hydra-access-controls 9.8.1 → 9.9.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/app/models/concerns/hydra/access_controls/permissions.rb +8 -0
- data/hydra-access-controls.gemspec +1 -1
- data/lib/hydra/config.rb +3 -3
- data/lib/hydra/policy_aware_ability.rb +1 -1
- data/lib/hydra/policy_aware_access_controls_enforcement.rb +1 -1
- data/spec/support/mods_asset.rb +1 -1
- data/spec/unit/admin_policy_spec.rb +1 -1
- data/spec/unit/config_spec.rb +9 -6
- data/spec/unit/permissions_spec.rb +21 -9
- data/spec/unit/policy_aware_access_controls_enforcement_spec.rb +6 -6
- metadata +4 -4
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: e5e8e75ab64b8c7d4c45303b419f85541723e456
|
4
|
+
data.tar.gz: aa314f6c97078f405da78244abef65b2c009f6eb
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: bcc97deb25bd78cae7feaf01cffeedda9fc618648579326019676a0b6c34e6cb149d3612d805fca471b52b6b5363bcbe804e6ff38d5999a38d472b6d7915e0ed
|
7
|
+
data.tar.gz: 2b48522f260eb8394cca5d1e0a86a417f5059636339317e4ae80762de1629b15ee5f5c202cbe7da7da7194dba99b0ffb2d4ea9664bc8b105ef4ebd265f0b1f7d
|
@@ -9,8 +9,16 @@ module Hydra
|
|
9
9
|
accepts_nested_attributes_for :permissions, allow_destroy: true
|
10
10
|
alias_method :permissions_attributes_without_uniqueness=, :permissions_attributes=
|
11
11
|
alias_method :permissions_attributes=, :permissions_attributes_with_uniqueness=
|
12
|
+
|
13
|
+
before_destroy :remove_permissions
|
14
|
+
end
|
15
|
+
|
16
|
+
# Destroy and permission objects associated with this object
|
17
|
+
def remove_permissions
|
18
|
+
permissions.destroy_all
|
12
19
|
end
|
13
20
|
|
21
|
+
|
14
22
|
def to_solr(solr_doc = {})
|
15
23
|
super.tap do |doc|
|
16
24
|
[:discover, :read, :edit].each do |access|
|
@@ -19,7 +19,7 @@ Gem::Specification.new do |gem|
|
|
19
19
|
gem.required_ruby_version = '>= 1.9.3'
|
20
20
|
|
21
21
|
gem.add_dependency 'activesupport', '~> 4.0'
|
22
|
-
gem.add_dependency "active-fedora", '~> 9.
|
22
|
+
gem.add_dependency "active-fedora", '~> 9.10.0'
|
23
23
|
gem.add_dependency 'cancancan', '~> 1.8'
|
24
24
|
gem.add_dependency 'deprecation', '~> 0.2'
|
25
25
|
gem.add_dependency "blacklight", '>= 5.16'
|
data/lib/hydra/config.rb
CHANGED
@@ -131,7 +131,7 @@ module Hydra
|
|
131
131
|
end
|
132
132
|
|
133
133
|
def solr_name(*args)
|
134
|
-
ActiveFedora
|
134
|
+
ActiveFedora.index_field_mapper.solr_name(*args)
|
135
135
|
end
|
136
136
|
|
137
137
|
class EmbargoConfig
|
@@ -144,7 +144,7 @@ module Hydra
|
|
144
144
|
end
|
145
145
|
|
146
146
|
def solr_name(*args)
|
147
|
-
ActiveFedora
|
147
|
+
ActiveFedora.index_field_mapper.solr_name(*args)
|
148
148
|
end
|
149
149
|
end
|
150
150
|
|
@@ -158,7 +158,7 @@ module Hydra
|
|
158
158
|
end
|
159
159
|
|
160
160
|
def solr_name(*args)
|
161
|
-
ActiveFedora
|
161
|
+
ActiveFedora.index_field_mapper.solr_name(*args)
|
162
162
|
end
|
163
163
|
end
|
164
164
|
|
@@ -23,7 +23,7 @@ module Hydra::PolicyAwareAbility
|
|
23
23
|
def policy_id_for(object_id)
|
24
24
|
policy_id = policy_id_cache[object_id]
|
25
25
|
return policy_id if policy_id
|
26
|
-
solr_result = ActiveFedora::Base.
