ddr-models 2.4.15 → 2.4.16

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: b36660eee0bd55bbbbbe5ec8ee9c0b69291bd46e
-  data.tar.gz: b0b5714f775e92d23fa50f1cfd2d0286dce8c17f
+  metadata.gz: f83d8acaf696ecb6e92b5958efd1d09c9727acf1
+  data.tar.gz: d6af219cbb3395901762d0eb5f4a1f60c6b2ce0e
 SHA512:
-  metadata.gz: 894ff0cff82bc9bb72102b741a4959e69d06bd3d8a0c62f8322d9ff5478834b95fdab8491eb2829230c9f466ec099e3c3f6d7d96bf923f62f5815ed149f750ec
-  data.tar.gz: 4656487fb2cce3c1c5a62150b0733a4ccb22ae0c19f38f2e7407b87762c995c6f17cd3fe56077452651509c916e61a225f9ba702eb62b8f0edbc8502f99fcbdb
+  metadata.gz: 76e0f78041619d77258e3877f2dc587cb204e18c75b1be5e85ab7c883ac45ec5dec92cbfc2ab8d77306677d300bb831e2e1ce5dfa7e0e67a41d3f1adeb4a8963
+  data.tar.gz: 4f6c466ac5ed669cd23babebff7ef3b7cb2a0f62c957b02e6967121f6b75f950e62b77440994cfc7ffc942690be7b5558f0d119f9ffa0747404d5d72517479c3

data/lib/ddr/auth.rb

@@ -32,6 +32,7 @@ module Ddr
     autoload :WebAuthContext
 
     autoload_under 'ability_definitions' do
+      autoload :AdminSetAbilityDefinitions
       autoload :AliasAbilityDefinitions
       autoload :AttachmentAbilityDefinitions
       autoload :CollectionAbilityDefinitions
@@ -108,6 +109,10 @@ module Ddr
       "::Ability"
     end
 
+    mattr_accessor :metadata_managers_group do
+      ENV["METADATA_MANAGERS_GROUP"]
+    end
+
     def self.repository_group_filter
       if filter = ENV["REPOSITORY_GROUP_FILTER"]
         return filter

data/lib/ddr/auth/ability.rb

@@ -11,7 +11,9 @@ module Ddr
                                    DatastreamAbilityDefinitions,
                                    EventAbilityDefinitions,
                                    PublicationAbilityDefinitions,
-                                   LockAbilityDefinitions ]
+                                   LockAbilityDefinitions,
+                                   AdminSetAbilityDefinitions,
+                                 ]
 
     end
   end

data/lib/ddr/auth/ability_definitions/admin_set_ability_definitions.rb

@@ -0,0 +1,9 @@
+module Ddr::Auth
+  class AdminSetAbilityDefinitions < AbilityDefinitions
+
+    def call
+      can :export, Ddr::Models::AdminSet if metadata_manager?
+    end
+
+  end
+end

data/lib/ddr/auth/ability_factory.rb

@@ -1,32 +1,9 @@
 module Ddr::Auth
   class AbilityFactory
 
-    private_class_method :new
-
     def self.call(user = nil, env = nil)
-      new(user, env).call
-    end
-
-    attr_reader :auth_context
-
-    delegate :anonymous?, :superuser?, to: :auth_context
-    
-    def initialize(user, env)
-      @auth_context = AuthContextFactory.call(user, env)
-    end
-
-    def call
-      if anonymous?
-        AnonymousAbility.new(auth_context)
-      elsif superuser?
-        SuperuserAbility.new(auth_context)
-      else
-        default_ability.new(auth_context)
-      end
-    end
-
-    def default_ability
-      Ddr::Auth::default_ability.constantize
+      auth_context = AuthContextFactory.call(user, env)
+      auth_context.ability
     end
 
   end

data/lib/ddr/auth/abstract_ability.rb

@@ -17,7 +17,8 @@ module Ddr::Auth
 
     attr_reader :auth_context
 
-    delegate :anonymous?, :authenticated?, :user, :groups, :agents, :member_of?,
+    delegate :anonymous?, :authenticated?, :metadata_manager?,
+             :user, :groups, :agents, :member_of?,
              :authorized_to_act_as_superuser?,
              to: :auth_context
 

data/lib/ddr/auth/auth_context.rb

@@ -9,6 +9,20 @@ module Ddr::Auth
       @env = env
     end
 
+    def ability
+      if anonymous?
+        AnonymousAbility.new(self)
+      elsif superuser?
+        SuperuserAbility.new(self)
+      else
+        default_ability_class.new(self)
+      end
+    end
+
+    def default_ability_class
+      Ddr::Auth::default_ability.constantize
+    end
+
     # Return whether a user is absent from the auth context.
     # @return [Boolean]
     def anonymous?
@@ -27,6 +41,10 @@ module Ddr::Auth
       env && env.key?("warden") && env["warden"].authenticate?(scope: :superuser)
     end
 
