hydra-access-controls 6.3.4 → 6.4.0.pre1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: a66021a35f6755132cb22674e59e880d6980b571
-  data.tar.gz: 4d82907106c6f1c80e63d13cf02aef92b8ab6faa
+  metadata.gz: d58a98abb5fa51ab9dcc8d38a80475d6bc9310cb
+  data.tar.gz: 23bc49074fa0715dc9515c1e9c7638484ba8040e
 SHA512:
-  metadata.gz: dc5a599c3da37b374063f605ecc405db4ec68ea8b7b099a1c65507ff308459d58aea801589e05d98d6c52a33e33b31b2fc628de153071be8a451aba214659819
-  data.tar.gz: d135be6d700d4aba21be4736d3e867c3327929a39f95b7eb63adaad205eb0a1792641511342e13aa96d4fb5ef26306c581387eb7670d5187dcaeb2389481a7e5
+  metadata.gz: 4b7e22c6d6e32dbdd5b39032af3d3caad5b3f6a885fbcf40b7852cc714ec1109aca94906b88f9044652375ca3ca81cb247fce852e58960ca728ab0678c06343c
+  data.tar.gz: dd23a59d0a72cd311011244ccba077cd8964cf0a295f5dace58e6487081411b35bfac55e767767ee3c5380b3be0fdf8b8bff0721f32e59af36ccce98e2266f56

data/.rspec

@@ -0,0 +1,2 @@
+--color
+--format progress

data/README.textile

@@ -87,18 +87,14 @@ Object-level permissions and Policy-level permissions are combined to produce th
 
 To turn on Policy-based enforcement, 
 
-* include the Hydra::PolicyAwareAbility module in your Ability class (Make sure to include it _after_ Hydra::Ability because it overrides some of the methods provided by that module.)
+* include the Hydra::PolicyAwareAbility module in your Ability class (Make sure to remove `include Hydra::Ability`)
 * include the Hydra::PolicyAwareAccessControlsEnforcement module into any appropriate Controllers (or into ApplicationController)
  
 
 Example app/models/ability.rb
 
 <pre>
-  # Allows you to use CanCan to control access to Models
-  require 'cancan'
   class Ability
-    include CanCan::Ability
-    include Hydra::Ability
     include Hydra::PolicyAwareAbility
   end
 </pre>

data/app/models/concerns/hydra/access_controls.rb

@@ -0,0 +1,9 @@
+module Hydra
+  module AccessControls
+    extend ActiveSupport::Autoload
+    autoload :AccessRight
+    autoload :WithAccessRight
+    autoload :Visibility
+    autoload :Permissions
+  end
+end