|
26
|
+
solr_result = ActiveFedora::Base.search_with_conditions({ id: object_id }, fl: governed_by_solr_field).first
|
27
27
|
return unless solr_result
|
28
28
|
policy_id_cache[object_id] = policy_id = Array(solr_result[governed_by_solr_field]).first
|
29
29
|
end
|
@@ -24,7 +24,7 @@ module Hydra::PolicyAwareAccessControlsEnforcement
|
|
24
24
|
# Grant access based on user id & group
|
25
25
|
user_access_filters += apply_policy_group_permissions(discovery_permissions)
|
26
26
|
user_access_filters += apply_policy_user_permissions(discovery_permissions)
|
27
|
-
result = policy_class.
|
27
|
+
result = policy_class.search_with_conditions( user_access_filters.join(" OR "), fl: "id", rows: policy_class.count )
|
28
28
|
logger.debug "get policies: #{result}\n\n"
|
29
29
|
result.map {|h| h['id']}
|
30
30
|
end
|
data/spec/support/mods_asset.rb
CHANGED
@@ -3,5 +3,5 @@ class ModsAsset < ActiveFedora::Base
|
|
3
3
|
|
4
4
|
# This is how we're associating admin policies with assets.
|
5
5
|
# You can associate them however you want, just use the :is_governed_by relationship
|
6
|
-
belongs_to :admin_policy, class_name: "Hydra::AdminPolicy", predicate: ActiveFedora::
|
6
|
+
belongs_to :admin_policy, class_name: "Hydra::AdminPolicy", predicate: ActiveFedora::RDF::ProjectHydra.isGovernedBy
|
7
7
|
end
|
@@ -15,7 +15,7 @@ describe Hydra::AdminPolicy do
|
|
15
15
|
describe "to_solr" do
|
16
16
|
subject { Hydra::AdminPolicy.new(:title=>["Foobar"]).to_solr }
|
17
17
|
it "should have title_ssim" do
|
18
|
-
expect(subject[ActiveFedora
|
18
|
+
expect(subject[ActiveFedora.index_field_mapper.solr_name('title', type: :string)]).to eq ["Foobar"]
|
19
19
|
end
|
20
20
|
end
|
21
21
|
|
data/spec/unit/config_spec.rb
CHANGED
@@ -6,12 +6,15 @@ describe Hydra::Config do
|
|
6
6
|
# You only need to change these values if you've indexed permissions by some means other than the Hydra's built-in tooling.
|
7
7
|
# If you change these, you must also update the permissions request handler in your solrconfig.xml to return those values
|
8
8
|
config[:permissions] = {
|
9
|
-
:
|
10
|
-
|
11
|
-
:
|
12
|
-
|
9
|
+
discover: { group: ActiveFedora.index_field_mapper.solr_name("discover_access_group", :symbol),
|
10
|
+
individual: ActiveFedora.index_field_mapper.solr_name("discover_access_person", :symbol)},
|
11
|
+
read: { group: ActiveFedora.index_field_mapper.solr_name("read_access_group", :symbol),
|
12
|
+
individual: ActiveFedora.index_field_mapper.solr_name("read_access_person", :symbol)},
|
13
|
+
edit: { group: ActiveFedora.index_field_mapper.solr_name("edit_access_group", :symbol),
|
14
|
+
individual: ActiveFedora.index_field_mapper.solr_name("edit_access_person", :symbol)},
|
15
|
+
owner: ActiveFedora.index_field_mapper.solr_name("depositor", :symbol),
|
13
16
|
}
|
14
|
-
config.permissions.embargo.release_date = ActiveFedora
|
17
|
+
config.permissions.embargo.release_date = ActiveFedora.index_field_mapper.solr_name("embargo_release_date", Solrizer::Descriptor.new(:date, :stored, :indexed))
|
15
18
|
|
16
19
|
# specify the user model
|
17
20
|
config[:user_model] = 'User'
|
@@ -23,7 +26,7 @@ describe Hydra::Config do
|
|
23
26
|
# This specifies the solr field names of permissions-related fields.
|
24
27
|
# You only need to change these values if you've indexed permissions by some means other than the Hydra's built-in tooling.
|
25
28
|
# If you change these, you must also update the permissions request handler in your solrconfig.xml to return those values
|
26
|
-
config.permissions.discover.group = ActiveFedora
|
29
|
+
config.permissions.discover.group = ActiveFedora.index_field_mapper.solr_name("discover_access_group", :symbol)
|
27
30
|
|
28
31
|
# specify the user model
|
29
32
|
config.user_model = 'User'
|
@@ -9,13 +9,13 @@ describe Hydra::AccessControls::Permissions do
|
|
9
9
|
|
10
10
|
subject { Foo.new }
|
11
11
|
|
12
|
-
it "
|
12
|
+
it "has many permissions" do
|
13
13
|
expect(subject.permissions).to eq []
|
14
14
|
end
|
15
15
|
|
16
16
|
#TODO is permission same as an acl?
