hydra-access-controls 9.10.0 → 10.0.0.beta1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: ce4b268308e0df8c7d1aa5d8996b19c0670cf52c
-  data.tar.gz: b6071f5b3965cad44bc26605fed0d7c72b436967
+  metadata.gz: e70730aa7b919d1cbf3e4815db314bdf6c7ab61b
+  data.tar.gz: be22eb4d9e206a741b8e7543d355bcec3a9342dd
 SHA512:
-  metadata.gz: 4479206b877bce374fc5be89d50b69688dfc8a35304f6d20a1eeb0d8c5b5768d3d2dee3eaa5ed8eae13f2c406fa42033c080b048226b6ea6480e46fe45148216
-  data.tar.gz: d91c7e7f5e83aa16658674f63b654d55a36357e60f32758c8394e281dc89f6393d9239fb10f8e9ee2f503d7ffde3edfc7f2a344bcc0fa7e9509a56bf45c49299
+  metadata.gz: ebeb634bda7b08ac09e6a4210c87ba55863a6d63ad7d6abe9b6d31f8fd8d313bcd916494f2c5f9f3b50fea52012141b2caf5201593043747dbe451dc0d3b94b3
+  data.tar.gz: f13e52899116432172f7bcf87d53b55abf1173c294a70c4c66b28037339807297305ca54b8b1b948bb6ef6cccb57e347b48188e2c85c987bc5ec8b231cbe067b

data/README.textile

@@ -124,7 +124,4 @@ h2. Contributing
 
 h2. Testing
 
-    $ git submodule init
-    $ rake jetty:config
-    $ rake jetty:start
-    $ rake spec
+    $ bundle exec rake spec

data/Rakefile

@@ -3,7 +3,6 @@ require "bundler/gem_tasks"
 require 'rspec/core/rake_task'
 
 APP_ROOT= File.expand_path(File.join(File.dirname(__FILE__),".."))
-# re-using hydra_jetty.rake from hydra-head
 import "tasks/hydra-access-controls.rake"
 
 desc 'Default: run specs.'

data/app/models/concerns/hydra/access_controls/embargoable.rb

@@ -81,12 +81,6 @@ module Hydra
         visibility_will_change!
       end
 
-      # Validate that the current visibility is what is specified in the embargo
-      def validate_embargo
-        Deprecation.warn Embargoable, "validate_embargo is deprecated and will be removed in hydra-access-controls 9.0.0. Use validate_visibility_complies_with_embargo instead."
-        validate_visibility_complies_with_embargo
-      end
-
       # Validate that the current visibility is what is specified in the embargo
       def validate_visibility_complies_with_embargo
         return true unless embargo_release_date
@@ -117,11 +111,6 @@ module Hydra
         end
       end
 
-      def validate_lease
-        Deprecation.warn Embargoable, "validate_lease is deprecated and will be removed in hydra-access-controls 9.0.0. Use validate_visibility_complies_with_lease instead."
-        validate_visibility_complies_with_lease
-      end
-
       def validate_visibility_complies_with_lease
         return true unless lease_expiration_date
         if active_lease?

data/app/models/concerns/hydra/access_controls/permissions.rb

@@ -5,10 +5,24 @@ module Hydra
       include Hydra::AccessControls::Visibility
 
       included do
-        has_many :permissions, predicate: ::ACL.accessTo, class_name: 'Hydra::AccessControls::Permission', inverse_of: :access_to, dependent: :destroy
-        accepts_nested_attributes_for :permissions, allow_destroy: true
-        alias_method :permissions_attributes_without_uniqueness=, :permissions_attributes=
-        alias_method :permissions_attributes=, :permissions_attributes_with_uniqueness=
+        belongs_to :access_control, predicate: ::ACL.accessControl, class_name: 'Hydra::AccessControl'
+        before_destroy do |obj|
+          access_control.destroy
+        end
+        after_save do
+          # Only force save if autosave woudn't be called normally
+          access_control.save! unless access_control.changed?
+        end
+      end
+
+      delegate :permissions, :permissions=, to: :permission_delegate
+
+      def permissions_attributes_without_uniqueness=(attrs)
+        permission_delegate.permissions_attributes = attrs
+      end
+
+      def permission_delegate
+        (access_control || create_access_control).tap { |d| d.owner = self }
       end
 
