hydra-head 3.0.0pre1

data/lib/generators/hydra/templates/solr_conf/solr.xml

@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+<!--
+ All (relative) paths are relative to the installation path
+  
+  persistent: Save changes made via the API to this file
+  sharedLib: path to a lib directory that will be shared across all cores
+-->
+<solr persistent="false">
+
+  <!--
+  adminPath: RequestHandler path to manage cores.  
+    If 'null' (or absent), cores will not be manageable via REST
+  -->
+  <cores adminPath="/admin/cores">
+    <core name="core0" instanceDir="core0" />
+    <core name="core1" instanceDir="core1" />
+  </cores>
+</solr>

data/lib/hydra-head.rb

@@ -0,0 +1,29 @@
+module HydraHead 
+  require 'engine' if defined?(Rails) && Rails::VERSION::MAJOR == 3
+  require 'application_controller'
+
+  require 'hydra-head/version'
+  require 'hydra-head/routes'
+  
+  def self.version
+    HydraHead::VERSION
+  end
+
+  def self.root
+    @root ||= File.expand_path(File.dirname(File.dirname(__FILE__)))
+  end
+  
+  # If you put this in your application's routes.rb, it will add the Hydra Head routes to the app.
+  # The hydra:head generator puts this in routes.rb for you by default.
+  # See {HydraHead::Routes} for information about how to modify which routes are generated.
+  # @example 
+  #   # in config/routes.rb
+  #   MyAppName::Application.routes.draw do
+  #     Blacklight.add_routes(self)
+  #     HydraHead.add_routes(self)
+  #   end
+  def self.add_routes(router, options = {})
+    HydraHead::Routes.new(router, options).draw
+  end
+  
+end

data/lib/hydra-head/engine.rb

@@ -0,0 +1,9 @@
+require "hydra-head"
+require "rails"
+module HydraHead
+
+   class Engine < Rails::Engine
+
+   end 
+
+end

data/lib/hydra-head/routes.rb

@@ -0,0 +1,87 @@
+# -*- encoding : utf-8 -*-
+module HydraHead
+  class Routes
+
+    def initialize(router, options)
+      @router = router
+      @options = options
+    end
+
+    def draw
+      route_sets.each do |r|
+        self.send(r)
+      end
+    end
+
+    protected
+
+    def add_routes &blk
+      @router.instance_exec(@options, &blk)
+    end
+
+    def route_sets
+      (@options[:only] || default_route_sets) - (@options[:except] || [])
+    end
+
+    def default_route_sets
+      #[:file_assets, :assets, :downloads, :contributors, :grants, :permissions, :superuser,:catalog, :get]
+      [:get, :catalog, :superuser, :assets_with_all_nested_routes]
+    end
+
+    module RouteSets
+
+
+      def assets_with_all_nested_routes
+        add_routes do |options|
+          resources :file_assets
+          match "withdraw", :to => "assets#withdraw", :as => "withdraw"   
+          resources :assets do 
+            # this is to remove documents from SOLR but not from Fedora.
+            resources :contributors, :only=>[:new,:create]
+            match 'contributors/:contributor_type/:index', :to => 'contributors#show', :as => 'contributor', :via => 'get'
+            match 'contributors/:contributor_type/:index', :to => 'contributors#destroy', :as => 'connect',  :via => 'delete'
+            resources :file_assets
+            resources :downloads, :only=>[:index]
+            resources :grants, :only=>[:new,:create]
+            resources :permissions
+            # Allow updates to assets/:asset_id/permissions (no :id necessary)
+            match '/permissions', :to => 'permissions#update', :as => 'update_group_permissions'
+          end
+        end
+      end
+
+
+      def superuser
+        add_routes do |options|
+          match 'superuser', :to => 'user_sessions#superuser', :as => 'superuser'
+        end
+      end
+
+      def catalog
+        add_routes do |options|
+          match 'catalog/:id/edit', :to => 'catalog#edit', :as => 'edit_catalog'
+          # The delete method renders a confirmation page with a button to submit actual destroy request
+          match 'catalog/:id/delete', :to => 'catalog#delete', :as => 'delete_catalog'
+	  ### The rest of these routes are defined in blacklight
+          #resources :catalog, :id=> /.+/
+         # resources :catalog, :only => [:index, :show], :controller => "hydra_head/catalog", :path_prefix => HydraHead::Engine.config.mount_at, :as => "hydra_head", :id=> /.+/
+          #match 'catalog/:id', :to => "hydra_head/catalog#show", :path_prefix => HydraHead::Engine.config.mount_at, :as => "catalog", :id => /.+/
+          #match 'catalog/:id', :to => "hydra_head/catalog#show", :id => /.+/
+          # match 'about', :to => 'catalog#about', :as => 'about'
+        end
+      end
+
+
+      def get
+        add_routes do |options|
+          resources :get, :only=>:show 
+        end
+      end
+
+
+    end
+    include RouteSets
+
+#match 'generic_contents_object/content/:container_id', :to => 'generic_content_objects#create', :as => 'generic_content_object', :via => :post
+  end
+end

