ddr-core 0.2.1

data/config/locales/ddr-core.en.yml

@@ -0,0 +1,85 @@
+en:
+  ddr:
+    core:
+      errors:
+        incorrect_resource_class: "%{subject} must be a %{resource_class}"
+    index:
+      fields:
+        aleph_id:
+          label: "Aleph ID"
+        aspace_id:
+          label: "ArchivesSpace ID"
+        common_model_name:
+          label: "Common Model Name"
+        doi:
+          label: DOI
+        ead_id:
+          label: "EAD ID"
+        id:
+          label: ID
+          heading: id
+        local_id:
+          label: "Local ID"
+        permanent_id:
+          label: "Permanent ID"
+        permanent_url:
+          label: "Permanent URL"
+        resource_model:
+          label: Model
+          heading: model
+        streamable_media_url:
+          label: "Streamable Media URL"
+        created_at:
+          label: "Creation Date"
+          heading: creation_date
+        updated_at:
+          label: "Modification Date"
+          heading: modification_date
+        techmd_color_space:
+          label: "Color Space"
+          heading: color_space
+        techmd_creating_application:
+          label: "Creating Application"
+          heading: creating_application
+        techmd_creation_time:
+          label: "Creation Time"
+          heading: creation_time
+        techmd_file_size:
+          label: "File Size"
+          heading: "file_size"
+        techmd_fits_version:
+          label: "FITS Version"
+          heading: fits_version
+        techmd_fits_datetime:
+          label: "FITS Run At"
+          heading: fits_datetime
+        techmd_format_label:
+          label: "Format Label"
+          heading: format_label
+        techmd_format_version:
+          label: "Format Version"
+          heading: format_version
+        techmd_image_height:
+          label: "Image Height"
+          heading: image_height
+        techmd_image_width:
+          label: "Image Width"
+          heading: image_width
+        techmd_md5:
+          label: MD5
+          heading: md5
+        techmd_media_type:
+          label: "Media Type"
+          heading: media_type
+        techmd_modification_time:
+          label: "Modification Time"
+          heading: modification_time
+        techmd_pronom_identifier:
+          label: "PRONOM Unique ID"
+          heading: "pronom_uid"
+        techmd_valid:
+          label: Valid
+          heading: valid
+        techmd_well_formed:
+          label: "Well-formed"
+          heading: well_formed

data/config/routes.rb

@@ -0,0 +1,3 @@
+Rails.application.routes.draw do
+  devise_for :users, controllers: { omniauth_callbacks: "users/omniauth_callbacks", sessions: "users/sessions" }
+end

data/db/migrate/20141104181418_create_users.rb

@@ -0,0 +1,34 @@
+class CreateUsers < ActiveRecord::Migration[4.2]
+  def up
+    unless table_exists?("users")
+      create_table "users" do |t|
+        t.string   "email",                  default: "", null: false
+        t.string   "encrypted_password",     default: "", null: false
+        t.string   "reset_password_token"
+        t.datetime "reset_password_sent_at"
+        t.datetime "remember_created_at"
+        t.integer  "sign_in_count",          default: 0
+        t.datetime "current_sign_in_at"
+        t.datetime "last_sign_in_at"
+        t.string   "current_sign_in_ip"
+        t.string   "last_sign_in_ip"
+        t.datetime "created_at",                          null: false
+        t.datetime "updated_at",                          null: false
+        t.string   "username",               default: "", null: false
+        t.string   "first_name"
+        t.string   "middle_name"
+        t.string   "nickname"
+        t.string   "last_name"
+        t.string   "display_name"
+      end
+
+      add_index "users", ["email"], name: "index_users_on_email"
+      add_index "users", ["reset_password_token"], name: "index_users_on_reset_password_token", unique: true
+      add_index "users", ["username"], name: "index_users_on_username", unique: true
+    end
+  end
+
+  def down
+    raise ActiveRecord::IrreversibleMigration
+  end
+end

data/db/migrate/20141107124012_add_columns_to_user.rb

@@ -0,0 +1,46 @@
+class AddColumnsToUser < ActiveRecord::Migration[4.2]
+  def up
+    if table_exists?("users")
+      unless column_exists?("users", "username")
+        add_column "users", "username", :string, default: "", null: false
+      end
+      unless column_exists?("users", "first_name")
+        add_column "users", "first_name", :string
+      end
+      unless column_exists?("users", "middle_name")
+        add_column "users", "middle_name", :string
+      end
+      unless column_exists?("users", "nickname")
+        add_column "users", "nickname", :string
+      end
+      unless column_exists?("users", "last_name")
+        add_column "users", "last_name", :string
+      end
+      unless column_exists?("users", "display_name")
+        add_column "users", "display_name", :string
+      end
+
+      # If the email index exists and is set such that email must be unique (which is the initial
+      # setting typically set by Devise(?)), remove and we'll re-add it as non-unique below.
+      if index_exists?("users", ["email"])
+        if index_exists?("users", ["email"], unique: true)
+          remove_index "users", ["email"]
+        end
+      end
+
+      # Either the email index didn't exist when we started or, more likely, we removed above
+      # because it existed but required email to be unique.
+      unless index_exists?("users", ["email"])
+        add_index "users", ["email"], name: "index_users_on_email"
+      end
+
+      unless index_exists?("users", ["username"])
+        add_index "users", ["username"], name: "index_users_on_username", unique: true
+      end
+    end
+  end
+
+  def down
+    raise ActiveRecord::IrreversibleMigration
+  end
+end