       def to_solr(solr_doc = {})
@@ -23,36 +37,36 @@ module Hydra
       end
 
       # When chaging a permission for an object/user, ensure an update is done, not a duplicate
-      def permissions_attributes_with_uniqueness=(attributes_collection)
+      def permissions_attributes=(attributes_collection)
         if attributes_collection.is_a? Hash
           keys = attributes_collection.keys
           attributes_collection = if keys.include?('id') || keys.include?(:id)
-            Array(attributes_collection)
-          else
-            attributes_collection.sort_by { |i, _| i.to_i }.map { |_, attributes| attributes }
+                                    Array(attributes_collection)
+                                  else
+                                    attributes_collection.sort_by { |i, _| i.to_i }.map { |_, attributes| attributes }
           end
         end
 
+        attributes_collection = attributes_collection.map(&:with_indifferent_access)
         attributes_collection.each do |prop|
           existing = case prop[:type]
-          when 'group'
-            search_by_type(:group)
-          when 'person'
-            search_by_type(:person)
+                     when 'group'
+                       search_by_type(:group)
+                     when 'person'
+                       search_by_type(:person)
           end
 
-          next unless existing
+          next if existing.blank?
           selected = existing.find { |perm| perm.agent_name == prop[:name] }
           prop['id'] = selected.id if selected
         end
 
-        self.permissions_attributes_without_uniqueness=attributes_collection
+        self.permissions_attributes_without_uniqueness = attributes_collection
       end
 
-
       # Return a list of groups that have discover permission
       def discover_groups
-        search_by_type_and_mode(:group, Hydra::ACL.Discover).map { |p| p.agent_name }
+        search_by_type_and_mode(:group, Hydra::ACL.Discover).map(&:agent_name)
       end
 
       # Grant discover permissions to the groups specified. Revokes discover permission for all other groups.
@@ -74,12 +88,12 @@ module Hydra
       #  => ['one', 'two', 'three']
       #
       def discover_groups_string=(groups)
-        self.discover_groups=groups.split(/[\s,]+/)
+        self.discover_groups = groups.split(/[\s,]+/)
       end
 
       # Display the groups a comma delimeted string
       def discover_groups_string
-        self.discover_groups.join(', ')
+        discover_groups.join(', ')
       end
 
       # Grant discover permissions to the groups specified. Revokes discover permission for
@@ -102,7 +116,7 @@ module Hydra
       end
 
       def discover_users
-        search_by_type_and_mode(:person, Hydra::ACL.Discover).map { |p| p.agent_name }
+        search_by_type_and_mode(:person, Hydra::ACL.Discover).map(&:agent_name)
       end
 
       # Grant discover permissions to the users specified. Revokes discover permission for all other users.
@@ -124,12 +138,12 @@ module Hydra
       #  => ['one', 'two', 'three']
       #
       def discover_users_string=(users)
-        self.discover_users=users.split(/[\s,]+/)
+        self.discover_users = users.split(/[\s,]+/)
       end
 
       # Display the users as a comma delimeted string
       def discover_users_string
-        self.discover_users.join(', ')
+        discover_users.join(', ')
       end
 
       # Grant discover permissions to the users specified. Revokes discover permission for
@@ -153,7 +167,7 @@ module Hydra
 
       # Return a list of groups that have discover permission
       def read_groups
-        search_by_type_and_mode(:group, ::ACL.Read).map { |p| p.agent_name }
+        search_by_type_and_mode(:group, ::ACL.Read).map(&:agent_name)
       end
 
       # Grant read permissions to the groups specified. Revokes read permission for all other groups.
@@ -175,12 +189,12 @@ module Hydra
       #  => ['one', 'two', 'three']
       #
       def read_groups_string=(groups)
-        self.read_groups=groups.split(/[\s,]+/)
+        self.read_groups = groups.split(/[\s,]+/)
       end
 
       # Display the groups a comma delimeted string
       def read_groups_string
-        self.read_groups.join(', ')
+        read_groups.join(', ')
       end
 
