hyrax 2.0.3 → 2.1.0.beta1

data/spec/abilities/file_set_abilities_spec.rb

@@ -27,7 +27,7 @@ RSpec.describe 'User' do
       end
 
       describe 'as a repository manager' do
-        let(:manager_user) { FactoryBot.create(:admin) }
+        let(:manager_user) { create(:admin) }
         let(:creating_user) { user }
         let(:current_user) { manager_user }
 
@@ -41,7 +41,7 @@ RSpec.describe 'User' do
       end
 
       describe 'another authenticated user' do
-        let(:creating_user) { FactoryBot.create(:user) }
+        let(:creating_user) { create(:user) }
         let(:current_user) { user }
 
         it do
@@ -54,7 +54,7 @@ RSpec.describe 'User' do
       end
 
       describe 'a nil user' do
-        let(:creating_user) { FactoryBot.create(:user) }
+        let(:creating_user) { create(:user) }
         let(:current_user) { nil }
 
         it do

data/spec/abilities/generic_work_abilities_spec.rb

@@ -4,8 +4,8 @@ RSpec.describe 'User' do
   describe 'Abilities' do
     subject { Ability.new(current_user) }
 
-    let(:generic_work) { FactoryBot.create(:private_generic_work, user: creating_user) }
-    let(:user) { FactoryBot.create(:user) }
+    let(:generic_work) { create(:private_generic_work, user: creating_user) }
+    let(:user) { create(:user) }
 
     describe 'without embargo' do
       describe 'creator of object' do
@@ -21,7 +21,7 @@ RSpec.describe 'User' do
       end
 
       describe 'as a repository manager' do
-        let(:manager_user) { FactoryBot.create(:admin) }
+        let(:manager_user) { create(:admin) }
         let(:creating_user) { user }
         let(:current_user) { manager_user }
 
@@ -34,7 +34,7 @@ RSpec.describe 'User' do
       end
 
       describe 'another authenticated user' do
-        let(:creating_user) { FactoryBot.create(:user) }
+        let(:creating_user) { create(:user) }
         let(:current_user) { user }
 
         it do
@@ -47,7 +47,7 @@ RSpec.describe 'User' do
       end
 
       describe 'a nil user' do
-        let(:creating_user) { FactoryBot.create(:user) }
+        let(:creating_user) { create(:user) }
         let(:current_user) { nil }
 