data/app/models/concerns/hydra/access_controls/access_right.rb

@@ -0,0 +1,82 @@
+module Hydra
+  module AccessControls
+    class AccessRight
+      # What these groups are called in the Hydra rightsMetadata XML:
+      PERMISSION_TEXT_VALUE_PUBLIC = 'public'.freeze
+      PERMISSION_TEXT_VALUE_AUTHENTICATED = 'registered'.freeze
+
+      # The values that get drawn to the page
+      VISIBILITY_TEXT_VALUE_PUBLIC = 'open'.freeze
+      VISIBILITY_TEXT_VALUE_EMBARGO = 'open_with_embargo_release_date'.freeze
+      VISIBILITY_TEXT_VALUE_AUTHENTICATED = 'authenticated'.freeze
+      VISIBILITY_TEXT_VALUE_PRIVATE = 'restricted'.freeze
+
+      # @param permissionable [#visibility, #permissions]
+      # @example
+      #   file = GenericFile.find('sufia:1234')
+      #   access = Sufia::AccessRight.new(file)
+      def initialize(permissionable)
+        @permissionable = permissionable
+      end
+
+      attr_reader :permissionable
+      delegate :persisted?, :permissions, :visibility, to: :permissionable
+      protected :persisted?, :permissions, :visibility
+
+
+      def open_access?
+        return true if has_visibility_text_for?(VISIBILITY_TEXT_VALUE_PUBLIC)
+        # We don't want to know if its under embargo, simply does it have a date.
+        # In this way, we can properly inform the label input
+        persisted_open_access_permission? && !permissionable.embargo_release_date.present?
+      end
+
+      def open_access_with_embargo_release_date?
+        return false unless permissionable_is_embargoable?
+        return true if has_visibility_text_for?(VISIBILITY_TEXT_VALUE_EMBARGO)
+        # We don't want to know if its under embargo, simply does it have a date.
+        # In this way, we can properly inform the label input
+        persisted_open_access_permission? && permissionable.embargo_release_date.present?
+      end
+
+      def authenticated_only?
+        return false if open_access?
+        has_permission_text_for?(PERMISSION_TEXT_VALUE_AUTHENTICATED) ||
+          has_visibility_text_for?(VISIBILITY_TEXT_VALUE_AUTHENTICATED)
+      end
+
+      def private?
+        return false if open_access?
+        return false if authenticated_only?
+        return false if open_access_with_embargo_release_date?
+        true
+      end
+
+      private
+
+        def persisted_open_access_permission?
+          if persisted?
+            has_permission_text_for?(PERMISSION_TEXT_VALUE_PUBLIC)
+          else
+            visibility.to_s == ''
+          end
+        end
+
+        def on_or_after_any_embargo_release_date?
+          return true unless permissionable.embargo_release_date
+          permissionable.embargo_release_date.to_date < Date.today
+        end
+
+        def permissionable_is_embargoable?
+          permissionable.respond_to?(:embargo_release_date)
+        end
+
+        def has_visibility_text_for?(text)
+          visibility == text
+        end
+        def has_permission_text_for?(text)
+          !!permissions.detect { |perm| perm[:name] == text }
+        end
+    end
+  end
+end

data/app/models/concerns/hydra/access_controls/permissions.rb

@@ -0,0 +1,13 @@
+module Hydra
+  module AccessControls
+    module Permissions
+      extend ActiveSupport::Concern
+      include Hydra::ModelMixins::RightsMetadata
+      include Hydra::AccessControls::Visibility
+
+      included do
+        has_metadata "rightsMetadata", type: Hydra::Datastream::RightsMetadata
+      end
+    end
+  end
+end

data/app/models/concerns/hydra/access_controls/visibility.rb

@@ -0,0 +1,59 @@
+module Hydra
+  module AccessControls
+    module Visibility
+      extend ActiveSupport::Concern
+
+      def visibility=(value)
+        return if value.nil?
+        # only set explicit permissions
+        case value
+        when Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PUBLIC
+          public_visibility!
+        when Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
+          registered_visibility!
+        when Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE
+          private_visibility!
+        else
+          raise ArgumentError, "Invalid visibility: #{value.inspect}"
+        end
+      end
+
+      def visibility
+        if read_groups.include? Hydra::AccessControls::AccessRight::PERMISSION_TEXT_VALUE_PUBLIC
+          Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PUBLIC
+        elsif read_groups.include? Hydra::AccessControls::AccessRight::PERMISSION_TEXT_VALUE_AUTHENTICATED
+          Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
+        else
+          Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE
+        end
+      end
+
+      def visibility_changed?
+        @visibility_will_change
+      end
+
+      private
+      def visibility_will_change!
+        @visibility_will_change = true
+      end
+
+      def public_visibility!
+        visibility_will_change! unless visibility == Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PUBLIC
+        self.datastreams["rightsMetadata"].permissions({:group=>Hydra::AccessControls::AccessRight::PERMISSION_TEXT_VALUE_PUBLIC}, "read")
+      end
+
+      def registered_visibility!
+        visibility_will_change! unless visibility == Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
+        self.datastreams["rightsMetadata"].permissions({:group=>Hydra::AccessControls::AccessRight::PERMISSION_TEXT_VALUE_AUTHENTICATED}, "read")
+        self.datastreams["rightsMetadata"].permissions({:group=>Hydra::AccessControls::AccessRight::PERMISSION_TEXT_VALUE_PUBLIC}, "none")
+      end
+
+      def private_visibility!
+        visibility_will_change! unless visibility == Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE
+        self.datastreams["rightsMetadata"].permissions({:group=>Hydra::AccessControls::AccessRight::PERMISSION_TEXT_VALUE_AUTHENTICATED}, "none")
+        self.datastreams["rightsMetadata"].permissions({:group=>Hydra::AccessControls::AccessRight::PERMISSION_TEXT_VALUE_PUBLIC}, "none")
+      end
+
+    end
+  end
+end

