geoblacklight 6.0.0.pre.alpha.7 → 6.0.0.pre.beta.2

data/spec/requests/viewer_record_spec.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+RSpec.describe "Viewer record", type: :request do
+  let(:references) { JSON.parse(response.parsed_body[Geoblacklight.configuration.fields.references]) }
+
+  # Restricted, and provided by this app's own institution, so signing in makes the difference
+  let(:restricted) { "stanford-dp018hs9766" }
+
+  it "withholds a restricted record's data from a reader who isn't signed in" do
+    get viewer_solr_document_path(restricted)
+
+    expect(response).to have_http_status(:ok)
+    expect(references.keys).not_to include("https://github.com/cogeotiff/cog-spec", "http://schema.org/downloadUrl")
+    expect(references.keys).to include("http://www.isotc211.org/schemas/2005/gmd/")
+  end
+
+  it "hands over the same record once that reader signs in" do
+    sign_in
+    get viewer_solr_document_path(restricted)
+
+    expect(references.keys).to include("https://github.com/cogeotiff/cog-spec", "http://schema.org/downloadUrl")
+  end
+
+  it "hands over a public record in full" do
+    get viewer_solr_document_path("berkeley-s7pq31")
+
+    expect(references.keys).to include("http://www.opengis.net/def/serviceType/ogc/wms")
+  end
+
+  it "reports a record that isn't there as missing" do
+    get viewer_solr_document_path("no-such-record")
+
+    expect(response).to have_http_status(:not_found)
+  end
+end

data/spec/requests/viewer_requests_spec.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+RSpec.describe "Viewer requests", type: :request do
+  let(:origins) { ["https://stacks.stanford.edu/"] }
+
+  # Restricted, and provided by this app's own institution, so signing in makes the difference
+  let(:restricted) { "stanford-dp018hs9766" }
+
+  around do |example|
+    configured = Geoblacklight.configuration.restricted_origins
+    Geoblacklight.configuration.restricted_origins = origins
+    example.run
+    Geoblacklight.configuration.restricted_origins = configured
+  end
+
+  def restricted_origins
+    Capybara.string(response.body).find("ogm-viewer")["data-restricted-origins"]
+  end
+
+  it "names the services a signed-in reader's requests need to carry cookies to" do
+    sign_in
+    get solr_document_path(restricted)
+
+    expect(JSON.parse(restricted_origins)).to eq origins
+  end
+
+  it "names none for a reader who isn't signed in" do
+    get solr_document_path(restricted)
+
+    expect(restricted_origins).to be_nil
+  end
+
+  it "names none for a public record, which has nothing that needs authorizing" do
+    sign_in
+    get solr_document_path("berkeley-s7pq31")
+
+    expect(restricted_origins).to be_nil
+  end
+
+  context "when no services are configured" do
+    let(:origins) { [] }
+
+    it "names none" do
+      sign_in
+      get solr_document_path(restricted)
+
+      expect(restricted_origins).to be_nil
+    end
+  end
+end

data/spec/solr_config_spec.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+RSpec.describe "Solr configuration" do
+  def parse(name)
+    Nokogiri::XML(File.read(File.expand_path("../solr/conf/#{name}", __dir__)))
+  end
+
+  let(:schema) { parse("schema.xml") }
+  let(:solrconfig) { parse("solrconfig.xml") }
+
+  # Every *_ti and *_tmi name matches a dynamicField, so boosting a field that no
+  # copyField populates is legal, queryable, and always empty -- Solr never
+  # complains, the boost just silently contributes nothing to scoring. That has
+  # happened twice now: renaming a copyField destination from *_ti to *_tmi
+  # (multiValued sources need multiValued destinations) left the matching qf/pf
+  # entry behind. Deliberately ignores dynamicFields, since resolving through one
+  # is exactly the bug being guarded against.
+  def populated_fields
+    schema.xpath("//fields/field/@name").map(&:value) +
+      schema.xpath("//copyField/@dest").map(&:value)
+  end
+
+  # Reads the /text() children rather than the <str> node's own text, so the XML
+  # comment inside <str name="pf"> cannot leak words into the field list.
+  def boosted_fields(param)
+    solrconfig.xpath("//requestHandler[@name='/select']//str[@name='#{param}']/text()")
+      .map(&:text).join(" ")
+      .split.map { |entry| entry.split("^").first }
+  end
+
+  %w[qf pf].each do |param|
+    it "only boosts #{param} fields that something populates" do
+      dead = boosted_fields(param) - populated_fields
+
+      expect(dead).to be_empty,
+        "#{param} boosts fields no copyField or <field> populates: #{dead.join(", ")}"
+    end
+  end
+end

