hyrax 2.0.3 → 2.1.0.beta1

data/app/services/hyrax/collection_types/permissions_service.rb

@@ -0,0 +1,233 @@
+module Hyrax
+  module CollectionTypes
+    class PermissionsService
+      # @api public
+      #
+      # Ids of collection types that a user can create or manage
+      #
+      # @param roles [String] type of access, Hyrax::CollectionTypeParticipant::MANAGE_ACCESS and/or Hyrax::CollectionTypeParticipant::CREATE_ACCESS
+      # @param user [User] user (required if ability is nil)
+      # @param ability [Ability] the ability coming from cancan ability check (default: nil) (required if user is nil)
+      # @return [Array<String>] ids for collection types for which a user has the specified role
+      # @note Several checks get the user's groups from the user's ability.  The same values can be retrieved directly from a passed in ability.
+      #   If calling from Abilities, pass the ability.  If you try to get the ability from the user, you end up in an infinit loop.
+      def self.collection_type_ids_for_user(roles:, user: nil, ability: nil)
+        return false unless user.present? || ability.present?
+        return Hyrax::CollectionType.all.pluck('DISTINCT id') if user_admin?(user, ability)
+        Hyrax::CollectionTypeParticipant.where(agent_type: Hyrax::CollectionTypeParticipant::USER_TYPE,
+                                               agent_id: user_id(user, ability),
+                                               access: roles)
+                                        .or(
+                                          Hyrax::CollectionTypeParticipant.where(agent_type: Hyrax::CollectionTypeParticipant::GROUP_TYPE,
+                                                                                 agent_id: user_groups(user, ability),
+                                                                                 access: roles)
+                                        ).pluck('DISTINCT hyrax_collection_type_id')
+      end
+
+      # @api public
+      #
+      # Instances of collection types that a user can create or manage
+      #
+      # @param roles [String] type of access, Hyrax::CollectionTypeParticipant::MANAGE_ACCESS and/or Hyrax::CollectionTypeParticipant::CREATE_ACCESS
+      # @param user [User] user (required if ability is nil)
+      # @param ability [Ability] the ability coming from cancan ability check (default: nil) (required if user is nil)
+      # @return [Array<Hyrax::CollectionType>] instances of collection types for which a user has the specified role
+      # @note Several checks get the user's groups from the user's ability.  The same values can be retrieved directly from a passed in ability.
+      #   If calling from Abilities, pass the ability.  If you try to get the ability from the user, you end up in an infinit loop.
+      def self.collection_types_for_user(roles:, user: nil, ability: nil)
+        return false unless user.present? || ability.present?
+        return Hyrax::CollectionType.all if user_admin?(user, ability)
+        Hyrax::CollectionType.where(id: collection_type_ids_for_user(user: user, roles: roles, ability: ability))
+      end
+
+      # @api public
+      #
+      # Is the user a creator for any collection types?
+      #
+      # @param user [User] user (required if ability is nil)
+      # @param ability [Ability] the ability coming from cancan ability check (default: nil) (required if user is nil)
+      # @return [Boolean] true if the user has permission to create collections of at least one collection type
+      # @note Several checks get the user's groups from the user's ability.  The same values can be retrieved directly from a passed in ability.
+      #   If calling from Abilities, pass the ability.  If you try to get the ability from the user, you end up in an infinit loop.
+      def self.can_create_any_collection_type?(user: nil, ability: nil)
+        return false unless user.present? || ability.present?
+        return true if user_admin?(user, ability)
+        # both manage and create access can create collections of a type, so no need to include access in the query
+        return true if Hyrax::CollectionTypeParticipant.where(agent_type: Hyrax::CollectionTypeParticipant::USER_TYPE,
+                                                              agent_id: user_id(user, ability)).any?
+        return true if Hyrax::CollectionTypeParticipant.where(agent_type: Hyrax::CollectionTypeParticipant::GROUP_TYPE,
+                                                              agent_id: user_groups(user, ability)).any?
+        false
+      end
+
+      # @api public
+      #
+      # Is the user a creator for admin sets collection types?
+      #
+      # @param user [User] user (required if ability is nil)
+      # @param ability [Ability] the ability coming from cancan ability check (default: nil) (required if user is nil)
+      # @return [Boolean] true if the user has permission to create collections of type admin_set
+      # @note Several checks get the user's groups from the user's ability.  The same values can be retrieved directly from a passed in ability.
+      #   If calling from Abilities, pass the ability.  If you try to get the ability from the user, you end up in an infinit loop.
+      def self.can_create_admin_set_collection_type?(user: nil, ability: nil)
+        return false unless user.present? || ability.present?
+        return true if user_admin?(user, ability)
