hydra-access-controls 5.0.1 → 5.1.0

data/README.textile

@@ -2,6 +2,8 @@ h1. hydra-access-controls
 
 The hydra-access-controls gem provides access controls models and functionality for Hydra Heads.  See the "hydra-head":http://github.com/projecthydra/hydra-head gem and the "Hydra Project website":http://projecthydra.org for more info.
 
+Some background information is available on the wiki at https://github.com/projecthydra/hydra-head/wiki/Access-Controls
+
 h2. Installation
 
 The easiest way to make your code use this gem is to run the hydra generator that comes with the hydra-head gem.  That will set up everything you need:
@@ -13,14 +15,32 @@ The easiest way to make your code use this gem is to run the hydra generator tha
 
 h2. Usage
 
-h3. Enforcing Hydra-based Access Controls in your Controllers
+h3. Enforcing Hydra-based Access Controls using CanCan and Hydra::Ability
 
 They hydra generator handles part of this for you - it sets up the CatalogController (Blacklight's main controller for searches) to do gated discovery for you.
-In your custom controllers, you need to tell them to enforce access controls.  
 
-*!!!This section is unfinished!!!*  
-_If you encounter this note, send an email to the hydra-tech mailing list asking "jcoyne":https://github.com/jcoyne to explain how to make a controller enforce Hydra-based access controls using CanCan._
+Beyond enabling gated discovery, *everything is done using "CanCan":https://github.com/ryanb/cancan*.  For more information on CanCan, how to use it, and how to define access controls policies (aka "abilities":https://github.com/ryanb/cancan/wiki/Defining-Abilities), refer to the "CanCan documentation":https://github.com/ryanb/cancan/blob/master/README.rdoc.
+
+Within your CanCan ability definitions (usually ability.rb), if you include the "Hydra::Ability":https://github.com/projecthydra/hydra-head/blob/master/hydra-access-controls/lib/hydra/ability.rb module, you will have :read and :edit permissions defined for you, along with some convenience methods that help you evaluate permssions against info in the rightsMetadata. *Note*: the Hydra rails generator includes this module into your ability.rb for you!
+
+In your custom controllers, you need to tell them to enforce access controls using "CanCan":https://github.com/ryanb/cancan.  There are a number of ways to do this.  The easiest way is to use the cancan "controller action":https://github.com/ryanb/cancan/wiki/Authorizing-Controller-Actions 'load_and_authorize_resource', however on show and edit, this also causes a load the resource from fedora, which you may want to avoid.  If you want to authorize from solr, you ought to be able to call the cancan methods `authorize!` or `can?` which just checks the solr permissions handler. 
+
+Examples of using authorize! and can? in controller methods:
 
+<pre>
+def show
+  authorize! :show, params[:id] # raises CanCan::Access denied if they don't have permission
+  ...
+end
+
+def edit
+  if can? :edit, params[:id]
+    ## User is authorized
+  else
+    ## not authorized
+  end
+end
+</pre>
 
 h3. Modifying solr field names for enforcement
 

data/lib/hydra/admin_policy.rb

@@ -48,10 +48,12 @@ class Hydra::AdminPolicy < ActiveFedora::Base
     perm_hash = {'person' => defaultRights.individuals, 'group'=> defaultRights.groups}
 
     params.each do |row|
-      if row[:type] == 'user'
-        perm_hash['person'][row[:name]] = row[:access]
-      else
+      if row[:type] == 'user' || row[:type] == 'person'
+        perm_hash['person'][row[:name]] = row[:access]        
+      elsif row[:type] == 'group'
         perm_hash['group'][row[:name]] = row[:access]
+      else
+        raise ArgumentError, "Permission type must be 'user', 'person' (alias for 'user'), or 'group'"
       end
     end
     

data/lib/hydra/datastream/rights_metadata.rb

@@ -111,7 +111,6 @@ module Hydra
             access_type_symbol = "#{new_access_level}_access".to_sym
             result = self.update_values([access_type_symbol, type] => {"-1"=>actor})
           end
-          self.dirty = true
           return new_access_level
         end
           

data/lib/hydra/model_mixins/rights_metadata.rb

@@ -11,10 +11,12 @@ module Hydra
         perm_hash = {'person' => rightsMetadata.individuals, 'group'=> rightsMetadata.groups}
 