data/spec/solr_fixtures_spec.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+RSpec.describe "Solr fixture documents" do
+  def documents
+    Dir[File.expand_path("fixtures/solr_documents/*.json", __dir__)].flat_map do |path|
+      parsed = JSON.parse(File.read(path))
+      Array.wrap(parsed).map { |document| [File.basename(path), document] }
+    end
+  end
+
+  # geoblacklight:index:seed adds these documents to Solr, which upserts on id. Two
+  # fixtures sharing an id overwrite one another silently, so the index comes up
+  # short and the losing record is simply absent from every spec that expects it.
+  it "gives every document a unique id" do
+    duplicates = documents.group_by { |_file, document| document["id"] }
+      .select { |_id, entries| entries.length > 1 }
+      .transform_values { |entries| entries.map(&:first).sort }
+
+    expect(duplicates).to be_empty, "fixtures share an id: #{duplicates.inspect}"
+  end
+end

data/spec/spec_helper.rb

@@ -16,7 +16,7 @@ SimpleCov.start "rails" do
   add_filter "lib/geoblacklight/version.rb"
   add_filter "lib/geoblacklight/engine.rb"
   add_filter "lib/generators"
-  add_filter "lib/tasks/geoblacklight.rake"
+  add_filter "lib/tasks"
   add_filter "/spec"
   add_filter ".internal_test_app/"
   minimum_coverage 100
@@ -40,10 +40,20 @@ WebMock.allow_net_connect!(net_http_connect_on_start: true)
 Capybara.register_driver :chrome_headless do |app|
   # Set up Chrome options
   options = Selenium::WebDriver::Chrome::Options.new
-  options.add_argument("--headless")
+  options.add_argument("--headless=new")
   options.add_argument("--disable-gpu")
   options.add_argument("--no-sandbox")
   options.add_argument("--window-size=1280,1024")
+  # Scroll without animating. Bootstrap puts `scroll-behavior: smooth` on :root, so when
+  # ChromeDriver sets scrollTop to bring an element into view before clicking it, the page only
+  # starts to move and ChromeDriver reads back the element's old, off-screen position. The click
+  # then fails and is left to Capybara's retry, which a busy page can outlast.
+  options.add_argument("--disable-smooth-scrolling")
+  # Software WebGL, which the viewer and the overview map both need: they draw with MapLibre, and
+  # headless Chrome has no GPU to give them. SwiftShader is Chrome's own CPU renderer, and since
+  # Chrome 128 it has to be asked for by name before WebGL will fall back to it at all.
+  options.add_argument("--enable-unsafe-swiftshader")
+  options.add_argument("--use-angle=swiftshader")
   # Return from #visit at DOMContentLoaded instead of waiting for the full
   # window `load` event. GeoBlacklight pages pull basemap tiles and WMS/TMS
   # layers from external hosts; in CI those requests can hang and prevent
@@ -72,6 +82,6 @@ RSpec.configure do |config|
 
   config.use_transactional_fixtures = true
 
-  config.include Devise::Test::ControllerHelpers, type: :controller
+  config.include Devise::Test::ControllerHelpers, type: :controller if defined?(Devise)
   config.include ViewComponent::TestHelpers, type: :component
 end

