hydra-access-controls 8.2.0 → 9.0.0.beta1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/README.textile +10 -10
- data/app/models/concerns/hydra/access_controls/access_right.rb +3 -2
- data/app/models/concerns/hydra/access_controls/embargoable.rb +120 -132
- data/app/models/concerns/hydra/access_controls/permissions.rb +137 -103
- data/app/models/concerns/hydra/access_controls/visibility.rb +3 -5
- data/app/models/concerns/hydra/access_controls.rb +0 -1
- data/app/models/concerns/hydra/admin_policy_behavior.rb +27 -2
- data/app/models/concerns/hydra/rights.rb +15 -0
- data/app/models/hydra/access_controls/access_control_list.rb +17 -0
- data/app/models/hydra/access_controls/embargo.rb +65 -0
- data/app/models/hydra/access_controls/lease.rb +66 -0
- data/app/models/hydra/access_controls/permission.rb +85 -0
- data/app/vocabularies/acl.rb +12 -0
- data/app/vocabularies/hydra/acl.rb +20 -0
- data/config/fedora.yml +4 -2
- data/hydra-access-controls.gemspec +6 -7
- data/lib/hydra/ability.rb +45 -43
- data/lib/hydra/access_controls_enforcement.rb +23 -25
- data/lib/hydra/admin_policy.rb +34 -11
- data/lib/hydra/config.rb +4 -15
- data/lib/hydra/permissions_query.rb +2 -2
- data/lib/hydra/permissions_solr_document.rb +4 -6
- data/lib/hydra/policy_aware_ability.rb +56 -53
- data/lib/hydra/policy_aware_access_controls_enforcement.rb +28 -18
- data/lib/hydra-access-controls.rb +1 -1
- data/spec/factories.rb +15 -15
- data/spec/services/embargo_service_spec.rb +6 -6
- data/spec/services/lease_service_spec.rb +6 -6
- data/spec/spec_helper.rb +20 -13
- data/spec/support/mods_asset.rb +3 -3
- data/spec/unit/ability_spec.rb +96 -121
- data/spec/unit/access_controls_enforcement_spec.rb +29 -27
- data/spec/unit/access_right_spec.rb +6 -1
- data/spec/unit/accessible_by_spec.rb +14 -5
- data/spec/unit/admin_policy_spec.rb +99 -92
- data/spec/unit/config_spec.rb +14 -15
- data/spec/unit/embargoable_spec.rb +26 -28
- data/spec/unit/permission_spec.rb +36 -16
- data/spec/unit/permissions_spec.rb +121 -65
- data/spec/unit/policy_aware_ability_spec.rb +64 -78
- data/spec/unit/policy_aware_access_controls_enforcement_spec.rb +81 -77
- data/spec/unit/role_mapper_spec.rb +10 -10
- data/spec/unit/with_access_right_spec.rb +1 -1
- metadata +29 -51
- data/lib/hydra/access_controls/permission.rb +0 -40
- data/lib/hydra/datastream/inheritable_rights_metadata.rb +0 -22
- data/lib/hydra/datastream/rights_metadata.rb +0 -276
- data/lib/hydra/datastream.rb +0 -7
- data/spec/unit/hydra_rights_metadata_persistence_spec.rb +0 -71
- data/spec/unit/hydra_rights_metadata_spec.rb +0 -301
- data/spec/unit/inheritable_rights_metadata_spec.rb +0 -65
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 83a5be099ceb5cd745dc8fe1cd49ae0c5a72ba6d
|
4
|
+
data.tar.gz: 3670874653b5bc44c0dac63b277f755b99ad93cb
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: caf8e64a95d305198f5558e05cdf59fcffa12a0c48ccb447644cd108aff0595dad6c0e8b9924efb0c1067883bf5e5b049dd81f5ff03f5523fb93c575873f1c91
|
7
|
+
data.tar.gz: 4543dfab3f31ac9d8077fce7a29a17dcb3e72cfa97635300f7fadd52dca7fa69599cda30cf4400b9671610f6c05a8dd13c04251ccc0b999a1aef352e7e876f0d
