hydra-access-controls 8.2.0 → 9.0.0.beta1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (52) hide show
  1. checksums.yaml +4 -4
  2. data/README.textile +10 -10
  3. data/app/models/concerns/hydra/access_controls/access_right.rb +3 -2
  4. data/app/models/concerns/hydra/access_controls/embargoable.rb +120 -132
  5. data/app/models/concerns/hydra/access_controls/permissions.rb +137 -103
  6. data/app/models/concerns/hydra/access_controls/visibility.rb +3 -5
  7. data/app/models/concerns/hydra/access_controls.rb +0 -1
  8. data/app/models/concerns/hydra/admin_policy_behavior.rb +27 -2
  9. data/app/models/concerns/hydra/rights.rb +15 -0
  10. data/app/models/hydra/access_controls/access_control_list.rb +17 -0
  11. data/app/models/hydra/access_controls/embargo.rb +65 -0
  12. data/app/models/hydra/access_controls/lease.rb +66 -0
  13. data/app/models/hydra/access_controls/permission.rb +85 -0
  14. data/app/vocabularies/acl.rb +12 -0
  15. data/app/vocabularies/hydra/acl.rb +20 -0
  16. data/config/fedora.yml +4 -2
  17. data/hydra-access-controls.gemspec +6 -7
  18. data/lib/hydra/ability.rb +45 -43
  19. data/lib/hydra/access_controls_enforcement.rb +23 -25
  20. data/lib/hydra/admin_policy.rb +34 -11
  21. data/lib/hydra/config.rb +4 -15
  22. data/lib/hydra/permissions_query.rb +2 -2
  23. data/lib/hydra/permissions_solr_document.rb +4 -6
  24. data/lib/hydra/policy_aware_ability.rb +56 -53
  25. data/lib/hydra/policy_aware_access_controls_enforcement.rb +28 -18
  26. data/lib/hydra-access-controls.rb +1 -1
  27. data/spec/factories.rb +15 -15
  28. data/spec/services/embargo_service_spec.rb +6 -6
  29. data/spec/services/lease_service_spec.rb +6 -6
  30. data/spec/spec_helper.rb +20 -13
  31. data/spec/support/mods_asset.rb +3 -3
  32. data/spec/unit/ability_spec.rb +96 -121
  33. data/spec/unit/access_controls_enforcement_spec.rb +29 -27
  34. data/spec/unit/access_right_spec.rb +6 -1
  35. data/spec/unit/accessible_by_spec.rb +14 -5
  36. data/spec/unit/admin_policy_spec.rb +99 -92
  37. data/spec/unit/config_spec.rb +14 -15
  38. data/spec/unit/embargoable_spec.rb +26 -28
  39. data/spec/unit/permission_spec.rb +36 -16
  40. data/spec/unit/permissions_spec.rb +121 -65
  41. data/spec/unit/policy_aware_ability_spec.rb +64 -78
  42. data/spec/unit/policy_aware_access_controls_enforcement_spec.rb +81 -77
  43. data/spec/unit/role_mapper_spec.rb +10 -10
  44. data/spec/unit/with_access_right_spec.rb +1 -1
  45. metadata +29 -51
  46. data/lib/hydra/access_controls/permission.rb +0 -40
  47. data/lib/hydra/datastream/inheritable_rights_metadata.rb +0 -22
  48. data/lib/hydra/datastream/rights_metadata.rb +0 -276
  49. data/lib/hydra/datastream.rb +0 -7
  50. data/spec/unit/hydra_rights_metadata_persistence_spec.rb +0 -71
  51. data/spec/unit/hydra_rights_metadata_spec.rb +0 -301
  52. data/spec/unit/inheritable_rights_metadata_spec.rb +0 -65
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: 7d0c332d417111f77876c46bd3331349ce28da60
4
- data.tar.gz: 1282b9c10fe0ac75ba5e2793da8a08a1e0deb462
3
+ metadata.gz: 83a5be099ceb5cd745dc8fe1cd49ae0c5a72ba6d
4
+ data.tar.gz: 3670874653b5bc44c0dac63b277f755b99ad93cb
5
5
  SHA512:
6
- metadata.gz: 36f0b7eeab09aeee018e6610fd510a392110e7c6d6251d7b78b70c9c9b33b36014675b373f36487e53139ed79f397fa0e4404aee052c2f1c9630b4120c1cd2da
7
- data.tar.gz: c61a05b0b34fdf009ab676eda0a67f209f42c53d792952e39e454ac09be6cc4c9c2c66f665d47717a0b89a50e4155462ac6b8cb07c2bde46a577b351a374d33f
6
+ metadata.gz: caf8e64a95d305198f5558e05cdf59fcffa12a0c48ccb447644cd108aff0595dad6c0e8b9924efb0c1067883bf5e5b049dd81f5ff03f5523fb93c575873f1c91
7
+ data.tar.gz: 4543dfab3f31ac9d8077fce7a29a17dcb3e72cfa97635300f7fadd52dca7fa69599cda30cf4400b9671610f6c05a8dd13c04251ccc0b999a1aef352e7e876f0d
data/README.textile CHANGED
@@ -58,19 +58,19 @@ In config/initializers/hydra_config.rb
58
58
  # ... other stuff ...
59
59
