hyrax 2.0.3 → 2.1.0.beta1

data/spec/services/hyrax/collections/permissions_create_service_spec.rb

@@ -0,0 +1,41 @@
+RSpec.describe Hyrax::Collections::PermissionsCreateService do
+  let(:user) { create(:user) }
+  let(:user2) { create(:user) }
+
+  describe ".create_default" do
+    subject { described_class.create_default(collection: collection, creating_user: user) }
+
+    let(:collection_type) { create(:collection_type) }
+    let(:user_manage_attributes) do
+      {
+        hyrax_collection_type_id: collection_type.id,
+        access: 'manage',
+        agent_id: user2.user_key,
+        agent_type: 'user'
+      }
+    end
+    let(:group_manage_attributes) do
+      {
+        hyrax_collection_type_id: collection_type.id,
+        access: 'manage',
+        agent_id: 'manage_group',
+        agent_type: 'group'
+      }
+    end
+    let!(:collection_type_participant) { create(:collection_type_participant, user_manage_attributes) }
+    let!(:collection_type_participant2) { create(:collection_type_participant, group_manage_attributes) }
+    let(:collection) { create(:collection, collection_type_gid: collection_type.gid) }
+
+    before do
+      subject
+    end
+
+    it "creates the default permission template for the collection" do
+      expect(Hyrax::PermissionTemplate.find_by_source_id(collection.id)).to be_persisted
+    end
+
+    it "creates the default permission template access entries for the collection" do
+      expect(Hyrax::PermissionTemplate.find_by_source_id(collection.id).access_grants.count).to eq 4
+    end
+  end
+end