data/app/models/concerns/hydra/access_controls/with_access_right.rb

@@ -0,0 +1,20 @@
+module Hydra
+  module AccessControls
+    module WithAccessRight
+      extend ActiveSupport::Concern
+
+      def under_embargo?
+        @under_embargo ||= rightsMetadata.under_embargo?
+      end
+
+      delegate :open_access?, :open_access_with_embargo_release_date?, 
+               :authenticated_only_access?, :private_access?, to: :access_rights
+
+      protected
+        def access_rights
+          @access_rights ||= AccessRight.new(self)
+        end
+
+    end
+  end
+end

data/lib/hydra-access-controls.rb

@@ -6,6 +6,7 @@ require 'rails'
 
 module Hydra
   extend ActiveSupport::Autoload
+  autoload :AccessControls
   autoload :User
   autoload :AccessControlsEnforcement
   autoload :PolicyAwareAccessControlsEnforcement
@@ -19,6 +20,9 @@ module Hydra
   autoload :PermissionsCache
   autoload :PermissionsSolrDocument
   class Engine < Rails::Engine
+    config.autoload_paths += %W(
+      #{config.root}/app/models/concerns
+    )
   end
 
   module ModelMixins
@@ -30,5 +34,4 @@ module Hydra
   # This usually happens within a call to AccessControlsEnforcement#enforce_access_controls but can be
   # raised manually.
   class AccessDenied < ::CanCan::AccessDenied; end
-
 end

data/lib/hydra/policy_aware_ability.rb

@@ -1,5 +1,7 @@
 # Repeats access controls evaluation methods, but checks against a governing "Policy" object (or "Collection" object) that provides inherited access controls.
 module Hydra::PolicyAwareAbility
+  extend ActiveSupport::Concern
+  include Hydra::Ability
   
   # Extends Hydra::Ability.test_edit to try policy controls if object-level controls deny access
   def test_edit(pid)

data/lib/hydra/policy_aware_access_controls_enforcement.rb

@@ -27,7 +27,7 @@ module Hydra::PolicyAwareAccessControlsEnforcement
     # Grant access based on user id & role
     user_access_filters += apply_policy_role_permissions(discovery_permissions)
     user_access_filters += apply_policy_individual_permissions(discovery_permissions)
-    result = policy_class.find_with_conditions( user_access_filters.join(" OR "), :fl => "id" )
+    result = policy_class.find_with_conditions( user_access_filters.join(" OR "), :fl => "id", :rows => policy_class.count )
     logger.debug "get policies: #{result}\n\n"
     result.map {|h| h['id']}
   end

data/spec/spec_helper.rb

@@ -1,6 +1,8 @@
 ENV["environment"] ||= "test"
 
 require 'rspec/mocks'
+require 'rspec/autorun'
+require 'hydra-access-controls'
 
 module Hydra
   # Stubbing Hydra.config[:policy_aware] so Hydra::PolicyAwareAbility will be loaded for tests.
@@ -12,6 +14,7 @@ end
 
 $LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
 $LOAD_PATH.unshift(File.dirname(__FILE__))
+Hydra::Engine.config.autoload_paths.each { |path| $LOAD_PATH.unshift path }
 
 if ENV['COVERAGE'] and RUBY_VERSION =~ /^1.9/
   require 'simplecov'
@@ -21,8 +24,6 @@ if ENV['COVERAGE'] and RUBY_VERSION =~ /^1.9/
   SimpleCov.start
 end
 
-require 'rspec/autorun'
-require 'hydra-access-controls'
 require 'support/mods_asset'
 require 'support/solr_document'
 require "support/user"

