hydra-head 4.0.3 → 4.1.0

data/app/models/hydra/datastream/rights_metadata.rb

@@ -1,191 +0,0 @@
-module Hydra
-  module Datastream
-    # Implements Hydra RightsMetadata XML terminology for asserting access permissions
-    class RightsMetadata < ActiveFedora::NokogiriDatastream       
-      
-      set_terminology do |t|
-        t.root(:path=>"rightsMetadata", :xmlns=>"http://hydra-collab.stanford.edu/schemas/rightsMetadata/v1", :schema=>"http://github.com/projecthydra/schemas/tree/v1/rightsMetadata.xsd") 
-        t.copyright {
-          t.machine {
-            t.uvalicense
-            t.cclicense   
-            t.license     
-          }
-          t.human_readable(:path=>"human")
-          t.license(:proxy=>[:machine, :license ])            
-          t.cclicense(:proxy=>[:machine, :cclicense ])                  
-        }
-        t.access {
-          t.human_readable(:path=>"human")
-          t.machine {
-            t.group
-            t.person
-          }
-          t.person(:proxy=>[:machine, :person])
-          t.group(:proxy=>[:machine, :group])
-          # accessor :access_person, :term=>[:access, :machine, :person]
-        }
-        t.discover_access(:ref=>[:access], :attributes=>{:type=>"discover"})
-        t.read_access(:ref=>[:access], :attributes=>{:type=>"read"})
-        t.edit_access(:ref=>[:access], :attributes=>{:type=>"edit"})
-        # A bug in OM prevnts us from declaring proxy terms at the root of a Terminology
-        # t.access_person(:proxy=>[:access,:machine,:person])
-        # t.access_group(:proxy=>[:access,:machine,:group])
-        
-        t.embargo {
-          t.human_readable(:path=>"human")
-          t.machine{
-            t.date(:type =>"release")
-          }
-          t.embargo_release_date(:proxy => [:machine, :date])
-        }    
-      end
-
-      # Generates an empty Mods Article (used when you call ModsArticle.new without passing in existing xml)
-      def self.xml_template
-        builder = Nokogiri::XML::Builder.new do |xml|
-          xml.rightsMetadata(:version=>"0.1", "xmlns"=>"http://hydra-collab.stanford.edu/schemas/rightsMetadata/v1") {
-            xml.copyright {
-              xml.human
-              xml.machine {
-                xml.uvalicense "no"
-              }
-            }
-            xml.access(:type=>"discover") {
-              xml.human
-              xml.machine
-            }
-            xml.access(:type=>"read") {
-              xml.human 
-              xml.machine
-            }
-            xml.access(:type=>"edit") {
-              xml.human
-              xml.machine
-            }
-            xml.embargo{
-              xml.human
-              xml.machine
-            }        
-          }
-        end
-        return builder.doc
-      end
-        
-      # Returns the permissions for the selected person/group
-      # If new_access_level is provided, updates the selected person/group access_level to the one specified 
-      # A new_access_level of "none" will remove all access_levels for the selected person/group
-      # @param [Hash] selector hash in format {type => identifier}
-      # @param new_access_level (default nil)
-      # @return Hash in format {type => access_level}.  
-      # 
-      # ie. 
-      # permissions({:person=>"person123"})
-      # => {"person123"=>"edit"}
-      # permissions({:person=>"person123"}, "read")
-      # => {"person123"=>"read"}
-      # permissions({:person=>"person123"})
-      # => {"person123"=>"read"}
-      def permissions(selector, new_access_level=nil)
-        type = selector.keys.first.to_sym
-        actor = selector.values.first
-        if new_access_level.nil?
-          xpath = self.class.terminology.xpath_for(:access, type, actor)
-          nodeset = self.find_by_terms(xpath)
-          if nodeset.empty?
-            return "none"
-          else
-            return nodeset.first.ancestors("access").first.attributes["type"].text
-          end
-        else
-          remove_all_permissions(selector)
-          unless new_access_level == "none" 
-            access_type_symbol = "#{new_access_level}_access".to_sym
-            result = self.update_values([access_type_symbol, type] => {"-1"=>actor})
-          end
-          self.dirty = true
-          return new_access_level
-        end
-          
-      end
-      
-      # Reports on which groups have which permissions
-      # @return Hash in format {group_name => group_permissions, group_name => group_permissions}
-      def groups
-        return quick_search_by_type(:group)
-      end
-      
-      # Reports on which groups have which permissions
-      # @return Hash in format {person_name => person_permissions, person_name => person_permissions}
-      def individuals
-        return quick_search_by_type(:person)
-      end
-      
-      # Updates permissions for all of the persons and groups in a hash
-      # @param params ex. {"group"=>{"group1"=>"discover","group2"=>"edit"}, "person"=>{"person1"=>"read","person2"=>"discover"}}
-      # Currently restricts actor type to group or person.  Any others will be ignored
-      def update_permissions(params)
-        params.fetch("group", {}).each_pair {|group_id, access_level| self.permissions({"group"=>group_id}, access_level)}
-        params.fetch("person", {}).each_pair {|group_id, access_level| self.permissions({"person"=>group_id}, access_level)}
-      end
-      
-      # @param [Symbol] type (either :group or :person)
-      # @return 
-      # This method limits the response to known access levels.  Probably runs a bit faster than .permissions().
-      def quick_search_by_type(type)
-        result = {}
-        [{:discover_access=>"discover"},{:read_access=>"read"},{:edit_access=>"edit"}].each do |access_levels_hash|
-          access_level = access_levels_hash.keys.first
-          access_level_name = access_levels_hash.values.first
-          self.find_by_terms(*[access_level, type]).each do |entry|
-            result[entry.text] = access_level_name
-          end
-        end
-        return result
-      end
-
-      attr_reader :embargo_release_date
-      def embargo_release_date=(release_date)
-        release_date = release_date.to_s if release_date.is_a? Date
-        begin
-          Date.parse(release_date)
-        rescue 
-          return "INVALID DATE"
-        end
-        self.update_values({[:embargo,:machine,:date]=>release_date})
-      end
-      def embargo_release_date(opts={})
-        embargo_release_date = self.find_by_terms(*[:embargo,:machine,:date]).first ? self.find_by_terms(*[:embargo,:machine,:date]).first.text : nil
-        if embargo_release_date.present? && opts[:format] && opts[:format] == :solr_date
-          embargo_release_date << "T23:59:59Z"
-        end
-        embargo_release_date
-      end
-      def under_embargo?
-        (embargo_release_date && Date.today < embargo_release_date.to_date) ? true : false
-      end
-
-      def to_solr(solr_doc=Hash.new)
-        super(solr_doc)
-        ::Solrizer::Extractor.insert_solr_field_value(solr_doc, "embargo_release_date_dt", embargo_release_date(:format=>:solr_date)) if embargo_release_date
-        solr_doc
-      end
-
-
-
-
-      
-      private
-      # Purge all access given group/person 
-      def remove_all_permissions(selector)
-        return unless ng_xml
-        type = selector.keys.first.to_sym
-        actor = selector.values.first
-        xpath = self.class.terminology.xpath_for(:access, type, actor)
-        nodes_to_purge = self.find_by_terms(xpath)
-        nodes_to_purge.each {|node| node.remove}
-      end
-      
-    end
-  end
-end

