hydra-access-controls 10.3.0 → 10.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 8a33d80b5283cef71b32a69ac3d82827e4de5897
-  data.tar.gz: b3445c0190c5162c683c4e6423c04b742ea0e762
+  metadata.gz: 41551b5b4c585cf81dcf873b800b5699dc6c1b22
+  data.tar.gz: a81738e509b739baf6d816ad0ec58f68a1b880f9
 SHA512:
-  metadata.gz: ab7382a8803736b4d6c20fd02e5975ffd33792884ca8e0e987a35c8f675be1ca65d690b697ae680b4872bace4455c1604c6cb328b16a471145393963381516f1
-  data.tar.gz: 884bcb0cc0d3104fb6e0fd990455d457cd45550c359f1764e901f1240b1981c108191da35e2c0b965d1ea8256f55a0306be24472a22354a592afcaefbfc3218b
+  metadata.gz: a4979abd13373922171646bd2bf6cbf79c8c016e3c45b145be961cf778a4818d71151345ed0bfa8defa41ab3f32cfbe7de2a1a0a5d3280d600c2377d4811575b
+  data.tar.gz: 25049f1bb1d157fa2512c045644543851c88020c60f8875ee2c4b993f5619a0f57394a01d5e84b56ff5f15d69ff35cb34f17987f0b4e8d5f0ded3e5dfcce2051

data/app/models/concerns/hydra/access_controls/permissions.rb

@@ -61,7 +61,9 @@ module Hydra
           prop['id'] = selected.id if selected
         end
 
-        self.permissions_attributes_without_uniqueness = attributes_collection
+        clean_collection = remove_bad_deletes(attributes_collection)
+
+        self.permissions_attributes_without_uniqueness = clean_collection
       end
 
       # Return a list of groups that have discover permission
@@ -437,6 +439,19 @@ module Hydra
         raise 'no agent' unless agent.present?
         agent.first.rdf_subject.to_s.start_with?(PERSON_AGENT_URL_PREFIX)
       end
+
+      # Removes any permissions if both a delete and an update are found for the same id
+      # or if a delete is present without an id.
+      def remove_bad_deletes(collection)
+        collection.delete_if { |permission| (has_destroy_flag?(permission) && !permission.has_key?(:id)) }
+        collection.each do |permission|
+          next unless has_destroy_flag?(permission)
+          delete_id = permission.fetch(:id, nil)
+           if collection.map { |c| c if c.fetch(:id, nil) == delete_id }.compact.count > 1
+            collection.delete_if { |permission| permission.fetch(:id, nil) == delete_id }
+          end
+        end
+      end
     end
   end
 end

data/spec/unit/permissions_spec.rb

@@ -151,6 +151,55 @@ describe Hydra::AccessControls::Permissions do
               expect(reloaded).to eq [{ type: "person", access: "edit", name: "jcoyne" }]
             end
           end
+
+          context "when destroy and update are simultaneously set for the same id" do
+            let(:simultaneous) do
+              [
+                { id: permissions_id, type: "group", access: "read", name: "group1", _destroy: '1' },
+                { id: permissions_id, type: "group", access: "read", name: "group1", }
+              ]
+            end
+            before do
+              subject.update permissions_attributes: [{ type: "group", access: "read", name: "group1" }]
+              subject.update permissions_attributes: simultaneous
+            end
+
+            it "leaves the permissions unchanged" do
+              expect(reloaded).to contain_exactly({name: "jcoyne", type: "person", access: "edit"}, {name: "group1", type: "group", access: "read"})
+            end
+          end
+
+          context "when destroy is present without an id" do
+            let(:missing_id) do
+              [ { type: "group", access: "read", name: "group1", _destroy: '1' } ]
+            end
+            before do
+              subject.update permissions_attributes: missing_id
+            end
+
+            it "leaves the permissions unchanged" do
+              expect(reloaded).to contain_exactly({name: "jcoyne", type: "person", access: "edit"})
+            end
+          end
+
+          context "when updating multiple different permissions at the same time" do
+            before do
+              subject.update permissions_attributes: [{ type: "group", access: "read", name: "group1" }]
+              subject.update permissions_attributes: [
+                { id: permissions_id, type: "group", access: "read", name: "group1", _destroy: '1' },
+                { type: "group", access: "edit", name: "group2" },
+                { type: "person", access: "read", name: "joebob" } 
+              ]
+            end
+
+            it "removes permissions on existing groups and updates the others" do
+              expect(reloaded).to contain_exactly(
+                {name: "jcoyne", type: "person", access: "edit"},
+                {name: "group2", type: "group",  access: "edit"},
+                {name: "joebob", type: "person", access: "read"}
+              )
+            end
+          end
         end
 