+        # both manage and create access can create collections of a type, so no need to include access in the query
+        return true if Hyrax::CollectionTypeParticipant.joins(:hyrax_collection_type)
+                                                       .where(agent_type: Hyrax::CollectionTypeParticipant::USER_TYPE,
+                                                              agent_id: user_id(user, ability),
+                                                              hyrax_collection_types: { machine_id: Hyrax::CollectionType::ADMIN_SET_MACHINE_ID }).present?
+        return true if Hyrax::CollectionTypeParticipant.joins(:hyrax_collection_type)
+                                                       .where(agent_type: Hyrax::CollectionTypeParticipant::GROUP_TYPE,
+                                                              agent_id: user_groups(user, ability),
+                                                              hyrax_collection_types: { machine_id: Hyrax::CollectionType::ADMIN_SET_MACHINE_ID }).present?
+        false
+      end
+
+      # @api public
+      #
+      # Get a list of collection types that a user can create
+      #
+      # @param user [User] user (required if ability is nil)
+      # @param ability [Ability] the ability coming from cancan ability check (default: nil) (required if user is nil)
+      # @return [Array<Hyrax::CollectionType>] array of collection types the user can create
+      # @note Several checks get the user's groups from the user's ability.  The same values can be retrieved directly from a passed in ability.
+      #   If calling from Abilities, pass the ability.  If you try to get the ability from the user, you end up in an infinit loop.
+      def self.can_create_collection_types(user: nil, ability: nil)
+        collection_types_for_user(user: user, ability: ability, roles: [Hyrax::CollectionTypeParticipant::MANAGE_ACCESS, Hyrax::CollectionTypeParticipant::CREATE_ACCESS])
+      end
+
+      # @api public
+      #
+      # Get a list of collection types that a user can create
+      #
+      # @param collection_type [Hyrax::CollectionType] the type of the collection being created
+      # @param user [User] user (required if ability is nil)
+      # @param ability [Ability] the ability coming from cancan ability check (default: nil) (required if user is nil)
+      # @return [Boolean] true if the user has permission to create collections of specified type
+      # @note Several checks get the user's groups from the user's ability.  The same values can be retrieved directly from a passed in ability.
+      #   If calling from Abilities, pass the ability.  If you try to get the ability from the user, you end up in an infinit loop.
+      def self.can_create_collection_of_type?(collection_type:, user: nil, ability: nil)
+        manage_access_for_collection_type?(user: user, ability: ability, collection_type: collection_type) ||
+          create_access_for_collection_type?(user: user, ability: ability, collection_type: collection_type)
+      end
+
+      # @api private
+      #
+      # Determine if the given user has :manage access for the given collection type
+      #
+      # @param collection_type [Hyrax::CollectionType] the collection type we are checking permissions on
+      # @param user [User] user (required if ability is nil)
+      # @param ability [Ability] the ability coming from cancan ability check (default: nil) (required if user is nil)
+      # @return [Boolean] true if the user has permission to manage collections of the specified collection type
+      # @note Several checks get the user's groups from the user's ability.  The same values can be retrieved directly from a passed in ability.
+      #   If calling from Abilities, pass the ability.  If you try to get the ability from the user, you end up in an infinit loop.
+      def self.manage_access_for_collection_type?(collection_type:, user: nil, ability: nil)
+        access_to_collection_type?(user: user, ability: ability, collection_type: collection_type, access: 'manage')
+      end
+      private_class_method :manage_access_for_collection_type?
+
+      # @api private
+      #
+      # Determine if the given user has :create access for the given collection type
+      #
+      # @param collection_type [Hyrax::CollectionType] the collection type we are checking permissions on
+      # @param user [User] user (required if ability is nil)
+      # @param ability [Ability] the ability coming from cancan ability check (default: nil) (required if user is nil)
+      # @return [Boolean] true if the user has permission to create collections of the specified collection type
+      # @note Several checks get the user's groups from the user's ability.  The same values can be retrieved directly from a passed in ability.
+      #   If calling from Abilities, pass the ability.  If you try to get the ability from the user, you end up in an infinit loop.
+      def self.create_access_for_collection_type?(collection_type:, user: nil, ability: nil)
+        access_to_collection_type?(user: user, ability: ability, collection_type: collection_type, access: 'create')
+      end
+      private_class_method :create_access_for_collection_type?
+
+      # @api private
+      #
+      # Determine if the given user has specified access for the given collection type
+      #
+      # @param collection_type [Hyrax::CollectionType] the collection type we are checking permissions on
+      # @param access [Symbol] the access level to check