data/spec/services/hyrax/collections/permissions_service_spec.rb

@@ -0,0 +1,278 @@
+RSpec.describe Hyrax::Collections::PermissionsService do
+  let(:user) { create(:user, email: 'user@example.com') }
+
+  let(:ability) { Ability.new(user) }
+
+  context 'collection specific methods' do
+    let(:collection) { build(:collection_lw, id: 'collection_1') }
+    let(:admin_set) { build(:admin_set, id: 'adminset_1') }
+    let(:col_permission_template) { create(:permission_template, source_id: collection.id) }
+    let(:as_permission_template) { create(:permission_template, source_id: admin_set.id) }
+
+    before do
+      allow(Hyrax::PermissionTemplate).to receive(:find_by!).with(source_id: collection.id).and_return(col_permission_template)
+      allow(ability).to receive(:user_groups).and_return(['public', 'registered'])
+    end
+
+    context 'when manage user' do
+      before do
+        allow(col_permission_template).to receive(:agent_ids_for).with(agent_type: 'user', access: 'manage').and_return([user.user_key])
+        allow(col_permission_template).to receive(:agent_ids_for).with(agent_type: 'user', access: 'deposit').and_return([])
+        allow(col_permission_template).to receive(:agent_ids_for).with(agent_type: 'user', access: 'view').and_return([])
+        allow(col_permission_template).to receive(:agent_ids_for).with(agent_type: 'group', access: 'manage').and_return([])
+        allow(col_permission_template).to receive(:agent_ids_for).with(agent_type: 'group', access: 'deposit').and_return([])
+        allow(col_permission_template).to receive(:agent_ids_for).with(agent_type: 'group', access: 'view').and_return([])
+      end
+
+      subject { described_class }
+
+      it ".can_deposit_in_collection? returns true" do
+        expect(subject.can_deposit_in_collection?(collection_id: collection.id, ability: ability)).to be true
+      end
+      it ".can_view_admin_show_for_collection? returns true" do
+        expect(subject.can_view_admin_show_for_collection?(collection_id: collection.id, ability: ability)).to be true
+      end
+    end
+
+    context 'when deposit user' do
+      before do
+        allow(col_permission_template).to receive(:agent_ids_for).with(agent_type: 'user', access: 'manage').and_return([])
+        allow(col_permission_template).to receive(:agent_ids_for).with(agent_type: 'user', access: 'deposit').and_return([user.user_key])
+        allow(col_permission_template).to receive(:agent_ids_for).with(agent_type: 'user', access: 'view').and_return([])
+        allow(col_permission_template).to receive(:agent_ids_for).with(agent_type: 'group', access: 'manage').and_return([])
+        allow(col_permission_template).to receive(:agent_ids_for).with(agent_type: 'group', access: 'deposit').and_return([])
+        allow(col_permission_template).to receive(:agent_ids_for).with(agent_type: 'group', access: 'view').and_return([])
+      end
+
+      subject { described_class }
+
+      it ".can_deposit_in_collection? returns true" do
+        expect(subject.can_deposit_in_collection?(collection_id: collection.id, ability: ability)).to be true
+      end
+      it ".can_view_admin_show_for_collection? returns true" do
+        expect(subject.can_view_admin_show_for_collection?(collection_id: collection.id, ability: ability)).to be true
+      end
+    end
+
+    context 'when view user' do
+      before do
+        allow(col_permission_template).to receive(:agent_ids_for).with(agent_type: 'user', access: 'manage').and_return([])
+        allow(col_permission_template).to receive(:agent_ids_for).with(agent_type: 'user', access: 'deposit').and_return([])
+        allow(col_permission_template).to receive(:agent_ids_for).with(agent_type: 'user', access: 'view').and_return([user.user_key])
+        allow(col_permission_template).to receive(:agent_ids_for).with(agent_type: 'group', access: 'manage').and_return([])
+        allow(col_permission_template).to receive(:agent_ids_for).with(agent_type: 'group', access: 'deposit').and_return([])
+        allow(col_permission_template).to receive(:agent_ids_for).with(agent_type: 'group', access: 'view').and_return([])
+      end
+
+      subject { described_class }
+
+      it ".can_deposit_in_collection? returns true" do
+        expect(subject.can_deposit_in_collection?(collection_id: collection.id, ability: ability)).to be false
+      end
+      it ".can_view_admin_show_for_collection? returns true" do
+        expect(subject.can_view_admin_show_for_collection?(collection_id: collection.id, ability: ability)).to be true
+      end
+    end
+
+    context 'when user without access' do
+      subject { described_class }
+
+      it ".can_deposit_in_collection? returns true" do
+        expect(subject.can_deposit_in_collection?(collection_id: collection.id, ability: ability)).to be false
+      end
+      it ".can_view_admin_show_for_collection? returns true" do
+        expect(subject.can_view_admin_show_for_collection?(collection_id: collection.id, ability: ability)).to be false
+      end
+    end
+  end
+
+  context 'methods returning ids' do
+    let(:user1) { create(:user, email: 'user1@example.com') }
+    let(:user2) { create(:user, email: 'user2@example.com') }
+
+    let!(:col_vu) do
+      build(:collection_lw, id: 'collection_vu', user: user1, with_solr_document: true,
+                            with_permission_template: { view_users: [user] })
+    end
+    let!(:col_vg) do
+      build(:collection_lw, id: 'collection_vg', user: user1, with_solr_document: true,
+                            with_permission_template: { view_groups: ['view_group'] })
+    end
+    let!(:col_mu) do
+      build(:collection_lw, id: 'collection_mu', user: user1, with_solr_document: true,
+                            with_permission_template: { manage_users: [user] })
+    end
+    let!(:col_mg) do
+      build(:collection_lw, id: 'collection_mg', user: user1, with_solr_document: true,
+                            with_permission_template: { manage_groups: ['manage_group'] })
+    end
+    let!(:col_du) do
+      build(:collection_lw, id: 'collection_du', user: user1, with_solr_document: true,
+                            with_permission_template: { deposit_users: [user] })
+    end
+    let!(:col_dg) do
+      build(:collection_lw, id: 'collection_dg', user: user1, with_solr_document: true,
+                            with_permission_template: { deposit_groups: ['deposit_group'] })
+    end
+
+    let(:as_vu) { create(:admin_set, id: 'adminset_vu', with_permission_template: true) }
+    let(:as_vg) { create(:admin_set, id: 'adminset_vg', with_permission_template: true) }
+    let(:as_mu) { create(:admin_set, id: 'adminset_mu', with_permission_template: true) }
+    let(:as_mg) { create(:admin_set, id: 'adminset_mg', with_permission_template: true) }
