hydra-access-controls 8.2.0 → 9.0.0.beta1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.textile +10 -10
- data/app/models/concerns/hydra/access_controls/access_right.rb +3 -2
- data/app/models/concerns/hydra/access_controls/embargoable.rb +120 -132
- data/app/models/concerns/hydra/access_controls/permissions.rb +137 -103
- data/app/models/concerns/hydra/access_controls/visibility.rb +3 -5
- data/app/models/concerns/hydra/access_controls.rb +0 -1
- data/app/models/concerns/hydra/admin_policy_behavior.rb +27 -2
- data/app/models/concerns/hydra/rights.rb +15 -0
- data/app/models/hydra/access_controls/access_control_list.rb +17 -0
- data/app/models/hydra/access_controls/embargo.rb +65 -0
- data/app/models/hydra/access_controls/lease.rb +66 -0
- data/app/models/hydra/access_controls/permission.rb +85 -0
- data/app/vocabularies/acl.rb +12 -0
- data/app/vocabularies/hydra/acl.rb +20 -0
- data/config/fedora.yml +4 -2
- data/hydra-access-controls.gemspec +6 -7
- data/lib/hydra/ability.rb +45 -43
- data/lib/hydra/access_controls_enforcement.rb +23 -25
- data/lib/hydra/admin_policy.rb +34 -11
- data/lib/hydra/config.rb +4 -15
- data/lib/hydra/permissions_query.rb +2 -2
- data/lib/hydra/permissions_solr_document.rb +4 -6
- data/lib/hydra/policy_aware_ability.rb +56 -53
- data/lib/hydra/policy_aware_access_controls_enforcement.rb +28 -18
- data/lib/hydra-access-controls.rb +1 -1
- data/spec/factories.rb +15 -15
- data/spec/services/embargo_service_spec.rb +6 -6
- data/spec/services/lease_service_spec.rb +6 -6
- data/spec/spec_helper.rb +20 -13
- data/spec/support/mods_asset.rb +3 -3
- data/spec/unit/ability_spec.rb +96 -121
- data/spec/unit/access_controls_enforcement_spec.rb +29 -27
- data/spec/unit/access_right_spec.rb +6 -1
- data/spec/unit/accessible_by_spec.rb +14 -5
- data/spec/unit/admin_policy_spec.rb +99 -92
- data/spec/unit/config_spec.rb +14 -15
- data/spec/unit/embargoable_spec.rb +26 -28
- data/spec/unit/permission_spec.rb +36 -16
- data/spec/unit/permissions_spec.rb +121 -65
- data/spec/unit/policy_aware_ability_spec.rb +64 -78
- data/spec/unit/policy_aware_access_controls_enforcement_spec.rb +81 -77
- data/spec/unit/role_mapper_spec.rb +10 -10
- data/spec/unit/with_access_right_spec.rb +1 -1
- metadata +29 -51
- data/lib/hydra/access_controls/permission.rb +0 -40
- data/lib/hydra/datastream/inheritable_rights_metadata.rb +0 -22
- data/lib/hydra/datastream/rights_metadata.rb +0 -276
- data/lib/hydra/datastream.rb +0 -7
- data/spec/unit/hydra_rights_metadata_persistence_spec.rb +0 -71
- data/spec/unit/hydra_rights_metadata_spec.rb +0 -301
- data/spec/unit/inheritable_rights_metadata_spec.rb +0 -65
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 83a5be099ceb5cd745dc8fe1cd49ae0c5a72ba6d
|
4
|
+
data.tar.gz: 3670874653b5bc44c0dac63b277f755b99ad93cb
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: caf8e64a95d305198f5558e05cdf59fcffa12a0c48ccb447644cd108aff0595dad6c0e8b9924efb0c1067883bf5e5b049dd81f5ff03f5523fb93c575873f1c91
|
7
|
+
data.tar.gz: 4543dfab3f31ac9d8077fce7a29a17dcb3e72cfa97635300f7fadd52dca7fa69599cda30cf4400b9671610f6c05a8dd13c04251ccc0b999a1aef352e7e876f0d
