hydra-access-controls 8.2.0 → 9.0.0.beta1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (52) hide show
  1. checksums.yaml +4 -4
  2. data/README.textile +10 -10
  3. data/app/models/concerns/hydra/access_controls/access_right.rb +3 -2
  4. data/app/models/concerns/hydra/access_controls/embargoable.rb +120 -132
  5. data/app/models/concerns/hydra/access_controls/permissions.rb +137 -103
  6. data/app/models/concerns/hydra/access_controls/visibility.rb +3 -5
  7. data/app/models/concerns/hydra/access_controls.rb +0 -1
  8. data/app/models/concerns/hydra/admin_policy_behavior.rb +27 -2
  9. data/app/models/concerns/hydra/rights.rb +15 -0
  10. data/app/models/hydra/access_controls/access_control_list.rb +17 -0
  11. data/app/models/hydra/access_controls/embargo.rb +65 -0
  12. data/app/models/hydra/access_controls/lease.rb +66 -0
  13. data/app/models/hydra/access_controls/permission.rb +85 -0
  14. data/app/vocabularies/acl.rb +12 -0
  15. data/app/vocabularies/hydra/acl.rb +20 -0
  16. data/config/fedora.yml +4 -2
  17. data/hydra-access-controls.gemspec +6 -7
  18. data/lib/hydra/ability.rb +45 -43
  19. data/lib/hydra/access_controls_enforcement.rb +23 -25
  20. data/lib/hydra/admin_policy.rb +34 -11
  21. data/lib/hydra/config.rb +4 -15
  22. data/lib/hydra/permissions_query.rb +2 -2
  23. data/lib/hydra/permissions_solr_document.rb +4 -6
  24. data/lib/hydra/policy_aware_ability.rb +56 -53
  25. data/lib/hydra/policy_aware_access_controls_enforcement.rb +28 -18
  26. data/lib/hydra-access-controls.rb +1 -1
  27. data/spec/factories.rb +15 -15
  28. data/spec/services/embargo_service_spec.rb +6 -6
  29. data/spec/services/lease_service_spec.rb +6 -6
  30. data/spec/spec_helper.rb +20 -13
  31. data/spec/support/mods_asset.rb +3 -3
  32. data/spec/unit/ability_spec.rb +96 -121
  33. data/spec/unit/access_controls_enforcement_spec.rb +29 -27
  34. data/spec/unit/access_right_spec.rb +6 -1
  35. data/spec/unit/accessible_by_spec.rb +14 -5
  36. data/spec/unit/admin_policy_spec.rb +99 -92
  37. data/spec/unit/config_spec.rb +14 -15
  38. data/spec/unit/embargoable_spec.rb +26 -28
  39. data/spec/unit/permission_spec.rb +36 -16
  40. data/spec/unit/permissions_spec.rb +121 -65
  41. data/spec/unit/policy_aware_ability_spec.rb +64 -78
  42. data/spec/unit/policy_aware_access_controls_enforcement_spec.rb +81 -77
  43. data/spec/unit/role_mapper_spec.rb +10 -10
  44. data/spec/unit/with_access_right_spec.rb +1 -1
  45. metadata +29 -51
  46. data/lib/hydra/access_controls/permission.rb +0 -40
  47. data/lib/hydra/datastream/inheritable_rights_metadata.rb +0 -22
  48. data/lib/hydra/datastream/rights_metadata.rb +0 -276
  49. data/lib/hydra/datastream.rb +0 -7
  50. data/spec/unit/hydra_rights_metadata_persistence_spec.rb +0 -71
  51. data/spec/unit/hydra_rights_metadata_spec.rb +0 -301
  52. data/spec/unit/inheritable_rights_metadata_spec.rb +0 -65
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: 7d0c332d417111f77876c46bd3331349ce28da60
4
- data.tar.gz: 1282b9c10fe0ac75ba5e2793da8a08a1e0deb462
3
+ metadata.gz: 83a5be099ceb5cd745dc8fe1cd49ae0c5a72ba6d
4
+ data.tar.gz: 3670874653b5bc44c0dac63b277f755b99ad93cb
5
5
  SHA512:
6
- metadata.gz: 36f0b7eeab09aeee018e6610fd510a392110e7c6d6251d7b78b70c9c9b33b36014675b373f36487e53139ed79f397fa0e4404aee052c2f1c9630b4120c1cd2da
7
- data.tar.gz: c61a05b0b34fdf009ab676eda0a67f209f42c53d792952e39e454ac09be6cc4c9c2c66f665d47717a0b89a50e4155462ac6b8cb07c2bde46a577b351a374d33f
6
+ metadata.gz: caf8e64a95d305198f5558e05cdf59fcffa12a0c48ccb447644cd108aff0595dad6c0e8b9924efb0c1067883bf5e5b049dd81f5ff03f5523fb93c575873f1c91
7
+ data.tar.gz: 4543dfab3f31ac9d8077fce7a29a17dcb3e72cfa97635300f7fadd52dca7fa69599cda30cf4400b9671610f6c05a8dd13c04251ccc0b999a1aef352e7e876f0d
data/README.textile CHANGED
@@ -58,19 +58,19 @@ In config/initializers/hydra_config.rb
58
58
  # ... other stuff ...
59
59