+      # @param user [User] user (required if ability is nil)
+      # @param ability [Ability] the ability coming from cancan ability check (default: nil) (required if user is nil)
+      # @return [Boolean] true if the user has permission to create collections of the specified collection type
+      # @note Several checks get the user's groups from the user's ability.  The same values can be retrieved directly from a passed in ability.
+      #   If calling from Abilities, pass the ability.  If you try to get the ability from the user, you end up in an infinit loop.
+      def self.access_to_collection_type?(collection_type:, access:, user: nil, ability: nil) # rubocop:disable Metrics/CyclomaticComplexity
+        return false unless user.present? || ability.present?
+        return false unless user && collection_type
+        return true if ([user_id(user, ability)] & agent_ids_for(collection_type: collection_type, agent_type: 'user', access: access)).present?
+        return true if (user_groups(user, ability) & agent_ids_for(collection_type: collection_type, agent_type: 'group', access: access)).present?
+        false
+      end
+      private_class_method :access_to_collection_type?
+
+      # @api public
+      #
+      # What types of collection can the user create or manage
+      #
+      # @param user [User] user - The user requesting to create/manage a Collection
+      # @param roles [String] type of access, Hyrax::CollectionTypeParticipant::MANAGE_ACCESS and/or Hyrax::CollectionTypeParticipant::CREATE_ACCESS
+      # @return [Array<Hyrax::CollectionType>]
+      # @note Several checks get the user's groups from the user's ability.  The same values can be retrieved directly from a passed in ability.
+      #   If calling from Abilities, pass the ability.  If you try to get the ability from the user, you end up in an infinit loop.
+      def self.agent_ids_for(collection_type:, agent_type:, access:)
+        Hyrax::CollectionTypeParticipant.where(hyrax_collection_type_id: collection_type.id,
+                                               agent_type: agent_type,
+                                               access: access).pluck('DISTINCT agent_id')
+      end
+      private_class_method :agent_ids_for
+
+      # @api public
+      #
+      # Get a list of users who should be added as user editors for a new collection of the specified collection type
+      #
+      # @param collection_type [Hyrax::CollectionType] the type of the collection being created
+      # @return [Array<String>] array of user identifiers (typically emails) for users who can edit collections of this type
+      # @note Several checks get the user's groups from the user's ability.  The same values can be retrieved directly from a passed in ability.
+      #   If calling from Abilities, pass the ability.  If you try to get the ability from the user, you end up in an infinit loop.
+      def self.user_edit_grants_for_collection_of_type(collection_type: nil)
+        return [] unless collection_type
+        Hyrax::CollectionTypeParticipant.joins(:hyrax_collection_type).where(hyrax_collection_type_id: collection_type.id,
+                                                                             agent_type: Hyrax::CollectionTypeParticipant::USER_TYPE,
+                                                                             access: Hyrax::CollectionTypeParticipant::MANAGE_ACCESS).pluck('DISTINCT agent_id')
+      end
+
+      # @api public
+      #
+      # Get a list of group that should be added as group editors for a new collection of the specified collection type
+      #
+      # @param collection_type [Hyrax::CollectionType] the type of the collection being created
+      # @return [Array<String>] array of group identifiers (typically groupname) for groups who can edit collections of this type
+      # @note Several checks get the user's groups from the user's ability.  The same values can be retrieved directly from a passed in ability.
+      #   If calling from Abilities, pass the ability.  If you try to get the ability from the user, you end up in an infinit loop.
+      def self.group_edit_grants_for_collection_of_type(collection_type: nil)
+        return [] unless collection_type
+        groups = Hyrax::CollectionTypeParticipant.joins(:hyrax_collection_type).where(hyrax_collection_type_id: collection_type.id,
+                                                                                      agent_type: Hyrax::CollectionTypeParticipant::GROUP_TYPE,
+                                                                                      access: Hyrax::CollectionTypeParticipant::MANAGE_ACCESS).pluck('DISTINCT agent_id')
+        groups | ['admin']
+      end
+
+      def self.user_groups(user, ability)
+        # if called from abilities class, use ability instead of user; otherwise, you end up in an infinite loop
+        return ability.user_groups if ability.present?
+        user.ability.user_groups
+      end
+      private_class_method :user_groups
+
+      def self.user_admin?(user, ability)
+        # if called from abilities class, use ability instead of user; otherwise, you end up in an infinite loop
+        return ability.admin? if ability.present?
+        user.ability.admin?
+      end
+      private_class_method :user_groups
+
+      def self.user_id(user, ability)
+        return ability.current_user.user_key if ability.present?
+        user.user_key
+      end
+      private_class_method :user_id
+    end
+  end
+end