|
data/README.textile
CHANGED
@@ -58,19 +58,19 @@ In config/initializers/hydra_config.rb
|
|
58
58
|
# ... other stuff ...
|
59
59
|
indexer = Solrizer::Descriptor.new(:string, :stored, :indexed, :multivalued)
|
60
60
|
config[:permissions] = {
|
61
|
-
:discover => {:group =>ActiveFedora::
|
62
|
-
:read => {:group =>ActiveFedora::
|
63
|
-
:edit => {:group =>ActiveFedora::
|
64
|
-
:owner => ActiveFedora::
|
65
|
-
:embargo_release_date => ActiveFedora::
|
61
|
+
:discover => {:group =>ActiveFedora::SolrQueryBuilder.solr_name("discover_access_group", indexer), :individual=>ActiveFedora::SolrQueryBuilder.solr_name("discover_access_person", indexer)},
|
62
|
+
:read => {:group =>ActiveFedora::SolrQueryBuilder.solr_name("read_access_group", indexer), :individual=>ActiveFedora::SolrQueryBuilder.solr_name("read_access_person", indexer)},
|
63
|
+
:edit => {:group =>ActiveFedora::SolrQueryBuilder.solr_name("edit_access_group", indexer), :individual=>ActiveFedora::SolrQueryBuilder.solr_name("edit_access_person", indexer)},
|
64
|
+
:owner => ActiveFedora::SolrQueryBuilder.solr_name("depositor", indexer),
|
65
|
+
:embargo_release_date => ActiveFedora::SolrQueryBuilder.solr_name("embargo_release_date", Solrizer::Descriptor.new(:date, :stored, :indexed))
|
66
66
|
}
|
67
67
|
indexer = Solrizer::Descriptor.new(:string, :stored, :indexed, :multivalued)
|
68
68
|
config[:permissions][:inheritable] = {
|
69
|
-
:discover => {:group =>ActiveFedora::
|
70
|
-
:read => {:group =>ActiveFedora::
|
71
|
-
:edit => {:group =>ActiveFedora::
|
72
|
-
:owner => ActiveFedora::
|
73
|
-
:embargo_release_date => ActiveFedora::
|
69
|
+
:discover => {:group =>ActiveFedora::SolrQueryBuilder.solr_name("inheritable_discover_access_group", indexer), :individual=>ActiveFedora::SolrQueryBuilder.solr_name("inheritable_discover_access_person", indexer)},
|
70
|
+
:read => {:group =>ActiveFedora::SolrQueryBuilder.solr_name("inheritable_read_access_group", indexer), :individual=>ActiveFedora::SolrQueryBuilder.solr_name("inheritable_read_access_person", indexer)},
|
71
|
+
:edit => {:group =>ActiveFedora::SolrQueryBuilder.solr_name("inheritable_edit_access_group", indexer), :individual=>ActiveFedora::SolrQueryBuilder.solr_name("inheritable_edit_access_person", indexer)},
|
72
|
+
:owner => ActiveFedora::SolrQueryBuilder.solr_name("inheritable_depositor", indexer),
|
73
|
+
:embargo_release_date => ActiveFedora::SolrQueryBuilder.solr_name("inheritable_embargo_release_date", Solrizer::Descriptor.new(:date, :stored, :indexed))
|
74
74
|
}
|
75
75
|
end
|
76
76
|
</pre>
|
@@ -1,7 +1,7 @@
|
|
1
1
|
module Hydra
|
2
2
|
module AccessControls
|
3
3
|
class AccessRight
|
4
|
-
# What these groups are called in the Hydra
|
4
|
+
# What these groups are called in the Hydra rights assertions:
|
5
5
|
PERMISSION_TEXT_VALUE_PUBLIC = 'public'.freeze
|
6
6
|
PERMISSION_TEXT_VALUE_AUTHENTICATED = 'registered'.freeze
|
7
7
|
|
@@ -79,8 +79,9 @@ module Hydra
|
|
79
79
|
def has_visibility_text_for?(text)
|
80
80
|
visibility == text
|
81
81
|
end
|
82
|
+
|
82
83
|
def has_permission_text_for?(text)
|
83
|
-
!!permissions.detect { |perm| perm.
