hydra-access-controls 0.0.2 → 0.0.3

data/.gitignore

@@ -1,5 +1,6 @@
 *.gem
 *.rbc
+.rvmrc
 .bundle
 .config
 .yardoc

data/.gitmodules

@@ -0,0 +1,3 @@
+[submodule "jetty"]
+	path = jetty
+	url = git://github.com/projecthydra/hydra-jetty.git

data/.rspec

@@ -0,0 +1,2 @@
+--color
+--format documentation

data/Gemfile

@@ -3,9 +3,15 @@ source 'https://rubygems.org'
 # Specify your gem's dependencies in hydra-access-controls.gemspec
 gemspec
 
+group :development do
+  gem 'jettywrapper'
+  gem 'debugger', :platform => :mri_19
+end
+
 group :test do
   gem 'cucumber-rails', '>=1.2.0', :require=>false
   gem 'rcov', :platform => :mri_18
   gem 'simplecov', :platform => :mri_19
   gem 'simplecov-rcov', :platform => :mri_19
+  gem 'factory_girl', '< 3.0.0' # factory girl 3+ doesn't work with ruby 1.8
 end

data/README.textile

@@ -0,0 +1,100 @@
+h1. hydra-access-controls
+
+The hydra-access-controls gem provides access controls models and functionality for Hydra Heads.  See the "hydra-head":http://github.com/projecthydra/hydra-head gem and the "Hydra Project website":http://projecthydra.org for more info.
+
+h2. Installation
+
+Add this line to your application's Gemfile:
+
+    gem 'hydra-access-controls'
+
+And then execute:
+
+    $ bundle
+
+Or install it yourself as:
+
+    $ gem install hydra-access-controls
+
+h2. Usage
+
+h3. Policy-based Enforcement (or Collecton-level enforcement)
+
+If you have Policy-based enforcement enabled, then objects will inherit extra GRANT permissions from AdminPolicy objects they are linked to with an isGovernedBy RDF relationship (stored in solr as _is_governed_by_s__ field).  This allows you to grant discover/read/edit access for a whole set of objects by changing the policy they are governed by.
+
+AdminPolicy objects store their inheritable rightsMetadata in a datastream called defaultRights.  This datastream uses the regular Hydra rightsMetadata schema.  Each AdminPolicy object also has its own rightsMetadata datasream, like all other Hydra assets, which specifies who is able to _edit_ the Policy or _use_ it (associate it with objects).
+
+Object-level permissions and Policy-level permissions are combined to produce the list of Individuals & Groups who have access to the object.  This means that if _either_ the object's rightsMetadata or the Policy's defaultRights grants access to an Individual or Group, that access will be allowed.
+
+* Currently, an asset can have only one Policy associated with it -- you can't associate objects with multiple policies
+* 
+
+To turn on Policy-based enforcement, 
+
+* include the Hydra::PolicyAwareAbility module in your Ability class (Make sure to include it _after_ Hydra::Ability because it overrides some of the methods provided by that module.)
+* include the Hydra::PolicyAwareAccessControlsEnforcement module into any appropriate Controllers (or into ApplicationController)
+ 
+# app/models/ability.rb
+<pre>
+  # Allows you to use CanCan to control access to Models
+  require 'cancan'
+  class Ability
+    include CanCan::Ability
+    include Hydra::Ability
+    include Hydra::PolicyAwareAbility
+  end
+</pre>
+
+# app/controllers/catalog_controller.rb
+<pre>
+  class CatalogController < ApplicationController  
+
+    include Blacklight::Catalog
+    include Hydra::Controller::ControllerBehavior
+    include Hydra::PolicyAwareAccessControlsEnforcement
+    
+    # ...
+  end
+</pre>
+
+h3. Modifying solr field names for enforcement
+
+Hydra uses its own set of default solr field names to track rights-related metadata in solr.  If you want to use your own field names, you can change them in your Hydra config.  You will also have to modify the permissions response handler in your solrconfig.xml to return those fields.
+
+# config/initializers/hydra_config.rb
+<pre>
+  Hydra.configure(:shared) do |config|
+    # ... other stuff ...
+    config[:permissions] = {
+      :catchall => "access_t",
+      :discover => {:group =>"discover_access_group_t", :individual=>"discover_access_person_t"},
+      :read => {:group =>"read_access_group_t", :individual=>"read_access_person_t"},
+      :edit => {:group =>"edit_access_group_t", :individual=>"edit_access_person_t"},
+      :owner => "depositor_t",
+      :embargo_release_date => "embargo_release_date_dt"
+    }
+    config[:permissions][:inheritable] = {
+      :catchall => "inheritable_access_t",
+      :discover => {:group =>"inheritable_discover_access_group_t", :individual=>"inheritable_discover_access_person_t"},
+      :read => {:group =>"inheritable_read_access_group_t", :individual=>"inheritable_read_access_person_t"},
+      :edit => {:group =>"inheritable_edit_access_group_t", :individual=>"inheritable_edit_access_person_t"},
+      :owner => "inheritable_depositor_t",
+      :embargo_release_date => "inheritable_embargo_release_date_dt"
+    }
+  end
+</pre>
+
+h2. Contributing
+
+1. Fork it
+2. Create your feature branch (`git checkout -b my-new-feature`)
+3. Commit your changes (`git commit -am 'Added some feature'`)
+4. Push to the branch (`git push origin my-new-feature`)
+5. Create new Pull Request
+
+h2. Testing
+
+    $ git submodule init
+    $ rake jetty:config
+    $ rake jetty:start
+    $ rake spec