data/spec/unit/access_right_spec.rb

@@ -0,0 +1,57 @@
+require 'spec_helper'
+
+describe Hydra::AccessControls::AccessRight do
+  [
+    [false, Hydra::AccessControls::AccessRight::PERMISSION_TEXT_VALUE_PUBLIC,        nil,                                              nil,             true, false, false, false],
+    [false, Hydra::AccessControls::AccessRight::PERMISSION_TEXT_VALUE_AUTHENTICATED, nil,                                              nil,             true, false, false, false],
+    [false, nil,                                              nil,                                              nil,             true, false, false, false],
+    [false, nil,                                              nil,                                              2.days.from_now, false, false, false, true],
+    [false, nil,                                              nil,                                              2.days.ago,      false, false, false, true],
+    [false, nil,                                              Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PUBLIC,        nil,             true, false, false, false],
+    [false, nil,                                              Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED, nil,             false, true, false, false],
+    [false, nil,                                              Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE,       nil,             false, false, true, false],
+    [false, nil,                                              Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_EMBARGO,       nil,             false, false, false, true],
+    [true,  Hydra::AccessControls::AccessRight::PERMISSION_TEXT_VALUE_PUBLIC,        nil,                                              nil,             true, false, false, false],
+    [true,  Hydra::AccessControls::AccessRight::PERMISSION_TEXT_VALUE_PUBLIC,        nil,                                              2.days.from_now, false, false, false, true],
+    [true,  Hydra::AccessControls::AccessRight::PERMISSION_TEXT_VALUE_PUBLIC,        nil,                                              2.days.ago,      false, false, false, true],
+    [true,  Hydra::AccessControls::AccessRight::PERMISSION_TEXT_VALUE_AUTHENTICATED, nil,                                              nil,             false, true, false, false],
+    [true,  nil,                                              nil,                                              nil,             false, false, true, false],
+    [true,  nil,                                              Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PUBLIC,        nil,             true, false, false, false],
+    [true,  nil,                                              Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED, nil,             false, true, false, false],
+    [true,  nil,                                              Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE,       nil,             false, false, true, false],
+    [true,  nil,                                              Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_EMBARGO,       nil,             false, false, false, true],
+  ].each do |given_persisted, givin_permission, given_visibility, given_embargo_release_date, expected_open_access, expected_authentication_only, expected_private, expected_open_access_with_embargo_release_date|
+    spec_text = <<-TEXT
+
+    GIVEN: {
+      persisted: #{given_persisted.inspect},
+      permission: #{givin_permission.inspect},
+      visibility: #{given_visibility.inspect},
+      embargo_release_date: #{given_embargo_release_date}
+    },
+    EXPECTED: {
+      open_access: #{expected_open_access.inspect},
+      restricted: #{expected_authentication_only.inspect},
+      private: #{expected_private.inspect},
+      open_access_with_embargo_release_date: #{expected_open_access_with_embargo_release_date}
+    },
+    TEXT
+
+    it spec_text do
+      permissions = [{access: :edit, name: givin_permission}]
+      permissionable = double(
+        'permissionable',
+        permissions: permissions,
+        visibility: given_visibility,
+        persisted?: given_persisted,
+        embargo_release_date: given_embargo_release_date
+      )
+      access_right = Hydra::AccessControls::AccessRight.new(permissionable)
+
+      expect(access_right.open_access?).to eq(expected_open_access)
+      expect(access_right.authenticated_only?).to eq(expected_authentication_only)
+      expect(access_right.private?).to eq(expected_private)
+      expect(access_right.open_access_with_embargo_release_date?).to eq(expected_open_access_with_embargo_release_date)
+    end
+  end
+end

data/spec/unit/admin_policy_spec.rb

@@ -129,7 +129,16 @@ describe Hydra::AdminPolicy do
       @user = FactoryGirl.build(:martia_morocco)
       RoleMapper.stub(:roles).with(@user.user_key).and_return(@user.roles)
     end
-    subject { Ability.new(@user) }
+    before(:all) do
+      class TestAbility
+        include Hydra::PolicyAwareAbility
+      end
+    end
+
+    after(:all) do
+      Object.send(:remove_const, :TestAbility)
+    end
+    subject { TestAbility.new(@user) }
     context "Given a policy grants read access to a group I belong to" do
       before do
         @policy = Hydra::AdminPolicy.new