       # Grant read permissions to the groups specified. Revokes read permission for
@@ -203,7 +217,7 @@ module Hydra
       end
 
       def read_users
-        search_by_type_and_mode(:person, ::ACL.Read).map { |p| p.agent_name }
+        search_by_type_and_mode(:person, ::ACL.Read).map(&:agent_name)
       end
 
       # Grant read permissions to the users specified. Revokes read permission for all other users.
@@ -225,12 +239,12 @@ module Hydra
       #  => ['one', 'two', 'three']
       #
       def read_users_string=(users)
-        self.read_users=users.split(/[\s,]+/)
+        self.read_users = users.split(/[\s,]+/)
       end
 
       # Display the users as a comma delimeted string
       def read_users_string
-        self.read_users.join(', ')
+        read_users.join(', ')
       end
 
       # Grant read permissions to the users specified. Revokes read permission for
@@ -252,10 +266,9 @@ module Hydra
         set_entities(:read, :person, users, eligible_users)
       end
 
-
       # Return a list of groups that have edit permission
       def edit_groups
-        search_by_type_and_mode(:group, ::ACL.Write).map { |p| p.agent_name }
+        search_by_type_and_mode(:group, ::ACL.Write).map(&:agent_name)
       end
 
       # Grant edit permissions to the groups specified. Revokes edit permission for all other groups.
@@ -277,12 +290,12 @@ module Hydra
       #  => ['one', 'two', 'three']
       #
       def edit_groups_string=(groups)
-        self.edit_groups=groups.split(/[\s,]+/)
+        self.edit_groups = groups.split(/[\s,]+/)
       end
 
       # Display the groups a comma delimeted string
       def edit_groups_string
-        self.edit_groups.join(', ')
+        edit_groups.join(', ')
       end
 
       # Grant edit permissions to the groups specified. Revokes edit permission for
@@ -305,7 +318,7 @@ module Hydra
       end
 
       def edit_users
-        search_by_type_and_mode(:person, ::ACL.Write).map { |p| p.agent_name }
+        search_by_type_and_mode(:person, ::ACL.Write).map(&:agent_name)
       end
 
       # Grant edit permissions to the groups specified. Revokes edit permission for all other groups.
@@ -341,7 +354,7 @@ module Hydra
       protected
 
       def has_destroy_flag?(hash)
-        ["1", "true"].include?(hash['_destroy'].to_s)
+        %w(1 true).include?(hash['_destroy'].to_s)
       end
 
       private
@@ -358,7 +371,7 @@ module Hydra
 
         values.each do |agent_name|
           exists = search_by_type_and_mode(type, permission_to_uri(permission)).select { |p| p.agent_name == agent_name }
-          permissions.build(name: agent_name, access: permission.to_s, type: type ) unless exists.present?
+          permissions.build(name: agent_name, access: permission.to_s, type: type) unless exists.present?
         end
       end
 
@@ -401,7 +414,7 @@ module Hydra
       # @param [RDF::URI] mode One of the permissions modes, e.g. ACL.Write, ACL.Read, etc.
       # @yieldparam [Array<ActiveFedora::Base>] agent the agent type assertions
       # @return [Array<Permission>] list of permissions where the mode is as selected, the block evaluates to true and the target is not marked for delete
-      def search_by_mode(mode, &block)
+      def search_by_mode(mode)
         permissions.to_a.select do |p|
           yield(p.agent) && !p.marked_for_destruction? && p.mode.first.rdf_subject == mode
         end
@@ -416,16 +429,14 @@ module Hydra
       end
 
       def group_agent?(agent)
-        raise "no agent" unless agent.present?
+        raise 'no agent' unless agent.present?
         agent.first.rdf_subject.to_s.start_with?(GROUP_AGENT_URL_PREFIX)
-
       end
 
       def person_agent?(agent)
-        raise "no agent" unless agent.present?
+        raise 'no agent' unless agent.present?
         agent.first.rdf_subject.to_s.start_with?(PERSON_AGENT_URL_PREFIX)
       end
-
     end
   end
 end