  indexer = Solrizer::Descriptor.new(:string, :stored, :indexed, :multivalued)
60
60
  config[:permissions] = {
61
- :discover => {:group =>ActiveFedora::SolrService.solr_name("discover_access_group", indexer), :individual=>ActiveFedora::SolrService.solr_name("discover_access_person", indexer)},
62
- :read => {:group =>ActiveFedora::SolrService.solr_name("read_access_group", indexer), :individual=>ActiveFedora::SolrService.solr_name("read_access_person", indexer)},
63
- :edit => {:group =>ActiveFedora::SolrService.solr_name("edit_access_group", indexer), :individual=>ActiveFedora::SolrService.solr_name("edit_access_person", indexer)},
64
- :owner => ActiveFedora::SolrService.solr_name("depositor", indexer),
65
- :embargo_release_date => ActiveFedora::SolrService.solr_name("embargo_release_date", Solrizer::Descriptor.new(:date, :stored, :indexed))
61
+ :discover => {:group =>ActiveFedora::SolrQueryBuilder.solr_name("discover_access_group", indexer), :individual=>ActiveFedora::SolrQueryBuilder.solr_name("discover_access_person", indexer)},
62
+ :read => {:group =>ActiveFedora::SolrQueryBuilder.solr_name("read_access_group", indexer), :individual=>ActiveFedora::SolrQueryBuilder.solr_name("read_access_person", indexer)},
63
+ :edit => {:group =>ActiveFedora::SolrQueryBuilder.solr_name("edit_access_group", indexer), :individual=>ActiveFedora::SolrQueryBuilder.solr_name("edit_access_person", indexer)},
64
+ :owner => ActiveFedora::SolrQueryBuilder.solr_name("depositor", indexer),
65
+ :embargo_release_date => ActiveFedora::SolrQueryBuilder.solr_name("embargo_release_date", Solrizer::Descriptor.new(:date, :stored, :indexed))
66
66
  }
67
67
  indexer = Solrizer::Descriptor.new(:string, :stored, :indexed, :multivalued)
68
68
  config[:permissions][:inheritable] = {
69
- :discover => {:group =>ActiveFedora::SolrService.solr_name("inheritable_discover_access_group", indexer), :individual=>ActiveFedora::SolrService.solr_name("inheritable_discover_access_person", indexer)},
70
- :read => {:group =>ActiveFedora::SolrService.solr_name("inheritable_read_access_group", indexer), :individual=>ActiveFedora::SolrService.solr_name("inheritable_read_access_person", indexer)},
71
- :edit => {:group =>ActiveFedora::SolrService.solr_name("inheritable_edit_access_group", indexer), :individual=>ActiveFedora::SolrService.solr_name("inheritable_edit_access_person", indexer)},
72
- :owner => ActiveFedora::SolrService.solr_name("inheritable_depositor", indexer),
73
- :embargo_release_date => ActiveFedora::SolrService.solr_name("inheritable_embargo_release_date", Solrizer::Descriptor.new(:date, :stored, :indexed))
69
+ :discover => {:group =>ActiveFedora::SolrQueryBuilder.solr_name("inheritable_discover_access_group", indexer), :individual=>ActiveFedora::SolrQueryBuilder.solr_name("inheritable_discover_access_person", indexer)},
70
+ :read => {:group =>ActiveFedora::SolrQueryBuilder.solr_name("inheritable_read_access_group", indexer), :individual=>ActiveFedora::SolrQueryBuilder.solr_name("inheritable_read_access_person", indexer)},
71
+ :edit => {:group =>ActiveFedora::SolrQueryBuilder.solr_name("inheritable_edit_access_group", indexer), :individual=>ActiveFedora::SolrQueryBuilder.solr_name("inheritable_edit_access_person", indexer)},
72
+ :owner => ActiveFedora::SolrQueryBuilder.solr_name("inheritable_depositor", indexer),
73
+ :embargo_release_date => ActiveFedora::SolrQueryBuilder.solr_name("inheritable_embargo_release_date", Solrizer::Descriptor.new(:date, :stored, :indexed))
74
74
  }
75
75
  end
76
76
  </pre>
@@ -1,7 +1,7 @@
1
1
  module Hydra
2
2
  module AccessControls
3
3
  class AccessRight
4
- # What these groups are called in the Hydra rightsMetadata XML:
4
+ # What these groups are called in the Hydra rights assertions:
5
5
  PERMISSION_TEXT_VALUE_PUBLIC = 'public'.freeze
6
6
  PERMISSION_TEXT_VALUE_AUTHENTICATED = 'registered'.freeze
7
7
 