         it do

data/spec/abilities/permission_template_ability_spec.rb

@@ -0,0 +1,145 @@
+require 'cancan/matchers'
+
+RSpec.describe 'PermissionTemplateAbility' do
+  subject { ability }
+
+  let(:ability) { Ability.new(current_user) }
+  let(:user) { create(:user) }
+  let(:current_user) { user }
+  let(:collection_type_gid) { create(:collection_type).gid }
+
+  let!(:collection) { create(:collection, with_permission_template: true, collection_type_gid: collection_type_gid) }
+  let(:permission_template) { collection.permission_template }
+  let!(:permission_template_access) do
+    create(:permission_template_access,
+           :manage,
+           permission_template: permission_template,
+           agent_type: 'group',
+           agent_id: 'manage_group')
+  end
+
+  context 'when admin user' do
+    let(:user) { FactoryBot.create(:admin) }
+
+    it 'allows all template abilities' do
+      is_expected.to be_able_to(:manage, Hyrax::PermissionTemplate)
+      is_expected.to be_able_to(:create, permission_template)
+      is_expected.to be_able_to(:edit, permission_template)
+      is_expected.to be_able_to(:update, permission_template)
+      is_expected.to be_able_to(:destroy, permission_template)
+    end
+
+    it 'allows all template access abilities' do
+      is_expected.to be_able_to(:manage, Hyrax::PermissionTemplateAccess)
+      is_expected.to be_able_to(:create, permission_template_access)
+      is_expected.to be_able_to(:edit, permission_template_access)
+      is_expected.to be_able_to(:update, permission_template_access)
+      is_expected.to be_able_to(:destroy, permission_template_access)
+    end
+  end
+
+  context 'when user has manage access for the source' do
+    before do
+      create(:permission_template_access,
+             :manage,
+             permission_template: permission_template,
+             agent_type: 'user',
+             agent_id: user.user_key)
+      collection.reset_access_controls!
+    end
+
+    it 'allows most template abilities' do
+      is_expected.to be_able_to(:create, permission_template)
+      is_expected.to be_able_to(:edit, permission_template)
+      is_expected.to be_able_to(:update, permission_template)
+      is_expected.to be_able_to(:destroy, permission_template)
+    end
+
+    it 'denies manage ability for template' do
+      is_expected.not_to be_able_to(:manage, Hyrax::PermissionTemplate)
+    end
+
+    it 'allows most template access abilities' do
+      is_expected.to be_able_to(:create, permission_template_access)
+      is_expected.to be_able_to(:edit, permission_template_access)
+      is_expected.to be_able_to(:update, permission_template_access)
+      is_expected.to be_able_to(:destroy, permission_template_access)
+    end
+
+    it 'denies manage ability for template access' do
+      is_expected.not_to be_able_to(:manage, Hyrax::PermissionTemplateAccess)
+    end
+  end
+
+  context 'when user has deposit access for the source' do
+    before do
+      create(:permission_template_access,
+             :deposit,
+             permission_template: permission_template,
+             agent_type: 'user',
+             agent_id: user.user_key)
+      collection.reset_access_controls!
+    end
+
+    it 'denies all template abilities' do
+      is_expected.not_to be_able_to(:manage, Hyrax::PermissionTemplate)
+      is_expected.not_to be_able_to(:create, permission_template)
+      is_expected.not_to be_able_to(:edit, permission_template)
+      is_expected.not_to be_able_to(:update, permission_template)
+      is_expected.not_to be_able_to(:destroy, permission_template)
+    end
+
+    it 'denies all template access abilities' do
+      is_expected.not_to be_able_to(:manage, Hyrax::PermissionTemplateAccess)
+      is_expected.not_to be_able_to(:create, permission_template_access)
+      is_expected.not_to be_able_to(:edit, permission_template_access)
+      is_expected.not_to be_able_to(:update, permission_template_access)
+      is_expected.not_to be_able_to(:destroy, permission_template_access)
+    end
+  end
+
+  context 'when user has view access for the source' do
+    before do
+      create(:permission_template_access,
+             :view,
+             permission_template: permission_template,
+             agent_type: 'user',
+             agent_id: user.user_key)
+      collection.reset_access_controls!
+    end
+
+    it 'denies all template abilities' do
+      is_expected.not_to be_able_to(:manage, Hyrax::PermissionTemplate)
+      is_expected.not_to be_able_to(:create, permission_template)
+      is_expected.not_to be_able_to(:edit, permission_template)
+      is_expected.not_to be_able_to(:update, permission_template)
+      is_expected.not_to be_able_to(:destroy, permission_template)
+    end
+
+    it 'denies all template access abilities' do
+      is_expected.not_to be_able_to(:manage, Hyrax::PermissionTemplateAccess)
+      is_expected.not_to be_able_to(:create, permission_template_access)
+      is_expected.not_to be_able_to(:edit, permission_template_access)
+      is_expected.not_to be_able_to(:update, permission_template_access)
+      is_expected.not_to be_able_to(:destroy, permission_template_access)
+    end
+  end
+
+  context 'when user has no special access' do
+    it 'denies all template abilities' do
+      is_expected.not_to be_able_to(:manage, Hyrax::PermissionTemplate)
+      is_expected.not_to be_able_to(:create, permission_template)
+      is_expected.not_to be_able_to(:edit, permission_template)
+      is_expected.not_to be_able_to(:update, permission_template)
+      is_expected.not_to be_able_to(:destroy, permission_template)
+    end
+
+    it 'denies all template access abilities' do
+      is_expected.not_to be_able_to(:manage, Hyrax::PermissionTemplateAccess)
+      is_expected.not_to be_able_to(:create, permission_template_access)
+      is_expected.not_to be_able_to(:edit, permission_template_access)
+      is_expected.not_to be_able_to(:update, permission_template_access)
+      is_expected.not_to be_able_to(:destroy, permission_template_access)
+    end
+  end
+end