data/app/models/hydra/access_control.rb

@@ -0,0 +1,81 @@
+module Hydra
+  class AccessControl < ActiveFedora::Base
+
+    before_destroy do |obj|
+      contains.destroy_all
+    end
+
+    is_a_container class_name: 'Hydra::AccessControls::Permission'
+    accepts_nested_attributes_for :contains, allow_destroy: true
+
+    attr_accessor :owner
+
+    def permissions
+      relationship
+    end
+
+    def permissions=(records)
+      relationship.replace(records)
+    end
+
+    def permissions_attributes=(attribute_list)
+      raise ArgumentError unless attribute_list.is_a? Array
+      attribute_list.each do |attributes|
+        if attributes.key?(:id)
+          obj = relationship.find(attributes[:id])
+          if has_destroy_flag?(attributes)
+            obj.destroy
+          else
+            obj.update(attributes.except(:id, '_destroy'))
+          end
+        else
+          relationship.create(attributes)
+        end
+      end
+    end
+
+    # def has_destroy_flag?(hash)
+    #   ActiveFedora::Type::Boolean.new.cast(hash['_destroy'])
+    # end
+
+    def relationship
+      @relationship ||= CollectionRelationship.new(self, :contains)
+    end
+
+    class CollectionRelationship
+      def initialize(owner, reflection)
+        @owner = owner
+        @relationship = @owner.send(reflection)
+      end
+
+      delegate :to_a, :to_ary, :map, :delete, :last, :size, :count, :[],
+               :==, :detect, to: :@relationship
+
+      # TODO: if directly_contained relationships supported find, we could just
+      # delegate find.
+      def find(id)
+        return to_a.find { |record| record.id == id } if @relationship.loaded?
+        
+        unless id.start_with?(@owner.id)
+          raise ArgumentError, "requested ACL (#{id}) is not a member of #{@owner.id}"
+        end
+        ActiveFedora::Base.find(id)
+      end
+
+      # adds one to the target.
+      def build(attributes)
+        @relationship.build(attributes) do |record|
+          record.access_to = @owner.owner
+        end
+      end
+
+      def create(attributes)
+        build(attributes).tap(&:save!)
+      end
+
+      def replace(*args)
+        @relationship.replace(*args)
+      end
+    end
+  end
+end

data/app/models/hydra/access_controls/permission.rb

@@ -1,6 +1,6 @@
 module Hydra::AccessControls
-  AGENT_URL_PREFIX = "http://projecthydra.org/ns/auth/".freeze
-  GROUP_AGENT_URL_PREFIX = "http://projecthydra.org/ns/auth/group".freeze
+  AGENT_URL_PREFIX = 'http://projecthydra.org/ns/auth/'.freeze
+  GROUP_AGENT_URL_PREFIX = 'http://projecthydra.org/ns/auth/group'.freeze
   PERSON_AGENT_URL_PREFIX = 'http://projecthydra.org/ns/auth/person'.freeze
   class Permission < AccessControlList
     has_many :admin_policies, inverse_of: :default_permissions, class_name: 'Hydra::AdminPolicy'
@@ -21,12 +21,12 @@ module Hydra::AccessControls
       "<#{self.class.name} id: #{id} agent: #{agent_value} mode: #{mode_value} access_to: #{access_to_id.inspect}>"
     end
 
-    def == other
-      other.is_a?(Permission) && id == other.id && self.access_to_id == other.access_to_id &&
-        self.agent.first.rdf_subject == other.agent.first.rdf_subject && self.mode.first.rdf_subject == other.mode.first.rdf_subject
+    def ==(other)
+      other.is_a?(Permission) && id == other.id && access_to_id == other.access_to_id &&
+        agent.first.rdf_subject == other.agent.first.rdf_subject && mode.first.rdf_subject == other.mode.first.rdf_subject
     end
 