  indexer = Solrizer::Descriptor.new(:string, :stored, :indexed, :multivalued)
60
60
  config[:permissions] = {
61
- :discover => {:group =>ActiveFedora::SolrService.solr_name("discover_access_group", indexer), :individual=>ActiveFedora::SolrService.solr_name("discover_access_person", indexer)},
62
- :read => {:group =>ActiveFedora::SolrService.solr_name("read_access_group", indexer), :individual=>ActiveFedora::SolrService.solr_name("read_access_person", indexer)},
63
- :edit => {:group =>ActiveFedora::SolrService.solr_name("edit_access_group", indexer), :individual=>ActiveFedora::SolrService.solr_name("edit_access_person", indexer)},
64
- :owner => ActiveFedora::SolrService.solr_name("depositor", indexer),
65
- :embargo_release_date => ActiveFedora::SolrService.solr_name("embargo_release_date", Solrizer::Descriptor.new(:date, :stored, :indexed))
61
+ :discover => {:group =>ActiveFedora::SolrQueryBuilder.solr_name("discover_access_group", indexer), :individual=>ActiveFedora::SolrQueryBuilder.solr_name("discover_access_person", indexer)},
62
+ :read => {:group =>ActiveFedora::SolrQueryBuilder.solr_name("read_access_group", indexer), :individual=>ActiveFedora::SolrQueryBuilder.solr_name("read_access_person", indexer)},
63
+ :edit => {:group =>ActiveFedora::SolrQueryBuilder.solr_name("edit_access_group", indexer), :individual=>ActiveFedora::SolrQueryBuilder.solr_name("edit_access_person", indexer)},
64
+ :owner => ActiveFedora::SolrQueryBuilder.solr_name("depositor", indexer),
65
+ :embargo_release_date => ActiveFedora::SolrQueryBuilder.solr_name("embargo_release_date", Solrizer::Descriptor.new(:date, :stored, :indexed))
66
66
  }
67
67
  indexer = Solrizer::Descriptor.new(:string, :stored, :indexed, :multivalued)
68
68
  config[:permissions][:inheritable] = {
69
- :discover => {:group =>ActiveFedora::SolrService.solr_name("inheritable_discover_access_group", indexer), :individual=>ActiveFedora::SolrService.solr_name("inheritable_discover_access_person", indexer)},
70
- :read => {:group =>ActiveFedora::SolrService.solr_name("inheritable_read_access_group", indexer), :individual=>ActiveFedora::SolrService.solr_name("inheritable_read_access_person", indexer)},
71
- :edit => {:group =>ActiveFedora::SolrService.solr_name("inheritable_edit_access_group", indexer), :individual=>ActiveFedora::SolrService.solr_name("inheritable_edit_access_person", indexer)},
72
- :owner => ActiveFedora::SolrService.solr_name("inheritable_depositor", indexer),
73
- :embargo_release_date => ActiveFedora::SolrService.solr_name("inheritable_embargo_release_date", Solrizer::Descriptor.new(:date, :stored, :indexed))
69
+ :discover => {:group =>ActiveFedora::SolrQueryBuilder.solr_name("inheritable_discover_access_group", indexer), :individual=>ActiveFedora::SolrQueryBuilder.solr_name("inheritable_discover_access_person", indexer)},
70
+ :read => {:group =>ActiveFedora::SolrQueryBuilder.solr_name("inheritable_read_access_group", indexer), :individual=>ActiveFedora::SolrQueryBuilder.solr_name("inheritable_read_access_person", indexer)},
71
+ :edit => {:group =>ActiveFedora::SolrQueryBuilder.solr_name("inheritable_edit_access_group", indexer), :individual=>ActiveFedora::SolrQueryBuilder.solr_name("inheritable_edit_access_person", indexer)},
72
+ :owner => ActiveFedora::SolrQueryBuilder.solr_name("inheritable_depositor", indexer),
73
+ :embargo_release_date => ActiveFedora::SolrQueryBuilder.solr_name("inheritable_embargo_release_date", Solrizer::Descriptor.new(:date, :stored, :indexed))
74
74
  }
75
75
  end
76
76
  </pre>
@@ -1,7 +1,7 @@
1
1
  module Hydra
2
2
  module AccessControls
3
3
  class AccessRight
4
- # What these groups are called in the Hydra rightsMetadata XML:
4
+ # What these groups are called in the Hydra rights assertions:
5
5
  PERMISSION_TEXT_VALUE_PUBLIC = 'public'.freeze
6
6
  PERMISSION_TEXT_VALUE_AUTHENTICATED = 'registered'.freeze
7
7
 