data/spec/abilities/solr_document_ability_spec.rb

@@ -0,0 +1,27 @@
+require 'cancan/matchers'
+
+# rubocop:disable RSpec/EmptyExampleGroup
+RSpec.describe 'SolrDocumentAbility' do
+  subject { ability }
+
+  let(:ability) { Ability.new(current_user) }
+  let(:user) { create(:user) }
+  let(:current_user) { user }
+
+  context 'with Collection solr doc' do
+    # tested with collection's solr doc in collection_ability_spec.rb
+  end
+
+  context 'with admin_set' do
+    # tested with admin_set's solr doc in admin_set_ability_spec.rb
+  end
+
+  context 'with works' do
+    # TODO: Need tests for works
+  end
+
+  context 'with files' do
+    # TODO: Need tests for files
+  end
+end
+# rubocop:enable RSpec/EmptyExampleGroup

data/spec/actors/hyrax/actors/apply_permission_template_actor_spec.rb

@@ -5,12 +5,15 @@ RSpec.describe Hyrax::Actors::ApplyPermissionTemplateActor do
   let(:depositor) { create(:user) }
   let(:work) do
     build(:generic_work,
+          user: depositor,
           edit_users: ['Kevin'],
           read_users: ['Taraji'])
   end
-  let(:attributes) { { admin_set_id: admin_set.id } }
+  let(:attributes) { { source_id: admin_set.id } }
   let(:admin_set) { create(:admin_set, with_permission_template: true) }
-  let(:permission_template) { admin_set.permission_template }
+  let(:as_permission_template) { admin_set.permission_template }
+  let(:collection) { create(:collection, with_permission_template: true) }
+  let(:col_permission_template) { collection.permission_template }
 
   subject(:middleware) do
     stack = ActionDispatch::MiddlewareStack.new.tap do |middleware|
@@ -20,7 +23,7 @@ RSpec.describe Hyrax::Actors::ApplyPermissionTemplateActor do
   end
 
   describe "create" do
-    context "when admin_set_id is blank" do
+    context "when source_id is blank" do
       let(:attributes) { { admin_set_id: '' } }
 
       it "returns true" do
@@ -28,40 +31,105 @@ RSpec.describe Hyrax::Actors::ApplyPermissionTemplateActor do
       end
     end
 
-    context "when admin_set_id is provided" do
+    context "when admin_set_id only is provided" do
       let(:attributes) { { admin_set_id: admin_set.id } }
 
       before do
-        create(:permission_template_access,
-               :manage,
-               permission_template: permission_template,
-               agent_type: 'user',
-               agent_id: 'hannah')
-        create(:permission_template_access,
-               :manage,
-               permission_template: permission_template,
-               agent_type: 'group',
-               agent_id: 'librarians')
-        create(:permission_template_access,
-               :view,
-               permission_template: permission_template,
-               agent_type: 'user',
-               agent_id: 'gary')
-        create(:permission_template_access,
-               :view,
-               permission_template: permission_template,
-               agent_type: 'group',
-               agent_id: 'readers')
+        admin_set_access(as_permission_template)
         allow(terminator).to receive(:create).and_return(true)
       end
 