@@ -79,8 +79,9 @@ module Hydra
79
79
  def has_visibility_text_for?(text)
80
80
  visibility == text
81
81
  end
82
+
82
83
  def has_permission_text_for?(text)
83
- !!permissions.detect { |perm| perm.name == text }
84
+ !!permissions.detect { |perm| perm.agent_name == text }
84
85
  end
85
86
  end
86
87
  end
@@ -2,164 +2,152 @@ module Hydra
2
2
  module AccessControls
3
3
  module Embargoable
4
4
  extend ActiveSupport::Concern
5
+ include Hydra::AccessControls::WithAccessRight
5
6
 
6
7
  included do
7
- include Hydra::AccessControls::WithAccessRight
8
- # We include EmbargoableMethods so that it can override the methods included above,
9
- # and doesn't create a ActiveSupport::Concern::MultipleIncludedBlocks
10
- include EmbargoableMethods
11
8
  validates :embargo_release_date, :lease_expiration_date, :'hydra/future_date' => true
12
9
 
13
- has_attributes :visibility_during_embargo, :visibility_after_embargo, :embargo_release_date,
14
- :visibility_during_lease, :visibility_after_lease, :lease_expiration_date,
15
- datastream: 'rightsMetadata', multiple: false
10
+ belongs_to :embargo, predicate: Hydra::ACL.hasEmbargo, class_name: 'Hydra::AccessControls::Embargo'
11
+ belongs_to :lease, predicate: Hydra::ACL.hasLease, class_name: 'Hydra::AccessControls::Lease'
16
12
 
17
- has_attributes :embargo_history, :lease_history, datastream: 'rightsMetadata', multiple:true
13
+ delegate :visibility_during_embargo, :visibility_during_embargo=, :visibility_after_embargo, :visibility_after_embargo=, :embargo_release_date, :embargo_release_date=, :embargo_history, :embargo_history=, to: :existing_or_new_embargo
14
+ delegate :visibility_during_lease, :visibility_during_lease=, :visibility_after_lease, :visibility_after_lease=, :lease_expiration_date, :lease_expiration_date=, :lease_history, :lease_history=, to: :existing_or_new_lease
18
15
  end
19
16
 
