns/forms/file_manager_form.rb

@@ -20,7 +20,7 @@ module CurationConcerns
       private
 
         def member_presenter_factory
-          MemberPresenterFactory.new(work, ability)
+          MemberPresenterFactory.new(model, current_ability)
         end
     end
   end

data/app/presenters/curation_concerns/admin/workflow_role_presenter.rb

@@ -16,6 +16,10 @@ module CurationConcerns
           @agent = agent
         end
 
+        def responsibilities_present?
+          @agent.workflow_responsibilities.any?
+        end
+
         def responsibilities
           @agent.workflow_responsibilities.each do |responsibility|
             yield ResponsibilityPresenter.new(responsibility)

data/app/services/curation_concerns/workflow/permission_query.rb

@@ -257,7 +257,10 @@ module CurationConcerns
             .and(entity_responsibilities[:entity_id].eq(entity.id))
         )
 
-        sub_query_for_user = agent_table.project(agent_table[:proxy_for_id]).where(
+        # PostgreSQL requires an explicit cast from string to integer
+        cast = Arel::Nodes::NamedFunction.new "CAST", [agent_table[:proxy_for_id].as("integer")]
+
+        sub_query_for_user = agent_table.project(cast).where(
           agent_table[:id].in(workflow_agent_id_subquery)
             .or(agent_table[:id].in(entity_agent_id_subquery))
         ).where(

data/app/views/curation_concerns/admin/workflow_roles/index.html.erb

@@ -11,7 +11,7 @@
           <tr>
             <td><%= user.user_key %></td>
             <% agent_presenter = @presenter.presenter_for(user) %>
-            <% if agent_presenter %>
+            <% if agent_presenter && agent_presenter.responsibilities_present? %>
               <td>
                 <ul>
                   <% agent_presenter.responsibilities do |responsibility_presenter| %>
@@ -42,4 +42,3 @@
     </div>
   </div>
 </div>
-

data/app/views/curation_concerns/base/_form.html.erb

@@ -4,6 +4,8 @@
     <div class="alert alert-danger fade in">
       <strong>Wait don't go!</strong> There was a problem with your submission. Please review the errors below:
       <a class="close" data-dismiss="alert" href="#">&times;</a>
+      <%= render 'form_in_works_error', f: f %>
+      <%= render 'form_ordered_members_error', f: f %>
     </div>
   <% end %>
 

data/app/views/curation_concerns/base/_form_in_works_error.html.erb

@@ -0,0 +1,3 @@
+<% unless f.object.model.errors[:in_works_ids].empty? %>
+  <%= f.full_error(:in_works_ids) %>
+<% end %>

data/app/views/curation_concerns/base/_form_ordered_members_error.html.erb

@@ -0,0 +1,3 @@
+<% unless f.object.model.errors[:ordered_member_ids].empty? %>
+  <%= f.full_error(:ordered_member_ids) %>
+<% end %>

data/lib/curation_concerns/version.rb

@@ -1,3 +1,3 @@
 module CurationConcerns
-  VERSION = '1.7.4'.freeze
+  VERSION = '1.7.5'.freeze
 end

data/spec/actors/curation_concerns/apply_order_actor_spec.rb

@@ -78,5 +78,25 @@ describe CurationConcerns::Actors::ApplyOrderActor do
         expect(curation_concern.ordered_member_ids.size).to eq(1)
       end
     end
+
+    context 'with ordered_member_ids that include a work owned by a different user' do
+      # set user not a non-admin for this test to ensure the actor disallows adding the child
+      let(:user) { create(:user) }
+      let(:other_user) { create(:user) }
+      let(:child) { create(:generic_work, user: other_user) }
+      let(:attributes) { { ordered_member_ids: [child.id] } }
+      let(:root_actor) { double }
+
+      before do
+        allow(CurationConcerns::Actors::RootActor).to receive(:new).and_return(root_actor)
+        allow(root_actor).to receive(:update).with({}).and_return(true)
+        curation_concern.apply_depositor_metadata(user.user_key)
+        curation_concern.save!
+      end
+
+      it "does not attach the work" do
+        expect(subject.update(attributes)).to be false
+      end
+    end
   end
 end

data/spec/actors/curation_concerns/work_actor_spec.rb

@@ -81,7 +81,7 @@ describe CurationConcerns::Actors::GenericWorkActor do
       end
 
