hydra-access-controls 9.8.1 → 9.9.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/app/models/concerns/hydra/access_controls/permissions.rb +8 -0
- data/hydra-access-controls.gemspec +1 -1
- data/lib/hydra/config.rb +3 -3
- data/lib/hydra/policy_aware_ability.rb +1 -1
- data/lib/hydra/policy_aware_access_controls_enforcement.rb +1 -1
- data/spec/support/mods_asset.rb +1 -1
- data/spec/unit/admin_policy_spec.rb +1 -1
- data/spec/unit/config_spec.rb +9 -6
- data/spec/unit/permissions_spec.rb +21 -9
- data/spec/unit/policy_aware_access_controls_enforcement_spec.rb +6 -6
- metadata +4 -4
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: e5e8e75ab64b8c7d4c45303b419f85541723e456
|
4
|
+
data.tar.gz: aa314f6c97078f405da78244abef65b2c009f6eb
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: bcc97deb25bd78cae7feaf01cffeedda9fc618648579326019676a0b6c34e6cb149d3612d805fca471b52b6b5363bcbe804e6ff38d5999a38d472b6d7915e0ed
|
7
|
+
data.tar.gz: 2b48522f260eb8394cca5d1e0a86a417f5059636339317e4ae80762de1629b15ee5f5c202cbe7da7da7194dba99b0ffb2d4ea9664bc8b105ef4ebd265f0b1f7d
|
@@ -9,8 +9,16 @@ module Hydra
|
|
9
9
|
accepts_nested_attributes_for :permissions, allow_destroy: true
|
10
10
|
alias_method :permissions_attributes_without_uniqueness=, :permissions_attributes=
|
11
11
|
alias_method :permissions_attributes=, :permissions_attributes_with_uniqueness=
|
12
|
+
|
13
|
+
before_destroy :remove_permissions
|
14
|
+
end
|
15
|
+
|
16
|
+
# Destroy and permission objects associated with this object
|
17
|
+
def remove_permissions
|
18
|
+
permissions.destroy_all
|
12
19
|
end
|
13
20
|
|
21
|
+
|
14
22
|
def to_solr(solr_doc = {})
|
15
23
|
super.tap do |doc|
|
16
24
|
[:discover, :read, :edit].each do |access|
|
@@ -19,7 +19,7 @@ Gem::Specification.new do |gem|
|
|
19
19
|
gem.required_ruby_version = '>= 1.9.3'
|
20
20
|
|
21
21
|
gem.add_dependency 'activesupport', '~> 4.0'
|
22
|
-
gem.add_dependency "active-fedora", '~> 9.
|
22
|
+
gem.add_dependency "active-fedora", '~> 9.10.0'
|
23
23
|
gem.add_dependency 'cancancan', '~> 1.8'
|
24
24
|
gem.add_dependency 'deprecation', '~> 0.2'
|
25
25
|
gem.add_dependency "blacklight", '>= 5.16'
|
data/lib/hydra/config.rb
CHANGED
@@ -131,7 +131,7 @@ module Hydra
|
|
131
131
|
end
|
132
132
|
|
133
133
|
def solr_name(*args)
|
134
|
-
ActiveFedora
|
134
|
+
ActiveFedora.index_field_mapper.solr_name(*args)
|
135
135
|
end
|
136
136
|
|
137
137
|
class EmbargoConfig
|
@@ -144,7 +144,7 @@ module Hydra
|
|
144
144
|
end
|
145
145
|
|
146
146
|
def solr_name(*args)
|
147
|
-
ActiveFedora
|
147
|
+
ActiveFedora.index_field_mapper.solr_name(*args)
|
148
148
|
end
|
149
149
|
end
|
150
150
|
|
@@ -158,7 +158,7 @@ module Hydra
|
|
158
158
|
end
|
159
159
|
|
160
160
|
def solr_name(*args)
|
161
|
-
ActiveFedora
|
161
|
+
ActiveFedora.index_field_mapper.solr_name(*args)
|
162
162
|
end
|
163
163
|
end
|
164
164
|
|
@@ -23,7 +23,7 @@ module Hydra::PolicyAwareAbility
|
|
23
23
|
def policy_id_for(object_id)
|
24
24
|
policy_id = policy_id_cache[object_id]
|
25
25
|
return policy_id if policy_id
|
26
|
-
solr_result = ActiveFedora::Base.