data/lib/hydra-head/version.rb

@@ -0,0 +1,4 @@
+module HydraHead
+  VERSION = "3.0.0pre1"
+end
+

data/lib/hydra.rb

@@ -0,0 +1,22 @@
+require "blacklight"
+# Hydra libraries
+module Hydra
+  autoload :Configurable, 'blacklight/configurable'
+  extend Blacklight::Configurable
+end
+
+
+require 'mediashelf/active_fedora_helper'
+
+require 'hydra/repository_controller'
+require 'hydra/access_controls_enforcement'
+require 'hydra/testing_server'
+require 'hydra/assets_controller_helper'
+require 'hydra/file_assets_helper'
+
+require 'hydra/rights_metadata'
+require 'hydra/common_mods_index_methods'
+require 'hydra/mods_article'
+require 'hydra/model_methods'
+
+Dir[File.join(File.dirname(__FILE__), "hydra", "*.rb")].each {|f| require f}

data/lib/hydra/access_controls_enforcement.rb

@@ -0,0 +1,236 @@
+module Hydra::AccessControlsEnforcement
+  
+  def self.included(klass)
+    klass.send(:include, Hydra::AccessControlsEvaluation)
+  end
+  
+  #
+  #   Access Controls Enforcement Filters
+  #
+  
+  # Controller "before" filter that delegates enforcement based on the controller action
+  # Action-specific implementations are enforce_index_permissions, enforce_show_permissions, etc.
+  # @param [Hash] opts (optional, not currently used)
+  #
+  # @example
+  #   class CatalogController < ApplicationController  
+  #     before_filter :enforce_access_controls
+  #   end
+  def enforce_access_controls(opts={})
+    controller_action = params[:action].to_s
+    if params[:action] == "destroy" then controller_action = "edit" end
+    delegate_method = "enforce_#{controller_action}_permissions"
+    self.send(delegate_method.to_sym)
+  end
+  
+  
+  #
+  #  Solr integration
+  #
+  
+  # returns a params hash with the permissions info for a single solr document 
+  # If the id arg is nil, then the value is fetched from params[:id]
+  # This method is primary called by the get_permissions_solr_response_for_doc_id method.
+  # Modeled on Blacklight::SolrHelper.solr_doc_params
+  # @param [String] id of the documetn to retrieve
+  def permissions_solr_doc_params(id=nil)
+    id ||= params[:id]
+    # just to be consistent with the other solr param methods:
+    {
+      :qt => :permissions,
+      :id => id # this assumes the document request handler will map the 'id' param to the unique key field
+    }
+  end
+  
+  # a solr query method
+  # retrieve a solr document, given the doc id
+  # Modeled on Blacklight::SolrHelper.get_permissions_solr_response_for_doc_id
+  # @param [String] id of the documetn to retrieve
+  # @param [Hash] extra_controller_params (optional)
+  def get_permissions_solr_response_for_doc_id(id=nil, extra_controller_params={})
+    raise Blacklight::Exceptions::InvalidSolrID.new("The application is trying to retrieve permissions without specifying an asset id") if id.nil?
+    solr_response = Blacklight.solr.find permissions_solr_doc_params(id).merge(extra_controller_params)
+    raise Blacklight::Exceptions::InvalidSolrID.new("The solr permissions search handler didn't return anything for id \"#{id}\"") if solr_response.docs.empty?
+    document = SolrDocument.new(solr_response.docs.first, solr_response)
+    [solr_response, document]
+  end
+  
+  # Loads permissions info into @permissions_solr_response and @permissions_solr_document
+  def load_permissions_from_solr(id=params[:id], extra_controller_params={})
+    unless !@permissions_solr_document.nil? && !@permissions_solr_response.nil?
+      @permissions_solr_response, @permissions_solr_document = get_permissions_solr_response_for_doc_id(id, extra_controller_params)
+    end
+  end
+  
+  private
+