data/lib/ddr-core.rb

@@ -0,0 +1 @@
+require 'ddr/core'

data/lib/ddr/auth.rb

@@ -0,0 +1,80 @@
+module Ddr
+  module Auth
+    extend ActiveSupport::Autoload
+
+    autoload :Ability
+    autoload :AbilityDefinitions
+    autoload :AbilityFactory
+    autoload :AbstractAbility
+    autoload :Affiliation
+    autoload :AffiliationGroups
+    autoload :AnonymousAbility
+    autoload :AuthContext
+    autoload :AuthContextFactory
+    autoload :DetachedAuthContext
+    autoload :DynamicGroups
+    autoload :EffectivePermissions
+    autoload :EffectiveRoles
+    autoload :FailureApp
+    autoload :Group
+    autoload :GrouperGateway
+    autoload :Groups
+    autoload :LdapGateway
+    autoload :Permissions
+    autoload :RemoteGroups
+    autoload :RoleBasedAccessControlsEnforcement
+    autoload :Roles
+    autoload :SuperuserAbility
+    autoload :User
+    autoload :WebAuthContext
+
+    autoload_under 'ability_definitions' do
+      autoload :AdminSetAbilityDefinitions
+      autoload :AliasAbilityDefinitions
+      autoload :AttachmentAbilityDefinitions
+      autoload :CollectionAbilityDefinitions
+      autoload :ComponentAbilityDefinitions
+      autoload :ItemAbilityDefinitions
+      autoload :PublicationAbilityDefinitions
+      autoload :LockAbilityDefinitions
+      autoload :RoleBasedAbilityDefinitions
+      autoload :SuperuserAbilityDefinitions
+    end
+
+    # Name of group whose members are authorized to act as superuser
+    mattr_accessor :superuser_group
+
+    # Name of group whose members are authorized to create Collections
+    mattr_accessor :collection_creators_group
+
+    # Name of group whose members are authorized to act as a metadata manager
+    mattr_accessor :metadata_managers_group
+
+    # Whether to require Shibboleth authentication
+    mattr_accessor :require_shib_user_authn do
+      false
+    end
+
+    # Grouper gateway implementation
+    mattr_accessor :grouper_gateway do
+      GrouperGateway
+    end
+
+    # LDAP gateway implementation
+    mattr_accessor :ldap_gateway do
+      LdapGateway
+    end
+
+    mattr_accessor :default_ability do
+      "::Ability"
+    end
+
+    def self.repository_group_filter
+      if filter = ENV["REPOSITORY_GROUP_FILTER"]
+        return filter
+      end
+      raise Ddr::Error, "The \"REPOSITORY_GROUP_FILTER\" environment variable is not set."
+    end
+
+  end
+end

data/lib/ddr/auth/ability.rb

@@ -0,0 +1,18 @@
+module Ddr
+  module Auth
+    class Ability < AbstractAbility
+
+      self.ability_definitions = [ AliasAbilityDefinitions,
+                                   CollectionAbilityDefinitions,
+                                   ItemAbilityDefinitions,
+                                   ComponentAbilityDefinitions,
+                                   AttachmentAbilityDefinitions,
+                                   RoleBasedAbilityDefinitions,
+                                   PublicationAbilityDefinitions,
+                                   LockAbilityDefinitions,
+                                   AdminSetAbilityDefinitions,
+                                 ]
+
+    end
+  end
+end

data/lib/ddr/auth/ability_definitions.rb

@@ -0,0 +1,26 @@
+require "delegate"
+
+module Ddr
+  module Auth
+    #
+    # A class which applies ability definitions to the delegated ability class
+    # when `#call` is invoked.
+    #
+    # @abstract
+    #
+    class AbilityDefinitions < SimpleDelegator
+
+      # Applies ability definitions to the ability and return it
+      def self.call(ability)
+        new(ability).call
+        ability
+      end
+
+      # Applies abilities definitions with `can` and `cannot`.
+      def call
+        raise NotImplementedError, "Subclasses must implement `#call`."
+      end
+
+    end
+  end
+end

data/lib/ddr/auth/ability_definitions/admin_set_ability_definitions.rb

@@ -0,0 +1,9 @@
+module Ddr::Auth
+  class AdminSetAbilityDefinitions < AbilityDefinitions
+
+    def call
+      can :export, Ddr::AdminSet if metadata_manager?
+    end
+
+  end
+end