data/Rakefile

@@ -1,6 +1,11 @@
 #!/usr/bin/env rake
 require "bundler/gem_tasks"
 require 'rspec/core/rake_task'
+APP_ROOT = File.expand_path("#{File.dirname(__FILE__)}")
+require "jettywrapper"
+# re-using hydra_jetty.rake from hydra-head
+import "lib/tasks/hydra_jetty.rake"
+import "lib/tasks/hydra-access-controls.rake"
 
 desc 'Default: run specs.'
 task :default => :spec
@@ -11,6 +16,4 @@ RSpec::Core::RakeTask.new do |t|
     t.rcov = true
     t.rcov_opts = %w{--exclude spec\/*,gems\/*,ruby\/* --aggregate coverage.data}
   end
-end
-
-
+end

data/config/fedora.yml

@@ -0,0 +1,8 @@
+development:
+  user: fedoraAdmin
+  password: fedoraAdmin
+  url: http://127.0.0.1:<%= ENV['TEST_JETTY_PORT'] || 8983 %>/fedora
+test:
+  user: fedoraAdmin
+  password: fedoraAdmin
+  url: http://127.0.0.1:<%= ENV['TEST_JETTY_PORT'] || 8983 %>/fedora-test

data/config/jetty.yml

@@ -0,0 +1,5 @@
+default:
+  jetty_port: <%= ENV['TEST_JETTY_PORT'] || 8983 %>
+  java_opts:
+    - "-Xmx256m" 
+    - "-XX:MaxPermSize=128m"

data/config/solr.yml

@@ -0,0 +1,6 @@
+development:
+  default:
+    url: http://localhost:<%= ENV['TEST_JETTY_PORT'] || 8983 %>/solr/development
+test: 
+  default:
+    url: http://localhost:<%= ENV['TEST_JETTY_PORT'] || 8983 %>/solr/test

data/hydra-access-controls.gemspec

@@ -2,8 +2,8 @@
 require File.expand_path('../lib/hydra-access-controls/version', __FILE__)
 
 Gem::Specification.new do |gem|
-  gem.authors       = ["Justin Coyne"]
-  gem.email         = ["justin.coyne@yourmediashelf.com"]
+  gem.authors       = ["Chris Beer", "Justin Coyne", "Matt Zumwalt"]
+  gem.email         = ["hydra-tech@googlegroups.com"]
   gem.description   = %q{Access controls for project hydra}
   gem.summary       = %q{Access controls for project hydra}
   gem.homepage      = ""
@@ -19,6 +19,7 @@ Gem::Specification.new do |gem|
   gem.add_dependency 'active-fedora'
   gem.add_dependency 'cancan'
   gem.add_dependency 'deprecation'
+  gem.add_dependency 'blacklight'
 
   gem.add_development_dependency("rake")
   gem.add_development_dependency 'rspec'

data/lib/ability.rb

@@ -3,4 +3,5 @@ require 'cancan'
 class Ability
   include CanCan::Ability
   include Hydra::Ability
+  include Hydra::PolicyAwareAbility
 end

data/lib/hydra-access-controls.rb

@@ -1,5 +1,6 @@
 require 'active_support'
 require 'active-fedora'
+require 'cancan'
 require 'deprecation'
 require "hydra-access-controls/version"
 begin
@@ -10,15 +11,24 @@ require 'hydra/datastream'
 
 module Hydra
   extend ActiveSupport::Autoload
+  autoload :User
   autoload :AccessControlsEnforcement
+  autoload :PolicyAwareAccessControlsEnforcement
   autoload :AccessControlsEvaluation
   autoload :Ability
+  autoload :PolicyAwareAbility
+  autoload :AdminPolicy
   autoload :RoleMapperBehavior
 
   module ModelMixins
     autoload :RightsMetadata, 'hydra/model_mixins/rights_metadata'
   end
 