-    def attributes=(attributes)
+    def assign_attributes(attributes)
       attrs = attributes.dup
       name = attrs.delete(:name)
       type = attrs.delete(:type)
@@ -50,35 +50,34 @@ module Hydra::AccessControls
 
     protected
 
-      def parsed_agent
-        @parsed_agent ||= agent.first.rdf_subject.to_s.sub(AGENT_URL_PREFIX, '').split('#')
-      end
-
-      def build_agent(name, type)
-        raise "Can't build agent #{inspect}" unless name && type
-        self.agent = case type
-                     when "group"
-                       Agent.new(::RDF::URI.new("#{GROUP_AGENT_URL_PREFIX}##{name}"))
-                     when "person"
-                       Agent.new(::RDF::URI.new("#{PERSON_AGENT_URL_PREFIX}##{name}"))
-                     else
-                       raise ArgumentError, "Unknown agent type #{type.inspect}"
-                     end
-      end
+    def parsed_agent
+      @parsed_agent ||= agent.first.rdf_subject.to_s.sub(AGENT_URL_PREFIX, '').split('#')
+    end
 
-      def build_access(access)
-        raise "Can't build access #{inspect}" unless access
-        self.mode = case access
-                    when "read"
-                      Mode.new(::ACL.Read)
-                    when "edit"
-                      Mode.new(::ACL.Write)
-                    when "discover"
-                      Mode.new(Hydra::ACL.Discover)
-                    else
-                      raise ArgumentError, "Unknown access #{access.inspect}"
-                    end
-      end
+    def build_agent(name, type)
+      raise "Can't build agent #{inspect}" unless name && type
+      self.agent = case type
+                   when 'group'
+                     Agent.new(::RDF::URI.new("#{GROUP_AGENT_URL_PREFIX}##{name}"))
+                   when 'person'
+                     Agent.new(::RDF::URI.new("#{PERSON_AGENT_URL_PREFIX}##{name}"))
+                   else
+                     raise ArgumentError, "Unknown agent type #{type.inspect}"
+                   end
+    end
 
+    def build_access(access)
+      raise "Can't build access #{inspect}" unless access
+      self.mode = case access
+                  when 'read'
+                    Mode.new(::ACL.Read)
+                  when 'edit'
+                    Mode.new(::ACL.Write)
+                  when 'discover'
+                    Mode.new(Hydra::ACL.Discover)
+                  else
+                    raise ArgumentError, "Unknown access #{access.inspect}"
+                  end
+    end
   end
 end

data/app/vocabularies/acl.rb

@@ -3,6 +3,7 @@ class ACL < RDF::StrictVocabulary('http://www.w3.org/ns/auth/acl#')
   property :mode
   property :agent
   property :agentClass
+  property :accessControl
 
   property :Agent
   property :Read

data/hydra-access-controls.gemspec

@@ -19,9 +19,9 @@ Gem::Specification.new do |gem|
   gem.required_ruby_version = '>= 1.9.3'
 
   gem.add_dependency 'activesupport', '~> 4.0'
-  gem.add_dependency "active-fedora", '~> 9.11'
+  gem.add_dependency "active-fedora", '>= 10.0.0.beta1', '< 11'
   gem.add_dependency 'cancancan', '~> 1.8'
-  gem.add_dependency 'deprecation', '~> 0.2'
+  gem.add_dependency 'deprecation', '~> 1.0'
   gem.add_dependency "blacklight", '>= 5.16'
   gem.add_dependency "blacklight-access_controls", '~> 0.1'
 

data/lib/hydra-access-controls.rb

@@ -18,7 +18,6 @@ module Hydra
   autoload :AdminPolicyBehavior
   autoload :RoleMapperBehavior
   autoload :PermissionsQuery
-  autoload :PermissionsCache
   autoload :IpBasedGroups
 
   class << self

data/lib/hydra/admin_policy.rb

@@ -22,17 +22,5 @@ module Hydra
       title_without_first.first
     end
     alias_method_chain :title, :first
-
-    def license_title=(_)
-      Deprecation.warn AdminPolicy, "license_title= has been removed from AdminPolicy. Look at Hydra::Rights instead"
-    end
-
-    def license_description=(_)
-      Deprecation.warn AdminPolicy, "license_description= has been removed from AdminPolicy. Look at Hydra::Rights instead"
-    end
-
-    def license_url=(_)
-      Deprecation.warn AdminPolicy, "license_url= has been removed from AdminPolicy. Look at Hydra::Rights instead"
-    end
   end
 end

data/spec/spec_helper.rb

@@ -1,7 +1,8 @@
-ENV["environment"] ||= "test"
+ENV['RAILS_ENV'] ||= 'test'
+require 'engine_cart'
+path = File.expand_path(File.join('..', '..', '..', '.internal_test_app'), __FILE__)
+EngineCart.load_application! path
 