data/lib/ddr/auth/ability_definitions/alias_ability_definitions.rb

@@ -0,0 +1,23 @@
+module Ddr
+  module Auth
+    class AliasAbilityDefinitions < AbilityDefinitions
+
+      FILE_REQUIRES_DOWNLOAD = %i( content extracted_text )
+      DEFAULT_FILE_PERMISSION = :read
+
+      DOWNLOAD_ALIASES = Ddr::Resource::FILE_FIELDS.each_with_object({}) do |field, memo|
+        action = [ :download, field ].join('_').to_sym # e.g., :download_content
+        memo[action] = FILE_REQUIRES_DOWNLOAD.include?(field) ? :download : DEFAULT_FILE_PERMISSION
+      end
+
+      def call
+        alias_action :upload, to: :replace
+        alias_action :add_attachment, to: :add_children
+        DOWNLOAD_ALIASES.each do |action, permission|
+          alias_action action, to: permission
+        end
+      end
+
+    end
+  end
+end

data/lib/ddr/auth/ability_definitions/attachment_ability_definitions.rb

@@ -0,0 +1,13 @@
+module Ddr
+  module Auth
+    class AttachmentAbilityDefinitions < AbilityDefinitions
+
+      def call
+        can :create, Ddr::Attachment do |obj|
+          obj.attached_to.present? && can?(:add_attachment, obj.attached_to)
+        end
+      end
+
+    end
+  end
+end

data/lib/ddr/auth/ability_definitions/collection_ability_definitions.rb

@@ -0,0 +1,28 @@
+module Ddr
+  module Auth
+    class CollectionAbilityDefinitions < AbilityDefinitions
+
+      def call
+        if member_of? Ddr::Auth.collection_creators_group
+          can :create, Ddr::Collection
+        end
+        can :export, Ddr::Collection do |obj|
+          has_policy_permission?(obj, Permissions::READ)
+        end
+      end
+
+      private
+
+      def policy_permissions(obj)
+        obj.policy_roles
+          .select { |r| agents.include?(r.agent) }
+          .map(&:permissions).flatten.uniq
+      end
+
+      def has_policy_permission?(obj, perm)
+        policy_permissions(obj).include?(perm)
+      end
+
+    end
+  end
+end

data/lib/ddr/auth/ability_definitions/component_ability_definitions.rb

@@ -0,0 +1,13 @@
+module Ddr
+  module Auth
+    class ComponentAbilityDefinitions < AbilityDefinitions
+
+      def call
+        can :create, Ddr::Component do |obj|
+          obj.parent.present? && can?(:add_children, obj.parent)
+        end
+      end
+
+    end
+  end
+end

data/lib/ddr/auth/ability_definitions/item_ability_definitions.rb

@@ -0,0 +1,13 @@
+module Ddr
+  module Auth
+    class ItemAbilityDefinitions < AbilityDefinitions
+
+      def call
+        can :create, Ddr::Item do |obj|
+          obj.parent.present? && can?(:add_children, obj.parent)
+        end
+      end
+
+    end
+  end
+end

data/lib/ddr/auth/ability_definitions/lock_ability_definitions.rb

@@ -0,0 +1,13 @@
+module Ddr
+  module Auth
+    class LockAbilityDefinitions < AbilityDefinitions
+
+      DENIED_WHEN_LOCKED = [ :add_children, :update, :replace, :arrange, :grant ]
+
+      def call
+        cannot DENIED_WHEN_LOCKED, Ddr::Resource, :locked? => true
+      end
+
+    end
+  end
+end

data/lib/ddr/auth/ability_definitions/publication_ability_definitions.rb

@@ -0,0 +1,16 @@
+module Ddr
+  module Auth
+    class PublicationAbilityDefinitions < AbilityDefinitions
+
+      def call
+        cannot :publish, Ddr::Resource do |obj|
+          obj.published? || !obj.publishable?
+        end
+        cannot :unpublish, Ddr::Resource do |obj|
+          !obj.published?
+        end
+      end
+
+    end
+  end
+end

data/lib/ddr/auth/ability_definitions/role_based_ability_definitions.rb

@@ -0,0 +1,39 @@
+module Ddr
+  module Auth
+    class RoleBasedAbilityDefinitions < AbilityDefinitions
+
+      def call
+        Permissions::ALL.each do |permission|
+          can permission, [ Ddr::Resource, ::SolrDocument, String ] do |obj|
+            has_permission? permission, obj
+          end
+        end
+      end
+
+      private
+
+      def has_permission?(permission, object_or_id)
+        permissions(object_or_id).include? permission
+      end
+
+      def permissions(object_or_id)
+        case object_or_id
+        when Ddr::Resource, ::SolrDocument
+          cached_permissions(object_or_id.id) do
+            object_or_id.effective_permissions(agents)
+          end
+        when String
+          cached_permissions(object_or_id) do
+            doc = ::SolrDocument.find(object_or_id) # raises SolrDocument::NotFound
+            doc.effective_permissions(agents)
+          end
+        end
+      end
+
+      def cached_permissions(pid, &block)
+        cache[pid] ||= block.call
+      end
+
+    end
+  end
+end