|
84
|
+
!!permissions.detect { |perm| perm.agent_name == text }
|
84
85
|
end
|
85
86
|
end
|
86
87
|
end
|
@@ -2,164 +2,152 @@ module Hydra
|
|
2
2
|
module AccessControls
|
3
3
|
module Embargoable
|
4
4
|
extend ActiveSupport::Concern
|
5
|
+
include Hydra::AccessControls::WithAccessRight
|
5
6
|
|
6
7
|
included do
|
7
|
-
include Hydra::AccessControls::WithAccessRight
|
8
|
-
# We include EmbargoableMethods so that it can override the methods included above,
|
9
|
-
# and doesn't create a ActiveSupport::Concern::MultipleIncludedBlocks
|
10
|
-
include EmbargoableMethods
|
11
8
|
validates :embargo_release_date, :lease_expiration_date, :'hydra/future_date' => true
|
12
9
|
|
13
|
-
|
14
|
-
|
15
|
-
datastream: 'rightsMetadata', multiple: false
|
10
|
+
belongs_to :embargo, predicate: Hydra::ACL.hasEmbargo, class_name: 'Hydra::AccessControls::Embargo'
|
11
|
+
belongs_to :lease, predicate: Hydra::ACL.hasLease, class_name: 'Hydra::AccessControls::Lease'
|
16
12
|
|
17
|
-
|
13
|
+
delegate :visibility_during_embargo, :visibility_during_embargo=, :visibility_after_embargo, :visibility_after_embargo=, :embargo_release_date, :embargo_release_date=, :embargo_history, :embargo_history=, to: :existing_or_new_embargo
|
14
|
+
delegate :visibility_during_lease, :visibility_during_lease=, :visibility_after_lease, :visibility_after_lease=, :lease_expiration_date, :lease_expiration_date=, :lease_history, :lease_history=, to: :existing_or_new_lease
|
18
15
|
end
|
19
16
|
|
20
|
-
|
21
|
-
|
22
|
-
|
23
|
-
|
17
|
+
# if the embargo exists return it, if not, build one and return it
|
18
|
+
def existing_or_new_embargo
|
19
|
+
embargo || build_embargo
|
20
|
+
end
|
24
21
|
|
25
|
-
|
26
|
-
|
27
|
-
|
22
|
+
# if the lease exists return it, if not, build one and return it
|
23
|
+
def existing_or_new_lease
|
24
|
+
lease || build_lease
|
25
|
+
end
|
28
26
|
|
29
|
-
|
30
|
-
|
31
|
-
|
32
|
-
|
33
|
-
if !embargo_release_date.nil?
|
34
|
-
deactivate_embargo! unless value == visibility_during_embargo
|
35
|
-
end
|
36
|
-
if !lease_expiration_date.nil?
|
37
|
-
deactivate_lease! unless value == visibility_during_lease
|
38
|
-
end
|
39
|
-
super
|
27
|
+
def to_solr(solr_doc = {})
|
28
|
+
super.tap do |doc|
|
29
|
+
doc.merge!(embargo.to_hash) if embargo
|
30
|
+
doc.merge!(lease.to_hash) if lease
|
40
31
|
end
|
32
|
+
end
|
41
33
|
|
42
|
-
|
43
|
-
|
44
|
-
|
45
|
-
self.visibility_after_embargo = visibility_after unless visibility_after.nil?
|
46
|
-
embargo_visibility!
|
47
|
-
visibility_will_change!
|
48
|
-
end
|
34
|
+
def under_embargo?
|
35
|
+
embargo && embargo.active?
|
36
|
+
end
|
49
37
|
|
50
|
-
|
51
|
-
|
52
|
-
|
53
|
-
embargo_record = embargo_history_message(embargo_state, Date.today, embargo_release_date, visibility_during_embargo, visibility_after_embargo)
|
54
|
-
self.embargo_release_date = nil
|
55
|
-
self.visibility_during_embargo = nil
|
56
|
-
self.visibility_after_embargo = nil
|
57
|
-
self.embargo_history += [embargo_record]
|
58
|
-
visibility_will_change!
|
59
|
-
end
|
38
|
+
def active_lease?
|
39
|
+
lease && lease.active?
|
40
|
+
end
|
60
41
|
|
61
|
-
def validate_embargo
|
62
|
-
if embargo_release_date
|
63
|
-
if under_embargo?
|
64
|
-
expected_visibility = visibility_during_embargo
|
65
|
-
failure_message = "An embargo is in effect for this object until #{embargo_release_date}. Until that time the "
|
66
|
-
else
|
67
|
-
expected_visibility = visibility_after_embargo
|
68
|
-
failure_message = "The embargo expired on #{embargo_release_date}. The "
|
69
|
-
end
|
70
|
-
if visibility == expected_visibility
|
71
|
-
return true
|
72
|
-
else
|
73
|
-
failure_message << "visibility should be #{expected_visibility} but it is currently #{visibility}. Call embargo_visibility! on this object to repair."
|
74
|
-
self.errors[:embargo] << failure_message
|
75
|
-
return false
|
76
|
-
end
|
77
|
-
else
|
78
|
-
return true
|
79
|
-
end
|
80
|
-
end
|
81
42
|
|
82
|
-
|
83
|
-
|
84
|
-
|
85
|
-
|
86
|
-
|
87
|
-
|
88
|
-
self.visibility = visibility_during_embargo
|
89
|
-
else
|
90
|
-
self.visibility = visibility_after_embargo ? visibility_after_embargo : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
|
91
|
-
end
|
92
|
-
end
|
43
|
+
# If changing away from embargo or lease, this will deactivate the lease/embargo before proceeding.
|
44
|
+
# The lease_visibility! and embargo_visibility! methods rely on this to deactivate the lease when applicable.
|
45
|
+
def visibility=(value)
|
46
|
+
# If changing from embargo or lease, deactivate the lease/embargo and wipe out the associated metadata before proceeding
|
47
|
+
if !embargo_release_date.nil?
|
48
|
+
deactivate_embargo! unless value == visibility_during_embargo
|
93
49
|
end
|
94
|
-
|
95
|
-
|
96
|
-
if lease_expiration_date
|
97
|
-
if active_lease?
|
98
|
-
expected_visibility = visibility_during_lease
|
99
|
-
failure_message = "A lease is in effect for this object until #{lease_expiration_date}. Until that time the "
|
100
|
-
else
|
101
|
-
expected_visibility = visibility_after_lease
|
102
|
-
failure_message = "The lease expired on #{lease_expiration_date}. The "
|
103
|
-
end
|
104
|
-
if visibility == expected_visibility
|
105
|
-
return true
|
106
|
-
else
|
107
|
-
failure_message << "visibility should be #{expected_visibility} but it is currently #{visibility}. Call lease_visibility! on this object to repair."
|
108
|
-
self.errors[:lease] << failure_message
|
109
|
-
return false
|
110
|
-
end
|
111
|
-
else
|
112
|
-
return true
|
113
|
-
end
|
50
|
+
if !lease_expiration_date.nil?
|
51
|
+
deactivate_lease! unless value == visibility_during_lease
|
114
52
|
end
|
53
|
+
super
|
54
|
+
end
|
115
55
|
|
116
|
-
|
117
|
-
|
118
|
-
|
119
|
-
|
120
|
-
|
121
|
-
|
56
|
+
def apply_embargo(release_date, visibility_during=nil, visibility_after=nil)
|
57
|
+
self.embargo_release_date = release_date
|
58
|
+
self.visibility_during_embargo = visibility_during unless visibility_during.nil?
|
59
|
+
self.visibility_after_embargo = visibility_after unless visibility_after.nil?
|
60
|
+
embargo_visibility!
|
61
|
+
visibility_will_change!
|
62
|
+
end
|
63
|
+
|
64
|
+
def deactivate_embargo!
|
65
|
+
embargo && embargo.deactivate!
|
66
|
+
visibility_will_change!
|
67
|
+
end
|
68
|
+
|
69
|
+
# Validate that the current visibility is what is specified in the embargo
|
70
|
+
def validate_embargo
|
71
|
+
Deprecation.warn Embargoable, "validate_embargo is deprecated and will be removed in hydra-access-controls 9.0.0. Use validate_visibility_complies_with_embargo instead."
|
72
|
+
validate_visibility_complies_with_embargo
|
73
|
+
end
|
74
|
+
|
75
|
+
# Validate that the current visibility is what is specified in the embargo
|
76
|
+
def validate_visibility_complies_with_embargo
|
77
|
+
return true unless embargo_release_date
|
78
|
+
if under_embargo?
|
79
|
+
expected_visibility = visibility_during_embargo
|
80
|
+
failure_message = "An embargo is in effect for this object until #{embargo_release_date}. Until that time the "
|
81
|
+
else
|
82
|
+
expected_visibility = visibility_after_embargo
|
83
|
+
failure_message = "The embargo expired on #{embargo_release_date}. The "
|
84
|
+
end
|
85
|
+
if visibility != expected_visibility
|
86
|
+
failure_message << "visibility should be #{expected_visibility} but it is currently #{visibility}. Call embargo_visibility! on this object to repair."
|
87
|
+
self.errors[:embargo] << failure_message
|
88
|
+
return false
|
122
89
|
end
|
90
|
+
true
|
91
|
+
end
|
123
92
|
|
124
|
-
|
125
|
-
|
126
|
-
|
127
|
-
|
128
|
-
self.
|
129
|
-
self.
|
130
|
-
self.
|
131
|
-
|
132
|
-
|
93
|
+
# Set the current visibility to match what is described in the embargo.
|
94
|
+
def embargo_visibility!
|
95
|
+
return unless embargo_release_date
|
96
|
+
if under_embargo?
|
97
|
+
self.visibility_during_embargo = visibility_during_embargo ? visibility_during_embargo : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE
|
98
|
+
self.visibility_after_embargo = visibility_after_embargo ? visibility_after_embargo : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
|
99
|
+
self.visibility = visibility_during_embargo
|
100
|
+
else
|
101
|
+
self.visibility = visibility_after_embargo ? visibility_after_embargo : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
|
133
102
|
end
|
103
|
+
end
|
134
104
|
|
135
|
-
|
136
|
-
|
137
|
-
|
138
|
-
|
139
|
-
|
140
|
-
|
141
|
-
|
142
|
-
|
143
|
-
|
144
|
-
|
145
|
-
|
105
|
+
def validate_lease
|
106
|
+
Deprecation.warn Embargoable, "validate_lease is deprecated and will be removed in hydra-access-controls 9.0.0. Use validate_visibility_complies_with_lease instead."
|
107
|
+
validate_visibility_complies_with_lease
|
108
|
+
end
|
109
|
+
|
110
|
+
def validate_visibility_complies_with_lease
|
111
|
+
return true unless lease_expiration_date
|
112
|
+
if active_lease?
|
113
|
+
expected_visibility = visibility_during_lease
|
114
|
+
failure_message = "A lease is in effect for this object until #{lease_expiration_date}. Until that time the "
|
115
|
+
else
|
116
|
+
expected_visibility = visibility_after_lease
|
117
|
+
failure_message = "The lease expired on #{lease_expiration_date}. The "
|
118
|
+
end
|
119
|
+
if visibility != expected_visibility
|
120
|
+
failure_message << "visibility should be #{expected_visibility} but it is currently #{visibility}. Call lease_visibility! on this object to repair."
|
121
|
+
self.errors[:lease] << failure_message
|
122
|
+
return false
|
146
123
|
end
|
124
|
+
true
|
125
|
+
end
|
147
126
|
|
148
|
-
|
127
|
+
def apply_lease(release_date, visibility_during=nil, visibility_after=nil)
|
128
|
+
self.lease_expiration_date = release_date
|
129
|
+
self.visibility_during_lease = visibility_during unless visibility_during.nil?
|
130
|
+
self.visibility_after_lease = visibility_after unless visibility_after.nil?
|
131
|
+
lease_visibility!
|
132
|
+
visibility_will_change!
|
133
|
+
end
|
149
134
|
|
150
|
-
|
151
|
-
|
152
|
-
|
153
|
-
|
154
|
-
visibility_during: visibility_during, visibility_after: visibility_after
|
155
|
-
end
|
135
|
+
def deactivate_lease!
|
136
|
+
lease && lease.deactivate!
|
137
|
+
visibility_will_change!
|
138
|
+
end
|
156
139
|
|
157
|
-
|
158
|
-
|
159
|
-
|
160
|
-
|
161
|
-
|
140
|
+
# Set the current visibility to match what is described in the lease.
|
141
|
+
def lease_visibility!
|
142
|
+
if lease_expiration_date
|
143
|
+
if active_lease?
|
144
|
+
self.visibility_during_lease = visibility_during_lease ? visibility_during_lease : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
|
145
|
+
self.visibility_after_lease = visibility_after_lease ? visibility_after_lease : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE
|
146
|
+
self.visibility = visibility_during_lease
|
147
|
+
else
|
148
|
+
self.visibility = visibility_after_lease ? visibility_after_lease : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE
|
162
149
|
end
|
150
|
+
end
|
163
151
|
end
|
164
152
|
end
|
165
153
|
end
|