|
17
17
|
|
18
|
-
it "
|
18
|
+
it "has a set of permissions" do
|
19
19
|
subject.read_groups=['group1', 'group2']
|
20
20
|
subject.edit_users=['user1']
|
21
21
|
subject.read_users=['user2', 'user3']
|
@@ -29,7 +29,7 @@ describe Hydra::AccessControls::Permissions do
|
|
29
29
|
describe "building a new permission" do
|
30
30
|
before { subject.save! }
|
31
31
|
|
32
|
-
it "
|
32
|
+
it "sets the accessTo association" do
|
33
33
|
perm = subject.permissions.build(name: 'user1', type: 'person', access: 'read')
|
34
34
|
subject.save
|
35
35
|
expect(perm.access_to_id).to eq subject.id
|
@@ -47,7 +47,7 @@ describe Hydra::AccessControls::Permissions do
|
|
47
47
|
subject.permissions_attributes = {'0' => { type: "group", access:"read", name:"group1" },
|
48
48
|
'1' => { type: 'person', access: 'edit', name: 'user2' }}
|
49
49
|
end
|
50
|
-
it "
|
50
|
+
it "handles a hash" do
|
51
51
|
expect(subject.permissions.size).to eq 3
|
52
52
|
expect(subject.permissions.to_a).to all(be_a(Hydra::AccessControls::Permission))
|
53
53
|
expect(subject.permissions.map(&:to_hash)).to match_array [
|
@@ -164,7 +164,7 @@ describe Hydra::AccessControls::Permissions do
|
|
164
164
|
Hydra::AccessControls::Permission.new(type: "person", access: "edit", name: "jcoyne")]
|
165
165
|
subject.save!
|
166
166
|
end
|
167
|
-
it "
|
167
|
+
it "sets the permissions" do
|
168
168
|
expect(subject.edit_users).to eq ['jcoyne']
|
169
169
|
expect(subject.edit_groups).to eq ['group1']
|
170
170
|
subject.permissions = []
|
@@ -183,22 +183,22 @@ describe Hydra::AccessControls::Permissions do
|
|
183
183
|
subject.permissions.build(type: 'group', access: 'edit', name: 'group-8')
|
184
184
|
end
|
185
185
|
|
186
|
-
it "
|
186
|
+
it "has read groups accessor" do
|
187
187
|
expect(subject.read_groups).to eq ['group-6', 'group-7']
|
188
188
|
end
|
189
189
|
|
190
|
-
it "
|
190
|
+
it "has read groups string accessor" do
|
191
191
|
expect(subject.read_groups_string).to eq 'group-6, group-7'
|
192
192
|
end
|
193
193
|
|
194
|
-
it "
|
194
|
+
it "has read groups string writer" do
|
195
195
|
subject.read_groups_string = 'umg/up.dlt.staff, group-3'
|
196
196
|
expect(subject.read_groups).to eq ['umg/up.dlt.staff', 'group-3']
|
197
197
|
expect(subject.edit_groups).to eq ['group-8']
|
198
198
|
expect(subject.read_users).to eq ['person1']
|
199
199
|
end
|
200
200
|
|
201
|
-
it "
|
201
|
+
it "only revoke eligible groups" do
|
202
202
|
subject.set_read_groups(['group-2', 'group-3'], ['group-6'])
|
203
203
|
# 'group-7' is not eligible to be revoked
|
204
204
|
expect(subject.permissions.map(&:to_hash)).to match_array([
|
@@ -210,4 +210,16 @@ describe Hydra::AccessControls::Permissions do
|
|
210
210
|
{ name: 'person2', type: 'person', access: 'discover' }])
|
211
211
|
end
|
212
212
|
end
|
213
|
+
|
214
|
+
context "when the original object is destroyed" do
|
215
|
+
before do
|
216
|
+
subject.save!
|
217
|
+
subject.permissions.build(type: 'person', access: 'read', name: 'person1')
|
218
|
+
subject.save!