       context 'with in_work_ids' do
-        let(:parent) { FactoryGirl.create(:generic_work) }
+        let(:parent) { create(:generic_work, user: user) }
         let(:attributes) do
           FactoryGirl.attributes_for(:generic_work, visibility: visibility).merge(
             in_works_ids: [parent.id]
@@ -91,6 +91,11 @@ describe CurationConcerns::Actors::GenericWorkActor do
           expect(subject.create(attributes)).to be true
           expect(curation_concern.in_works).to eq [parent]
         end
+        it "does not attach the parent" do
+          allow(curation_concern).to receive(:depositor).and_return("blahblahblah")
+          expect(subject.create(attributes)).to be false
+          expect(curation_concern.in_works).to eq []
+        end
       end
 
       context 'with a file' do
@@ -190,23 +195,20 @@ describe CurationConcerns::Actors::GenericWorkActor do
     end
 
     context 'with in_works_ids' do
-      let(:parent) { FactoryGirl.create(:generic_work) }
-      let(:old_parent) { FactoryGirl.create(:generic_work) }
+      let(:parent) { create(:generic_work, user: user) }
+      let(:old_parent) { create(:generic_work, user: user) }
       let(:attributes) do
         FactoryGirl.attributes_for(:generic_work).merge(
           in_works_ids: [parent.id]
         )
       end
       before do
-        curation_concern.apply_depositor_metadata(user.user_key)
-        curation_concern.save!
         old_parent.ordered_members << curation_concern
         old_parent.save!
       end
       it "attaches the parent" do
         expect(subject.update(attributes)).to be true
         expect(curation_concern.in_works).to eq [parent]
-
         expect(old_parent.reload.members).to eq []
       end
     end
@@ -224,6 +226,7 @@ describe CurationConcerns::Actors::GenericWorkActor do
         old_parent.save!
       end
       it "removes the old parent" do
+        allow(curation_concern).to receive(:depositor).and_return(old_parent.depositor)
         expect(subject.update(attributes)).to be true
         expect(curation_concern.in_works).to eq []
         expect(old_parent.reload.members).to eq []

data/spec/features/create_child_work_spec.rb

@@ -6,12 +6,12 @@ feature 'Creating a new child Work', :workflow do
   let!(:sipity_entity) do
     create(:sipity_entity, proxy_for_global_id: parent.to_global_id.to_s)
   end
-  let(:redlock_client_stub) { # stub out redis connection
+  let(:redlock_client_stub) do # stub out redis connection
     client = double('redlock client')
     allow(client).to receive(:lock).and_yield(true)
     allow(Redlock::Client).to receive(:new).and_return(client)
     client
-  }
+  end
   let!(:parent) { create(:generic_work, user: user, title: ["Parent First"]) }
 
   before do
@@ -64,5 +64,19 @@ feature 'Creating a new child Work', :workflow do
 
       expect(curation_concern.reload.in_works_ids.length).to eq 2
     end
+
+    context "with a parent that doesn't belong to this user" do
+      let(:new_user) { create(:user) }
+      let(:new_parent) { create(:generic_work, user: new_user) }
+      it "fails to update" do
+        visit "/concern/parent/#{parent.id}/generic_works/#{curation_concern.id}/edit"
+        first("input#generic_work_in_works_ids", visible: false).set new_parent.id
+        first("input#parent_id", visible: false).set new_parent.id
+        click_on "Update Generic work"
+
+        expect(new_parent.reload.ordered_members.to_a.length).to eq 0
+        expect(page).to have_content "Works can only be related to each other if user has ability to edit both."
+      end
+    end
   end
 end

data/spec/forms/curation_concerns/forms/file_manager_form_spec.rb

@@ -0,0 +1,19 @@
+require 'spec_helper'
+
+RSpec.describe CurationConcerns::Forms::FileManagerForm do
+  let(:work) { create(:work) }
+  let(:ability) { instance_double Ability }
+  let(:form) { described_class.new(work, ability) }
+
+  describe "#member_presenters" do
+    subject { form.member_presenters }
+    let(:factory) { instance_double(CurationConcerns::MemberPresenterFactory, member_presenters: result) }
+    let(:result) { double }
+    before do
+      allow(CurationConcerns::MemberPresenterFactory).to receive(:new).with(work, ability).and_return(factory)
+    end
+    it "is delegated to the MemberPresenterFactory" do
+      expect(subject).to eq result
+    end
+  end
+end