+  # If someone hits the show action while their session's viewing_context is in edit mode, 
+  # this will redirect them to the edit action.
+  # If they do not have sufficient privileges to edit documents, it will silently switch their session to browse mode.
+  def enforce_viewing_context_for_show_requests
+    if params[:viewing_context] == "browse"
+      session[:viewing_context] = params[:viewing_context]
+    elsif session[:viewing_context] == "edit"
+      if editor?
+        logger.debug("enforce_viewing_context_for_show_requests redirecting to edit")
+        if params[:files]
+          redirect_to :action=>:edit, :files=>true
+        else
+          redirect_to :action=>:edit
+        end
+      else
+        session[:viewing_context] = "browse"
+      end
+    end
+  end
+  
+  #
+  # Action-specific enforcement
+  #
+  
+  # Controller "before" filter for enforcing access controls on show actions
+  # @param [Hash] opts (optional, not currently used)
+  def enforce_show_permissions(opts={})
+    load_permissions_from_solr
+    unless @permissions_solr_document['access_t'] && (@permissions_solr_document['access_t'].first == "public" || @permissions_solr_document['access_t'].first == "Public")
+      if @permissions_solr_document["embargo_release_date_dt"] 
+        embargo_date = Date.parse(@permissions_solr_document["embargo_release_date_dt"].split(/T/)[0])
+        if embargo_date > Date.parse(Time.now.to_s)
+          # check for depositor raise "#{@document["depositor_t"].first} --- #{current_user.login}"
+          unless current_user && current_user.login == @permissions_solr_document["depositor_t"].first
+            flash[:notice] = "This item is under embargo.  You do not have sufficient access privileges to read this document."
+            redirect_to(:action=>'index', :q=>nil, :f=>nil) and return false
+          end
+        end
+      end
+      unless reader?
+        flash[:notice]= "You do not have sufficient access privileges to read this document, which has been marked private."
+        redirect_to(:action => 'index', :q => nil , :f => nil) and return false
+      end
+    end
+  end
+  
+  # Controller "before" filter for enforcing access controls on edit actions
+  # @param [Hash] opts (optional, not currently used)
+  def enforce_edit_permissions(opts={})
+    logger.debug("Enforcing edit permissions")
+    load_permissions_from_solr
+    if !editor?
+      session[:viewing_context] = "browse"
+      flash[:notice] = "You do not have sufficient privileges to edit this document. You have been redirected to the read-only view."
+      redirect_to :action=>:show
+    else
+      session[:viewing_context] = "edit"
+    end
+  end
+
+  ## proxies to enforce_edit_permssions.  This method is here for you to override
+  def enforce_update_permissions(opts={})
+    enforce_edit_permissions(opts)
+  end
+
+  # Controller "before" filter for enforcing access controls on index actions
+  # Currently does nothing, instead relies on 
+  # @param [Hash] opts (optional, not currently used)
+  def enforce_index_permissions(opts={})
+    return true
+    # Do nothing. Relies on enforce_search_permissions being included in the Controller's solr_search_params_logic
+    # apply_gated_discovery
+    # if !reader? 
+    #   solr_parameters[:qt] = Blacklight.config[:public_qt]
+    # end
+  end
+  
+  #
+  # Solr query modifications
+  #
+  
+  # Set solr_parameters to enforce appropriate permissions 
+  # * Applies a lucene query to the solr :q parameter for gated discovery
+  # * Uses public_qt search handler if user does not have "read" permissions
+  # @param solr_parameters the current solr parameters
+  # @param user_parameters the current user-subitted parameters
+  #
+  # @example This method should be added to your Catalog Controller's solr_search_params_logic
+  #   class CatalogController < ApplicationController 
+  #     include Hydra::Catalog
+  #     CatalogController.solr_search_params_logic << :add_access_controls_to_solr_params
+  #   end
+  def add_access_controls_to_solr_params(solr_parameters, user_parameters)
+    apply_gated_discovery(solr_parameters, user_parameters)
+    if !reader? 
+      solr_parameters[:qt] = Blacklight.config[:public_qt]
+    end
+  end
+  
+  # Contrller before filter that sets up access-controlled lucene query in order to provide gated discovery behavior
+  # @param solr_parameters the current solr parameters
+  # @param user_parameters the current user-subitted parameters
+  def apply_gated_discovery(solr_parameters, user_parameters)
+    # solr_parameters[:q] ||= []
+    solr_parameters[:q] = build_lucene_query(params[:q])
+    # @extra_controller_params ||= {}
+    # @extra_controller_params.merge!(:q=>build_lucene_query(params[:q]))
+    logger.debug("Solr query: #{ solr_parameters[:q] }")
+  end
+  
+  # proxy for {enforce_index_permissions}
+  def enforce_search_permissions
+    enforce_index_permissions
+  end
+
+  # proxy for {enforce_show_permissions}
+  def enforce_read_permissions
+    enforce_show_permissions
+  end
+
+  # Build the lucene query that performs gated discovery based on Hydra rightsMetadata information in Solr
+  # @param [String] user_query the user's original query request that will be wrapped in access controls
+  def build_lucene_query(user_query)
+    q = ""
+    # start query of with user supplied query term
+      q << "_query_:\"{!dismax qf=$qf_dismax pf=$pf_dismax}#{user_query}\""
+
+    # Append the exclusion of FileAssets
+      q << " AND NOT _query_:\"info\\\\:fedora/afmodel\\\\:FileAsset\""
+
+    # Append the query responsible for adding the users discovery level
+      permission_types = ["edit","discover","read"]
+      field_queries = []
+      embargo_query = ""
+      permission_types.each do |type|
+        field_queries << "_query_:\"#{type}_access_group_t:public\""
+      end
+
+      unless current_user.nil?
+        # for roles
+        RoleMapper.roles(current_user.login).each do |role|
+          permission_types.each do |type|
+            field_queries << "_query_:\"#{type}_access_group_t:#{role}\""
+          end
+        end
+        # for individual person access
+        permission_types.each do |type|
+          field_queries << "_query_:\"#{type}_access_person_t:#{current_user.login}\""
+        end
+        if current_user.is_being_superuser?(session)
+          permission_types.each do |type|
+            field_queries << "_query_:\"#{type}_access_person_t:[* TO *]\""
+          end
+        end
+
+        # if it is the depositor and it is under embargo, that is ok
+        # otherwise if it not the depositor and it is under embargo, don't show it
+        embargo_query = " OR  ((_query_:\"embargo_release_date_dt:[NOW TO *]\" AND  _query_:\"depositor_t:#{current_user.login}\") AND NOT (NOT _query_:\"depositor_t:#{current_user.login}\" AND _query_:\"embargo_release_date_dt:[NOW TO *]\"))"
+      end
+      
+      # remove anything with an embargo release date in the future  
+#embargo_query = " AND NOT _query_:\"embargo_release_date_dt:[NOW TO *]\"" if embargo_query.blank?
+      field_queries << " NOT _query_:\"embargo_release_date_dt:[NOW TO *]\"" if embargo_query.blank?
+      
+      q << " AND (#{field_queries.join(" OR ")})"
+      q << embargo_query 
+    return q
+  end
+
+end

data/lib/hydra/access_controls_evaluation.rb

@@ -0,0 +1,97 @@
+# Provides methods for testing permissions
+# If you include this into a Controller, it will also make a number of these methods available as view helpers.
+module Hydra::AccessControlsEvaluation
+  
+  def self.included(klass)
+    if klass.respond_to?(:helper_method)
+      klass.helper_method(:editor?)
+      klass.helper_method(:reader?)
+      klass.helper_method(:test_permission?)
+    end
+  end
+  
+  # Test the current user's permissions.  This method is used by the editor? and reader? methods
+  # @param [Symbol] permission_type valid options: :edit, :read
+  # This is available as a view helper method as well as within your controllers.
+  # @example
+  #   test_permission(:edit)
+  def test_permission(permission_type)    
+    # if !current_user.nil?
+      if (@permissions_solr_document == nil)
+        logger.warn("SolrDocument is nil")
+      end
+
+      if current_user.nil? 
+        user = "public"
+        logger.debug("current_user is nil, assigning public")
+      else
+        user = current_user.login
+      end
+      
+      user_groups = RoleMapper.roles(user)
+      # everyone is automatically a member of the group 'public'
+      user_groups.push 'public' unless user_groups.include?('public')
+      # logged-in users are automatically members of the group "registered"
+      user_groups.push 'registered' unless (user == "public" || user_groups.include?('registered') )
+      
+      logger.debug("User #{user} is a member of groups: #{user_groups.inspect}")
+      case permission_type
+        when :edit
+          logger.debug("Checking edit permissions for user: #{user}")
+          group_intersection = user_groups & edit_groups
+          result = !group_intersection.empty? || edit_persons.include?(user)
+        when :read
+          logger.debug("Checking read permissions for user: #{user}")
+          group_intersection = user_groups & read_groups
+          result = !group_intersection.empty? || read_persons.include?(user)
+        else
+          result = false
+      end
+      logger.debug("test_permission result: #{result}")
+      return result
+    # else
+    #   logger.debug("nil user, test_permission returning false")
+    #   return false
+    # end
+  end
+  
+  # Test whether the the current user has edit permissions.  
+  # This is available as a view helper method as well as within your controllers.
+  def editor?
+    test_permission(:edit) or (current_user and current_user.is_being_superuser?(session))
+  end
+  
+  # Test whether the the current user has read permissions.  
+  # This is available as a view helper method as well as within your controllers.
+  def reader?
+    test_permission(:read) or (current_user and current_user.is_being_superuser?(session))
+  end
+
+  private
+  def edit_groups
+    eg = (@permissions_solr_document == nil || @permissions_solr_document['edit_access_group_t'] == nil) ? [] : @permissions_solr_document['edit_access_group_t']
+    logger.debug("edit_groups: #{eg.inspect}")
+    return eg
+  end
+
+  # edit implies read, so read_groups is the union of edit and read groups
+  def read_groups
+    rg = edit_groups | ((@permissions_solr_document == nil || @permissions_solr_document['read_access_group_t'] == nil) ? [] : @permissions_solr_document['read_access_group_t'])
+    logger.debug("read_groups: #{rg.inspect}")
+    return rg
+  end
+
+  def edit_persons
+    ep = (@permissions_solr_document == nil || @permissions_solr_document['edit_access_person_t'] == nil) ? [] : @permissions_solr_document['edit_access_person_t']
+    logger.debug("edit_persons: #{ep.inspect}")
+    return ep
+  end
+
+  # edit implies read, so read_persons is the union of edit and read persons
+  def read_persons
+    rp = edit_persons | ((@permissions_solr_document == nil || @permissions_solr_document['read_access_person_t'] == nil) ? [] : @permissions_solr_document['read_access_person_t'])
+    logger.debug("read_persons: #{rp.inspect}")
+    return rp
+  end
+
+end