|
26
|
+
solr_result = ActiveFedora::Base.search_with_conditions({ id: object_id }, fl: governed_by_solr_field).first
|
27
27
|
return unless solr_result
|
28
28
|
policy_id_cache[object_id] = policy_id = Array(solr_result[governed_by_solr_field]).first
|
29
29
|
end
|
@@ -24,7 +24,7 @@ module Hydra::PolicyAwareAccessControlsEnforcement
|
|
24
24
|
# Grant access based on user id & group
|
25
25
|
user_access_filters += apply_policy_group_permissions(discovery_permissions)
|
26
26
|
user_access_filters += apply_policy_user_permissions(discovery_permissions)
|
27
|
-
result = policy_class.
|
27
|
+
result = policy_class.search_with_conditions( user_access_filters.join(" OR "), fl: "id", rows: policy_class.count )
|
28
28
|
logger.debug "get policies: #{result}\n\n"
|
29
29
|
result.map {|h| h['id']}
|
30
30
|
end
|
data/spec/support/mods_asset.rb
CHANGED
@@ -3,5 +3,5 @@ class ModsAsset < ActiveFedora::Base
|
|
3
3
|
|
4
4
|
# This is how we're associating admin policies with assets.
|
5
5
|
# You can associate them however you want, just use the :is_governed_by relationship
|
6
|
-
belongs_to :admin_policy, class_name: "Hydra::AdminPolicy", predicate: ActiveFedora::
|
6
|
+
belongs_to :admin_policy, class_name: "Hydra::AdminPolicy", predicate: ActiveFedora::RDF::ProjectHydra.isGovernedBy
|
7
7
|
end
|
@@ -15,7 +15,7 @@ describe Hydra::AdminPolicy do
|
|
15
15
|
describe "to_solr" do
|
16
16
|
subject { Hydra::AdminPolicy.new(:title=>["Foobar"]).to_solr }
|
17
17
|
it "should have title_ssim" do
|
18
|
-
expect(subject[ActiveFedora
|
18
|
+
expect(subject[ActiveFedora.index_field_mapper.solr_name('title', type: :string)]).to eq ["Foobar"]
|
19
19
|
end
|
20
20
|
end
|
21
21
|
|
data/spec/unit/config_spec.rb
CHANGED
@@ -6,12 +6,15 @@ describe Hydra::Config do
|
|
6
6
|
# You only need to change these values if you've indexed permissions by some means other than the Hydra's built-in tooling.
|
7
7
|
# If you change these, you must also update the permissions request handler in your solrconfig.xml to return those values
|
8
8
|
config[:permissions] = {
|
9
|
-
:
|
10
|
-
|
11
|
-
:
|
12
|
-
|
9
|
+
discover: { group: ActiveFedora.index_field_mapper.solr_name("discover_access_group", :symbol),
|
10
|
+
individual: ActiveFedora.index_field_mapper.solr_name("discover_access_person", :symbol)},
|
11
|
+
read: { group: ActiveFedora.index_field_mapper.solr_name("read_access_group", :symbol),
|
12
|
+
individual: ActiveFedora.index_field_mapper.solr_name("read_access_person", :symbol)},
|
13
|
+
edit: { group: ActiveFedora.index_field_mapper.solr_name("edit_access_group", :symbol),
|
14
|
+
individual: ActiveFedora.index_field_mapper.solr_name("edit_access_person", :symbol)},
|
15
|
+
owner: ActiveFedora.index_field_mapper.solr_name("depositor", :symbol),
|
13
16
|
}
|
14
|
-
config.permissions.embargo.release_date = ActiveFedora
|
17
|
+
config.permissions.embargo.release_date = ActiveFedora.index_field_mapper.solr_name("embargo_release_date", Solrizer::Descriptor.new(:date, :stored, :indexed))
|
15
18
|
|
16
19
|
# specify the user model
|
17
20
|
config[:user_model] = 'User'
|
@@ -23,7 +26,7 @@ describe Hydra::Config do
|
|
23
26
|
# This specifies the solr field names of permissions-related fields.
|
24
27
|
# You only need to change these values if you've indexed permissions by some means other than the Hydra's built-in tooling.
|
25
28
|
# If you change these, you must also update the permissions request handler in your solrconfig.xml to return those values
|
26
|
-
config.permissions.discover.group = ActiveFedora
|
29
|
+
config.permissions.discover.group = ActiveFedora.index_field_mapper.solr_name("discover_access_group", :symbol)
|
27
30
|
|
28
31
|
# specify the user model
|
29
32
|
config.user_model = 'User'
|
@@ -9,13 +9,13 @@ describe Hydra::AccessControls::Permissions do
|
|
9
9
|
|
10
10
|
subject { Foo.new }
|
11
11
|
|
12
|
-
it "
|
12
|
+
it "has many permissions" do
|
13
13
|
expect(subject.permissions).to eq []
|
14
14
|
end
|
15
15
|
|
16
16
|
#TODO is permission same as an acl?