data/spec/support/authentication.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+# The app can be generated using Devise auth, Rails auth, or no auth. These
+# are for signing in and/or skipping tests depending on which is the case.
+module AuthenticationHelpers
+  # :devise, :rails, or nil if the app has no authentication
+  def self.provider
+    if defined?(Devise)
+      :devise
+    elsif ApplicationController.respond_to?(:allow_unauthenticated_access)
+      :rails
+    end
+  end
+
+  def skip_without_authentication
+    skip "the test app has no authentication" unless AuthenticationHelpers.provider
+  end
+
+  module Requests
+    # Sign a new user in by posting the sign-in form
+    def sign_in
+      skip_without_authentication
+      user = FactoryBot.create(:user)
+
+      if AuthenticationHelpers.provider == :devise
+        post user_session_path, params: {user: {email: user.email, password: user.password}}
+      else
+        post session_path, params: {email_address: user.email_address, password: user.password}
+      end
+    end
+  end
+end
+
+RSpec.configure do |config|
+  config.include AuthenticationHelpers
+  config.include AuthenticationHelpers::Requests, type: :request
+end

data/spec/support/features/map_helpers.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+module Features
+  module MapHelpers
+    # An overview or locator map, once it has something on it. Both are handed what to draw a moment
+    # after the page arrives - a locator fetches its own record, and an overview's controller imports
+    # the library it draws with - so anything that reads or points at a map has to wait for that
+    # rather than for the page.
+    def map_ready(selector = "#overview-map", wait: 20)
+      map = find(selector)
+      expect(map.shadow_root).to have_css("canvas.maplibregl-canvas", wait: wait)
+
+      # And until there is something to draw, which may well be nothing: a map with no results to
+      # put on it - the home page's - has still been given its records.
+      page.document.synchronize(wait) do
+        given = page.evaluate_script(
+          "arguments[0].record !== undefined || arguments[0].previewers !== undefined || arguments[0].previewer !== undefined", map
+        )
+        raise(Capybara::ElementNotFound) unless given
+      end
+
+      map
+    end
+
+    # What the map has been given to draw, as a west/south, east/north pair per result, in the order
+    # their numbers put them, with nil where a result had nowhere to be drawn. A locator holds one
+    # record rather than a list, and reports the same shape around it: a single-entry array, worked
+    # out from the record's own geometry rather than asked of a previewer, since none is exposed.
+    def drawn_extents(selector = "#overview-map")
+      page.evaluate_async_script(<<~JS, map_ready(selector))
+        const [map, done] = arguments
+
+        if (map.record) {
+          const geometry = map.record.getGeometry()
+          const points = geometry?.coordinates?.[0] ?? []
+          if (!points.length) return done([null])
+
+          const lngs = points.map(([lng]) => lng)
+          const lats = points.map(([, lat]) => lat)
+          return done([[[Math.min(...lngs), Math.min(...lats)], [Math.max(...lngs), Math.max(...lats)]]])
+        }
+
+        const drawn = map.previewers ?? [map.previewer]
+        Promise.all(Array.from(drawn, (previewer) => previewer?.getBounds() ?? null)).then(done)
+      JS
+    end
+
+    # Search the map the way a reader does: hold shift and drag a box over the middle of it. There is
+    # no control to click - the gesture is the whole of it - so this is a real mouse drag.
+    def search_map_area(selector = "#overview-map", size: 80)
+      map = map_ready(selector)
+
+      page.driver.browser.action
+        .move_to(map.native, -size / 2, -size / 2)
+        .key_down(:shift)
+        .click_and_hold
+        .move_by(size, size)
+        .release
+        .key_up(:shift)
+        .perform
+    end
+
+    # The area the query on screen asked after, as the bbox parameter states it
+    def searched_bbox
+      URI.decode_www_form(URI(page.current_url).query.to_s).to_h["bbox"]
+    end
+  end
+end