|
data/README.textile
CHANGED
@@ -58,19 +58,19 @@ In config/initializers/hydra_config.rb
|
|
58
58
|
# ... other stuff ...
|
59
59
|
indexer = Solrizer::Descriptor.new(:string, :stored, :indexed, :multivalued)
|
60
60
|
config[:permissions] = {
|
61
|
-
:discover => {:group =>ActiveFedora::
|
62
|
-
:read => {:group =>ActiveFedora::
|
63
|
-
:edit => {:group =>ActiveFedora::
|
64
|
-
:owner => ActiveFedora::
|
65
|
-
:embargo_release_date => ActiveFedora::
|
61
|
+
:discover => {:group =>ActiveFedora::SolrQueryBuilder.solr_name("discover_access_group", indexer), :individual=>ActiveFedora::SolrQueryBuilder.solr_name("discover_access_person", indexer)},
|
62
|
+
:read => {:group =>ActiveFedora::SolrQueryBuilder.solr_name("read_access_group", indexer), :individual=>ActiveFedora::SolrQueryBuilder.solr_name("read_access_person", indexer)},
|
63
|
+
:edit => {:group =>ActiveFedora::SolrQueryBuilder.solr_name("edit_access_group", indexer), :individual=>ActiveFedora::SolrQueryBuilder.solr_name("edit_access_person", indexer)},
|
64
|
+
:owner => ActiveFedora::SolrQueryBuilder.solr_name("depositor", indexer),
|
65
|
+
:embargo_release_date => ActiveFedora::SolrQueryBuilder.solr_name("embargo_release_date", Solrizer::Descriptor.new(:date, :stored, :indexed))
|
66
66
|
}
|
67
67
|
indexer = Solrizer::Descriptor.new(:string, :stored, :indexed, :multivalued)
|
68
68
|
config[:permissions][:inheritable] = {
|
69
|
-
:discover => {:group =>ActiveFedora::
|
70
|
-
:read => {:group =>ActiveFedora::
|
71
|
-
:edit => {:group =>ActiveFedora::
|
72
|
-
:owner => ActiveFedora::
|
73
|
-
:embargo_release_date => ActiveFedora::
|
69
|
+
:discover => {:group =>ActiveFedora::SolrQueryBuilder.solr_name("inheritable_discover_access_group", indexer), :individual=>ActiveFedora::SolrQueryBuilder.solr_name("inheritable_discover_access_person", indexer)},
|
70
|
+
:read => {:group =>ActiveFedora::SolrQueryBuilder.solr_name("inheritable_read_access_group", indexer), :individual=>ActiveFedora::SolrQueryBuilder.solr_name("inheritable_read_access_person", indexer)},
|
71
|
+
:edit => {:group =>ActiveFedora::SolrQueryBuilder.solr_name("inheritable_edit_access_group", indexer), :individual=>ActiveFedora::SolrQueryBuilder.solr_name("inheritable_edit_access_person", indexer)},
|
72
|
+
:owner => ActiveFedora::SolrQueryBuilder.solr_name("inheritable_depositor", indexer),
|
73
|
+
:embargo_release_date => ActiveFedora::SolrQueryBuilder.solr_name("inheritable_embargo_release_date", Solrizer::Descriptor.new(:date, :stored, :indexed))
|
74
74
|
}
|
75
75
|
end
|
76
76
|
</pre>
|
@@ -1,7 +1,7 @@
|
|
1
1
|
module Hydra
|
2
2
|
module AccessControls
|
3
3
|
class AccessRight
|
4
|
-
# What these groups are called in the Hydra
|
4
|
+
# What these groups are called in the Hydra rights assertions:
|
5
5
|
PERMISSION_TEXT_VALUE_PUBLIC = 'public'.freeze
|
6
6
|
PERMISSION_TEXT_VALUE_AUTHENTICATED = 'registered'.freeze
|
7
7
|
|
@@ -79,8 +79,9 @@ module Hydra
|
|
79
79
|
def has_visibility_text_for?(text)
|
80
80
|
visibility == text
|
81
81
|
end
|
82
|
+
|
82
83
|
def has_permission_text_for?(text)
|
83
|
-
!!permissions.detect { |perm| perm.