data/app/services/hyrax/collections/collection_member_service.rb

@@ -0,0 +1,91 @@
+module Hyrax
+  module Collections
+    # Responsible for retrieving collection members
+    class CollectionMemberService
+      attr_reader :scope, :params, :collection
+      delegate :repository, to: :scope
+
+      # @param scope [#repository] Typically a controller object which responds to :repository
+      # @param [Collection]
+      # @param [ActionController::Parameters] query params
+      def initialize(scope:, collection:, params:)
+        @scope = scope
+        @collection = collection
+        @params = params
+      end
+
+      # @api public
+      #
+      # Collections which are members of the given collection
+      # @return [Blacklight::Solr::Response] {up to 50 solr documents}
+      def available_member_subcollections
+        query_solr(query_builder: subcollections_search_builder, query_params: params_for_subcollections)
+      end
+
+      # @api public
+      #
+      # Works which are members of the given collection
+      # @return [Blacklight::Solr::Response]
+      def available_member_works
+        query_solr(query_builder: works_search_builder, query_params: params)
+      end
+
+      # @api public
+      #
+      # Work ids of the works which are members of the given collection
+      # @return [Blacklight::Solr::Response]
+      def available_member_work_ids
+        query_solr_with_field_selection(query_builder: work_ids_search_builder, fl: 'id')
+      end
+
+      private
+
+        # @api private
+        #
+        # set up a member search builder for works only
+        # @return [CollectionMemberSearchBuilder] new or existing
+        def works_search_builder
+          @works_search_builder ||= Hyrax::CollectionMemberSearchBuilder.new(scope: scope, collection: collection, search_includes_models: :works)
+        end
+
+        # @api private
+        #
+        # set up a member search builder for collections only
+        # @return [CollectionMemberSearchBuilder] new or existing
+        def subcollections_search_builder
+          @subcollections_search_builder ||= Hyrax::CollectionMemberSearchBuilder.new(scope: scope, collection: collection, search_includes_models: :collections)
+        end
+
+        # @api private
+        #
+        # set up a member search builder for returning work ids only
+        # @return [CollectionMemberSearchBuilder] new or existing
+        def work_ids_search_builder
+          @work_ids_search_builder ||= Hyrax::CollectionMemberSearchBuilder.new(scope: scope, collection: collection, search_includes_models: :works)
+        end
+
+        # @api private
+        #
+        def query_solr(query_builder:, query_params:)
+          repository.search(query_builder.with(query_params).query)
+        end
+
+        # @api private
+        #
+        def query_solr_with_field_selection(query_builder:, fl:)
+          repository.search(query_builder.merge(fl: fl).query)
+        end
+
+        # @api private
+        #
+        # Blacklight pagination still needs to be overridden and set up for the subcollections.
+        # @return <Hash> the additional inputs required for the subcollection member search builder
+        def params_for_subcollections
+          # To differentiate current page for works vs subcollections, we have to use a sub_collection_page
+          # param. Map this to the page param before querying for subcollections, if it's present
+          params[:page] = params.delete(:sub_collection_page)
+          params
+        end
+    end
+  end
+end

data/app/services/hyrax/collections/managed_collections_service.rb

@@ -0,0 +1,16 @@
+module Hyrax
+  module Collections
+    module ManagedCollectionsService
+      # @api public
+      #
+      # Count of collections the current user can manage.
+      #
+      # @param scope [Object] Typically a controller object that responds to `repository`, `can?`, `blacklight_config`, `current_ability`
+      # @return [Array<SolrDocument>]
+      def self.managed_collections_count(scope:)
+        query_builder = Hyrax::Dashboard::CollectionsSearchBuilder.new(scope).rows(0)
+        scope.repository.search(query_builder.query).response["numFound"]
+      end
+    end
+  end
+end