+    def metadata_manager?
+      member_of? Ddr::Auth.metadata_managers_group
+    end
+
     # Return the user agent for this context.
     # @return [String] or nil, if auth context is anonymous/
     def agent

data/lib/ddr/auth/auth_context_factory.rb

@@ -1,8 +1,6 @@
 module Ddr::Auth
   class AuthContextFactory
 
-    private_class_method :new
-
     def self.call(user = nil, env = nil)
       if env
         WebAuthContext.new(user, env)

data/lib/ddr/models/version.rb

@@ -1,5 +1,5 @@
 module Ddr
   module Models
-    VERSION = "2.4.15"
+    VERSION = "2.4.16"
   end
 end

data/spec/auth/ability_factory_spec.rb

@@ -1,7 +1,24 @@
 module Ddr::Auth
   RSpec.describe AbilityFactory do
 
-    # write tests or delete this module
+    describe ".call" do
+      subject { described_class.call(user, env) }
+
+      describe "anonymous context" do
+        let(:user) { nil }
+        let(:env) { Hash.new }
+        it { is_expected.to be_a(AnonymousAbility) }
+      end
+
+      describe "superuser context" do
+        let(:user) { FactoryGirl.create(:user) }
+        let(:env) { Hash.new }
+        before {
+          allow_any_instance_of(AuthContext).to receive(:superuser?) { true }
+        }
+        it { is_expected.to be_a(SuperuserAbility) }
+      end
+    end
 
   end
 end

data/spec/auth/ability_spec.rb

@@ -56,6 +56,23 @@ module Ddr::Auth
       end
     end
 
+    describe "AdminSet abilities" do
+      describe "export" do
+        describe "when the user is a metadata manager" do
+          before {
+            allow(auth_context).to receive(:metadata_manager?) { true }
+          }
+          it { is_expected.to be_able_to(:export, Ddr::Models::AdminSet) }
+        end
+        describe "when the user is a metadata manager" do
+          before {
+            allow(auth_context).to receive(:metadata_manager?) { false }
+          }
+          it { is_expected.not_to be_able_to(:export, Ddr::Models::AdminSet) }
+        end
+      end
+    end
+
     describe "Collection abilities" do
       describe "create" do
         before do
@@ -63,6 +80,7 @@ module Ddr::Auth
         end
         describe "when the user is a collection creator" do
           before do
+            allow(auth_context).to receive(:member_of?) { false }
             allow(auth_context).to receive(:member_of?).with("collection_creators") { true }
           end
           it { should be_able_to(:create, Collection) }
@@ -70,6 +88,7 @@ module Ddr::Auth
 
         describe "when the user is not a collection creator" do
           before do
+            allow(auth_context).to receive(:member_of?) { false }
             allow(auth_context).to receive(:member_of?).with("collection_creators") { false }
           end
           it { should_not be_able_to(:create, Collection) }

data/spec/support/shared_examples_for_auth_contexts.rb

@@ -23,6 +23,39 @@ module Ddr::Auth
       end
     end
 
+    describe "#metadata_manager?" do
+      describe "when a user is present" do
+        before { allow(subject).to receive(:user) { double(agent: "bob@example.com") } }
+        describe "and there is no metadata managers group" do
+          before {
+            allow(Ddr::Auth).to receive(:metadata_managers_group) { nil }
+          }
+          its(:metadata_manager?) { should be false }
+        end
+        describe "and there is a metadata managers group" do
+          before {
+            allow(Ddr::Auth).to receive(:metadata_managers_group) { "metadata_managers" }
+          }
+          describe "and the auth context is a member of the group" do
+            before {
+              allow(subject).to receive(:groups) { [ Group.new("metadata_managers") ] }
+            }
+            its(:metadata_manager?) { should be true }
+          end
+          describe "and the auth context is not a member of the group" do
+            before {
+              allow(subject).to receive(:groups) { [ Group.new("foo"), Group.new("bar") ] }
+            }
+            its(:metadata_manager?) { should be false }
+          end
+        end
+      end
+      describe "when no user is present" do
+        before { allow(subject).to receive(:user) { nil } }
+        its(:metadata_manager?) { should be false }
+      end
+    end
+
     describe "#duke_agent?" do
       describe "when the auth context is anonymous" do
         before { allow(subject).to receive(:user) { nil } }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ddr-models
 version: !ruby/object:Gem::Version
-  version: 2.4.15
+  version: 2.4.16
 platform: ruby
 authors:
 - Jim Coble
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-09-16 00:00:00.000000000 Z
+date: 2016-09-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -404,6 +404,7 @@ files:
 - lib/ddr/auth.rb
 - lib/ddr/auth/ability.rb
 - lib/ddr/auth/ability_definitions.rb
+- lib/ddr/auth/ability_definitions/admin_set_ability_definitions.rb
 - lib/ddr/auth/ability_definitions/alias_ability_definitions.rb
 - lib/ddr/auth/ability_definitions/attachment_ability_definitions.rb
 - lib/ddr/auth/ability_definitions/collection_ability_definitions.rb