         context "to a falsy value" do

data/spec/unit/policy_aware_access_controls_enforcement_spec.rb

@@ -126,23 +126,31 @@ describe Hydra::PolicyAwareAccessControlsEnforcement do
   end
 
   describe "apply_gated_discovery" do
-    before do
-      allow(RoleMapper).to receive(:roles).with(user).and_return(user.roles)
-    end
     let(:governed_field) { ActiveFedora.index_field_mapper.solr_name('isGovernedBy', :symbol) }
+    let(:policy_queries) { @solr_parameters[:fq].first.split(" OR ") }
 
-    it "includes policy-aware query" do
-      # stubbing out policies_with_access because solr doesn't always return them in the same order.
-      policy_ids = (1..8).map {|n| "policies/#{n}"}
-      expect(subject).to receive(:policies_with_access).and_return(policy_ids)
-      subject.apply_gated_discovery(@solr_parameters)
-      expect(@solr_parameters[:fq].first).to include(" OR (_query_:\"{!field f=#{governed_field}}policies/1\" OR _query_:\"{!field f=#{governed_field}}policies/2\" OR _query_:\"{!field f=#{governed_field}}policies/3\" OR _query_:\"{!field f=#{governed_field}}policies/4\" OR _query_:\"{!field f=#{governed_field}}policies/5\" OR _query_:\"{!field f=#{governed_field}}policies/6\" OR _query_:\"{!field f=#{governed_field}}policies/7\" OR _query_:\"{!field f=#{governed_field}}policies/8\")")
-    end
+    before { allow(RoleMapper).to receive(:roles).with(user).and_return(user.roles) }
 
-    it "doesn't change anything if there are no clauses to add" do
-      allow(subject).to receive(:policy_clauses).and_return(nil)
-      subject.apply_gated_discovery(@solr_parameters)
-      expect(@solr_parameters[:fq].first).not_to include(" OR (_query_:\"{!field f=#{governed_field}}policies/1\" OR _query_:\"{!field f=#{governed_field}}policies/2\" OR _query_:\"{!field f=#{governed_field}}policies/3\" OR _query_:\"{!field f=#{governed_field}}policies/4\" OR _query_:\"{!field f=#{governed_field}}policies/5\" OR _query_:\"{!field f=#{governed_field}}policies/6\" OR _query_:\"{!field f=#{governed_field}}policies/7\" OR _query_:\"{!field f=#{governed_field}}policies/8\")")
+    context "when policies are included" do
+      before { subject.apply_gated_discovery(@solr_parameters) }
+      
+      it "builds a query that includes all the policies" do
+        (1..11).each do |p|
+          expect(policy_queries).to include(/_query_:\"{!raw f=#{governed_field}}test-policy#{p}\"/)
+        end
+      end
+    end
+    
+    context "when policies are not included" do
+      before do
+        allow(subject).to receive(:policy_clauses).and_return(nil)
+        subject.apply_gated_discovery(@solr_parameters)
+      end
+      it "does not include any policies in the query" do
+        (1..11).each do |p|
+          expect(policy_queries).not_to include(/_query_:\"{!raw f=#{governed_field}}test-policy#{p}\"/)
+        end
+      end
     end
   end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hydra-access-controls
 version: !ruby/object:Gem::Version
-  version: 10.3.0
+  version: 10.3.2
 platform: ruby
 authors:
 - Chris Beer
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-09-02 00:00:00.000000000 Z
+date: 2016-10-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -236,7 +236,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.2
+rubygems_version: 2.6.4
 signing_key: 
 specification_version: 4
 summary: Access controls for project hydra