data/app/models/hydra/role_mapper_behavior.rb

@@ -1,33 +0,0 @@
-# this code will be moved/renamed to Hydra::AccessControl::RoleMapperBehavior (with the appropriate namespace changes) in Hydra 5.0
-require 'yaml'
-module Hydra::RoleMapperBehavior
-  extend ActiveSupport::Concern
-
-  module ClassMethods
-    def role_names
-      map.keys
-    end
-    def roles(username)
-      byname[username]||[]
-    end
-    
-    def whois(r)
-      map[r]||[]
-    end
-
-    def map
-      @map ||= YAML.load(File.open(File.join(Rails.root, "config/role_map_#{Rails.env}.yml")))
-    end
-
-
-    def byname
-      return @byname if @byname
-      m = Hash.new{|h,k| h[k]=[]}
-      @byname = map.inject(m) do|memo, (role,usernames)| 
-        ((usernames if usernames.respond_to?(:each)) || [usernames]).each { |x| memo[x]<<role}
-        memo
-      end
-    end
-  end
-end
-

data/app/models/role_mapper.rb

@@ -1,6 +0,0 @@
-# RoleMapper This is used by AccessControlsEnforcement to get users' Roles (used in access permissions)
-# If you are using something like Shibboleth or LDAP to get users' Roles, you should override this Class.  
-# Your override should include a Module that implements the same behaviors as Hydra::RoleMapperBehavior 
-class RoleMapper
-  include Hydra::RoleMapperBehavior
-end