20
- module EmbargoableMethods
21
- def under_embargo?
22
- rightsMetadata.under_embargo?
23
- end
17
+ # if the embargo exists return it, if not, build one and return it
18
+ def existing_or_new_embargo
19
+ embargo || build_embargo
20
+ end
24
21
 
25
- def active_lease?
26
- rightsMetadata.active_lease?
27
- end
22
+ # if the lease exists return it, if not, build one and return it
23
+ def existing_or_new_lease
24
+ lease || build_lease
25
+ end
28
26
 
29
- # If changing away from embargo or lease, this will deactivate the lease/embargo before proceeding.
30
- # The lease_visibility! and embargo_visibility! methods rely on this to deactivate the lease when applicable.
31
- def visibility=(value)
32
- # If changing from embargo or lease, deactivate the lease/embargo and wipe out the associated metadata before proceeding
33
- if !embargo_release_date.nil?
34
- deactivate_embargo! unless value == visibility_during_embargo
35
- end
36
- if !lease_expiration_date.nil?
37
- deactivate_lease! unless value == visibility_during_lease
38
- end
39
- super
27
+ def to_solr(solr_doc = {})
28
+ super.tap do |doc|
29
+ doc.merge!(embargo.to_hash) if embargo
30
+ doc.merge!(lease.to_hash) if lease
40
31
  end
32
+ end
41
33
 
42
- def apply_embargo(release_date, visibility_during=nil, visibility_after=nil)
43
- self.embargo_release_date = release_date
44
- self.visibility_during_embargo = visibility_during unless visibility_during.nil?
45
- self.visibility_after_embargo = visibility_after unless visibility_after.nil?
46
- embargo_visibility!
47
- visibility_will_change!
48
- end
34
+ def under_embargo?
35
+ embargo && embargo.active?
36
+ end
49
37
 
50
- def deactivate_embargo!
51
- return unless embargo_release_date
52
- embargo_state = under_embargo? ? "active" : "expired"
53
- embargo_record = embargo_history_message(embargo_state, Date.today, embargo_release_date, visibility_during_embargo, visibility_after_embargo)
54
- self.embargo_release_date = nil
55
- self.visibility_during_embargo = nil
56
- self.visibility_after_embargo = nil
57
- self.embargo_history += [embargo_record]
58
- visibility_will_change!
59
- end
38
+ def active_lease?
39
+ lease && lease.active?
40
+ end
60
41
 
61
- def validate_embargo
62
- if embargo_release_date
63
- if under_embargo?
64
- expected_visibility = visibility_during_embargo
65
- failure_message = "An embargo is in effect for this object until #{embargo_release_date}. Until that time the "
66
- else
67
- expected_visibility = visibility_after_embargo
68
- failure_message = "The embargo expired on #{embargo_release_date}. The "
69
- end
70
- if visibility == expected_visibility
71
- return true
72
- else
73
- failure_message << "visibility should be #{expected_visibility} but it is currently #{visibility}. Call embargo_visibility! on this object to repair."
74
- self.errors[:embargo] << failure_message
75
- return false
76
- end
77
- else
78
- return true
79
- end
80
- end
81
42
 