data/spec/views/curation_concerns/admin/workflow_roles/index.html.erb_spec.rb

@@ -0,0 +1,33 @@
+require 'spec_helper'
+
+describe 'curation_concerns/admin/workflow_roles/index.html.erb', type: :view do
+  let!(:user1) { create(:user) }
+  let!(:user2) { create(:user) }
+  let(:presenter) do
+    CurationConcerns::Admin::WorkflowRolePresenter.new
+  end
+
+  before do
+    assign(:presenter, presenter)
+    allow(view).to receive(:admin_workflow_roles_path).and_return('/admin/workflow_roles')
+  end
+
+  context 'with no users having workflow roles' do
+    it 'displays "No Roles" for each user' do
+      render
+      expect(rendered).to have_content('No roles', count: 2)
+    end
+  end
+
+  context 'with some users having workflow roles' do
+    before do
+      # Force user instances to have corresponding sipity agents
+      user1.to_sipity_agent
+      user2.to_sipity_agent
+    end
+    it 'displays roles for each user' do
+      render
+      expect(rendered.match(/<ul>\s+<\/ul>/m)).to be nil
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: curation_concerns
 version: !ruby/object:Gem::Version
-  version: 1.7.4
+  version: 1.7.5
 platform: ruby
 authors:
 - Matt Zumwalt
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-02-07 00:00:00.000000000 Z
+date: 2017-03-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: hydra-head
@@ -1134,7 +1134,9 @@ files:
 - app/views/curation_concerns/base/_form_descriptive_fields.html.erb
 - app/views/curation_concerns/base/_form_files_and_links.html.erb
 - app/views/curation_concerns/base/_form_in_works.html.erb
+- app/views/curation_concerns/base/_form_in_works_error.html.erb
 - app/views/curation_concerns/base/_form_media.html.erb
+- app/views/curation_concerns/base/_form_ordered_members_error.html.erb
 - app/views/curation_concerns/base/_form_permission.html.erb
 - app/views/curation_concerns/base/_form_permission_embargo.html.erb
 - app/views/curation_concerns/base/_form_permission_lease.html.erb
@@ -1376,6 +1378,7 @@ files:
 - spec/features/work_generator_spec.rb
 - spec/features/workflow_roles_spec.rb
 - spec/forms/collection_edit_form_spec.rb
+- spec/forms/curation_concerns/forms/file_manager_form_spec.rb
 - spec/forms/curation_concerns/forms/workflow_action_form_spec.rb
 - spec/forms/curation_concerns/forms/workflow_responsibility_form_spec.rb
 - spec/forms/file_set_edit_form_spec.rb
@@ -1548,6 +1551,7 @@ files:
 - spec/views/curation_concerns/admin/_total_objects_charts.html.erb_spec.rb
 - spec/views/curation_concerns/admin/index.html.erb_spec.rb
 - spec/views/curation_concerns/admin/widgets/_pie.html.erb_spec.rb
+- spec/views/curation_concerns/admin/workflow_roles/index.html.erb_spec.rb
 - spec/views/curation_concerns/base/_attributes.html.erb_spec.rb
 - spec/views/curation_concerns/base/_form.html.erb_spec.rb
 - spec/views/curation_concerns/base/_form_rights_spec.rb
@@ -1597,7 +1601,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.8
+rubygems_version: 2.5.1
 signing_key: 
 specification_version: 4
 summary: A Rails Engine that allows an application to CRUD CurationConcern objects
@@ -1673,6 +1677,7 @@ test_files:
 - spec/features/work_generator_spec.rb
 - spec/features/workflow_roles_spec.rb
 - spec/forms/collection_edit_form_spec.rb
+- spec/forms/curation_concerns/forms/file_manager_form_spec.rb
 - spec/forms/curation_concerns/forms/workflow_action_form_spec.rb
 - spec/forms/curation_concerns/forms/workflow_responsibility_form_spec.rb
 - spec/forms/file_set_edit_form_spec.rb
@@ -1845,6 +1850,7 @@ test_files:
 - spec/views/curation_concerns/admin/_total_objects_charts.html.erb_spec.rb
 - spec/views/curation_concerns/admin/index.html.erb_spec.rb
 - spec/views/curation_concerns/admin/widgets/_pie.html.erb_spec.rb
+- spec/views/curation_concerns/admin/workflow_roles/index.html.erb_spec.rb
 - spec/views/curation_concerns/base/_attributes.html.erb_spec.rb
 - spec/views/curation_concerns/base/_form.html.erb_spec.rb
 - spec/views/curation_concerns/base/_form_rights_spec.rb