|
84
|
+
!!permissions.detect { |perm| perm.agent_name == text }
|
84
85
|
end
|
85
86
|
end
|
86
87
|
end
|
@@ -2,164 +2,152 @@ module Hydra
|
|
2
2
|
module AccessControls
|
3
3
|
module Embargoable
|
4
4
|
extend ActiveSupport::Concern
|
5
|
+
include Hydra::AccessControls::WithAccessRight
|
5
6
|
|
6
7
|
included do
|
7
|
-
include Hydra::AccessControls::WithAccessRight
|
8
|
-
# We include EmbargoableMethods so that it can override the methods included above,
|
9
|
-
# and doesn't create a ActiveSupport::Concern::MultipleIncludedBlocks
|
10
|
-
include EmbargoableMethods
|
11
8
|
validates :embargo_release_date, :lease_expiration_date, :'hydra/future_date' => true
|
12
9
|
|
13
|
-
|
14
|
-
|
15
|
-
datastream: 'rightsMetadata', multiple: false
|
10
|
+
belongs_to :embargo, predicate: Hydra::ACL.hasEmbargo, class_name: 'Hydra::AccessControls::Embargo'
|
11
|
+
belongs_to :lease, predicate: Hydra::ACL.hasLease, class_name: 'Hydra::AccessControls::Lease'
|
16
12
|
|
17
|
-
|
13
|
+
delegate :visibility_during_embargo, :visibility_during_embargo=, :visibility_after_embargo, :visibility_after_embargo=, :embargo_release_date, :embargo_release_date=, :embargo_history, :embargo_history=, to: :existing_or_new_embargo
|
14
|
+
delegate :visibility_during_lease, :visibility_during_lease=, :visibility_after_lease, :visibility_after_lease=, :lease_expiration_date, :lease_expiration_date=, :lease_history, :lease_history=, to: :existing_or_new_lease
|
18
15
|
end
|
19
16
|
|
20
|
-
|
21
|
-
|
22
|
-
|
23
|
-
|
17
|
+
# if the embargo exists return it, if not, build one and return it
|
18
|
+
def existing_or_new_embargo
|
19
|
+
embargo || build_embargo
|
20
|
+
end
|
24
21
|
|
25
|
-
|
26
|
-
|
27
|
-
|
22
|
+
# if the lease exists return it, if not, build one and return it
|
23
|
+
def existing_or_new_lease
|
24
|
+
lease || build_lease
|
25
|
+
end
|
28
26
|
|
29
|
-
|
30
|
-
|
31
|
-
|
32
|
-
|
33
|
-
if !embargo_release_date.nil?
|
34
|
-
deactivate_embargo! unless value == visibility_during_embargo
|
35
|
-
end
|
36
|
-
if !lease_expiration_date.nil?
|
37
|
-
deactivate_lease! unless value == visibility_during_lease
|
38
|
-
end
|
39
|
-
super
|
27
|
+
def to_solr(solr_doc = {})
|
28
|
+
super.tap do |doc|
|
29
|
+
doc.merge!(embargo.to_hash) if embargo
|
30
|
+
doc.merge!(lease.to_hash) if lease
|
40
31
|
end
|
32
|
+
end
|
41
33
|
|
42
|
-
|
43
|
-
|
44
|
-
|
45
|
-
self.visibility_after_embargo = visibility_after unless visibility_after.nil?
|
46
|
-
embargo_visibility!
|
47
|
-
visibility_will_change!
|
48
|
-
end
|
34
|
+
def under_embargo?
|
35
|
+
embargo && embargo.active?
|
36
|
+
end
|
49
37
|
|
50
|
-
|
51
|
-
|
52
|
-
|
53
|
-
embargo_record = embargo_history_message(embargo_state, Date.today, embargo_release_date, visibility_during_embargo, visibility_after_embargo)
|
54
|
-
self.embargo_release_date = nil
|
55
|
-
self.visibility_during_embargo = nil
|
56
|
-
self.visibility_after_embargo = nil
|
57
|
-
self.embargo_history += [embargo_record]
|
58
|
-
visibility_will_change!
|
59
|
-
end
|
38
|
+
def active_lease?
|
39
|
+
lease && lease.active?
|
40
|
+
end
|
60
41
|
|
61
|
-
def validate_embargo
|
62
|
-
if embargo_release_date
|
63
|
-
if under_embargo?
|
64
|
-
expected_visibility = visibility_during_embargo
|
65
|
-
failure_message = "An embargo is in effect for this object until #{embargo_release_date}. Until that time the "
|
66
|
-
else
|
67
|
-
expected_visibility = visibility_after_embargo
|
68
|
-
failure_message = "The embargo expired on #{embargo_release_date}. The "
|
69
|
-
end
|
70
|
-
if visibility == expected_visibility
|
71
|
-
return true
|
72
|
-
else
|
73
|
-
failure_message << "visibility should be #{expected_visibility} but it is currently #{visibility}. Call embargo_visibility! on this object to repair."