82
- # Set the current visibility to match what is described in the embargo.
83
- def embargo_visibility!
84
- if embargo_release_date
85
- if under_embargo?
86
- self.visibility_during_embargo = visibility_during_embargo ? visibility_during_embargo : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE
87
- self.visibility_after_embargo = visibility_after_embargo ? visibility_after_embargo : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
88
- self.visibility = visibility_during_embargo
89
- else
90
- self.visibility = visibility_after_embargo ? visibility_after_embargo : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
91
- end
92
- end
43
+ # If changing away from embargo or lease, this will deactivate the lease/embargo before proceeding.
44
+ # The lease_visibility! and embargo_visibility! methods rely on this to deactivate the lease when applicable.
45
+ def visibility=(value)
46
+ # If changing from embargo or lease, deactivate the lease/embargo and wipe out the associated metadata before proceeding
47
+ if !embargo_release_date.nil?
48
+ deactivate_embargo! unless value == visibility_during_embargo
93
49
  end
94
-
95
- def validate_lease
96
- if lease_expiration_date
97
- if active_lease?
98
- expected_visibility = visibility_during_lease
99
- failure_message = "A lease is in effect for this object until #{lease_expiration_date}. Until that time the "
100
- else
101
- expected_visibility = visibility_after_lease
102
- failure_message = "The lease expired on #{lease_expiration_date}. The "
103
- end
104
- if visibility == expected_visibility
105
- return true
106
- else
107
- failure_message << "visibility should be #{expected_visibility} but it is currently #{visibility}. Call lease_visibility! on this object to repair."
108
- self.errors[:lease] << failure_message
109
- return false
110
- end
111
- else
112
- return true
113
- end
50
+ if !lease_expiration_date.nil?
51
+ deactivate_lease! unless value == visibility_during_lease
114
52
  end
53
+ super
54
+ end
115
55
 
116
- def apply_lease(release_date, visibility_during=nil, visibility_after=nil)
117
- self.lease_expiration_date = release_date
118
- self.visibility_during_lease = visibility_during unless visibility_during.nil?
119
- self.visibility_after_lease = visibility_after unless visibility_after.nil?
120
- lease_visibility!
121
- visibility_will_change!
56
+ def apply_embargo(release_date, visibility_during=nil, visibility_after=nil)
57
+ self.embargo_release_date = release_date
58
+ self.visibility_during_embargo = visibility_during unless visibility_during.nil?
59
+ self.visibility_after_embargo = visibility_after unless visibility_after.nil?
60
+ embargo_visibility!
61
+ visibility_will_change!
62
+ end
63
+
64
+ def deactivate_embargo!
65
+ embargo && embargo.deactivate!
66
+ visibility_will_change!
67
+ end
68
+
69
+ # Validate that the current visibility is what is specified in the embargo
70
+ def validate_embargo
71
+ Deprecation.warn Embargoable, "validate_embargo is deprecated and will be removed in hydra-access-controls 9.0.0. Use validate_visibility_complies_with_embargo instead."
72
+ validate_visibility_complies_with_embargo
73
+ end
74
+
75
+ # Validate that the current visibility is what is specified in the embargo
76
+ def validate_visibility_complies_with_embargo
77
+ return true unless embargo_release_date
78
+ if under_embargo?
79
+ expected_visibility = visibility_during_embargo
80
+ failure_message = "An embargo is in effect for this object until #{embargo_release_date}. Until that time the "
81
+ else
82
+ expected_visibility = visibility_after_embargo
83
+ failure_message = "The embargo expired on #{embargo_release_date}. The "
84
+ end
85
+ if visibility != expected_visibility
86
+ failure_message << "visibility should be #{expected_visibility} but it is currently #{visibility}. Call embargo_visibility! on this object to repair."
87
+ self.errors[:embargo] << failure_message
88
+ return false
122
89
  end
90
+ true
91
+ end
123
92
 
124
- def deactivate_lease!
125
- return unless lease_expiration_date
126
- lease_state = active_lease? ? "active" : "expired"
127
- lease_record = lease_history_message(lease_state, Date.today, lease_expiration_date, visibility_during_lease, visibility_after_lease)
128
- self.lease_expiration_date = nil
129
- self.visibility_during_lease = nil
130
- self.visibility_after_lease = nil
131
- self.lease_history += [lease_record]
132
- visibility_will_change!
93
+ # Set the current visibility to match what is described in the embargo.
94
+ def embargo_visibility!
95
+ return unless embargo_release_date
96
+ if under_embargo?
97
+ self.visibility_during_embargo = visibility_during_embargo ? visibility_during_embargo : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE
98
+ self.visibility_after_embargo = visibility_after_embargo ? visibility_after_embargo : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
99
+ self.visibility = visibility_during_embargo
100
+ else
101
+ self.visibility = visibility_after_embargo ? visibility_after_embargo : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
133
102
  end
103
+ end
134
104
 