       it "adds the template users to the work" do
         expect(middleware.create(env)).to be true
-        expect(work.edit_users).to include('hannah', 'Kevin')
-        expect(work.edit_groups).to include 'librarians'
-        expect(work.read_users).to include('gary', 'Taraji')
-        expect(work.read_groups).to include 'readers'
+        expect(work.edit_users).to match_array [depositor.user_key, 'Kevin', 'hannah a. smith']
+        expect(work.edit_groups).to match_array ['librarians_as']
+        expect(work.read_users).to match_array ['Taraji', 'gary a. stevens']
+        expect(work.read_groups).to match_array ['readers_as']
       end
     end
+
+    context "when admin_set_id and collection_id is provided" do
+      let(:attributes) { { admin_set_id: admin_set.id, collection_id: collection.id } }
+
+      before do
+        admin_set_access(as_permission_template)
+        collection_access(col_permission_template)
+        allow(terminator).to receive(:create).and_return(true)
+      end
+
+      it "adds the template users to the work" do
+        expect(middleware.create(env)).to be true
+        expect(work.edit_users).to match_array [depositor.user_key, 'Kevin', 'hannah a. smith', 'joe conrad']
+        expect(work.edit_groups).to match_array ['librarians_as', 'managers_c']
+        expect(work.read_users).to match_array ['Taraji', 'gary a. stevens', 'carol cassidy']
+        expect(work.read_groups).to match_array ['readers_as', 'viewers_c']
+      end
+    end
+
+    def admin_set_access(permission_template) # rubocop:disable Metrics/MethodLength
+      create(:permission_template_access,
+             :manage,
+             permission_template: permission_template,
+             agent_type: 'user',
+             agent_id: 'hannah a. smith')
+      create(:permission_template_access,
+             :manage,
+             permission_template: permission_template,
+             agent_type: 'group',
+             agent_id: 'librarians_as')
+      create(:permission_template_access,
+             :deposit,
+             permission_template: permission_template,
+             agent_type: 'user',
+             agent_id: 'mike a. steward')
+      create(:permission_template_access,
+             :deposit,
+             permission_template: permission_template,
+             agent_type: 'group',
+             agent_id: 'staff_as')
+      create(:permission_template_access,
+             :view,
+             permission_template: permission_template,
+             agent_type: 'user',
+             agent_id: 'gary a. stevens')
+      create(:permission_template_access,
+             :view,
+             permission_template: permission_template,
+             agent_type: 'group',
+             agent_id: 'readers_as')
+    end
+
+    def collection_access(permission_template) # rubocop:disable Metrics/MethodLength
+      create(:permission_template_access,
+             :manage,
+             permission_template: permission_template,
+             agent_type: 'user',
+             agent_id: "joe conrad")
+      create(:permission_template_access,
+             :manage,
+             permission_template: permission_template,
+             agent_type: 'group',
+             agent_id: "managers_c")
+      create(:permission_template_access,
+             :deposit,
+             permission_template: permission_template,
+             agent_type: 'user',
+             agent_id: "donny cartwright")
+      create(:permission_template_access,
+             :deposit,
+             permission_template: permission_template,
+             agent_type: 'group',
+             agent_id: "depositors_c")
+      create(:permission_template_access,
+             :view,
+             permission_template: permission_template,
+             agent_type: 'user',
+             agent_id: "carol cassidy")
+      create(:permission_template_access,
+             :view,
+             permission_template: permission_template,
+             agent_type: 'group',
+             agent_id: "viewers_c")
+    end
   end
 end

data/spec/actors/hyrax/actors/collections_membership_actor_spec.rb

@@ -1,7 +1,7 @@
 RSpec.describe Hyrax::Actors::CollectionsMembershipActor do
   let(:user) { create(:user) }
   let(:ability) { ::Ability.new(user) }
-  let(:curation_concern) { GenericWork.new }
+  let(:curation_concern) { build(:work, user: user) }
   let(:attributes) { {} }
   let(:terminator) { Hyrax::Actors::Terminator.new }
   let(:env) { Hyrax::Actors::Environment.new(curation_concern, ability, attributes) }
@@ -9,22 +9,27 @@ RSpec.describe Hyrax::Actors::CollectionsMembershipActor do
   subject(:middleware) do
     stack = ActionDispatch::MiddlewareStack.new.tap do |middleware|
       middleware.use described_class
+      middleware.use RemoveCollectionActor
       middleware.use Hyrax::Actors::GenericWorkActor
     end
     stack.build(terminator)
   end
 
   describe 'the next actor' do
+    let(:collection) { create(:collection, create_access: true) }
     let(:attributes) do
-      { member_of_collection_ids: ['123'], title: ['test'] }
+      {
+        member_of_collections_attributes: { '0' => { id: '123' } },
+        title: ['test']
+      }
     end
 
     before do
-      allow(Collection).to receive(:find).with(['123'])
+      allow(Collection).to receive(:find).with('123').and_return(collection)
       allow(curation_concern).to receive(:member_of_collections=)
     end
 