|
219
|
+
end
|
220
|
+
|
221
|
+
it "destroys the associated permissions" do
|
222
|
+
expect { subject.destroy }.to change { Hydra::AccessControls::Permission.count }.by(-1)
|
223
|
+
end
|
224
|
+
end
|
213
225
|
end
|
@@ -111,7 +111,7 @@ describe Hydra::PolicyAwareAccessControlsEnforcement do
|
|
111
111
|
|
112
112
|
it "should allow you to configure which model to use for policies" do
|
113
113
|
allow(Hydra.config.permissions).to receive(:policy_class).and_return(ModsAsset)
|
114
|
-
expect(ModsAsset).to receive(:
|
114
|
+
expect(ModsAsset).to receive(:search_with_conditions).and_return([])
|
115
115
|
subject.policies_with_access
|
116
116
|
end
|
117
117
|
end
|
@@ -127,20 +127,20 @@ describe Hydra::PolicyAwareAccessControlsEnforcement do
|
|
127
127
|
before do
|
128
128
|
allow(RoleMapper).to receive(:roles).with(user).and_return(user.roles)
|
129
129
|
end
|
130
|
-
let(:governed_field) { ActiveFedora
|
130
|
+
let(:governed_field) { ActiveFedora.index_field_mapper.solr_name('isGovernedBy', :symbol) }
|
131
131
|
|
132
|
-
it "
|
132
|
+
it "includes policy-aware query" do
|
133
133
|
# stubbing out policies_with_access because solr doesn't always return them in the same order.
|
134
134
|
policy_ids = (1..8).map {|n| "policies/#{n}"}
|
135
135
|
expect(subject).to receive(:policies_with_access).and_return(policy_ids)
|
136
136
|
subject.apply_gated_discovery(@solr_parameters)
|
137
|
-
expect(@solr_parameters[:fq].first).to include(" OR (_query_:\"{!
|
137
|
+
expect(@solr_parameters[:fq].first).to include(" OR (_query_:\"{!field f=#{governed_field}}policies/1\" OR _query_:\"{!field f=#{governed_field}}policies/2\" OR _query_:\"{!field f=#{governed_field}}policies/3\" OR _query_:\"{!field f=#{governed_field}}policies/4\" OR _query_:\"{!field f=#{governed_field}}policies/5\" OR _query_:\"{!field f=#{governed_field}}policies/6\" OR _query_:\"{!field f=#{governed_field}}policies/7\" OR _query_:\"{!field f=#{governed_field}}policies/8\")")
|
138
138
|
end
|
139
139
|
|
140
|
-
it "
|
140
|
+
it "doesn't change anything if there are no clauses to add" do
|
141
141
|
allow(subject).to receive(:policy_clauses).and_return(nil)
|
142
142
|
subject.apply_gated_discovery(@solr_parameters)
|
143
|
-
expect(@solr_parameters[:fq].first).not_to include(" OR (_query_:\"{!
|
143
|
+
expect(@solr_parameters[:fq].first).not_to include(" OR (_query_:\"{!field f=#{governed_field}}policies/1\" OR _query_:\"{!field f=#{governed_field}}policies/2\" OR _query_:\"{!field f=#{governed_field}}policies/3\" OR _query_:\"{!field f=#{governed_field}}policies/4\" OR _query_:\"{!field f=#{governed_field}}policies/5\" OR _query_:\"{!field f=#{governed_field}}policies/6\" OR _query_:\"{!field f=#{governed_field}}policies/7\" OR _query_:\"{!field f=#{governed_field}}policies/8\")")
|
144
144
|
end
|
145
145
|
end
|
146
146
|
|
metadata
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: hydra-access-controls
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 9.
|
4
|
+
version: 9.9.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Chris Beer
|
@@ -10,7 +10,7 @@ authors:
|
|
10
10
|
autorequire:
|
11
11
|
bindir: bin
|
12
12
|
cert_chain: []
|
13
|
-
date: 2016-
|
13
|
+
date: 2016-03-28 00:00:00.000000000 Z
|
14
14
|
dependencies:
|
15
15
|
- !ruby/object:Gem::Dependency
|
16
16
|
name: activesupport
|
@@ -32,14 +32,14 @@ dependencies:
|
|
32
32
|
requirements:
|
33
33
|
- - "~>"
|
34
34
|
- !ruby/object:Gem::Version
|
35
|
-
version:
|
35
|
+
version: 9.10.0
|
36
36
|
type: :runtime
|
37
37
|
prerelease: false
|
38
38
|
version_requirements: !ruby/object:Gem::Requirement
|
39
39
|
requirements:
|
40
40
|
- - "~>"
|
41
41
|
- !ruby/object:Gem::Version
|
42
|
-
version:
|
42
|
+
version: 9.10.0
|
43
43
|
- !ruby/object:Gem::Dependency
|
44
44
|
name: cancancan
|
45
45
|
requirement: !ruby/object:Gem::Requirement
|