@@ -79,8 +79,9 @@ module Hydra
79
79
  def has_visibility_text_for?(text)
80
80
  visibility == text
81
81
  end
82
+
82
83
  def has_permission_text_for?(text)
83
- !!permissions.detect { |perm| perm.name == text }
84
+ !!permissions.detect { |perm| perm.agent_name == text }
84
85
  end
85
86
  end
86
87
  end
@@ -2,164 +2,152 @@ module Hydra
2
2
  module AccessControls
3
3
  module Embargoable
4
4
  extend ActiveSupport::Concern
5
+ include Hydra::AccessControls::WithAccessRight
5
6
 
6
7
  included do
7
- include Hydra::AccessControls::WithAccessRight
8
- # We include EmbargoableMethods so that it can override the methods included above,
9
- # and doesn't create a ActiveSupport::Concern::MultipleIncludedBlocks
10
- include EmbargoableMethods
11
8
  validates :embargo_release_date, :lease_expiration_date, :'hydra/future_date' => true
12
9
 
13
- has_attributes :visibility_during_embargo, :visibility_after_embargo, :embargo_release_date,
14
- :visibility_during_lease, :visibility_after_lease, :lease_expiration_date,
15
- datastream: 'rightsMetadata', multiple: false
10
+ belongs_to :embargo, predicate: Hydra::ACL.hasEmbargo, class_name: 'Hydra::AccessControls::Embargo'
11
+ belongs_to :lease, predicate: Hydra::ACL.hasLease, class_name: 'Hydra::AccessControls::Lease'
16
12
 
17
- has_attributes :embargo_history, :lease_history, datastream: 'rightsMetadata', multiple:true
13
+ delegate :visibility_during_embargo, :visibility_during_embargo=, :visibility_after_embargo, :visibility_after_embargo=, :embargo_release_date, :embargo_release_date=, :embargo_history, :embargo_history=, to: :existing_or_new_embargo
14
+ delegate :visibility_during_lease, :visibility_during_lease=, :visibility_after_lease, :visibility_after_lease=, :lease_expiration_date, :lease_expiration_date=, :lease_history, :lease_history=, to: :existing_or_new_lease
18
15
  end
19
16
 