-    it 'does not receive the member_of_collection_ids' do
+    it 'does not receive the member_of_collections_attributes' do
       expect(terminator).to receive(:create).with(Hyrax::Actors::Environment) do |k|
         expect(k.attributes).to eq("title" => ["test"])
       end
@@ -33,9 +38,12 @@ RSpec.describe Hyrax::Actors::CollectionsMembershipActor do
   end
 
   describe 'create' do
-    let(:collection) { create(:collection) }
+    let(:collection) { create(:collection, collection_type_settings: [:discoverable], user: user, create_access: true) }
     let(:attributes) do
-      { member_of_collection_ids: [collection.id], title: ['test'] }
+      {
+        member_of_collections_attributes: { '0' => { id: collection.id } },
+        title: ['test']
+      }
     end
 
     it 'adds it to the collection' do
@@ -43,13 +51,31 @@ RSpec.describe Hyrax::Actors::CollectionsMembershipActor do
       expect(collection.reload.member_objects).to eq [curation_concern]
     end
 
-    describe "when work is in user's own collection" do
-      let(:collection) { create(:collection, user: user, title: ['A good title']) }
-      let(:attributes) { { member_of_collection_ids: [] } }
+    context 'when multiple membership checker returns a non-nil value' do
+      before do
+        allow(Hyrax::MultipleMembershipChecker).to receive(:new).and_return(checker)
+        allow(checker).to receive(:check).and_return(error_message)
+      end
+
+      let(:checker) { double('checker') }
+      let(:error_message) { 'Error: foo bar' }
+
+      it 'adds an error and returns false' do
+        expect(env.curation_concern.errors).to receive(:add).with(:collections, error_message)
+        expect(subject.create(env)).to be false
+        expect(curation_concern.member_of_collections).to be_empty
+      end
+    end
+
+    context "when work is in user's own collection and destroy is passed" do
+      let(:collection) { create(:collection, user: user, title: ['A good title'], create_access: true) }
+      let(:attributes) do
+        { member_of_collections_attributes: { '0' => { id: collection.id, _destroy: 'true' } } }
+      end
 
       before do
-        subject.create(Hyrax::Actors::Environment.new(curation_concern, ability,
-                                                      member_of_collection_ids: [collection.id], title: ['test']))
+        curation_concern.member_of_collections = [collection]
+        curation_concern.save!
       end
 
       it "removes the work from that collection" do
@@ -58,15 +84,257 @@ RSpec.describe Hyrax::Actors::CollectionsMembershipActor do
       end
     end
 
-    describe "when work is in another user's collection" do
+    context "when work is in another user's collection" do
       let(:other_user) { create(:user) }
-      let(:collection) { create(:collection, user: other_user, title: ['A good title']) }
+      let(:other_collection) { create(:collection, user: other_user, title: ['A good title'], create_access: true) }
+
+      before do
+        curation_concern.member_of_collections = [other_collection]
+        curation_concern.save!
+      end
 