data/lib/hydra/access_controls_enforcement.rb

@@ -1,237 +0,0 @@
-# will move to lib/hydra/access_control folder/namespace in release 5.x
-module Hydra::AccessControlsEnforcement
-  
-  def self.included(klass)
-    klass.send(:include, Hydra::AccessControlsEvaluation)
-  end
-  
-  #
-  #   Access Controls Enforcement Filters
-  #
-  
-  # Controller "before" filter that delegates enforcement based on the controller action
-  # Action-specific implementations are enforce_index_permissions, enforce_show_permissions, etc.
-  # @param [Hash] opts (optional, not currently used)
-  #
-  # @example
-  #   class CatalogController < ApplicationController  
-  #     before_filter :enforce_access_controls
-  #   end
-  def enforce_access_controls(opts={})
-    controller_action = params[:action].to_s
-    controller_action = "edit" if params[:action] == "destroy" 
-    delegate_method = "enforce_#{controller_action}_permissions"
-    if self.respond_to?(delegate_method.to_sym, true)
-      self.send(delegate_method.to_sym)
-    else
-      true
-    end
-  end
-  
-  
-  #
-  #  Solr integration
-  #
-  
-  # returns a params hash with the permissions info for a single solr document 
-  # If the id arg is nil, then the value is fetched from params[:id]
-  # This method is primary called by the get_permissions_solr_response_for_doc_id method.
-  # Modeled on Blacklight::SolrHelper.solr_doc_params
-  # @param [String] id of the documetn to retrieve
-  def permissions_solr_doc_params(id=nil)
-    id ||= params[:id]
-    # just to be consistent with the other solr param methods:
-    {
-      :qt => :permissions,
-      :id => id # this assumes the document request handler will map the 'id' param to the unique key field
-    }
-  end
-  
-  # a solr query method
-  # retrieve a solr document, given the doc id
-  # Modeled on Blacklight::SolrHelper.get_permissions_solr_response_for_doc_id
-  # @param [String] id of the documetn to retrieve
-  # @param [Hash] extra_controller_params (optional)
-  def get_permissions_solr_response_for_doc_id(id=nil, extra_controller_params={})
-    raise Blacklight::Exceptions::InvalidSolrID.new("The application is trying to retrieve permissions without specifying an asset id") if id.nil?
-    solr_response = Blacklight.solr.find permissions_solr_doc_params(id).merge(extra_controller_params)
-    raise Blacklight::Exceptions::InvalidSolrID.new("The solr permissions search handler didn't return anything for id \"#{id}\"") if solr_response.docs.empty?
-    document = SolrDocument.new(solr_response.docs.first, solr_response)
-    [solr_response, document]
-  end
-  
-  # Loads permissions info into @permissions_solr_response and @permissions_solr_document
-  def load_permissions_from_solr(id=params[:id], extra_controller_params={})
-    unless !@permissions_solr_document.nil? && !@permissions_solr_response.nil?
-      @permissions_solr_response, @permissions_solr_document = get_permissions_solr_response_for_doc_id(id, extra_controller_params)
-    end
-  end
-  
-  private
-
-  # If someone hits the show action while their session's viewing_context is in edit mode, 
-  # this will redirect them to the edit action.
-  # If they do not have sufficient privileges to edit documents, it will silently switch their session to browse mode.
-  def enforce_viewing_context_for_show_requests
-    if params[:viewing_context] == "browse"
-      session[:viewing_context] = params[:viewing_context]
-    elsif session[:viewing_context] == "edit"
-      if can? :edit, params[:id]
-        logger.debug("enforce_viewing_context_for_show_requests redirecting to edit")
-        if params[:files]
-          redirect_to :action=>:edit, :files=>true
-        else
-          redirect_to :action=>:edit
-        end
-      else
-        session[:viewing_context] = "browse"
-      end
-    end
-  end
-  
-  #
-  # Action-specific enforcement
-  #
-  
-  # Controller "before" filter for enforcing access controls on show actions
-  # @param [Hash] opts (optional, not currently used)
-  def enforce_show_permissions(opts={})
-    load_permissions_from_solr
-    unless @permissions_solr_document['access_t'] && (@permissions_solr_document['access_t'].first == "public" || @permissions_solr_document['access_t'].first == "Public")
-      if @permissions_solr_document["embargo_release_date_dt"] 
-        embargo_date = Date.parse(@permissions_solr_document["embargo_release_date_dt"].split(/T/)[0])
-        if embargo_date > Date.parse(Time.now.to_s)
-          ### Assuming we're using devise and have only one authentication key
-          unless current_user && can?(:edit, params[:id])
-            flash[:alert] = "This item is under embargo.  You do not have sufficient access privileges to read this document."
-            redirect_to(:action=>'index', :q=>nil, :f=>nil) and return false
-          end
-        end
-      end
-      unless can? :read, params[:id] 
-        flash[:alert]= "You do not have sufficient access privileges to read this document, which has been marked private."
-        redirect_to(:action => 'index', :q => nil , :f => nil) and return false
-      end
-    end
-  end
-  
-  # Controller "before" filter for enforcing access controls on edit actions
-  # @param [Hash] opts (optional, not currently used)
-  def enforce_edit_permissions(opts={})
-    logger.debug("Enforcing edit permissions")
-    load_permissions_from_solr
-    if !can? :edit, params[:id]
-      session[:viewing_context] = "browse"
-      flash[:notice] = "You do not have sufficient privileges to edit this document. You have been redirected to the read-only view."
-      redirect_to :action=>:show
-    else
-      session[:viewing_context] = "edit"
-    end
-  end
-
-  ## proxies to enforce_edit_permssions.  This method is here for you to override
-  def enforce_update_permissions(opts={})
-    enforce_edit_permissions(opts)
-  end
-
-  ## proxies to enforce_edit_permssions.  This method is here for you to override
-  def enforce_delete_permissions(opts={})
-    enforce_edit_permissions(opts)
-  end
-
-  # Controller "before" filter for enforcing access controls on index actions
-  # Currently does nothing, instead relies on 
-  # @param [Hash] opts (optional, not currently used)
-  def enforce_index_permissions(opts={})
-    # Do nothing. Relies on enforce_search_permissions being included in the Controller's solr_search_params_logic
-    return true
-  end
-  
-  #
-  # Solr query modifications
-  #
-  
-  # Set solr_parameters to enforce appropriate permissions 
-  # * Applies a lucene query to the solr :q parameter for gated discovery
-  # * Uses public_qt search handler if user does not have "read" permissions
-  # @param solr_parameters the current solr parameters
-  # @param user_parameters the current user-subitted parameters
-  #
-  # @example This method should be added to your Catalog Controller's solr_search_params_logic
-  #   class CatalogController < ApplicationController 
-  #     include Hydra::Catalog
-  #     CatalogController.solr_search_params_logic << :add_access_controls_to_solr_params
-  #   end
-  def add_access_controls_to_solr_params(solr_parameters, user_parameters)
-    apply_gated_discovery(solr_parameters, user_parameters)
-  end
-
-  
-  # Which permission levels (logical OR) will grant you the ability to discover documents in a search.
-  # Override this method if you want it to be something other than the default
-  def discovery_permissions
-    ["edit","discover","read"]
-  end
-
-  # Contrller before filter that sets up access-controlled lucene query in order to provide gated discovery behavior
-  # @param solr_parameters the current solr parameters
-  # @param user_parameters the current user-subitted parameters
-  def apply_gated_discovery(solr_parameters, user_parameters)
-    solr_parameters[:fq] ||= []
-    # Grant access to public content
-    permission_types = discovery_permissions
-    user_access_filters = []
-    
-    permission_types.each do |type|
-      user_access_filters << "#{type}_access_group_t:public"
-    end
-    
-    # Grant access based on user id & role
-    unless current_user.nil?
-      # for roles
-      ::RoleMapper.roles(user_key).each_with_index do |role, i|
-        permission_types.each do |type|
-          user_access_filters << "#{type}_access_group_t:#{role}"
-        end
-      end
-      # for individual person access
-      permission_types.each do |type|
-        user_access_filters << "#{type}_access_person_t:#{user_key}"        
-      end
-      if Deprecation.silence(Hydra::SuperuserAttributes) { current_user.is_being_superuser?(session) }
-        permission_types.each do |type|
-          user_access_filters << "#{type}_access_person_t:[* TO *]"        
-        end
-      end
-      
-      # Enforcing Embargo at Query time has been disabled.  
-      # If you want to do this, set up your own solr_search_params before_filter that injects the appropriate :fq constraints for a field that expresses your objects' embargo status.
-      #
-      # include docs in results if the embargo date is NOT in the future OR if the current user is depositor
-      # embargo_query = "(NOT embargo_release_date_dt:[NOW TO *]) OR depositor_t:#{user_key}"
-      # embargo_query = "(NOT embargo_release_date_dt:[NOW TO *]) OR (embargo_release_date_dt:[NOW TO *] AND  depositor_t:#{user_key}) AND NOT (NOT depositor_t:#{user_key} AND embargo_release_date_dt:[NOW TO *])"
-      # solr_parameters[:fq] << embargo_query         
-    end
-    solr_parameters[:fq] << user_access_filters.join(" OR ")
-    logger.debug("Solr parameters: #{ solr_parameters.inspect }")
-  end
-  
-  
-  # proxy for {enforce_index_permissions}
-  def enforce_search_permissions
-    enforce_index_permissions
-  end
-
-  # proxy for {enforce_show_permissions}
-  def enforce_read_permissions
-    enforce_show_permissions
-  end
-  
-  # This filters out objects that you want to exclude from search results.  By default it only excludes FileAssets
-  # @param solr_parameters the current solr parameters
-  # @param user_parameters the current user-subitted parameters
-  def exclude_unwanted_models(solr_parameters, user_parameters)
-    solr_parameters[:fq] ||= []
-    solr_parameters[:fq] << "-has_model_s:\"info:fedora/afmodel:FileAsset\""
-  end
-end