+    let(:as_du) { create(:admin_set, id: 'adminset_du', with_permission_template: true) }
+    let(:as_dg) { create(:admin_set, id: 'adminset_dg', with_permission_template: true) }
+
+    before do
+      source_access(as_vu.permission_template, 'user', user.user_key, :view)
+      source_access(as_vg.permission_template, 'group', 'view_group', :view)
+      source_access(as_mu.permission_template, 'user', user.user_key, :manage)
+      source_access(as_mg.permission_template, 'group', 'manage_group', :manage)
+      source_access(as_du.permission_template, 'user', user.user_key, :deposit)
+      source_access(as_dg.permission_template, 'group', 'deposit_group', :deposit)
+
+      allow(user).to receive(:groups).and_return(['view_group', 'deposit_group', 'manage_group'])
+    end
+
+    describe '.collection_ids_for_user' do
+      it 'returns collection ids where user has manage access' do
+        expect(described_class.collection_ids_for_user(access: 'manage', ability: ability)).to match_array [col_mu.id, col_mg.id]
+      end
+      it 'returns collection ids where user has deposit access' do
+        expect(described_class.collection_ids_for_user(access: 'deposit', ability: ability)).to match_array [col_du.id, col_dg.id]
+      end
+      it 'returns collection ids where user has view access' do
+        expect(described_class.collection_ids_for_user(access: 'view', ability: ability)).to match_array [col_vu.id, col_vg.id]
+      end
+      it 'returns collection ids where user has manage, deposit, or view access' do
+        all = [col_mu.id, col_mg.id, col_du.id, col_dg.id, col_vu.id, col_vg.id]
+        expect(described_class.collection_ids_for_user(access: ['manage', 'deposit', 'view'], ability: ability)).to match_array all
+      end
+
+      context 'when user has no access' do
+        let(:ability) { Ability.new(user2) }
+
+        it 'returns empty array' do
+          expect(described_class.collection_ids_for_user(access: ['manage', 'deposit', 'view'], ability: ability)).to match_array []
+        end
+      end
+    end
+
+    describe '.source_ids_for_manage' do
+      it 'returns collection and admin set ids where user has manage access' do
+        expect(described_class.source_ids_for_manage(ability: ability)).to match_array [col_mu.id, col_mg.id, as_mu.id, as_mg.id]
+      end
+      it 'returns collection ids where user has manage access' do
+        expect(described_class.source_ids_for_manage(ability: ability, source_type: 'collection')).to match_array [col_mu.id, col_mg.id]
+      end
+      it 'returns admin set ids where user has manage access' do
+        expect(described_class.source_ids_for_manage(ability: ability, source_type: 'admin_set')).to match_array [as_mu.id, as_mg.id]
+      end
+
+      context 'when user has no access' do
+        let(:ability) { Ability.new(user2) }
+
+        it 'returns empty array' do
+          expect(described_class.source_ids_for_manage(ability: ability)).to match_array []
+        end
+      end
+    end
+
+    describe '.source_ids_for_deposit' do
+      it 'returns collection and admin set ids where user has deposit access' do
+        expect(described_class.source_ids_for_deposit(ability: ability)).to match_array [col_du.id, col_dg.id, col_mu.id, col_mg.id, as_du.id, as_dg.id, as_mu.id, as_mg.id]
+      end
+      it 'returns collection ids where user has deposit access' do
+        expect(described_class.source_ids_for_deposit(ability: ability, source_type: 'collection')).to match_array [col_du.id, col_dg.id, col_mu.id, col_mg.id]
+      end
+      it 'returns admin set ids where user has deposit access' do
+        expect(described_class.source_ids_for_deposit(ability: ability, source_type: 'admin_set')).to match_array [as_du.id, as_dg.id, as_mu.id, as_mg.id]
+      end
+
+      context 'when user has no access' do
+        let(:ability) { Ability.new(user2) }
+
+        it 'returns empty array' do
+          expect(described_class.source_ids_for_deposit(ability: ability)).to match_array []
+        end
+      end
+    end
+
+    describe '.collection_ids_for_deposit' do
+      it 'returns collection ids where user has manage access' do
+        expect(described_class.collection_ids_for_deposit(ability: ability)).to match_array [col_du.id, col_dg.id, col_mu.id, col_mg.id]
+      end
+
+      context 'when user has no access' do
+        let(:ability) { Ability.new(user2) }
+
+        it 'returns empty array' do
+          expect(described_class.collection_ids_for_deposit(ability: ability)).to match_array []
+        end
+      end
+    end
+
+    describe '.can_manage_any_collection?' do
+      it 'returns true when user has manage access to at least one collection' do
+        expect(described_class.can_manage_any_collection?(ability: ability)).to be true
+      end
+
+      context 'when user has no access' do
+        let(:ability) { Ability.new(user2) }
+
+        it 'returns false' do
+          expect(described_class.can_manage_any_collection?(ability: ability)).to be false
+        end
+      end
+    end
+
+    describe '.can_manage_any_admin_set?' do
+      it 'returns true when user has manage access to at least one admin set' do
+        expect(described_class.can_manage_any_admin_set?(ability: ability)).to be true
+      end
+
+      context 'when user has no access' do
+        let(:ability) { Ability.new(user2) }
+
+        it 'returns false' do
+          expect(described_class.can_manage_any_admin_set?(ability: ability)).to be false
+        end
+      end
+    end
+
+    describe '.can_view_admin_show_for_any_collection?' do
+      it 'returns true when user has manage, deposit, or view access to at least one collection' do
+        expect(described_class.can_view_admin_show_for_any_collection?(ability: ability)).to be true
+      end
+
+      context 'when user has no access' do
+        let(:ability) { Ability.new(user2) }
+
+        it 'returns false' do
+          expect(described_class.can_view_admin_show_for_any_collection?(ability: ability)).to be false
+        end
+      end
+    end
+
+    describe '.can_view_admin_show_for_any_admin set?' do
+      it 'returns true when user has manage, deposit, or view access to at least one admin set' do
+        expect(described_class.can_view_admin_show_for_any_admin_set?(ability: ability)).to be true
+      end
+
+      context 'when user has no access' do
+        let(:ability) { Ability.new(user2) }
+
+        it 'returns false' do
+          expect(described_class.can_view_admin_show_for_any_admin_set?(ability: ability)).to be false
+        end
+      end
+    end
+  end
+
+  def source_access(permission_template, agent_type, agent_id, access)
+    create(:permission_template_access,
+           access,
+           permission_template: permission_template,
+           agent_type: agent_type,
+           agent_id: agent_id)
+  end
+end