-      it "doesn't remove the work from that collection" do
+      it "doesn't remove the work from the other user's collection" do
         subject.create(env)
         expect(subject.create(env)).to be true
-        expect(curation_concern.member_of_collections).to eq [collection]
+        expect(curation_concern.member_of_collections).to match_array [collection, other_collection]
       end
     end
+
+    context 'when passing `member_of_collection_ids`' do
+      let(:attributes) { { member_of_collection_ids: [collection.id], title: ['test'] } }
+
+      it 'adds it to the collection' do
+        skip 'this behavior past its deprecation sunset time and can be removed' if
+          Hyrax::VERSION.split('.').first.to_i >= 3
+
+        expect(subject.create(env)).to be true
+        expect(collection.reload.member_objects).to eq [curation_concern]
+      end
+
+      context "when work is in user's own collection" do
+        let(:attributes) { { member_of_collection_ids: [] } }
+
+        it "removes the work from that collection" do
+          skip 'this behavior past its deprecation sunset time and can be removed' if
+            Hyrax::VERSION.split('.').first.to_i >= 3
+
+          expect(subject.create(env)).to be true
+          expect(collection.reload.member_objects).to be_empty
+        end
+      end
+
+      describe "when work is in another user's collection" do
+        let(:other_user)    { create(:user) }
+        let(:collection)    { create(:collection, user: other_user, title: ['A good title']) }
+        let(:my_collection) { create(:collection, title: ['My good title']) }
+
+        let(:attributes) { { member_of_collection_ids: [my_collection.id] } }
+
+        before do
+          curation_concern.member_of_collections = [collection]
+          curation_concern.save!
+        end
+
+        it "doesn't remove the work from the other user's collection" do
+          skip 'this behavior past its deprecation sunset time and can be removed' if
+            Hyrax::VERSION.split('.').first.to_i >= 3
+
+          expect(subject.create(env)).to be true
+          expect(curation_concern.member_of_collections)
+            .to contain_exactly(collection, my_collection)
+        end
+      end
+    end
+
+    context "updates env" do
+      let!(:collection_type) { create(:collection_type) }
+      let!(:collection) { create(:collection, collection_type_gid: collection_type.gid, create_access: true) }
+
+      subject(:middleware) do
+        stack = ActionDispatch::MiddlewareStack.new.tap do |middleware|
+          middleware.use described_class
+        end
+        stack.build(terminator)
+      end
+
+      context "when share applies to works" do
+        before do
+          allow(collection.collection_type).to receive(:share_applies_to_works).and_return(true)
+        end
+
+        context "and only one collection" do
+          let(:attributes) do
+            {
+              member_of_collections_attributes: { '0' => { id: collection.id } },
+              title: ['test']
+            }
+          end
+
+          it "removes member_of_collections_attributes and adds collection_id to env" do
+            expect(env.attributes).to have_key(:member_of_collections_attributes)
+            expect(env.attributes[:member_of_collections_attributes].size).to eq 1
+            expect(subject.create(env)).to be true
+            expect(env.attributes).not_to have_key(:member_of_collections_attributes)
+            expect(env.attributes).to have_key(:collection_id)
+            expect(env.attributes[:collection_id]).to eq collection.id
+          end
+        end
+
+        context "when more than one collection" do
+          let(:collection2) { create(:collection, create_access: true) }
+          let(:attributes) do
+            {
+              member_of_collections_attributes: {
+                '0' => { id: collection.id },
+                '1' => { id: collection2.id }
+              },
+              title: ['test']
+            }
+          end
+
+          it "removes member_of_collections_attributes and does NOT add collection_id" do
+            expect(env.attributes).to have_key(:member_of_collections_attributes)
+            expect(env.attributes[:member_of_collections_attributes].size).to eq 2
+            expect(subject.create(env)).to be true
+            expect(env.attributes).not_to have_key(:member_of_collections_attributes)
+            expect(env.attributes).not_to have_key(:collection_id)
+          end
+        end
+      end
+
+      context "when share does NOT apply to works" do
+        before do
+          allow(collection.collection_type).to receive(:share_applies_to_new_works?).and_return(false)
+          allow(Collection).to receive(:find).with(collection.id).and_return(collection)
+          allow(Collection).to receive(:find).with([collection.id]).and_return([collection])
+        end
+
+        context "and only one collection" do
+          let(:attributes) do
+            {
+              member_of_collections_attributes: { '0' => { id: collection.id } },