135
- # Set the current visibility to match what is described in the lease.
136
- def lease_visibility!
137
- if lease_expiration_date
138
- if active_lease?
139
- self.visibility_during_lease = visibility_during_lease ? visibility_during_lease : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
140
- self.visibility_after_lease = visibility_after_lease ? visibility_after_lease : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE
141
- self.visibility = visibility_during_lease
142
- else
143
- self.visibility = visibility_after_lease ? visibility_after_lease : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE
144
- end
145
- end
105
+ def validate_lease
106
+ Deprecation.warn Embargoable, "validate_lease is deprecated and will be removed in hydra-access-controls 9.0.0. Use validate_visibility_complies_with_lease instead."
107
+ validate_visibility_complies_with_lease
108
+ end
109
+
110
+ def validate_visibility_complies_with_lease
111
+ return true unless lease_expiration_date
112
+ if active_lease?
113
+ expected_visibility = visibility_during_lease
114
+ failure_message = "A lease is in effect for this object until #{lease_expiration_date}. Until that time the "
115
+ else
116
+ expected_visibility = visibility_after_lease
117
+ failure_message = "The lease expired on #{lease_expiration_date}. The "
118
+ end
119
+ if visibility != expected_visibility
120
+ failure_message << "visibility should be #{expected_visibility} but it is currently #{visibility}. Call lease_visibility! on this object to repair."
121
+ self.errors[:lease] << failure_message
122
+ return false
146
123
  end
124
+ true
125
+ end
147
126
 
148
- protected
127
+ def apply_lease(release_date, visibility_during=nil, visibility_after=nil)
128
+ self.lease_expiration_date = release_date
129
+ self.visibility_during_lease = visibility_during unless visibility_during.nil?
130
+ self.visibility_after_lease = visibility_after unless visibility_after.nil?
131
+ lease_visibility!
132
+ visibility_will_change!
133
+ end
149
134
 
150
- # Create the log message used when deactivating an embargo
151
- # This method may be overriden in order to transform the values of the passed parameters.
152
- def embargo_history_message(state, deactivate_date, release_date, visibility_during, visibility_after)
153
- I18n.t 'hydra.embargo.history_message', state: state, deactivate_date: deactivate_date, release_date: release_date,
154
- visibility_during: visibility_during, visibility_after: visibility_after
155
- end
135
+ def deactivate_lease!
136
+ lease && lease.deactivate!
137
+ visibility_will_change!
138
+ end
156
139
 
157
- # Create the log message used when deactivating a lease
158
- # This method may be overriden in order to transform the values of the passed parameters.
159
- def lease_history_message(state, deactivate_date, expiration_date, visibility_during, visibility_after)
160
- I18n.t 'hydra.lease.history_message', state: state, deactivate_date: deactivate_date, expiration_date: expiration_date,
161
- visibility_during: visibility_during, visibility_after: visibility_after
140
+ # Set the current visibility to match what is described in the lease.
141
+ def lease_visibility!
142
+ if lease_expiration_date
143
+ if active_lease?
144
+ self.visibility_during_lease = visibility_during_lease ? visibility_during_lease : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
145
+ self.visibility_after_lease = visibility_after_lease ? visibility_after_lease : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE
146
+ self.visibility = visibility_during_lease
147
+ else
148
+ self.visibility = visibility_after_lease ? visibility_after_lease : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE
162
149
  end
150
+ end
163
151
  end
164
152
  end
165
153
  end