data/spec/support/features/session_helpers.rb

@@ -2,21 +2,26 @@
 
 module Features
   module SessionHelpers
-    def sign_up_with(email, password)
-      visit new_user_registration_path
-      fill_in "Email", with: email
-      fill_in "Password", with: password
-      click_button "Sign up"
+    def sign_in
+      skip_without_authentication
+      visit (AuthenticationHelpers.provider == :devise) ? new_user_session_path : new_session_path
+      fill_in_sign_in_form FactoryBot.create(:user)
+      # Wait for the persistent "Log Out" nav link rather than the one-shot
+      # "Signed in successfully." flash, which can render and then become
+      # non-visible before Capybara's default wait time elapses.
+      expect(page).to have_link "Log Out"
     end
 
-    def sign_in
-      user = FactoryBot.create(:user)
-      user.save
-      visit new_user_session_path
-      fill_in "user_email", with: user.email
-      fill_in "user_password", with: user.password
-      click_button "Log in"
-      expect(page).to have_content "Signed in successfully."
+    def fill_in_sign_in_form(user)
+      if AuthenticationHelpers.provider == :devise
+        fill_in "user_email", with: user.email
+        fill_in "user_password", with: user.password
+        click_button "Log in"
+      else
+        fill_in "email_address", with: user.email_address
+        fill_in "password", with: user.password
+        click_button "Sign in"
+      end
     end
   end
 end

data/spec/support/features/viewer_helpers.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module Features
+  module ViewerHelpers
+    # What the item viewer offers to show, as the labels on its tabs. It works these out from the
+    # record's references once it has fetched the record, inside its own shadow root, so this waits
+    # for them rather than expecting them to be there when the page arrives.
+    def preview_tabs(wait: 20)
+      page.document.synchronize(wait) do
+        page.evaluate_script(<<~JS) || raise(Capybara::ElementNotFound)
+          (() => {
+            const previews = document.querySelector("ogm-viewer")?.shadowRoot?.querySelector("ogm-previews")
+            const tabs = previews?.shadowRoot?.querySelectorAll("wa-tab")
+            return tabs?.length ? Array.from(tabs).map((tab) => tab.textContent.trim()) : null
+          })()
+        JS
+      end
+    end
+  end
+end

data/spec/support/features.rb

@@ -1,7 +1,11 @@
 # frozen_string_literal: true
 
 require File.expand_path("../features/session_helpers.rb", __FILE__)
+require File.expand_path("../features/map_helpers.rb", __FILE__)
+require File.expand_path("../features/viewer_helpers.rb", __FILE__)
 
 RSpec.configure do |config|
   config.include Features::SessionHelpers, type: :feature
+  config.include Features::MapHelpers, type: :feature
+  config.include Features::ViewerHelpers, type: :feature
 end

data/spec/test_app_templates/lib/generators/test_app_generator.rb

@@ -16,7 +16,7 @@ class TestAppGenerator < Rails::Generators::Base
   # Install blacklight
   def run_blacklight_generator
     say_status("warning", "GENERATING BL", :yellow)
-    generate "blacklight:install", "--devise", "--skip-solr"
+    generate "blacklight:install", ENV["BLACKLIGHT_INSTALL_OPTIONS"].presence || "--devise --skip-solr"
   end
 
   # Install geoblacklight

data/template.rb

@@ -10,7 +10,7 @@ end
 run "bundle install"
 
 after_bundle do
-  generate "blacklight:install", ENV.fetch("BLACKLIGHT_INSTALL_OPTIONS", "--devise")
+  generate "blacklight:install", ENV["BLACKLIGHT_INSTALL_OPTIONS"].presence || "--devise --skip-solr"
   generate "geoblacklight:install"
   rails_command "db:migrate"
 end