-require 'rspec/mocks'
-require 'rspec/its'
 require 'hydra-access-controls'
 
 $LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
@@ -18,9 +19,6 @@ if ENV['COVERAGE'] and RUBY_VERSION =~ /^1.9/
   SimpleCov.start
 end
 
-
-require 'support/rails'
-
 # Since we're not doing a Rails Engine test, we have to load these classes manually:
 require 'active_support'
 require 'active_support/dependencies'
@@ -38,6 +36,8 @@ require 'support/mods_asset'
 require 'support/solr_document'
 require "support/user"
 require "factory_girl"
+require 'rspec/mocks'
+require 'rspec/its'
 require "factories"
 
 # HttpLogger.logger = Logger.new(STDOUT)
@@ -53,9 +53,3 @@ RSpec.configure do |config|
   end
 end
 
-# Stubbing Devise
-class Devise
-  def self.authentication_keys
-    ["uid"]
-  end
-end

data/spec/unit/ability_spec.rb

@@ -2,6 +2,9 @@ require 'spec_helper'
 require 'cancan/matchers'
 
 describe Ability do
+  before do
+    allow(Devise).to receive(:authentication_keys).and_return(['uid'])
+  end
   describe "class methods" do
     subject { Ability }
     its(:read_group_field) { should == 'read_access_group_ssim'}

data/spec/unit/access_controls_enforcement_spec.rb

@@ -1,6 +1,9 @@
 require 'spec_helper'
 
 describe Hydra::AccessControlsEnforcement do
+  before do
+    allow(Devise).to receive(:authentication_keys).and_return(['uid'])
+  end
   let(:controller) { MockController.new }
   let(:method_chain) { MockController.search_params_logic }
   let(:search_builder) { MockSearchBuilder.new(method_chain, controller) }

data/spec/unit/admin_policy_spec.rb

@@ -1,6 +1,9 @@
 require 'spec_helper'
 
 describe Hydra::AdminPolicy do
+  before do
+    allow(Devise).to receive(:authentication_keys).and_return(['uid'])
+  end
 
   describe "when setting attributes" do
     before do

data/spec/unit/permissions_spec.rb

@@ -19,11 +19,12 @@ describe Hydra::AccessControls::Permissions do
     subject.read_groups=['group1', 'group2']
     subject.edit_users=['user1']
     subject.read_users=['user2', 'user3']
-    expect(subject.permissions).to match_array [Hydra::AccessControls::Permission.new(type: "group", access: "read", name: "group1"),
-        Hydra::AccessControls::Permission.new({ type: "group", access: "read", name: "group2" }),
-        Hydra::AccessControls::Permission.new({ type: "person", access: "read", name: "user2" }),
-        Hydra::AccessControls::Permission.new({ type: "person", access: "read", name: "user3" }),
-        Hydra::AccessControls::Permission.new({ type: "person", access: "edit", name: "user1" })]
+    expect(subject.permissions.to_a).to all(be_kind_of(Hydra::AccessControls::Permission))
+    expect(subject.permissions.map(&:to_hash)).to match_array [{type: "group", access: "read", name: "group1"},
+        { type: "group", access: "read", name: "group2" },
+        { type: "person", access: "read", name: "user2" },
+        { type: "person", access: "read", name: "user3" },
+        { type: "person", access: "edit", name: "user1" }]
   end
 
   describe "building a new permission" do
@@ -31,9 +32,16 @@ describe Hydra::AccessControls::Permissions do
 
     it "sets the accessTo association" do
       perm = subject.permissions.build(name: 'user1', type: 'person', access: 'read')
-      subject.save
       expect(perm.access_to_id).to eq subject.id
     end
+
+    it "autosaves the permissions" do
+      subject.permissions.build(name: 'user1', type: 'person', access: 'read')
+      subject.save!
+      subject.reload
+      foo = Foo.find(subject.id)
+      expect(foo.permissions.to_a).not_to eq []
+    end
   end
 