|
17
17
|
|
18
|
-
it "
|
18
|
+
it "has a set of permissions" do
|
19
19
|
subject.read_groups=['group1', 'group2']
|
20
20
|
subject.edit_users=['user1']
|
21
21
|
subject.read_users=['user2', 'user3']
|
@@ -29,7 +29,7 @@ describe Hydra::AccessControls::Permissions do
|
|
29
29
|
describe "building a new permission" do
|
30
30
|
before { subject.save! }
|
31
31
|
|
32
|
-
it "
|
32
|
+
it "sets the accessTo association" do
|
33
33
|
perm = subject.permissions.build(name: 'user1', type: 'person', access: 'read')
|
34
34
|
subject.save
|
35
35
|
expect(perm.access_to_id).to eq subject.id
|
@@ -47,7 +47,7 @@ describe Hydra::AccessControls::Permissions do
|
|
47
47
|
subject.permissions_attributes = {'0' => { type: "group", access:"read", name:"group1" },
|
48
48
|
'1' => { type: 'person', access: 'edit', name: 'user2' }}
|
49
49
|
end
|
50
|
-
it "
|
50
|
+
it "handles a hash" do
|
51
51
|
expect(subject.permissions.size).to eq 3
|
52
52
|
expect(subject.permissions.to_a).to all(be_a(Hydra::AccessControls::Permission))
|
53
53
|
expect(subject.permissions.map(&:to_hash)).to match_array [
|
@@ -164,7 +164,7 @@ describe Hydra::AccessControls::Permissions do
|
|
164
164
|
Hydra::AccessControls::Permission.new(type: "person", access: "edit", name: "jcoyne")]
|
165
165
|
subject.save!
|
166
166
|
end
|
167
|
-
it "
|
167
|
+
it "sets the permissions" do
|
168
168
|
expect(subject.edit_users).to eq ['jcoyne']
|
169
169
|
expect(subject.edit_groups).to eq ['group1']
|
170
170
|
subject.permissions = []
|
@@ -183,22 +183,22 @@ describe Hydra::AccessControls::Permissions do
|
|
183
183
|
subject.permissions.build(type: 'group', access: 'edit', name: 'group-8')
|
184
184
|
end
|
185
185
|
|
186
|
-
it "
|
186
|
+
it "has read groups accessor" do
|
187
187
|
expect(subject.read_groups).to eq ['group-6', 'group-7']
|
188
188
|
end
|
189
189
|
|
190
|
-
it "
|
190
|
+
it "has read groups string accessor" do
|
191
191
|
expect(subject.read_groups_string).to eq 'group-6, group-7'
|
192
192
|
end
|
193
193
|
|
194
|
-
it "
|
194
|
+
it "has read groups string writer" do
|
195
195
|
subject.read_groups_string = 'umg/up.dlt.staff, group-3'
|
196
196
|
expect(subject.read_groups).to eq ['umg/up.dlt.staff', 'group-3']
|
197
197
|
expect(subject.edit_groups).to eq ['group-8']
|
198
198
|
expect(subject.read_users).to eq ['person1']
|
199
199
|
end
|
200
200
|
|
201
|
-
it "
|
201
|
+
it "only revoke eligible groups" do
|
202
202
|
subject.set_read_groups(['group-2', 'group-3'], ['group-6'])
|
203
203
|
# 'group-7' is not eligible to be revoked
|
204
204
|
expect(subject.permissions.map(&:to_hash)).to match_array([
|
@@ -210,4 +210,16 @@ describe Hydra::AccessControls::Permissions do
|
|
210
210
|
{ name: 'person2', type: 'person', access: 'discover' }])
|
211
211
|
end
|
212
212
|
end
|
213
|
+
|
214
|
+
context "when the original object is destroyed" do
|
215
|
+
before do
|
216
|
+
subject.save!
|
217
|
+
subject.permissions.build(type: 'person', access: 'read', name: 'person1')
|
218
|
+
subject.save!