20
- module EmbargoableMethods
21
- def under_embargo?
22
- rightsMetadata.under_embargo?
23
- end
17
+ # if the embargo exists return it, if not, build one and return it
18
+ def existing_or_new_embargo
19
+ embargo || build_embargo
20
+ end
24
21
 
25
- def active_lease?
26
- rightsMetadata.active_lease?
27
- end
22
+ # if the lease exists return it, if not, build one and return it
23
+ def existing_or_new_lease
24
+ lease || build_lease
25
+ end
28
26
 
29
- # If changing away from embargo or lease, this will deactivate the lease/embargo before proceeding.
30
- # The lease_visibility! and embargo_visibility! methods rely on this to deactivate the lease when applicable.
31
- def visibility=(value)
32
- # If changing from embargo or lease, deactivate the lease/embargo and wipe out the associated metadata before proceeding
33
- if !embargo_release_date.nil?
34
- deactivate_embargo! unless value == visibility_during_embargo
35
- end
36
- if !lease_expiration_date.nil?
37
- deactivate_lease! unless value == visibility_during_lease
38
- end
39
- super
27
+ def to_solr(solr_doc = {})
28
+ super.tap do |doc|
29
+ doc.merge!(embargo.to_hash) if embargo
30
+ doc.merge!(lease.to_hash) if lease
40
31
  end
32
+ end
41
33
 
42
- def apply_embargo(release_date, visibility_during=nil, visibility_after=nil)
43
- self.embargo_release_date = release_date
44
- self.visibility_during_embargo = visibility_during unless visibility_during.nil?
45
- self.visibility_after_embargo = visibility_after unless visibility_after.nil?
46
- embargo_visibility!
47
- visibility_will_change!
48
- end
34
+ def under_embargo?
35
+ embargo && embargo.active?
36
+ end
49
37
 
50
- def deactivate_embargo!
51
- return unless embargo_release_date
52
- embargo_state = under_embargo? ? "active" : "expired"
53
- embargo_record = embargo_history_message(embargo_state, Date.today, embargo_release_date, visibility_during_embargo, visibility_after_embargo)
54
- self.embargo_release_date = nil
55
- self.visibility_during_embargo = nil
56
- self.visibility_after_embargo = nil
57
- self.embargo_history += [embargo_record]
58
- visibility_will_change!
59
- end
38
+ def active_lease?
39
+ lease && lease.active?
40
+ end
60
41
 
61
- def validate_embargo
62
- if embargo_release_date
63
- if under_embargo?
64
- expected_visibility = visibility_during_embargo
65
- failure_message = "An embargo is in effect for this object until #{embargo_release_date}. Until that time the "
66
- else
67
- expected_visibility = visibility_after_embargo
68
- failure_message = "The embargo expired on #{embargo_release_date}. The "
69
- end
70
- if visibility == expected_visibility
71
- return true
72
- else
73
- failure_message << "visibility should be #{expected_visibility} but it is currently #{visibility}. Call embargo_visibility! on this object to repair."
74
- self.errors[:embargo] << failure_message
75
- return false
76
- end
77
- else
78
- return true
79
- end
80
- end
81
42
 