|
74
|
-
self.errors[:embargo] << failure_message
|
75
|
-
return false
|
76
|
-
end
|
77
|
-
else
|
78
|
-
return true
|
79
|
-
end
|
80
|
-
end
|
81
42
|
|
82
|
-
|
83
|
-
|
84
|
-
|
85
|
-
|
86
|
-
|
87
|
-
|
88
|
-
self.visibility = visibility_during_embargo
|
89
|
-
else
|
90
|
-
self.visibility = visibility_after_embargo ? visibility_after_embargo : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
|
91
|
-
end
|
92
|
-
end
|
43
|
+
# If changing away from embargo or lease, this will deactivate the lease/embargo before proceeding.
|
44
|
+
# The lease_visibility! and embargo_visibility! methods rely on this to deactivate the lease when applicable.
|
45
|
+
def visibility=(value)
|
46
|
+
# If changing from embargo or lease, deactivate the lease/embargo and wipe out the associated metadata before proceeding
|
47
|
+
if !embargo_release_date.nil?
|
48
|
+
deactivate_embargo! unless value == visibility_during_embargo
|
93
49
|
end
|
94
|
-
|
95
|
-
|
96
|
-
if lease_expiration_date
|
97
|
-
if active_lease?
|
98
|
-
expected_visibility = visibility_during_lease
|
99
|
-
failure_message = "A lease is in effect for this object until #{lease_expiration_date}. Until that time the "
|
100
|
-
else
|
101
|
-
expected_visibility = visibility_after_lease
|
102
|
-
failure_message = "The lease expired on #{lease_expiration_date}. The "
|
103
|
-
end
|
104
|
-
if visibility == expected_visibility
|
105
|
-
return true
|
106
|
-
else
|
107
|
-
failure_message << "visibility should be #{expected_visibility} but it is currently #{visibility}. Call lease_visibility! on this object to repair."
|
108
|
-
self.errors[:lease] << failure_message
|
109
|
-
return false
|
110
|
-
end
|
111
|
-
else
|
112
|
-
return true
|
113
|
-
end
|
50
|
+
if !lease_expiration_date.nil?
|
51
|
+
deactivate_lease! unless value == visibility_during_lease
|
114
52
|
end
|
53
|
+
super
|
54
|
+
end
|
115
55
|
|
116
|
-
|
117
|
-
|
118
|
-
|
119
|
-
|
120
|
-
|
121
|
-
|
56
|
+
def apply_embargo(release_date, visibility_during=nil, visibility_after=nil)
|
57
|
+
self.embargo_release_date = release_date
|
58
|
+
self.visibility_during_embargo = visibility_during unless visibility_during.nil?
|
59
|
+
self.visibility_after_embargo = visibility_after unless visibility_after.nil?
|
60
|
+
embargo_visibility!
|
61
|
+
visibility_will_change!
|
62
|
+
end
|
63
|
+
|
64
|
+
def deactivate_embargo!
|
65
|
+
embargo && embargo.deactivate!
|
66
|
+
visibility_will_change!
|
67
|
+
end
|
68
|
+
|
69
|
+
# Validate that the current visibility is what is specified in the embargo
|
70
|
+
def validate_embargo
|
71
|
+
Deprecation.warn Embargoable, "validate_embargo is deprecated and will be removed in hydra-access-controls 9.0.0. Use validate_visibility_complies_with_embargo instead."
|
72
|
+
validate_visibility_complies_with_embargo
|
73
|
+
end
|
74
|
+
|
75
|
+
# Validate that the current visibility is what is specified in the embargo
|
76
|
+
def validate_visibility_complies_with_embargo
|
77
|
+
return true unless embargo_release_date
|
78
|
+
if under_embargo?
|
79
|
+
expected_visibility = visibility_during_embargo
|
80
|
+
failure_message = "An embargo is in effect for this object until #{embargo_release_date}. Until that time the "
|
81
|
+
else
|
82
|
+
expected_visibility = visibility_after_embargo
|
83
|
+
failure_message = "The embargo expired on #{embargo_release_date}. The "
|
84
|
+
end
|
85
|
+
if visibility != expected_visibility
|
86
|
+
failure_message << "visibility should be #{expected_visibility} but it is currently #{visibility}. Call embargo_visibility! on this object to repair."