|
219
|
+
end
|
220
|
+
|
221
|
+
it "destroys the associated permissions" do
|
222
|
+
expect { subject.destroy }.to change { Hydra::AccessControls::Permission.count }.by(-1)
|
223
|
+
end
|
224
|
+
end
|
213
225
|
end
|
@@ -111,7 +111,7 @@ describe Hydra::PolicyAwareAccessControlsEnforcement do
|
|
111
111
|
|
112
112
|
it "should allow you to configure which model to use for policies" do
|
113
113
|
allow(Hydra.config.permissions).to receive(:policy_class).and_return(ModsAsset)
|
114
|
-
expect(ModsAsset).to receive(:
|
114
|
+
expect(ModsAsset).to receive(:search_with_conditions).and_return([])
|
115
115
|
subject.policies_with_access
|
116
116
|
end
|
117
117
|
end
|
@@ -127,20 +127,20 @@ describe Hydra::PolicyAwareAccessControlsEnforcement do
|
|
127
127
|
before do
|
128
128
|
allow(RoleMapper).to receive(:roles).with(user).and_return(user.roles)
|
129
129
|
end
|
130
|
-
let(:governed_field) { ActiveFedora
|
130
|
+
let(:governed_field) { ActiveFedora.index_field_mapper.solr_name('isGovernedBy', :symbol) }
|
131
131
|
|
132
|
-
it "
|
132
|
+
it "includes policy-aware query" do
|
133
133
|
# stubbing out policies_with_access because solr doesn't always return them in the same order.
|
134
134
|
policy_ids = (1..8).map {|n| "policies/#{n}"}
|
135
135
|
expect(subject).to receive(:policies_with_access).and_return(policy_ids)
|
136
136
|
subject.apply_gated_discovery(@solr_parameters)
|
137
|
-
expect(@solr_parameters[:fq].first).to include(" OR (_query_:\"{!
|
137
|
+
expect(@solr_parameters[:fq].first).to include(" OR (_query_:\"{!field f=#{governed_field}}policies/1\" OR _query_:\"{!field f=#{governed_field}}policies/2\" OR _query_:\"{!field f=#{governed_field}}policies/3\" OR _query_:\"{!field f=#{governed_field}}policies/4\" OR _query_:\"{!field f=#{governed_field}}policies/5\" OR _query_:\"{!field f=#{governed_field}}policies/6\" OR _query_:\"{!field f=#{governed_field}}policies/7\" OR _query_:\"{!field f=#{governed_field}}policies/8\")")
|
138
138
|
end
|
139
139
|
|
140
|
-
it "
|
140
|
+
it "doesn't change anything if there are no clauses to add" do
|
141
141
|
allow(subject).to receive(:policy_clauses).and_return(nil)
|
142
142
|
subject.apply_gated_discovery(@solr_parameters)
|
143
|
-
expect(@solr_parameters[:fq].first).not_to include(" OR (_query_:\"{!
|
143
|
+
expect(@solr_parameters[:fq].first).not_to include(" OR (_query_:\"{!field f=#{governed_field}}policies/1\" OR _query_:\"{!field f=#{governed_field}}policies/2\" OR _query_:\"{!field f=#{governed_field}}policies/3\" OR _query_:\"{!field f=#{governed_field}}policies/4\" OR _query_:\"{!field f=#{governed_field}}policies/5\" OR _query_:\"{!field f=#{governed_field}}policies/6\" OR _query_:\"{!field f=#{governed_field}}policies/7\" OR _query_:\"{!field f=#{governed_field}}policies/8\")")
|
144
144
|
end
|
145
145
|
end
|
146
146
|
|
metadata
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: hydra-access-controls
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 9.
|
4
|
+
version: 9.9.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Chris Beer
|
@@ -10,7 +10,7 @@ authors:
|
|
10
10
|
autorequire:
|
11
11
|
bindir: bin
|
12
12
|
cert_chain: []
|
13
|
-
date: 2016-
|
13
|
+
date: 2016-03-28 00:00:00.000000000 Z
|
14
14
|
dependencies:
|
15
15
|
- !ruby/object:Gem::Dependency
|
16
16
|
name: activesupport
|
@@ -32,14 +32,14 @@ dependencies:
|
|
32
32
|
requirements:
|
33
33
|
- - "~>"
|
34
34
|
- !ruby/object:Gem::Version
|
35
|
-
version:
|
35
|
+
version: 9.10.0
|
36
36
|
type: :runtime
|
37
37
|
prerelease: false
|
38
38
|
version_requirements: !ruby/object:Gem::Requirement
|
39
39
|
requirements:
|
40
40
|
- - "~>"
|
41
41
|
- !ruby/object:Gem::Version
|
42
|
-
version:
|
42
|
+
version: 9.10.0
|
43
43
|
- !ruby/object:Gem::Dependency
|
44
44
|
name: cancancan
|
45
45
|
requirement: !ruby/object:Gem::Requirement
|