82
- # Set the current visibility to match what is described in the embargo.
83
- def embargo_visibility!
84
- if embargo_release_date
85
- if under_embargo?
86
- self.visibility_during_embargo = visibility_during_embargo ? visibility_during_embargo : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE
87
- self.visibility_after_embargo = visibility_after_embargo ? visibility_after_embargo : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
88
- self.visibility = visibility_during_embargo
89
- else
90
- self.visibility = visibility_after_embargo ? visibility_after_embargo : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
91
- end
92
- end
43
+ # If changing away from embargo or lease, this will deactivate the lease/embargo before proceeding.
44
+ # The lease_visibility! and embargo_visibility! methods rely on this to deactivate the lease when applicable.
45
+ def visibility=(value)
46
+ # If changing from embargo or lease, deactivate the lease/embargo and wipe out the associated metadata before proceeding
47
+ if !embargo_release_date.nil?
48
+ deactivate_embargo! unless value == visibility_during_embargo
93
49
  end
94
-
95
- def validate_lease
96
- if lease_expiration_date
97
- if active_lease?
98
- expected_visibility = visibility_during_lease
99
- failure_message = "A lease is in effect for this object until #{lease_expiration_date}. Until that time the "
100
- else
101
- expected_visibility = visibility_after_lease
102
- failure_message = "The lease expired on #{lease_expiration_date}. The "
103
- end
104
- if visibility == expected_visibility
105
- return true
106
- else
107
- failure_message << "visibility should be #{expected_visibility} but it is currently #{visibility}. Call lease_visibility! on this object to repair."
108
- self.errors[:lease] << failure_message
109
- return false
110
- end
111
- else
112
- return true
113
- end
50
+ if !lease_expiration_date.nil?
51
+ deactivate_lease! unless value == visibility_during_lease
114
52
  end
53
+ super
54
+ end
115
55
 
116
- def apply_lease(release_date, visibility_during=nil, visibility_after=nil)
117
- self.lease_expiration_date = release_date
118
- self.visibility_during_lease = visibility_during unless visibility_during.nil?
119
- self.visibility_after_lease = visibility_after unless visibility_after.nil?
120
- lease_visibility!
121
- visibility_will_change!
56
+ def apply_embargo(release_date, visibility_during=nil, visibility_after=nil)
57
+ self.embargo_release_date = release_date
58
+ self.visibility_during_embargo = visibility_during unless visibility_during.nil?
59
+ self.visibility_after_embargo = visibility_after unless visibility_after.nil?
60
+ embargo_visibility!
61
+ visibility_will_change!
62
+ end
63
+
64
+ def deactivate_embargo!
65
+ embargo && embargo.deactivate!
66
+ visibility_will_change!
67
+ end
68
+
69
+ # Validate that the current visibility is what is specified in the embargo
70
+ def validate_embargo
71
+ Deprecation.warn Embargoable, "validate_embargo is deprecated and will be removed in hydra-access-controls 9.0.0. Use validate_visibility_complies_with_embargo instead."
72
+ validate_visibility_complies_with_embargo
73
+ end
74
+
75
+ # Validate that the current visibility is what is specified in the embargo
76
+ def validate_visibility_complies_with_embargo
77
+ return true unless embargo_release_date
78
+ if under_embargo?
79
+ expected_visibility = visibility_during_embargo
80
+ failure_message = "An embargo is in effect for this object until #{embargo_release_date}. Until that time the "
81
+ else
82
+ expected_visibility = visibility_after_embargo
83
+ failure_message = "The embargo expired on #{embargo_release_date}. The "
84
+ end
85
+ if visibility != expected_visibility
86
+ failure_message << "visibility should be #{expected_visibility} but it is currently #{visibility}. Call embargo_visibility! on this object to repair."
87
+ self.errors[:embargo] << failure_message
88
+ return false
122
89
  end
90
+ true
91
+ end
123
92
 
124
- def deactivate_lease!
125
- return unless lease_expiration_date
126
- lease_state = active_lease? ? "active" : "expired"
127
- lease_record = lease_history_message(lease_state, Date.today, lease_expiration_date, visibility_during_lease, visibility_after_lease)
128
- self.lease_expiration_date = nil
129
- self.visibility_during_lease = nil
130
- self.visibility_after_lease = nil
131
- self.lease_history += [lease_record]
132
- visibility_will_change!
93
+ # Set the current visibility to match what is described in the embargo.
94
+ def embargo_visibility!
95
+ return unless embargo_release_date
96
+ if under_embargo?
97
+ self.visibility_during_embargo = visibility_during_embargo ? visibility_during_embargo : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE
98
+ self.visibility_after_embargo = visibility_after_embargo ? visibility_after_embargo : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
99
+ self.visibility = visibility_during_embargo
100
+ else
101
+ self.visibility = visibility_after_embargo ? visibility_after_embargo : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
133
102
  end
103
+ end
134
104
 
135
- # Set the current visibility to match what is described in the lease.
136
- def lease_visibility!
137
- if lease_expiration_date
138
- if active_lease?
139
- self.visibility_during_lease = visibility_during_lease ? visibility_during_lease : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
140
- self.visibility_after_lease = visibility_after_lease ? visibility_after_lease : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE
141
- self.visibility = visibility_during_lease
142
- else
143
- self.visibility = visibility_after_lease ? visibility_after_lease : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE
144
- end
145
- end
105
+ def validate_lease
106
+ Deprecation.warn Embargoable, "validate_lease is deprecated and will be removed in hydra-access-controls 9.0.0. Use validate_visibility_complies_with_lease instead."
107
+ validate_visibility_complies_with_lease
108
+ end
109
+
110
+ def validate_visibility_complies_with_lease
111
+ return true unless lease_expiration_date
112
+ if active_lease?
113
+ expected_visibility = visibility_during_lease
114
+ failure_message = "A lease is in effect for this object until #{lease_expiration_date}. Until that time the "
115
+ else
116
+ expected_visibility = visibility_after_lease
117
+ failure_message = "The lease expired on #{lease_expiration_date}. The "
118
+ end
119
+ if visibility != expected_visibility
120
+ failure_message << "visibility should be #{expected_visibility} but it is currently #{visibility}. Call lease_visibility! on this object to repair."
121
+ self.errors[:lease] << failure_message
122
+ return false
146
123
  end
124
+ true
125
+ end
147
126
 
148
- protected
127
+ def apply_lease(release_date, visibility_during=nil, visibility_after=nil)
128
+ self.lease_expiration_date = release_date
129
+ self.visibility_during_lease = visibility_during unless visibility_during.nil?
130
+ self.visibility_after_lease = visibility_after unless visibility_after.nil?
131
+ lease_visibility!
132
+ visibility_will_change!
133
+ end
149
134
 
150
- # Create the log message used when deactivating an embargo
151
- # This method may be overriden in order to transform the values of the passed parameters.
152
- def embargo_history_message(state, deactivate_date, release_date, visibility_during, visibility_after)
153
- I18n.t 'hydra.embargo.history_message', state: state, deactivate_date: deactivate_date, release_date: release_date,
154
- visibility_during: visibility_during, visibility_after: visibility_after
155
- end
135
+ def deactivate_lease!
136
+ lease && lease.deactivate!
137
+ visibility_will_change!
138
+ end
156
139
 
157
- # Create the log message used when deactivating a lease
158
- # This method may be overriden in order to transform the values of the passed parameters.
159
- def lease_history_message(state, deactivate_date, expiration_date, visibility_during, visibility_after)
160
- I18n.t 'hydra.lease.history_message', state: state, deactivate_date: deactivate_date, expiration_date: expiration_date,
161
- visibility_during: visibility_during, visibility_after: visibility_after
140
+ # Set the current visibility to match what is described in the lease.
141
+ def lease_visibility!
142
+ if lease_expiration_date
143
+ if active_lease?
144
+ self.visibility_during_lease = visibility_during_lease ? visibility_during_lease : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
145
+ self.visibility_after_lease = visibility_after_lease ? visibility_after_lease : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE
146
+ self.visibility = visibility_during_lease
147
+ else
148
+ self.visibility = visibility_after_lease ? visibility_after_lease : Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE
162
149
  end
150
+ end
163
151
  end
164
152
  end
165
153
  end