data/spec/unit/policy_aware_ability_spec.rb

@@ -21,8 +21,6 @@ describe Hydra::PolicyAwareAbility do
   end
   before(:all) do
     class PolicyAwareClass
-      include CanCan::Ability
-      include Hydra::Ability
       include Hydra::PolicyAwareAbility
     end
     @policy = Hydra::AdminPolicy.new
@@ -40,7 +38,11 @@ describe Hydra::PolicyAwareAbility do
     @asset.admin_policy = @policy
     @asset.save
   end
-  after(:all) { @policy.delete; @asset.delete }
+  after(:all) do
+    @policy.delete
+    @asset.delete 
+    Object.send(:remove_const, :PolicyAwareClass)
+  end 
   subject { PolicyAwareClass.new( User.new ) }
   
   describe "policy_pid_for" do

data/spec/unit/policy_aware_access_controls_enforcement_spec.rb

@@ -65,6 +65,14 @@ describe Hydra::PolicyAwareAccessControlsEnforcement do
     policy8.save
     @sample_policies << policy8
 
+    # user discover policies for testing that all are applied when over 10 are applicable
+    (9..11).each do |i|
+      policy = Hydra::AdminPolicy.create(:pid => "test:policy#{i}")
+      policy.default_permissions = [{:type=>"user", :access=>"discover", :name=>"sara_student"}]
+      policy.save
+      @sample_policies << policy
+    end
+
     # no access 
     policy_no_access = Hydra::AdminPolicy.create(:pid=>"test:policy_no_access")
     @sample_policies << policy_no_access

data/spec/unit/visibility_spec.rb

@@ -0,0 +1,19 @@
+require 'spec_helper'
+
+describe Hydra::AccessControls::Visibility do
+  module VisibilityOverride
+    extend ActiveSupport::Concern
+    include Hydra::AccessControls::Permissions
+    def visibility; super; end
+    def visibility=(value); super(value); end
+  end
+  class MockParent < ActiveFedora::Base
+    include VisibilityOverride
+  end
+
+  it 'allows for overrides of visibility' do
+    expect{
+      MockParent.new(visibility: Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE)
+    }.to_not raise_error
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hydra-access-controls
 version: !ruby/object:Gem::Version
-  version: 6.3.4
+  version: 6.4.0.pre1
 platform: ruby
 authors:
 - Chris Beer
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-08-27 00:00:00.000000000 Z
+date: 2013-09-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -117,9 +117,15 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- .rspec
 - README.textile
 - Rakefile
 - app/models/ability.rb
+- app/models/concerns/hydra/access_controls.rb
+- app/models/concerns/hydra/access_controls/access_right.rb
+- app/models/concerns/hydra/access_controls/permissions.rb
+- app/models/concerns/hydra/access_controls/visibility.rb
+- app/models/concerns/hydra/access_controls/with_access_right.rb
 - app/models/role_mapper.rb
 - config/fedora.yml
 - config/solr.yml
@@ -151,6 +157,7 @@ files:
 - spec/support/user.rb
 - spec/unit/ability_spec.rb
 - spec/unit/access_controls_enforcement_spec.rb
+- spec/unit/access_right_spec.rb
 - spec/unit/admin_policy_spec.rb
 - spec/unit/hydra_rights_metadata_persistence_spec.rb
 - spec/unit/hydra_rights_metadata_spec.rb
@@ -159,6 +166,7 @@ files:
 - spec/unit/policy_aware_access_controls_enforcement_spec.rb
 - spec/unit/rights_metadata_spec.rb
 - spec/unit/role_mapper_spec.rb
+- spec/unit/visibility_spec.rb
 - tasks/hydra-access-controls.rake
 homepage: http://projecthydra.org
 licenses:
@@ -175,9 +183,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: 1.9.3
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - '>'
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 1.3.1
 requirements: []
 rubyforge_project: 
 rubygems_version: 2.0.5
@@ -196,6 +204,7 @@ test_files:
 - spec/support/user.rb
 - spec/unit/ability_spec.rb
 - spec/unit/access_controls_enforcement_spec.rb
+- spec/unit/access_right_spec.rb
 - spec/unit/admin_policy_spec.rb
 - spec/unit/hydra_rights_metadata_persistence_spec.rb
 - spec/unit/hydra_rights_metadata_spec.rb
@@ -204,4 +213,5 @@ test_files:
 - spec/unit/policy_aware_access_controls_enforcement_spec.rb
 - spec/unit/rights_metadata_spec.rb
 - spec/unit/role_mapper_spec.rb
+- spec/unit/visibility_spec.rb
 has_rdoc: