hyrax 1.1.1 → 2.0.0.beta1

data/app/controllers/hyrax/admin/appearances_controller.rb

@@ -0,0 +1,33 @@
+module Hyrax
+  module Admin
+    class AppearancesController < ApplicationController
+      before_action :require_permissions
+      layout 'dashboard'
+      class_attribute :form_class
+      self.form_class = Hyrax::Forms::Admin::Appearance
+
+      def show
+        add_breadcrumb t(:'hyrax.controls.home'), root_path
+        add_breadcrumb t(:'hyrax.dashboard.breadcrumbs.admin'), hyrax.dashboard_path
+        add_breadcrumb t(:'hyrax.admin.sidebar.configuration'), '#'
+        add_breadcrumb t(:'hyrax.admin.sidebar.appearance'), request.path
+        @form = form_class.new
+      end
+
+      def update
+        form_class.new(update_params).update!
+        redirect_to({ action: :show }, notice: t('.flash.success'))
+      end
+
+      private
+
+        def update_params
+          params.require(:admin_appearance).permit(form_class.permitted_params)
+        end
+
+        def require_permissions
+          authorize! :update, :appearance
+        end
+    end
+  end
+end

data/app/controllers/hyrax/admin/features_controller.rb

@@ -1,7 +1,7 @@
 module Hyrax
   module Admin
     class FeaturesController < Flipflop::FeaturesController
-      layout 'admin'
+      layout 'dashboard'
 
       before_action do
         authorize! :manage, Hyrax::Feature
@@ -9,8 +9,9 @@ module Hyrax
 
       def index
         add_breadcrumb t(:'hyrax.controls.home'), root_path
-        add_breadcrumb t(:'hyrax.toolbar.admin.menu'), hyrax.admin_path
-        add_breadcrumb t(:'hyrax.admin.sidebar.settings'), hyrax.admin_features_path
+        add_breadcrumb t(:'hyrax.dashboard.breadcrumbs.admin'), hyrax.dashboard_path
+        add_breadcrumb t(:'hyrax.admin.sidebar.configuration'), '#'
+        add_breadcrumb t(:'hyrax.admin.sidebar.technical'), hyrax.admin_features_path
         super
       end
     end

data/app/controllers/hyrax/admin/permission_template_accesses_controller.rb

@@ -4,12 +4,21 @@ module Hyrax
       load_and_authorize_resource class: 'Hyrax::PermissionTemplateAccess'
 
       def destroy
-        @permission_template_access.destroy
-        update_admin_set if @permission_template_access.manage?
+        ActiveRecord::Base.transaction do
+          @permission_template_access.destroy
+          update_management if @permission_template_access.manage?
+        end
+
+        if @permission_template_access.destroyed?
+          redirect_to hyrax.edit_admin_admin_set_path(admin_set_id,
+                                                      anchor: 'participants'),
+                      notice: translate('participants', scope: 'hyrax.admin.admin_sets.form.permission_update_notices')
+        else
+          redirect_to hyrax.edit_admin_admin_set_path(admin_set_id,
+                                                      anchor: 'participants'),
+                      alert: @permission_template_access.errors.full_messages.to_sentence
 
-        redirect_to hyrax.edit_admin_admin_set_path(admin_set_id,
-                                                    anchor: 'participants'),
-                    notice: translate('participants', scope: 'hyrax.admin.admin_sets.form.permission_update_notices')
+        end
       end
 
       private
@@ -19,8 +28,8 @@ module Hyrax
           @admin_set_id ||= @permission_template_access.permission_template.admin_set_id
         end
 
-        def update_admin_set
-          AdminSet.find(admin_set_id).update_access_controls!
+        def update_management
+          Forms::PermissionTemplateForm.new(@permission_template_access.permission_template).update_management
         end
     end
   end

data/app/controllers/hyrax/admin/users_controller.rb

@@ -1,5 +1,5 @@
 module Hyrax
-  class Admin::UsersController < AdminController
+  class Admin::UsersController < ApplicationController
     include Hyrax::Admin::UsersControllerBehavior
   end
 end

data/app/controllers/hyrax/admin/workflow_roles_controller.rb

@@ -2,11 +2,11 @@ module Hyrax
   module Admin
     class WorkflowRolesController < ApplicationController
       before_action :require_permissions
-      layout 'admin'
+      layout 'dashboard'
 
       def index
         add_breadcrumb t(:'hyrax.controls.home'), root_path
-        add_breadcrumb t(:'hyrax.toolbar.admin.menu'), hyrax.admin_path
+        add_breadcrumb t(:'hyrax.dashboard.breadcrumbs.admin'), hyrax.dashboard_path
         add_breadcrumb t(:'hyrax.admin.workflow_roles.header'), hyrax.admin_workflow_roles_path
         @presenter = WorkflowRolesPresenter.new
       end

data/app/controllers/hyrax/admin/workflows_controller.rb

@@ -1,12 +1,17 @@
 module Hyrax
   # Presents a list of works in workflow
   class Admin::WorkflowsController < ApplicationController
-    before_action :ensure_admin!
-    layout 'admin'
+    before_action :ensure_authorized!
+    layout 'dashboard'
+    class_attribute :deposited_workflow_state_name
+
+    # Works that are in this workflow state (see workflow json template) are excluded from the
+    # status list and display in the "Published" tab
+    self.deposited_workflow_state_name = 'deposited'
 
     def index
       add_breadcrumb t(:'hyrax.controls.home'), root_path
-      add_breadcrumb t(:'hyrax.toolbar.admin.menu'), hyrax.admin_path
+      add_breadcrumb t(:'hyrax.dashboard.breadcrumbs.admin'), hyrax.dashboard_path
       add_breadcrumb t(:'hyrax.admin.sidebar.tasks'), '#'
       add_breadcrumb t(:'hyrax.admin.sidebar.workflow_review'), request.path
       @status_list = Hyrax::Workflow::StatusListService.new(self, "-workflow_state_name_ssim:#{deposited_workflow_state_name}")
@@ -15,14 +20,8 @@ module Hyrax
 
     private
 
-      def ensure_admin!
-        # Even though the user can view this admin set, they may not be able to view
-        # it on the admin page.
-        authorize! :read, :admin_dashboard
-      end
-
-      def deposited_workflow_state_name
-        'deposited'
+      def ensure_authorized!
+        authorize! :review, :submissions
       end
   end
 end

data/app/controllers/hyrax/api/zotero_controller.rb

@@ -24,9 +24,9 @@ module Hyrax
         current_user.zotero_userid = access_token.params[:userID]
         current_user.save
         Hyrax::Arkivo::CreateSubscriptionJob.perform_later(current_user)
-        redirect_to hyrax.profile_path(current_user), notice: 'Successfully connected to Zotero!'
+        redirect_to hyrax.dashboard_profile_path(current_user), notice: 'Successfully connected to Zotero!'
       rescue OAuth::Unauthorized
-        redirect_to hyrax.edit_profile_path(current_user.to_param), alert: 'Please re-authenticate with Zotero'
+        redirect_to hyrax.edit_dashboard_profile_path(current_user.to_param), alert: 'Please re-authenticate with Zotero'
       ensure
         current_user.zotero_token = nil
         current_user.save
@@ -42,10 +42,10 @@ module Hyrax
 
         def validate_params
           if malformed_request?
-            redirect_to hyrax.edit_profile_path(current_user.to_param),
+            redirect_to hyrax.edit_dashboard_profile_path(current_user.to_param),
                         alert: "Malformed request from Zotero"
           elsif invalid_token?
-            redirect_to hyrax.edit_profile_path(current_user.to_param),
+            redirect_to hyrax.edit_dashboard_profile_path(current_user.to_param),
                         alert: "You have not yet connected to Zotero"
           end
         end

data/app/controllers/hyrax/batch_edits_controller.rb

@@ -1,7 +1,104 @@
 module Hyrax
   class BatchEditsController < ApplicationController
-    include Hydra::BatchEditBehavior
     include FileSetHelper
-    include BatchEditsControllerBehavior
+    include Hyrax::Breadcrumbs
+    include Hyrax::Collections::AcceptsBatches
+
+    before_action :build_breadcrumbs, only: :edit
+    before_action :filter_docs_with_access!, only: [:edit, :update, :destroy_collection]
+    before_action :check_for_empty!, only: [:edit, :update, :destroy_collection]
+
+    # provides the help_text view method
+    helper PermissionsHelper
+
+    def edit
+      work = form_class.model_class.new
+      work.depositor = current_user.user_key
+      @form = form_class.new(work, current_user, batch)
+    end
+
+    def after_update
+      respond_to do |format|
+        format.json { head :no_content }
+        format.html { redirect_to_return_controller }
+      end
+    end
+
+    def after_destroy_collection
+      redirect_to_return_controller unless request.xhr?
+    end
+
+    def check_for_empty!
+      return unless check_for_empty_batch?
+      redirect_back fallback_location: hyrax.batch_edits_path
+      false
+    end
+
+    def destroy_collection
+      batch.each do |doc_id|
+        obj = ActiveFedora::Base.find(doc_id, cast: true)
+        obj.destroy
+      end
+      flash[:notice] = "Batch delete complete"
+      after_destroy_collection
+    end
+
+    def update_document(obj)
+      obj.attributes = work_params
+      obj.date_modified = Time.current.ctime
+      obj.visibility = params[:visibility]
+      obj.save
+    end
+
+    def update
+      case params["update_type"]
+      when "update"
+        batch.each do |doc_id|
+          update_document(ActiveFedora::Base.find(doc_id))
+        end
+        flash[:notice] = "Batch update complete"
+        after_update
+      when "delete_all"
+        destroy_batch
+      end
+    end
+
+    private
+
+      def add_breadcrumb_for_controller
+        add_breadcrumb I18n.t('hyrax.dashboard.my.works'), hyrax.my_works_path
+      end
+
+      def _prefixes
+        # This allows us to use the templates in hyrax/base, while prefering
+        # our local paths. Thus we are unable to just override `self.local_prefixes`
+        @_prefixes ||= super + ['hyrax/base']
+      end
+
+      def destroy_batch
+        batch.each { |id| ActiveFedora::Base.find(id).destroy }
+        after_update
+      end
+
+      def form_class
+        Forms::BatchEditForm
+      end
+
+      def terms
+        form_class.terms
+      end
+
+      def work_params
+        work_params = params[form_class.model_name.param_key] || ActionController::Parameters.new
+        form_class.model_attributes(work_params)
+      end
+
+      def redirect_to_return_controller
+        if params[:return_controller]
+          redirect_to hyrax.url_for(controller: params[:return_controller], only_path: true)
+        else
+          redirect_to hyrax.dashboard_path
+        end
+      end
   end
 end

data/app/controllers/hyrax/batch_uploads_controller.rb

@@ -1,3 +1,93 @@
-class Hyrax::BatchUploadsController < ApplicationController
-  include Hyrax::BatchUploadsControllerBehavior
+module Hyrax
+  class BatchUploadsController < ApplicationController
+    include Hydra::Controller::ControllerBehavior
+    include Hyrax::WorksControllerBehavior
+
+    # Gives the class of the form.
+    class BatchUploadFormService < Hyrax::WorkFormService
+      def self.form_class(_ = nil)
+        ::Hyrax::Forms::BatchUploadForm
+      end
+    end
+
+    self.work_form_service = BatchUploadFormService
+    self.curation_concern_type = work_form_service.form_class.model_class # includes CanCan side-effects
+    # We use BatchUploadItem as a null stand-in curation_concern_type.
+    # The actual permission is checked dynamically during #create.
+
+    layout 'dashboard'
+
+    # The permissions to create a batch are not as important as the permissions for the concern being batched.
+    # @note we don't call `authorize!` directly, since `authorized_models` already checks `user.can? :create, ...`
+    def create
+      authenticate_user!
+      if Flipflop.batch_upload?
+        handle_payload_concern!
+        redirect_after_update!
+      else
+        respond_with_batch_upload_disabled
+      end
+    end
+
+    private
+
+      def respond_with_batch_upload_disabled
+        respond_to do |wants|
+          wants.json do
+            return render_json_response(response_type: :forbidden, message: view_context.t('hyrax.batch_uploads.disabled'))
+          end
+          wants.html do
+            return redirect_to hyrax.my_works_path, alert: view_context.t('hyrax.batch_uploads.disabled')
+          end
+        end
+      end
+
+      def build_form
+        super
+        @form.payload_concern = params[:payload_concern]
+      end
+
+      def handle_payload_concern!
+        unsafe_pc = params.fetch(:batch_upload_item, {})[:payload_concern]
+        # Calling constantize on user params is disfavored (per brakeman), so we sanitize by matching it against an authorized model.
+        safe_pc = Hyrax::SelectTypeListPresenter.new(current_user).authorized_models.map(&:to_s).find { |x| x == unsafe_pc }
+        raise CanCan::AccessDenied, "Cannot create an object of class '#{unsafe_pc}'" unless safe_pc
+        # authorize! :create, safe_pc
+        create_update_job(safe_pc)
+      end
+
+      def redirect_after_update!
+        # Calling `#t` in a controller context does not mark _html keys as html_safe
+        flash[:notice] = view_context.t('hyrax.works.create.after_create_html', application_name: view_context.application_name)
+        if uploading_on_behalf_of?
+          redirect_to hyrax.dashboard_shares_path
+        else
+          redirect_to hyrax.my_works_path
+        end
+      end
+
+      # @param [String] klass the name of the Hyrax Work Class being created by the batch
+      # @note Cannot use a proper Class here because it won't serialize
+      def create_update_job(klass)
+        operation = BatchCreateOperation.create!(user: current_user,
+                                                 operation_type: "Batch Create")
+        # ActionController::Parameters are not serializable, so cast to a hash
+        BatchCreateJob.perform_later(current_user,
+                                     params[:title].permit!.to_h,
+                                     params.fetch(:resource_type, {}).permit!.to_h,
+                                     params[:uploaded_files],
+                                     attributes_for_actor.to_h.merge!(model: klass),
+                                     operation)
+      end
+
+      def uploading_on_behalf_of?
+        params.fetch(hash_key_for_curation_concern).key?(:on_behalf_of)
+      end
+
+      def attributes_for_actor
+        raw_params = params[hash_key_for_curation_concern]
+        return {} unless raw_params
+        work_form_service.form_class(curation_concern).model_attributes(raw_params)
+      end
+  end
 end

data/app/controllers/hyrax/citations_controller.rb

@@ -1,6 +1,6 @@
 module Hyrax
   class CitationsController < ApplicationController
-    include CurationConcernController
+    include WorksControllerBehavior
     include Breadcrumbs
     include SingularSubresourceController
 
@@ -11,7 +11,7 @@ module Hyrax
     end
 
     def file
-      # We set _@presenter_ here so it isn't set in CurationConcernController#presenter
+      # We set _@presenter_ here so it isn't set in WorksControllerBehavior#presenter
       # which is intended to find works (not files)
       solr_file = ::SolrDocument.find(params[:id])
       authorize! :show, solr_file

data/app/controllers/hyrax/collections_controller.rb

@@ -2,5 +2,31 @@ module Hyrax
   class CollectionsController < ApplicationController
     include CollectionsControllerBehavior
     include BreadcrumbsForCollections
+    layout :decide_layout
+    load_and_authorize_resource except: [:index, :show, :create], instance_name: :collection
+
+    # Renders a JSON response with a list of files in this collection
+    # This is used by the edit form to populate the thumbnail_id dropdown
+    def files
+      result = form.select_files.map do |label, id|
+        { id: id, text: label }
+      end
+      render json: result
+    end
+
+    private
+
+      def form
+        @form ||= form_class.new(@collection, current_ability, repository)
+      end
+
+      def decide_layout
+        case action_name
+        when 'show'
+          theme
+        else
+          'dashboard'
+        end
+      end
   end
 end

data/app/controllers/hyrax/contact_form_controller.rb

@@ -1,5 +1,46 @@
 module Hyrax
   class ContactFormController < ApplicationController
-    include ContactFormControllerBehavior
+    before_action :build_contact_form
+    layout 'homepage'
+
+    def new; end
+
+    def create
+      # not spam and a valid form
+      if @contact_form.valid?
+        ContactMailer.contact(@contact_form).deliver_now
+        flash.now[:notice] = 'Thank you for your message!'
+        after_deliver
+        @contact_form = ContactForm.new
+      else
+        flash.now[:error] = 'Sorry, this message was not sent successfully. '
+        flash.now[:error] << @contact_form.errors.full_messages.map(&:to_s).join(", ")
+      end
+      render :new
+    rescue RuntimeError => exception
+      handle_create_exception(exception)
+    end
+
+    def handle_create_exception(exception)
+      logger.error("Contact form failed to send: #{exception.inspect}")
+      flash.now[:error] = 'Sorry, this message was not delivered.'
+      render :new
+    end
+
+    # Override this method if you want to perform additional operations
+    # when a email is successfully sent, such as sending a confirmation
+    # response to the user.
+    def after_deliver; end
+
+    private
+
+      def build_contact_form
+        @contact_form = Hyrax::ContactForm.new(contact_form_params)
+      end
+
+      def contact_form_params
+        return {} unless params.key?(:contact_form)
+        params.require(:contact_form).permit(:contact_method, :category, :name, :email, :subject, :message)
+      end
   end
 end