|
87
|
+
self.errors[:embargo] << failure_message
|
88
|
+
return false
|
122
89
|
end
|
90
|
+
true
|
91
|
+
end
|
123
92
|
|
124
|
-
|
125
|
-
|
126
|
-
|
127
|
-
|
128
|
-
self.
|
129
|
-
self.
|
130
|
-
self.
|
131
|
-
|
132
|
-
|
93
|
+
# Set the current visibility to match what is described in the embargo.
|
94
|
+
def embargo_visibility!
|
95
|
+
return unless embargo_release_date
|
96
|
+
if under_embargo?
|
97
|
+
self.visibility_during_embargo = visibility_during_embargo ? visibility_during_embargo : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE
|
98
|
+
self.visibility_after_embargo = visibility_after_embargo ? visibility_after_embargo : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
|
99
|
+
self.visibility = visibility_during_embargo
|
100
|
+
else
|
101
|
+
self.visibility = visibility_after_embargo ? visibility_after_embargo : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
|
133
102
|
end
|
103
|
+
end
|
134
104
|
|
135
|
-
|
136
|
-
|
137
|
-
|
138
|
-
|
139
|
-
|
140
|
-
|
141
|
-
|
142
|
-
|
143
|
-
|
144
|
-
|
145
|
-
|
105
|
+
def validate_lease
|
106
|
+
Deprecation.warn Embargoable, "validate_lease is deprecated and will be removed in hydra-access-controls 9.0.0. Use validate_visibility_complies_with_lease instead."
|
107
|
+
validate_visibility_complies_with_lease
|
108
|
+
end
|
109
|
+
|
110
|
+
def validate_visibility_complies_with_lease
|
111
|
+
return true unless lease_expiration_date
|
112
|
+
if active_lease?
|
113
|
+
expected_visibility = visibility_during_lease
|
114
|
+
failure_message = "A lease is in effect for this object until #{lease_expiration_date}. Until that time the "
|
115
|
+
else
|
116
|
+
expected_visibility = visibility_after_lease
|
117
|
+
failure_message = "The lease expired on #{lease_expiration_date}. The "
|
118
|
+
end
|
119
|
+
if visibility != expected_visibility
|
120
|
+
failure_message << "visibility should be #{expected_visibility} but it is currently #{visibility}. Call lease_visibility! on this object to repair."
|
121
|
+
self.errors[:lease] << failure_message
|
122
|
+
return false
|
146
123
|
end
|
124
|
+
true
|
125
|
+
end
|
147
126
|
|
148
|
-
|
127
|
+
def apply_lease(release_date, visibility_during=nil, visibility_after=nil)
|
128
|
+
self.lease_expiration_date = release_date
|
129
|
+
self.visibility_during_lease = visibility_during unless visibility_during.nil?
|
130
|
+
self.visibility_after_lease = visibility_after unless visibility_after.nil?
|
131
|
+
lease_visibility!
|
132
|
+
visibility_will_change!
|
133
|
+
end
|
149
134
|
|
150
|
-
|
151
|
-
|
152
|
-
|
153
|
-
|
154
|
-
visibility_during: visibility_during, visibility_after: visibility_after
|
155
|
-
end
|
135
|
+
def deactivate_lease!
|
136
|
+
lease && lease.deactivate!
|
137
|
+
visibility_will_change!
|
138
|
+
end
|
156
139
|
|
157
|
-
|
158
|
-
|
159
|
-
|
160
|
-
|
161
|
-
|
140
|
+
# Set the current visibility to match what is described in the lease.
|
141
|
+
def lease_visibility!
|
142
|
+
if lease_expiration_date
|
143
|
+
if active_lease?
|
144
|
+
self.visibility_during_lease = visibility_during_lease ? visibility_during_lease : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
|
145
|
+
self.visibility_after_lease = visibility_after_lease ? visibility_after_lease : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE
|
146
|
+
self.visibility = visibility_during_lease
|
147
|
+
else
|
148
|
+
self.visibility = visibility_after_lease ? visibility_after_lease : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE
|
162
149
|
end
|
150
|
+
end
|
163
151
|
end
|
164
152
|
end
|
165
153
|
end
|