+  # This error is raised when a user isn't allowed to access a given controller action.
+  # This usually happens within a call to AccessControlsEnforcement#enforce_access_controls but can be
+  # raised manually.
+  class AccessDenied < ::CanCan::AccessDenied; end
+
 end
 require 'ability'
 require 'role_mapper'

data/lib/hydra-access-controls/version.rb

@@ -1,7 +1,7 @@
 module Hydra
   module Access
     module Controls
-      VERSION = "0.0.2"
+      VERSION = "0.0.3"
     end
   end
 end

data/lib/hydra/ability.rb

@@ -1,5 +1,6 @@
+require "blacklight"
 # this code will move to lib/hydra/access_controls/ability.rb (with the appropriate namespace changes) in Hydra 5.0
-# Code for CanCan access to Hydra models
+# Code for [CANCAN] access to Hydra models
 module Hydra::Ability
   include Hydra::AccessControlsEnforcement
 
@@ -12,7 +13,7 @@ module Hydra::Ability
   def user_groups(user, session)
     return @user_groups if @user_groups
     @user_groups = RoleMapper.roles(user_key(user)) + default_user_groups
-    @user_groups << 'registered' unless user.new_record?
+    @user_groups << 'registered' unless (user.new_record? || @user_groups.include?('registered'))
     @user_groups
   end
 
@@ -24,7 +25,7 @@ module Hydra::Ability
 
   def hydra_default_permissions(user, session)
     logger.debug("Usergroups are " + user_groups(user, session).inspect)
-    if Deprecation.silence(Hydra::SuperuserAttributes) { user.is_being_superuser?(session) }
+    if user.respond_to?(:is_being_superuser?) && Deprecation.silence(Hydra::SuperuserAttributes) {user.is_being_superuser?(session)}
       can :manage, :all
     else
       create_permissions(user, session)
@@ -39,11 +40,11 @@ module Hydra::Ability
   end
 
   def edit_permissions(user, session)
-    can :edit, String do |pid|
+    can [:edit, :update, :destroy], String do |pid|
       test_edit(pid, user, session)
     end 
 
-    can :edit, ActiveFedora::Base do |obj|
+    can [:edit, :update, :destroy], ActiveFedora::Base do |obj|
       test_edit(obj.pid, user, session)
     end
  
@@ -84,26 +85,26 @@ module Hydra::Ability
 
   def test_edit(pid, user, session)
     permissions_doc(pid)
-    logger.debug("CANCAN Checking edit permissions for user: #{user}")
+    logger.debug("[CANCAN] Checking edit permissions for user: #{user_key(user)} with groups: #{user_groups(user, session).inspect}")
     group_intersection = user_groups(user, session) & edit_groups
     result = !group_intersection.empty? || edit_persons.include?(user_key(user))
-    logger.debug("CANCAN decision: #{result}")
+    logger.debug("[CANCAN] decision: #{result}")
     result
   end   
   
   def test_read(pid, user, session)
     permissions_doc(pid)
-    logger.debug("CANCAN Checking edit permissions for user: #{user}")
+    logger.debug("[CANCAN] Checking edit permissions for user: #{user_key(user)} with groups: #{user_groups(user, session).inspect}")
     group_intersection = user_groups(user, session) & read_groups
     result = !group_intersection.empty? || read_persons.include?(user_key(user))
-    logger.debug("CANCAN decision: #{result}")
+    logger.debug("[CANCAN] decision: #{result}")
     result
   end 
   
   def edit_groups
     edit_group_field = Hydra.config[:permissions][:edit][:group]
     eg = ((@permissions_solr_document == nil || @permissions_solr_document.fetch(edit_group_field,nil) == nil) ? [] : @permissions_solr_document.fetch(edit_group_field,nil))
-    logger.debug("edit_groups: #{eg.inspect}")
+    logger.debug("[CANCAN] edit_groups: #{eg.inspect}")
     return eg
   end
 
@@ -111,14 +112,14 @@ module Hydra::Ability
   def read_groups
     read_group_field = Hydra.config[:permissions][:read][:group]
     rg = edit_groups | ((@permissions_solr_document == nil || @permissions_solr_document.fetch(read_group_field,nil) == nil) ? [] : @permissions_solr_document.fetch(read_group_field,nil))
-    logger.debug("read_groups: #{rg.inspect}")
+    logger.debug("[CANCAN] read_groups: #{rg.inspect}")
     return rg
   end
 
   def edit_persons
     edit_person_field = Hydra.config[:permissions][:edit][:individual]
     ep = ((@permissions_solr_document == nil || @permissions_solr_document.fetch(edit_person_field,nil) == nil) ? [] : @permissions_solr_document.fetch(edit_person_field,nil))
-    logger.debug("edit_persons: #{ep.inspect}")
+    logger.debug("[CANCAN] edit_persons: #{ep.inspect}")
     return ep
   end
 
@@ -126,7 +127,7 @@ module Hydra::Ability
   def read_persons
     read_individual_field = Hydra.config[:permissions][:read][:individual]
     rp = edit_persons | ((@permissions_solr_document == nil || @permissions_solr_document.fetch(read_individual_field,nil) == nil) ? [] : @permissions_solr_document.fetch(read_individual_field,nil))
-    logger.debug("read_persons: #{rp.inspect}")
+    logger.debug("[CANCAN] read_persons: #{rp.inspect}")
     return rp
   end
 

data/lib/hydra/access_controls_enforcement.rb

@@ -100,7 +100,6 @@ module Hydra::AccessControlsEnforcement
       if @permissions_solr_document["embargo_release_date_dt"] 
         embargo_date = Date.parse(@permissions_solr_document["embargo_release_date_dt"].split(/T/)[0])
         if embargo_date > Date.parse(Time.now.to_s)
-          ### Assuming we're using devise and have only one authentication key
           unless current_user && can?(:edit, params[:id])
             raise Hydra::AccessDenied.new("This item is under embargo.  You do not have sufficient access privileges to read this document.", :edit, params[:id])
           end
@@ -197,35 +196,47 @@ module Hydra::AccessControlsEnforcement
     
     # Grant access based on user id & role
     unless current_user.nil?
+      user_access_filters += apply_role_permissions(permission_types)
+      user_access_filters += apply_individual_permissions(permission_types)
+      user_access_filters += apply_superuser_permissions(permission_types)
+    end
+    solr_parameters[:fq] << user_access_filters.join(" OR ")
+    logger.debug("Solr parameters: #{ solr_parameters.inspect }")
+  end
+  
+  def apply_role_permissions(permission_types)
       # for roles
+      user_access_filters = []
       ::RoleMapper.roles(user_key).each_with_index do |role, i|
         permission_types.each do |type|
           user_access_filters << "#{type}_access_group_t:#{role}"
         end
       end
+      user_access_filters
+  end
+
+  def apply_individual_permissions(permission_types)
       # for individual person access
+      user_access_filters = []
       permission_types.each do |type|
         user_access_filters << "#{type}_access_person_t:#{user_key}"        
       end
-      if Deprecation.silence(Hydra::SuperuserAttributes) { current_user.is_being_superuser?(session) }
-        permission_types.each do |type|
-          user_access_filters << "#{type}_access_person_t:[* TO *]"        
-        end
+      user_access_filters
+  end
+
+
+  # Even though is_being_superuser? is deprecated, keep this method around (just return empty set) 
+  # so developers can easily override this behavior in their local app
+  def apply_superuser_permissions(permission_types)
+    user_access_filters = []
+    if current_user.respond_to?(:is_being_superuser?) && current_user.is_being_superuser?(session) ##Deprecated
+      permission_types.each do |type|
+        user_access_filters << "#{type}_access_person_t:[* TO *]"        
       end
-      
-      # Enforcing Embargo at Query time has been disabled.  
-      # If you want to do this, set up your own solr_search_params before_filter that injects the appropriate :fq constraints for a field that expresses your objects' embargo status.
-      #
-      # include docs in results if the embargo date is NOT in the future OR if the current user is depositor
-      # embargo_query = "(NOT embargo_release_date_dt:[NOW TO *]) OR depositor_t:#{user_key}"
-      # embargo_query = "(NOT embargo_release_date_dt:[NOW TO *]) OR (embargo_release_date_dt:[NOW TO *] AND  depositor_t:#{user_key}) AND NOT (NOT depositor_t:#{user_key} AND embargo_release_date_dt:[NOW TO *])"
-      # solr_parameters[:fq] << embargo_query         
     end
-    solr_parameters[:fq] << user_access_filters.join(" OR ")
-    logger.debug("Solr parameters: #{ solr_parameters.inspect }")
+    user_access_filters
   end
   
-  
   # proxy for {enforce_index_permissions}
   def enforce_search_permissions
     enforce_index_permissions

data/lib/hydra/admin_policy.rb

@@ -0,0 +1,81 @@
+class Hydra::AdminPolicy < ActiveFedora::Base
+  
+  # When you subclass Hydra::AdminPolicy, you probably want to include Hydra::ModelMethods so you can call apply_depositor_metadata
+  # include Hydra::ModelMethods
+
+  # Uses the Hydra Rights Metadata Schema for tracking access permissions & copyright
+  has_metadata :name => "defaultRights", :type => Hydra::Datastream::InheritableRightsMetadata 
+
+  # Uses the Hydra Rights Metadata Schema for tracking access permissions & copyright
+  has_metadata :name => "rightsMetadata", :type => Hydra::Datastream::RightsMetadata 
+
+  has_metadata :name =>'descMetadata', :type => ActiveFedora::QualifiedDublinCoreDatastream do |ds|
+    ds.field :license_url
+  end
+
+  delegate_to :descMetadata, [:title, :description], :unique=>true
+  delegate :license_title, :to=>'rightsMetadata', :at=>[:license, :title], :unique=>true
+  delegate :license_description, :to=>'rightsMetadata', :at=>[:license, :description], :unique=>true
+  delegate :license_url, :to=>'rightsMetadata', :at=>[:license, :url], :unique=>true
+
+  # easy access to edit_groups, etc
+  include Hydra::ModelMixins::RightsMetadata 
+
+  def self.readable_by_user(user)
+    where_user_has_permissions(user, [:read, :edit])
+  end
+
+  def self.editable_by_user(user)
+    where_user_has_permissions(user, [:edit])
+  end
+
+  def self.where_user_has_permissions(user, permissions=[:edit])
+    or_query = [] 
+    RoleMapper.roles(user).each do |group|
+      permissions.each do |permission|
+        or_query << "#{permission}_access_group_t:#{group}"
+      end
+    end
+    permissions.each do |permission|
+      or_query << "#{permission}_access_person_t:#{user.user_key}"
+    end
+    find_with_conditions(or_query.join(" OR "))
+  end
+
+  ## Updates those permissions that are provided to it. Does not replace any permissions unless they are provided
+  # @example
+  #  obj.default_permissions= [{:name=>"group1", :access=>"discover", :type=>'group'},
+  #  {:name=>"group2", :access=>"discover", :type=>'group'}]
+  def default_permissions=(params)
+    perm_hash = {'person' => defaultRights.individuals, 'group'=> defaultRights.groups}
+
+    params.each do |row|
+      if row[:type] == 'user'
+        perm_hash['person'][row[:name]] = row[:access]
+      else
+        perm_hash['group'][row[:name]] = row[:access]
+      end
+    end
+    
+    defaultRights.update_permissions(perm_hash)
+  end
+
+  ## Returns a list with all the permissions on the object.
+  # @example
+  #  [{:name=>"group1", :access=>"discover", :type=>'group'},
+  #  {:name=>"group2", :access=>"discover", :type=>'group'},
+  #  {:name=>"user2", :access=>"read", :type=>'user'},
+  #  {:name=>"user1", :access=>"edit", :type=>'user'},
+  #  {:name=>"user3", :access=>"read", :type=>'user'}]
+  def default_permissions
+    (defaultRights.groups.map {|x| {:type=>'group', :access=>x[1], :name=>x[0] }} + 
+      defaultRights.individuals.map {|x| {:type=>'user', :access=>x[1], :name=>x[0]}})
+
+  end
+
+  def to_solr(solr_doc = {}) 
+    super
+    solr_doc['title_display'] = solr_doc['title_t'].first if solr_doc['title_t']
+    solr_doc
+  end
+end