data/spec/services/hyrax/collections_service_spec.rb

@@ -2,38 +2,60 @@ RSpec.describe Hyrax::CollectionsService do
   let(:controller) { ::CatalogController.new }
 
   let(:context) do
-    double(current_ability: Ability.new(user),
+    double(current_ability: Ability.new(user1),
            repository: controller.repository,
            blacklight_config: controller.blacklight_config)
   end
 
   let(:service) { described_class.new(context) }
-  let(:user) { create(:user) }
+  let(:user1) { build(:user) }
 
   describe "#search_results", :clean_repo do
     subject { service.search_results(access) }
 
-    let!(:collection1) { create(:collection, :public, title: ['foo']) }
-    let!(:collection2) { create(:collection, :public, title: ['bar']) }
-    let!(:collection3) { create(:collection, :public, edit_users: [user.user_key], title: ['baz']) }
+    let(:user2) { build(:user) }
+    let!(:collection1) do
+      build(:private_collection_lw, id: 'col-1-own', title: ['user1 created'], user: user1,
+                                    with_permission_template: true, with_solr_document: true)
+    end
+    let!(:collection2) do
+      build(:private_collection_lw, id: 'col-2-mgr', title: ['user2 shares manage access with user1'], user: user2,
+                                    with_permission_template: { manage_users: [user1] }, with_solr_document: true)
+    end
+    let!(:collection3) do
+      build(:private_collection_lw, id: 'col-3-dep', title: ['user2 shares deposit access with user1'], user: user2,
+                                    with_permission_template: { deposit_users: [user1] }, with_solr_document: true)
+    end
+    let!(:collection4) do
+      build(:private_collection_lw, id: 'col-4-view', title: ['user2 shares view access with user1'], user: user2,
+                                    with_permission_template: { view_users: [user1] }, with_solr_document: true)
+    end
 
     before do
-      create(:admin_set, read_groups: ['public']) # this should never be returned.
+      create(:admin_set, id: 'as-1', read_groups: ['public']) # this should never be returned.
     end
 
     context "with read access" do
       let(:access) { :read }
 
       it "returns three collections" do
-        expect(subject.map(&:id)).to match_array [collection1.id, collection2.id, collection3.id]
+        expect(subject.map(&:id)).to match_array [collection1.id, collection2.id, collection3.id, collection4.id]
       end
     end
 