+              title: ['test']
+            }
+          end
+
+          it "removes member_of_collection_ids and does NOT add collection_id" do
+            expect(env.attributes).to have_key(:member_of_collections_attributes)
+            expect(env.attributes[:member_of_collections_attributes].size).to eq 1
+            expect(subject.create(env)).to be true
+            expect(env.attributes).not_to have_key(:member_of_collections_attributes)
+            expect(env.attributes).not_to have_key(:collection_id)
+          end
+        end
+      end
+    end
+  end
+
+  context 'when old style env parameter' do
+    describe 'create' do
+      let(:collection) { create(:collection) }
+      let(:attributes) do
+        { member_of_collection_ids: [collection.id], title: ['test'] }
+      end
+
+      it 'adds it to the collection' do
+        expect(subject.create(env)).to be true
+        expect(collection.reload.member_objects).to eq [curation_concern]
+      end
+
+      context 'when multiple membership checker returns a non-nil value' do
+        before do
+          allow(Hyrax::MultipleMembershipChecker).to receive(:new).and_return(checker)
+          allow(checker).to receive(:check).and_return(error_message)
+        end
+
+        let(:checker) { double('checker') }
+        let(:error_message) { 'Error: foo bar' }
+
+        it 'adds an error and returns false' do
+          expect(env.curation_concern.errors).to receive(:add).with(:collections, error_message)
+          expect(subject.create(env)).to be false
+          expect(curation_concern.member_of_collections).to be_empty
+        end
+      end
+
+      context "when work is in user's own collection" do
+        let(:collection) { create(:collection, user: user, title: ['A good title']) }
+        let(:attributes) { { member_of_collection_ids: [] } }
+
+        before do
+          subject.create(Hyrax::Actors::Environment.new(curation_concern, ability,
+                                                        member_of_collection_ids: [collection.id], title: ['test']))
+        end
+
+        it "removes the work from that collection" do
+          expect(subject.create(env)).to be true
+          expect(curation_concern.member_of_collections).to eq []
+        end
+      end
+
+      context "when work is in another user's collection" do
+        let(:other_user) { create(:user) }
+        let(:collection) { create(:collection, user: other_user, title: ['A good title']) }
+
+        it "doesn't remove the work from that collection" do
+          subject.create(env)
+          expect(subject.create(env)).to be true
+          expect(curation_concern.member_of_collections).to eq [collection]
+        end
+      end
+
+      context "updates env" do
+        let(:collection) do
+          create(:collection, collection_type_settings: [:discoverable, :sharable])
+        end
+
+        subject(:middleware) do
+          stack = ActionDispatch::MiddlewareStack.new.tap do |middleware|
+            middleware.use described_class
+          end
+          stack.build(terminator)
+        end
+
+        context "when only one collection" do
+          let(:attributes) do
+            { member_of_collection_ids: [collection.id], title: ['test'] }
+          end
+
+          it "removes member_of_collection_ids and adds collection_id to env" do
+            expect(env.attributes).to have_key(:member_of_collection_ids)
+            expect(env.attributes[:member_of_collection_ids].size).to eq 1
+            expect(subject.create(env)).to be true
+            expect(env.attributes).not_to have_key(:member_of_collection_ids)
+            expect(env.attributes).to have_key(:collection_id)
+            expect(env.attributes[:collection_id]).to eq collection.id
+          end
+        end
+
+        context "when more than one collection" do
+          let(:collection2) { create(:collection) }
+          let(:attributes) do
+            { member_of_collection_ids: [collection.id, collection2.id], title: ['test'] }
+          end
+
+          it "removes member_of_collection_ids and does NOT add collection_id" do
+            expect(env.attributes).to have_key(:member_of_collection_ids)
+            expect(env.attributes[:member_of_collection_ids].size).to eq 2
+            expect(subject.create(env)).to be true
+            expect(env.attributes).not_to have_key(:member_of_collection_ids)
+            expect(env.attributes).not_to have_key(:collection_id)
+          end
+        end
+      end
+    end
+  end
+
+  class RemoveCollectionActor < Hyrax::Actors::AbstractActor
+    # The collection is normally removed by ApplyPermissionTemplateActor, but this test doesn't setup and call that actor.
+    # So we are faking it here and removing it before the GenericWorkActor is called.  Otherwise, it tries to save a
+    # property named collection_id which doesn't exist in GenericWork.
+    def create(env)
+      env.attributes.delete(:collection_id)
+      next_actor.create(env)
+    end
   end
 end