   describe "updating permissions" do
@@ -113,14 +121,14 @@ describe Hydra::AccessControls::Permissions do
       end
 
       context "when the destroy flag is set" do
-        let(:reloaded) { subject.permissions.reload.map(&:to_hash) }
+        let(:reloaded) { subject.reload.permissions.map(&:to_hash) }
         let(:permissions_id) { ActiveFedora::Base.uri_to_id(subject.permissions.last.rdf_subject.to_s) }
 
         context "to a truthy value" do
           context "when updating users" do
             before do
               subject.update permissions_attributes: [{ type: "person", access: "read", name: "user1" }]
-              subject.update permissions_attributes: [{ id: permissions_id, type: "person", access: "edit", name: "user1", _destroy: true}]
+              subject.update permissions_attributes: [{ id: permissions_id, type: "person", access: "edit", name: "user1", _destroy: 'true' }]
             end
 
             it "removes permissions on existing users" do
@@ -214,7 +222,7 @@ describe Hydra::AccessControls::Permissions do
   context "when the original object is destroyed" do
     before do
       subject.save!
-      subject.permissions.build(type: 'person', access: 'read', name: 'person1')
+      subject.permissions.create(type: 'person', access: 'read', name: 'person1')
       subject.save!
     end
 

data/spec/unit/policy_aware_access_controls_enforcement_spec.rb

@@ -2,6 +2,8 @@ require 'spec_helper'
 
 describe Hydra::PolicyAwareAccessControlsEnforcement do
   before do
+    allow(Devise).to receive(:authentication_keys).and_return(['uid'])
+
     class PolicyMockSearchBuilder < Blacklight::SearchBuilder
       include Blacklight::Solr::SearchBuilderBehavior
       include Hydra::AccessControlsEnforcement

data/spec/unit/role_mapper_spec.rb

@@ -1,28 +1,32 @@
 require 'spec_helper'
 
 describe RoleMapper do
-  it "should define the 4 roles" do
+  before do
+    allow(Devise).to receive(:authentication_keys).and_return(['uid'])
+  end
+
+  it "defines the 4 roles" do
     expect(RoleMapper.role_names.sort).to eq %w(admin_policy_object_editor archivist donor patron researcher)
   end
-  it "should quer[iy]able for roles for a given user" do
+  it "is quer[iy]able for roles for a given user" do
     expect(RoleMapper.roles('leland_himself@example.com').sort).to eq ['archivist', 'donor', 'patron']
     expect(RoleMapper.roles('archivist2@example.com')).to eq ['archivist']
   end
 
-  it "should not change it's response when it's called repeatedly" do
+  it "doesn't change its response when it's called repeatedly" do
     u = User.new(:uid=>'leland_himself@example.com')
     allow(u).to receive(:new_record?).and_return(false)
     expect(RoleMapper.roles(u).sort).to eq ['archivist', 'donor', 'patron', "registered"]
     expect(RoleMapper.roles(u).sort).to eq ['archivist', 'donor', 'patron', "registered"]
   end
 
-  it "should return an empty array if there are no roles" do
+  it "returns an empty array if there are no roles" do
     expect(RoleMapper.roles('zeus@olympus.mt')).to be_empty
   end
-  it "should know who is what" do
+
+  it "knows who is what" do
     expect(RoleMapper.whois('archivist').sort).to eq %w(archivist1@example.com archivist2@example.com leland_himself@example.com)
     expect(RoleMapper.whois('salesman')).to be_empty
     expect(RoleMapper.whois('admin_policy_object_editor').sort).to eq %w(archivist1@example.com)
   end
-
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hydra-access-controls
 version: !ruby/object:Gem::Version
-  version: 9.10.0
+  version: 10.0.0.beta1
 platform: ruby
 authors:
 - Chris Beer
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-04-19 00:00:00.000000000 Z
+date: 2016-05-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -30,16 +30,22 @@ dependencies:
   name: active-fedora
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '9.11'
+        version: 10.0.0.beta1
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '11'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 10.0.0.beta1
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '9.11'
+        version: '11'
 - !ruby/object:Gem::Dependency
   name: cancancan
   requirement: !ruby/object:Gem::Requirement
@@ -60,14 +66,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.2'
+        version: '1.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.2'
+        version: '1.0'
 - !ruby/object:Gem::Dependency
   name: blacklight
   requirement: !ruby/object:Gem::Requirement
@@ -147,6 +153,7 @@ files:
 - app/models/concerns/hydra/ip_based_ability.rb
 - app/models/concerns/hydra/rights.rb
 - app/models/concerns/hydra/with_depositor.rb
+- app/models/hydra/access_control.rb
 - app/models/hydra/access_controls/access_control_list.rb
 - app/models/hydra/access_controls/embargo.rb
 - app/models/hydra/access_controls/lease.rb
@@ -169,7 +176,6 @@ files:
 - lib/hydra/admin_policy.rb
 - lib/hydra/config.rb
 - lib/hydra/ip_based_groups.rb
-- lib/hydra/permissions_cache.rb
 - lib/hydra/permissions_query.rb
 - lib/hydra/policy_aware_ability.rb
 - lib/hydra/policy_aware_access_controls_enforcement.rb
@@ -181,11 +187,8 @@ files:
 - spec/services/embargo_service_spec.rb
 - spec/services/lease_service_spec.rb
 - spec/spec_helper.rb
-- spec/support/config/blacklight.yml
-- spec/support/config/hydra_ip_range.yml
 - spec/support/config/role_map.yml
 - spec/support/mods_asset.rb
-- spec/support/rails.rb
 - spec/support/solr_document.rb
 - spec/support/user.rb
 - spec/unit/ability_spec.rb
@@ -221,12 +224,12 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: 1.9.3
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - ">"
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 1.3.1
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5.1
+rubygems_version: 2.5.1
 signing_key: 
 specification_version: 4
 summary: Access controls for project hydra
@@ -237,11 +240,8 @@ test_files:
 - spec/services/embargo_service_spec.rb
 - spec/services/lease_service_spec.rb
 - spec/spec_helper.rb
-- spec/support/config/blacklight.yml
-- spec/support/config/hydra_ip_range.yml
 - spec/support/config/role_map.yml
 - spec/support/mods_asset.rb
-- spec/support/rails.rb
 - spec/support/solr_document.rb
 - spec/support/user.rb
 - spec/unit/ability_spec.rb

data/lib/hydra/permissions_cache.rb

@@ -1,6 +0,0 @@
-class Hydra::PermissionsCache < Blacklight::AccessControls::PermissionsCache
-  extend Deprecation
-
-  Deprecation.warn Hydra::PermissionsCache, "Hydra::PermissionsCache will be removed in Hydra 10.  Use Blacklight::AccessControls::PermissionsCache instead (from blacklight-access_controls gem)."
-
-end

data/spec/support/config/blacklight.yml

@@ -1,6 +0,0 @@
-development:
-  adapter: solr
-  url: http://localhost:<%= ENV['SOLR_DEVELOPMENT_PORT'] || 8983 %>/solr/hydra-development
-test:
-  adapter: solr
-  url: http://localhost:<%= ENV['SOLR_TEST_PORT'] || 8985 %>/solr/hydra-test

data/spec/support/config/hydra_ip_range.yml

@@ -1,9 +0,0 @@
-development: &development
-  groups:
-    - name: 'on-campus'
-      subnets:
-        - 192.168.0.0/24
-        - 10.0.0.0/22
-test: *development
-production: *development
-

data/spec/support/rails.rb

@@ -1,23 +0,0 @@
-# Rails normally loads the locales of engines for us.
-I18n.load_path << 'config/locales/hydra-access-controls.en.yml'
-
-module Rails
-  class << self
-    def env
-      ENV['environment']
-    end
-
-    def version
-      "0.0.0"
-      #"hydra-access-controls mock rails"
-    end
-
-    def root
-      'spec/support'
-    end
-
-    def logger
-      @@logger ||= Logger.new(File.expand_path('../../test.log', __FILE__)).tap { |logger| logger.level = Logger::WARN }
-    end
-  end
-end