     context "with edit access" do
       let(:access) { :edit }
 
+      it "returns two collections" do
+        expect(subject.map(&:id)).to match_array [collection1.id, collection2.id]
+      end
+    end
+
+    context "with deposit access" do
+      let(:access) { :deposit }
+
       it "returns one collections" do
-        expect(subject.map(&:id)).to match_array [collection3.id]
+        expect(subject.map(&:id)).to match_array [collection1.id, collection2.id, collection3.id]
       end
     end
   end

data/spec/services/hyrax/embargo_service_spec.rb

@@ -5,19 +5,19 @@ RSpec.describe Hyrax::EmbargoService do
   let(:past_date) { 2.days.ago }
 
   let!(:work_with_expired_embargo1) do
-    FactoryBot.build(:generic_work, embargo_release_date: past_date.to_s).tap do |work|
+    build(:work, embargo_release_date: past_date.to_s).tap do |work|
       work.save(validate: false)
     end
   end
 
   let!(:work_with_expired_embargo2) do
-    FactoryBot.build(:generic_work, embargo_release_date: past_date.to_s).tap do |work|
+    build(:work, embargo_release_date: past_date.to_s).tap do |work|
       work.save(validate: false)
     end
   end
 
-  let!(:work_with_embargo_in_effect) { FactoryBot.create(:generic_work, embargo_release_date: future_date.to_s) }
-  let!(:work_without_embargo) { FactoryBot.create(:generic_work) }
+  let!(:work_with_embargo_in_effect) { create(:work, embargo_release_date: future_date.to_s) }
+  let!(:work_without_embargo) { create(:generic_work) }
 
   describe '#assets_with_expired_embargoes' do
     it 'returns an array of assets with expired embargoes' do
@@ -29,10 +29,31 @@ RSpec.describe Hyrax::EmbargoService do
 
   describe '#assets_under_embargo' do
     it 'returns all assets with embargo release date set' do
-      subject.assets_under_embargo
       returned_pids = subject.assets_under_embargo.map(&:id)
       expect(returned_pids).to include work_with_expired_embargo1.id, work_with_expired_embargo2.id, work_with_embargo_in_effect.id
       expect(returned_pids).not_to include work_without_embargo.id
     end
   end
+
+  describe '#assets_with_deactivated_embargoes' do
+    let(:id) { Noid::Rails::Service.new.mint }
+    let(:attributes) do
+      { 'embargo_history_ssim' => ['This is in the past'],
+        'id' => id }
+    end
+
+    before do
+      ActiveFedora::SolrService.add(attributes)
+      ActiveFedora::SolrService.commit
+    end
+
+    it 'returns all assets with embargo history set' do
+      returned_pids = subject.assets_with_deactivated_embargoes.map(&:id)
+      expect(returned_pids).to include id
+      expect(returned_pids).not_to include(work_without_embargo.id,
+                                           work_with_expired_embargo1.id,
+                                           work_with_expired_embargo2.id,
+                                           work_with_embargo_in_effect.id)
+    end
+  end
 end

data/spec/services/hyrax/iiif_authorization_service_spec.rb

@@ -0,0 +1,43 @@
+RSpec.describe Hyrax::IIIFAuthorizationService do
+  let(:user) { create(:user) }
+  let(:ability) { Ability.new(user) }
+  let(:controller) { double(current_ability: ability) }
+  let(:service) { described_class.new(controller) }
+  let(:file_set_id) { 'mp48sc763' }
+  let(:image_id) { "#{file_set_id}/files/0b957460-99b4-4c31-902f-0fc23eefb972" }
+  let(:image) { Riiif::Image.new(image_id) }
+
+  describe "#can?" do
+    context "when the user has read access to the FileSet" do
+      before { allow(ability).to receive(:test_read).with(file_set_id).and_return(true) }
+
+      context "info" do
+        subject { service.can?(:info, image) }
+
+        it { is_expected.to be true }
+      end
+
+      context "show" do
+        subject { service.can?(:show, image) }
+
+        it { is_expected.to be true }
+      end
+    end
+
+    context "when the user doesn't have read access to the FileSet" do
+      before { allow(ability).to receive(:test_read).with(file_set_id).and_return(false) }
+
+      context "info" do
+        subject { service.can?(:info, image) }
+
+        it { is_expected.to be false }
+      end
+
+      context "show" do
+        subject { service.can?(:show, image) }
+
+        it { is_expected.to be false }
+      end
+    end
+  end
+end