data/app/services/hyrax/collections/migration_service.rb

@@ -0,0 +1,81 @@
+module Hyrax
+  module Collections
+    # Responsible for migrating legacy collections.  Legacy collections are those created before Hyrax 2.1.0 and
+    # are identified by the lack of the collection having a collection type gid.
+    class MigrationService
+      # @api public
+      #
+      # Migrate all legacy collections to extended collections with collection type assigned.  Legacy collections are those
+      # created before Hyrax 2.1.0 and are identified by the lack of the collection having a collection type gid.
+      def self.migrate_all_collections
+        Rails.logger.info "*** Migrating #{Collection.count} collections"
+        Collection.all.each do |col|
+          migrate_collection(col)
+          Rails.logger.info "  migrating collection - id: #{col.id}, title: #{col.title}"
+        end
+        Rails.logger.info "--- Migration Complete"
+      end
+
+      # @api private
+      #
+      # Migrate a single legacy collection to extended collections with collection type assigned.  Legacy collections are those
+      # created before Hyrax 2.1.0 and are identified by the lack of the collection having a collection type gid.
+      #
+      # @param collection [Collection] collection object to be migrated
+      def self.migrate_collection(collection)
+        return if collection.collection_type_gid.present? # already migrated
+        collection.collection_type_gid = Hyrax::CollectionType.find_or_create_default_collection_type.gid
+        create_permissions(collection)
+        collection.save
+      end
+      private_class_method :migrate_collection
+
+      # @api public
+      #
+      # Validate that migrated collections have both the collection type gid assigned and the permission template with
+      # access created and associated with the collection.  Any collection without collection type gid as nil or assigned
+      # the default collection type are ignored.
+      def self.repair_migrated_collections
+        Rails.logger.info "*** Repairing migrated collections"
+        Collection.all.each do |col|
+          repair_migrated_collection(col)
+          Rails.logger.info "  migrating collection - id: #{col.id}, title: #{col.title}"
+        end
+        Rails.logger.info "--- Migration Complete"
+      end
+
+      # @api private
+      #
+      # Validate and repair a migrated collection if needed.
+      #
+      # @param collection [Collection] collection object to be migrated/repaired
+      def self.repair_migrated_collection(collection)
+        return if collection.collection_type_gid.present? && collection.collection_type_gid != Hyrax::CollectionType.find_or_create_default_collection_type.gid
+        collection.collection_type_gid = Hyrax::CollectionType.find_or_create_default_collection_type.gid
+        permission_template = Hyrax::PermissionTemplate.find_by(source_id: collection.id)
+        if permission_template.present?
+          collection.reset_access_controls!
+        else
+          create_permissions(collection)
+        end
+        collection.save
+      end
+      private_class_method :repair_migrated_collection
+
+      # @api private
+      #
+      # Determine if collection was already migrated.
+      #
+      # @param [Collection] collection object to be validated
+      def self.create_permissions(collection)
+        grants = []
+        collection.edit_groups.each { |g| grants << { agent_type: 'group', agent_id: g, access: Hyrax::PermissionTemplateAccess::MANAGE } }
+        collection.edit_users.each { |u| grants << { agent_type: 'user', agent_id: u, access: Hyrax::PermissionTemplateAccess::MANAGE } }
+        collection.read_groups.each { |g| grants << { agent_type: 'group', agent_id: g, access: Hyrax::PermissionTemplateAccess::VIEW } }
+        collection.read_users.each { |u| grants << { agent_type: 'user', agent_id: u, access: Hyrax::PermissionTemplateAccess::VIEW } }
+        Hyrax::Collections::PermissionsCreateService.create_default(collection: collection, creating_user: ::User.find_by_user_key(collection.depositor), grants: grants)
+      end
+      private_class_method :create_permissions
+    end
+  end
+end

data/app/services/hyrax/collections/nested_collection_persistence_service.rb

@@ -0,0 +1,26 @@
+module Hyrax
+  module Collections
+    module NestedCollectionPersistenceService
+      # @api public
+      #
+      # Responsible for persisting the relationship between the parent and the child.
+      # @see Hyrax::Collections::NestedCollectionQueryService
+      #
+      # @param parent [Collection]
+      # @param child [Collection]
+      # @note There is odd permission arrangement based on the NestedCollectionQueryService:
+      #       You can nest the child within a parent if you can edit the parent and read the child.
+      #       See https://wiki.duraspace.org/display/samvera/Samvera+Tech+Call+2017-08-23 for tech discussion.
+      def self.persist_nested_collection_for(parent:, child:)
+        child.member_of_collections << parent
+        child.save
+      end
+
+      def self.remove_nested_relationship_for(parent:, child:)
+        child.member_of_collections.delete(parent)
+        child.save
+        true
+      end
+    end
+  end
+end