         params.each do |row|
-          if row[:type] == 'user'
+          if row[:type] == 'user' || row[:type] == 'person'
             perm_hash['person'][row[:name]] = row[:access]
-          else
+          elsif row[:type] == 'group'
             perm_hash['group'][row[:name]] = row[:access]
+          else
+            raise ArgumentError, "Permission type must be 'user', 'person' (alias for 'user'), or 'group'"
           end
         end
         

data/spec/unit/admin_policy_spec.rb

@@ -47,6 +47,46 @@ describe Hydra::AdminPolicy do
       subject["title_display"].should == 'Foobar'
     end
   end
+
+  describe "updating default permissions" do
+    it "should create new group permissions" do
+      subject.default_permissions = [{:name=>'group1', :access=>'discover', :type=>'group'}]
+      subject.default_permissions.should == [{:type=>'group', :access=>'discover', :name=>'group1'}]
+    end
+    it "should create new user permissions" do
+      subject.default_permissions = [{:name=>'user1', :access=>'discover', :type=>'user'}]
+      subject.default_permissions.should == [{:type=>'user', :access=>'discover', :name=>'user1'}]
+    end
+    it "should not replace existing groups" do
+      subject.default_permissions = [{:name=>'group1', :access=>'discover', :type=>'group'}]
+      subject.default_permissions = [{:name=>'group2', :access=>'discover', :type=>'group'}]
+      subject.default_permissions.should == [{:type=>'group', :access=>'discover', :name=>'group1'},
+                                   {:type=>'group', :access=>'discover', :name=>'group2'}]
+    end
+    it "should not replace existing users" do
+      subject.default_permissions = [{:name=>'user1', :access=>'discover', :type=>'user'}]
+      subject.default_permissions = [{:name=>'user2', :access=>'discover', :type=>'user'}]
+      subject.default_permissions.should == [{:type=>'user', :access=>'discover', :name=>'user1'},
+                                   {:type=>'user', :access=>'discover', :name=>'user2'}]
+    end
+    it "should update permissions on existing users" do
+      subject.default_permissions = [{:name=>'user1', :access=>'discover', :type=>'user'}]
+      subject.default_permissions = [{:name=>'user1', :access=>'edit', :type=>'user'}]
+      subject.default_permissions.should == [{:type=>'user', :access=>'edit', :name=>'user1'}]
+    end
+    it "should update permissions on existing groups" do
+      subject.default_permissions = [{:name=>'group1', :access=>'discover', :type=>'group'}]
+      subject.default_permissions = [{:name=>'group1', :access=>'edit', :type=>'group'}]
+      subject.default_permissions.should == [{:type=>'group', :access=>'edit', :name=>'group1'}]
+    end
+    it "should assign user permissions when :type == 'person'" do
+      subject.default_permissions = [{:name=>'user1', :access=>'discover', :type=>'person'}]
+      subject.default_permissions.should == [{:type=>'user', :access=>'discover', :name=>'user1'}]
+    end
+    it "should raise an ArgumentError when the :type hashkey is invalid" do
+      expect{subject.default_permissions = [{:name=>'user1', :access=>'read', :type=>'foo'}]}.to raise_error(ArgumentError)
+    end
+  end
   
   describe "Inheritable rights" do
     before do

data/spec/unit/rights_metadata_spec.rb

@@ -44,7 +44,13 @@ describe Hydra::ModelMixins::RightsMetadata do
       subject.permissions = [{:name=>'group1', :access=>'edit', :type=>'group'}]
       subject.permissions.should == [{:type=>'group', :access=>'edit', :name=>'group1'}]
     end
-
+    it "should assign user permissions when :type == 'person'" do
+      subject.permissions = [{:name=>'user1', :access=>'discover', :type=>'person'}]
+      subject.permissions.should == [{:type=>'user', :access=>'discover', :name=>'user1'}]
+    end
+    it "should raise an ArgumentError when the :type hashkey is invalid" do
+      expect{subject.permissions = [{:name=>'user1', :access=>'read', :type=>'foo'}]}.to raise_error(ArgumentError)
+    end
   end
 
   context "to_solr" do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hydra-access-controls
 version: !ruby/object:Gem::Version
-  version: 5.0.1
+  version: 5.1.0
   prerelease: 
 platform: ruby
 authors:
@@ -11,7 +11,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-12-17 00:00:00.000000000 Z
+date: 2012-12-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport