hydra-access-controls 8.2.0 → 9.0.0.beta1

data/lib/hydra/policy_aware_ability.rb

@@ -1,83 +1,76 @@
 # Repeats access controls evaluation methods, but checks against a governing "Policy" object (or "Collection" object) that provides inherited access controls.
 module Hydra::PolicyAwareAbility
   extend ActiveSupport::Concern
+  extend Deprecation
   include Hydra::Ability
-  
+
+  IS_GOVERNED_BY_SOLR_FIELD = "isGovernedBy_ssim".freeze
+
   # Extends Hydra::Ability.test_edit to try policy controls if object-level controls deny access
   def test_edit(pid)
-    result = super
-    if result 
-      return result
-    else
-      return test_edit_from_policy(pid)
-    end
+    super || test_edit_from_policy(pid)
   end
-  
+
   # Extends Hydra::Ability.test_read to try policy controls if object-level controls deny access
   def test_read(pid)
-    result = super
-    if result 
-      return result
-    else
-      return test_read_from_policy(pid)
-    end
+    super || test_read_from_policy(pid)
   end
-  
+
   # Returns the pid of policy object (is_governed_by) for the specified object
-  # Assumes that the policy object is associated by an is_governed_by relationship 
+  # Assumes that the policy object is associated by an is_governed_by relationship
   # (which is stored as "is_governed_by_ssim" in object's solr document)
   # Returns nil if no policy associated with the object
   def policy_pid_for(object_pid)
     policy_pid = policy_pid_cache[object_pid]
     return policy_pid if policy_pid
-    solr_result = ActiveFedora::Base.find_with_conditions({:id=>object_pid}, :fl=>ActiveFedora::SolrService.solr_name('is_governed_by', :symbol))
+    solr_result = ActiveFedora::Base.find_with_conditions({id: object_pid}, fl: governed_by_solr_field)
     begin
-      policy_pid_cache[object_pid] = policy_pid = value_from_solr_field(solr_result, ActiveFedora::SolrService.solr_name('is_governed_by', :symbol)).first.gsub("info:fedora/", "")
+      policy_pid_cache[object_pid] = policy_pid = value_from_solr_field(solr_result, governed_by_solr_field).first.gsub("info:fedora/", "")
     rescue NoMethodError
     end
     return policy_pid
   end
-  
+
+  def governed_by_solr_field
+    # TODO the solr key could be derived if we knew the class of the object:
+    #   ModsAsset.reflect_on_association(:admin_policy).solr_key
+    IS_GOVERNED_BY_SOLR_FIELD
+  end
+
   # Returns the permissions solr document for policy_pid
   # The document is stored in an instance variable, so calling this multiple times will only query solr once.
-  # To force reload, set @policy_permissions_solr_cache to {} 
+  # To force reload, set @policy_permissions_solr_cache to {}
   def policy_permissions_doc(policy_pid)
     @policy_permissions_solr_cache ||= {}
     @policy_permissions_solr_cache[policy_pid] ||= get_permissions_solr_response_for_doc_id(policy_pid)
   end
-  
+
   # Tests whether the object's governing policy object grants edit access for the current user
   def test_edit_from_policy(object_pid)
     policy_pid = policy_pid_for(object_pid)
-    if policy_pid.nil?
-      return false
-    else
-      Rails.logger.debug("[CANCAN] -policy- Does the POLICY #{policy_pid} provide EDIT permissions for #{current_user.user_key}?")
-      group_intersection = user_groups & edit_groups_from_policy( policy_pid )
-      result = !group_intersection.empty? || edit_users_from_policy( policy_pid ).include?(current_user.user_key)
-      Rails.logger.debug("[CANCAN] -policy- decision: #{result}")
-      return result
-    end
-  end   
-  
+    return false if policy_pid.nil?
+    Rails.logger.debug("[CANCAN] -policy- Does the POLICY #{policy_pid} provide EDIT permissions for #{current_user.user_key}?")
+    group_intersection = user_groups & edit_groups_from_policy( policy_pid )
+    result = !group_intersection.empty? || edit_users_from_policy( policy_pid ).include?(current_user.user_key)
+    Rails.logger.debug("[CANCAN] -policy- decision: #{result}")
+    result
+  end
+
   # Tests whether the object's governing policy object grants read access for the current user
   def test_read_from_policy(object_pid)
     policy_pid = policy_pid_for(object_pid)
-    if policy_pid.nil?
-      return false
-    else
-      Rails.logger.debug("[CANCAN] -policy- Does the POLICY #{policy_pid} provide READ permissions for #{current_user.user_key}?")
-      group_intersection = user_groups & read_groups_from_policy( policy_pid )
-      result = !group_intersection.empty? || read_users_from_policy( policy_pid ).include?(current_user.user_key)
-      Rails.logger.debug("[CANCAN] -policy- decision: #{result}")
-      result
-    end
-  end 
-  
+    return false if policy_pid.nil?
+    Rails.logger.debug("[CANCAN] -policy- Does the POLICY #{policy_pid} provide READ permissions for #{current_user.user_key}?")
+    group_intersection = user_groups & read_groups_from_policy( policy_pid )
+    result = !group_intersection.empty? || read_users_from_policy( policy_pid ).include?(current_user.user_key)
+    Rails.logger.debug("[CANCAN] -policy- decision: #{result}")
+    result
+  end
+
   # Returns the list of groups granted edit access by the policy object identified by policy_pid
   def edit_groups_from_policy(policy_pid)
     policy_permissions = policy_permissions_doc(policy_pid)
-    edit_group_field = Hydra.config[:permissions][:inheritable][:edit][:group]
+    edit_group_field = Hydra.config.permissions.inheritable[:edit][:group]
     eg = ((policy_permissions == nil || policy_permissions.fetch(edit_group_field,nil) == nil) ? [] : policy_permissions.fetch(edit_group_field,nil))
     Rails.logger.debug("[CANCAN] -policy- edit_groups: #{eg.inspect}")
     return eg
@@ -87,44 +80,54 @@ module Hydra::PolicyAwareAbility
   # Note: edit implies read, so read_groups is the union of edit and read groups
   def read_groups_from_policy(policy_pid)
     policy_permissions = policy_permissions_doc(policy_pid)
-    read_group_field = Hydra.config[:permissions][:inheritable][:read][:group]
+    read_group_field = Hydra.config.permissions.inheritable[:read][:group]
     rg = edit_groups_from_policy(policy_pid) | ((policy_permissions == nil || policy_permissions.fetch(read_group_field,nil) == nil) ? [] : policy_permissions.fetch(read_group_field,nil))
     Rails.logger.debug("[CANCAN] -policy- read_groups: #{rg.inspect}")
     return rg
   end
 
+  def edit_persons_from_policy(policy_pid)
+    Deprecation.warn(Hydra::PolicyAwareAbility, "The edit_persons_from_policy method is deprecated and will be removed from Hydra::PolicyAwareAbility in hydra-head 8.0.  Use edit_users_from_policy instead.", caller)
+    edit_users_from_policy(policy_pid)
+  end
+
   # Returns the list of users granted edit access by the policy object identified by policy_pid
   def edit_users_from_policy(policy_pid)
     policy_permissions = policy_permissions_doc(policy_pid)
-    edit_user_field = Hydra.config[:permissions][:inheritable][:edit][:individual]
+    edit_user_field = Hydra.config.permissions.inheritable[:edit][:individual]
     eu = ((policy_permissions == nil || policy_permissions.fetch(edit_user_field,nil) == nil) ? [] : policy_permissions.fetch(edit_user_field,nil))
     Rails.logger.debug("[CANCAN] -policy- edit_users: #{eu.inspect}")
     return eu
   end
 
+  def read_persons_from_policy(policy_pid)
+    Deprecation.warn(Hydra::PolicyAwareAbility, "The read_persons_from_policy method is deprecated and will be removed from Hydra::PolicyAwareAbility in hydra-head 8.0.  Use read_users_from_policy instead.", caller)
+    read_users_from_policy(policy_pid)
+  end
+
   # Returns the list of users granted read access by the policy object identified by policy_pid
   # Note: edit implies read, so read_users is the union of edit and read users
   def read_users_from_policy(policy_pid)
     policy_permissions = policy_permissions_doc(policy_pid)
-    read_user_field = Hydra.config[:permissions][:inheritable][:read][:individual]
+    read_user_field = Hydra.config.permissions.inheritable[:read][:individual]
     ru = edit_users_from_policy(policy_pid) | ((policy_permissions == nil || policy_permissions.fetch(read_user_field, nil) == nil) ? [] : policy_permissions.fetch(read_user_field, nil))
     Rails.logger.debug("[CANCAN] -policy- read_users: #{ru.inspect}")
     return ru
   end
-  
+
   private
-  
+
   # Grabs the value of field_name from solr_result
   # @example
-  #   solr_result = Multiresimage.find_with_conditions({:id=>object_pid}, :fl=>'is_governed_by_s')
-  #   value_from_solr_field(solr_result, 'is_governed_by_s')
+  #   solr_result = Multiresimage.find_with_conditions({:id=>object_pid}, :fl=>'is_governed_by_ssim')
+  #   value_from_solr_field(solr_result, 'is_governed_by_ssim')
   #   => ["info:fedora/changeme:2278"]
   def value_from_solr_field(solr_result, field_name)
     field_from_result = solr_result.select {|x| x.has_key?(field_name)}.first
     if field_from_result.nil?
-      return nil
+      nil
     else
-      return field_from_result[field_name]
+      field_from_result[field_name]
     end
   end
 

data/lib/hydra/policy_aware_access_controls_enforcement.rb

@@ -1,22 +1,24 @@
 # Repeats access controls evaluation methods, but checks against a governing "Policy" object (or "Collection" object) that provides inherited access controls.
 module Hydra::PolicyAwareAccessControlsEnforcement
-  
+  extend Deprecation
+
   # Extends Hydra::AccessControlsEnforcement.apply_gated_discovery to reflect policy-provided access
   # appends the result of policy_clauses into the :fq
   # @param solr_parameters the current solr parameters
-  def apply_gated_discovery(solr_parameters)
+  # @param user_parameters the current user-subitted parameters
+  def apply_gated_discovery(solr_parameters, user_parameters)
     solr_parameters[:fq] ||= []
     solr_parameters[:fq] << gated_discovery_filters.join(" OR ")
     logger.debug("POLICY-aware Solr parameters: #{ solr_parameters.inspect }")
   end
 
   # returns solr query for finding all objects whose policies grant discover access to current_user
-  def policy_clauses 
+  def policy_clauses
     policy_pids = policies_with_access
     return nil if policy_pids.empty?
-    '(' + policy_pids.map {|pid| ActiveFedora::SolrService.construct_query_for_rel(is_governed_by: "info:fedora/#{pid}")}.join(' OR ') + ')'
+    '(' + policy_pids.map {|pid| ActiveFedora::SolrQueryBuilder.construct_query_for_rel(is_governed_by: "info:fedora/#{pid}")}.join(' OR ') + ')'
   end
-  
+
   # find all the policies that grant discover/read/edit permissions to this user or any of its groups
   def policies_with_access
     #### TODO -- Memoize this and put it in the session?
@@ -28,39 +30,47 @@ module Hydra::PolicyAwareAccessControlsEnforcement
     logger.debug "get policies: #{result}\n\n"
     result.map {|h| h['id']}
   end
-  
+
+  def apply_policy_role_permissions(permission_types = discovery_permissions)
+    Deprecation.warn(Hydra::PolicyAwareAccessControlsEnforcement, "The method apply_policy_role_permissions is deprecated and will be removed from Hydra::PolicyAwareAccessControlsEnforcement in hydra-head 8.0.  Use apply_policy_group_permissions instead.", caller)
+    apply_policy_group_permissions(permission_types)
+  end
+
   def apply_policy_group_permissions(permission_types = discovery_permissions)
       # for groups
       user_access_filters = []
       current_ability.user_groups.each_with_index do |group, i|
         permission_types.each do |type|
-          user_access_filters << escape_filter(ActiveFedora::SolrService.solr_name("inheritable_#{type}_access_group", Hydra::Datastream::RightsMetadata.indexer ), group)
+          user_access_filters << escape_filter(Hydra.config.permissions.inheritable[type.to_sym].group, group)
         end
       end
       user_access_filters
   end
 
+  def apply_policy_individual_permissions(permission_types = discovery_permissions)
+    Deprecation.warn(Hydra::PolicyAwareAccessControlsEnforcement, "The method apply_policy_individual_permissions is deprecated and will be removed from Hydra::PolicyAwareAccessControlsEnforcement in hydra-head 8.0.  Use apply_policy_user_permissions instead.", caller)
+    apply_policy_user_permissions(permission_types)
+  end
+
   def apply_policy_user_permissions(permission_types = discovery_permissions)
     # for individual user access
-    user = current_ability.current_user
-    return [] unless user && user.user_key.present?
-    permission_types.map do |type|
-      escape_filter(ActiveFedora::SolrService.solr_name("inheritable_#{type}_access_person", Hydra::Datastream::RightsMetadata.indexer ), user.user_key)
+    user_access_filters = []
+    if current_user
+      permission_types.each do |type|
+        user_access_filters << escape_filter(Hydra.config.permissions.inheritable[type.to_sym].individual, current_user.user_key)
+      end
     end
+    user_access_filters
   end
 
   # Returns the Model used for AdminPolicy objects.
   # You can set this by overriding this method or setting Hydra.config[:permissions][:policy_class]
   # Defults to Hydra::AdminPolicy
   def policy_class
-    if Hydra.config[:permissions][:policy_class].nil?
-      return Hydra::AdminPolicy
-    else
-      return Hydra.config[:permissions][:policy_class]
-    end
+    Hydra.config.permissions.policy_class || Hydra::AdminPolicy
   end
 
-  protected 
+  protected
 
   def gated_discovery_filters
     filters = super
@@ -70,5 +80,5 @@ module Hydra::PolicyAwareAccessControlsEnforcement
     end
     filters
   end
-  
+
 end

data/lib/hydra-access-controls.rb

@@ -2,6 +2,7 @@ require 'rails'
 require 'active-fedora'
 require 'blacklight'
 require 'cancan'
+require "deprecation"
 
 module Hydra
   extend ActiveSupport::Autoload
@@ -11,7 +12,6 @@ module Hydra
   autoload :PolicyAwareAccessControlsEnforcement
   autoload :Ability
   autoload :Config
-  autoload :Datastream
   autoload :PolicyAwareAbility
   autoload :AdminPolicy
   autoload :AdminPolicyBehavior

data/spec/factories.rb

@@ -1,7 +1,7 @@
 FactoryGirl.define do
-  
+
   # Users
-  
+
   # Prototype user factory
   factory :user, :aliases => [:owner] do |u|
     sequence :uid do |n|
@@ -11,7 +11,7 @@ FactoryGirl.define do
     password { uid }
     new_record false
   end
-  
+
   factory :archivist, :parent=>:user do |u|
     uid 'archivist1'
     password 'archivist1'
@@ -71,34 +71,34 @@ FactoryGirl.define do
     roles { ["repository-admin"] }
   end
 
-  # 
+  #
   # Repository Objects
   #
-  
+
   factory :asset, :class => ModsAsset do |o|
   end
-  
+
   factory :admin_policy, :class => Hydra::AdminPolicy do |o|
   end
-  
+
   factory :default_access_asset, :parent=>:asset do |a|
-    permissions_attributes [{:name=>"joe_creator", :access=>"edit", :type=>"user"}]
+    permissions_attributes [{ name: "joe_creator", access: "edit", type: "person" }]
   end
-  
+
   factory :dept_access_asset, :parent=>:asset do |a|
-    permissions_attributes [{:name=>"africana-faculty", :access=>"read", :type=>"group"}, {:name=>"joe_creator", :access=>"edit", :type=>"user"}]
+    permissions_attributes [{ name: "africana-faculty", access: "read", type: "group" }, { name: "joe_creator", access: "edit", type: "person" }]
   end
 
   factory :group_edit_asset, :parent=>:asset do |a|
-    permissions_attributes [{:name=>"africana-faculty", :access=>"edit", :type=>"group"}, {:name=>"calvin_collaborator", :access=>"edit", :type=>"user"}]
+    permissions_attributes [{ name:"africana-faculty", access: "edit", type: "group" }, {name: "calvin_collaborator", access: "edit", type: "person"}]
   end
-  
+
   factory :org_read_access_asset, :parent=>:asset do |a|
-    permissions_attributes [{:name=>"registered", :access=>"read", :type=>"group"}, {:name=>"joe_creator", :access=>"edit", :type=>"user"}, {:name=>"calvin_collaborator", :access=>"edit", :type=>"user"}]
+    permissions_attributes [{ name: "registered", access: "read", type: "group" }, { name: "joe_creator", access: "edit", type: "person" }, { name: "calvin_collaborator", access: "edit", type: "person" }]
   end
-  
+
   factory :open_access_asset, :parent=>:asset do |a|
-    permissions_attributes [{:name=>"public", :access=>"read", :type=>"group"}, {:name=>"joe_creator", :access=>"edit", :type=>"user"}, {:name=>"calvin_collaborator", :access=>"edit", :type=>"user"}]
+    permissions_attributes [{ name: "public", access: "read", type: "group" }, { name: "joe_creator", access: "edit", type: "person" }, { name: "calvin_collaborator", access: "edit", type: "person" }]
   end
 
 end

data/spec/services/embargo_service_spec.rb

@@ -21,18 +21,18 @@ describe Hydra::EmbargoService do
 
   describe "#assets_with_expired_embargoes" do
     it "returns an array of assets with expired embargoes" do
-      returned_pids = subject.assets_with_expired_embargoes.map {|a| a.pid}
-      expect(returned_pids).to include work_with_expired_embargo1.pid,work_with_expired_embargo2.pid
-      expect(returned_pids).to_not include work_with_embargo_in_effect.pid,work_without_embargo.pid
+      returned_ids = subject.assets_with_expired_embargoes.map {|a| a.id}
+      expect(returned_ids).to include work_with_expired_embargo1.id, work_with_expired_embargo2.id
+      expect(returned_ids).to_not include work_with_embargo_in_effect.id, work_without_embargo.id
     end
   end
 
   describe "#assets_under_embargo" do
     it "returns all assets with embargo release date set" do
       result = subject.assets_under_embargo
-      returned_pids = subject.assets_under_embargo.map {|a| a.pid}
-      expect(returned_pids).to include work_with_expired_embargo1.pid,work_with_expired_embargo2.pid,work_with_embargo_in_effect.pid
-      expect(returned_pids).to_not include work_without_embargo.pid
+      returned_ids = subject.assets_under_embargo.map {|a| a.id}
+      expect(returned_ids).to include work_with_expired_embargo1.id, work_with_expired_embargo2.id, work_with_embargo_in_effect.id
+      expect(returned_ids).to_not include work_without_embargo.id
     end
   end
 end

data/spec/services/lease_service_spec.rb

@@ -21,17 +21,17 @@ describe Hydra::LeaseService do
 
   describe "#assets_with_expired_leases" do
     it "returns an array of assets with expired embargoes" do
-      returned_pids = subject.assets_with_expired_leases.map {|a| a.pid}
-      expect(returned_pids).to include work_with_expired_lease1.pid,work_with_expired_lease2.pid
-      expect(returned_pids).to_not include work_with_lease_in_effect.pid,work_without_lease.pid
+      returned_ids = subject.assets_with_expired_leases.map {|a| a.id}
+      expect(returned_ids).to include work_with_expired_lease1.id, work_with_expired_lease2.id
+      expect(returned_ids).to_not include work_with_lease_in_effect.id, work_without_lease.id
     end
   end
 
   describe "#assets_under_lease" do
     it "returns an array of assets with expired embargoes" do
-      returned_pids = subject.assets_under_lease.map {|a| a.pid}
-      expect(returned_pids).to include work_with_expired_lease1.pid,work_with_expired_lease2.pid,work_with_lease_in_effect.pid
-      expect(returned_pids).to_not include work_without_lease.pid
+      returned_ids = subject.assets_under_lease.map {|a| a.id}
+      expect(returned_ids).to include work_with_expired_lease1.id, work_with_expired_lease2.id, work_with_lease_in_effect.id
+      expect(returned_ids).to_not include work_without_lease.id
     end
   end
 end

data/spec/spec_helper.rb

@@ -20,27 +20,34 @@ end
 require 'support/rails'
 
 # Since we're not doing a Rails Engine test, we have to load these classes manually:
-require 'active_support'
-require 'active_support/dependencies'
-relative_load_paths = ["#{Blacklight.root}/app/controllers/concerns",
-                       "#{Blacklight.root}/app/models",
-                       "app/models",
-                       "app/models/concerns",
-                       "app/indexers",
-                       "app/services",
-                       "app/validators",
-                       "app/vocabularies"]
-ActiveSupport::Dependencies.autoload_paths += relative_load_paths
-
+require_relative '../app/vocabularies/acl'
+require_relative '../app/vocabularies/hydra/acl'
+require_relative '../app/models/role_mapper'
+require_relative '../app/models/ability'
+require_relative '../app/models/hydra/access_controls/access_control_list'
+require_relative '../app/models/hydra/access_controls/permission'
+require_relative '../app/models/hydra/access_controls/embargo'
+require_relative '../app/models/hydra/access_controls/lease'
+require_relative '../app/services/hydra/lease_service'
+require_relative '../app/services/hydra/embargo_service'
+require_relative '../app/validators/hydra/future_date_validator'
 require 'support/mods_asset'
 require 'support/solr_document'
 require "support/user"
 require "factory_girl"
 require "factories"
 
+# HttpLogger.logger = Logger.new(STDOUT)
+# HttpLogger.ignore = [/localhost:8983\/solr/]
+# HttpLogger.colorize = false
 
-RSpec.configure do |config|
+ActiveFedora::Base.logger = Logger.new(STDOUT)
 
+require 'active_fedora/cleaner'
+RSpec.configure do |config|
+  config.before(:each) do
+    ActiveFedora::Cleaner.clean!
+  end
 end
 
 # Stubbing Devise

data/spec/support/mods_asset.rb

@@ -1,7 +1,7 @@
 class ModsAsset < ActiveFedora::Base
   include Hydra::AccessControls::Embargoable
-  
-  # This is how we're associating admin policies with assets.  
+
+  # This is how we're associating admin policies with assets.
   # You can associate them however you want, just use the :is_governed_by relationship
-  belongs_to :admin_policy, class_name: "Hydra::AdminPolicy", property: :is_governed_by
+  belongs_to :admin_policy, class_name: "Hydra::AdminPolicy", predicate: ActiveFedora::Predicates.find_graph_predicate(:is_governed_by)
 end