hyrax 2.6.0 → 2.7.0

data/spec/controllers/hyrax/admin/features_controller_spec.rb

@@ -1,31 +0,0 @@
-RSpec.describe Hyrax::Admin::FeaturesController do
-  describe "#index" do
-    before do
-      sign_in user
-    end
-    let(:user) { create(:user) }
-
-    context "when not authorized" do
-      it "redirects away" do
-        get :index
-        expect(response).to redirect_to root_path
-      end
-    end
-
-    context "when authorized" do
-      before do
-        allow(controller).to receive_messages(current_user: user)
-        expect(user).to receive(:groups).and_return(['admin', 'registered'])
-      end
-
-      it "is successful" do
-        expect(controller).to receive(:add_breadcrumb).with('Home', root_path)
-        expect(controller).to receive(:add_breadcrumb).with('Dashboard', dashboard_path)
-        expect(controller).to receive(:add_breadcrumb).with('Configuration', '#')
-        expect(controller).to receive(:add_breadcrumb).with('Features', admin_features_path)
-        get :index
-        expect(response).to be_success
-      end
-    end
-  end
-end

data/spec/controllers/hyrax/admin/permission_template_accesses_controller_spec.rb

@@ -1,101 +0,0 @@
-RSpec.describe Hyrax::Admin::PermissionTemplateAccessesController do
-  routes { Hyrax::Engine.routes }
-  before do
-    sign_in create(:user)
-  end
-  let(:hyrax) { Hyrax::Engine.routes.url_helpers }
-  let(:permission_template_access) { create(:permission_template_access) }
-  let(:source_id) { permission_template_access.permission_template.source_id }
-
-  describe "destroy" do
-    context "without admin privleges" do
-      before do
-        allow(controller.current_ability).to receive(:test_edit).with(source_id).and_return(false)
-      end
-      it "is unauthorized" do
-        delete :destroy, params: { id: permission_template_access }
-        expect(response).to be_unauthorized
-      end
-    end
-
-    context "when signed in as an admin" do
-      # TODO: Need test that shows delete of admin group form depositors and viewers is allowed
-      let(:permission_template_access) do
-        create(:permission_template_access,
-               :manage,
-               permission_template: permission_template,
-               agent_type: agent_type,
-               agent_id: agent_id)
-      end
-
-      context 'when source is an admin set' do
-        let(:permission_template) { create(:permission_template, source_id: admin_set.id) }
-        let(:admin_set) { create(:admin_set, edit_users: ['Liz']) }
-
-        context 'when deleting the admin users group' do
-          let(:agent_type) { 'group' }
-          let(:agent_id) { 'admin' }
-
-          it "is fails" do
-            expect(controller).to receive(:authorize!).with(:destroy, permission_template_access)
-            expect do
-              delete :destroy, params: { id: permission_template_access }
-            end.not_to change { Hyrax::PermissionTemplateAccess.count }
-            expect(response).to redirect_to(hyrax.edit_admin_admin_set_path(source_id, locale: 'en', anchor: 'participants'))
-            expect(flash[:notice]).not_to eq I18n.t('participants', scope: 'hyrax.admin.admin_sets.form.permission_update_notices')
-            expect(flash[:alert]).to eq 'The repository administrators group cannot be removed'
-          end
-        end
-
-        context 'with deleting any agent other than the admin users group' do
-          let(:agent_type) { 'user' }
-          let(:agent_id) { 'Liz' }
-
-          it "is successful" do
-            expect(controller).to receive(:authorize!).with(:destroy, permission_template_access)
-            expect do
-              delete :destroy, params: { id: permission_template_access }
-            end.to change { Hyrax::PermissionTemplateAccess.count }.by(-1)
-            expect(response).to redirect_to(hyrax.edit_admin_admin_set_path(source_id, locale: 'en', anchor: 'participants'))
-            expect(flash[:notice]).to eq(I18n.t('participants', scope: 'hyrax.admin.admin_sets.form.permission_update_notices'))
-            expect(admin_set.reload.edit_users).to be_empty
-          end
-        end
-      end
-
-      context 'when source is a collection' do
-        let(:permission_template) { create(:permission_template, source_id: collection.id) }
-        let(:collection) { create(:collection, edit_users: ['Liz']) }
-
-        context 'when deleting the admin users group' do
-          let(:agent_type) { 'group' }
-          let(:agent_id) { 'admin' }
-
-          it "fails" do
-            expect(controller).to receive(:authorize!).with(:destroy, permission_template_access)
-            expect do
-              delete :destroy, params: { id: permission_template_access }
-            end.not_to change { Hyrax::PermissionTemplateAccess.count }
-            expect(response).to redirect_to(hyrax.edit_dashboard_collection_path(source_id, locale: 'en', anchor: 'sharing'))
-            expect(flash[:notice]).not_to eq I18n.t('sharing', scope: 'hyrax.dashboard.collections.form.permission_update_notices')
-            expect(flash[:alert]).to eq 'The repository administrators group cannot be removed'
-          end
-        end
-
-        context 'with deleting any agent other than the admin users group' do
-          let(:agent_type) { 'user' }
-          let(:agent_id) { 'Liz' }
-
-          it "is successful" do
-            expect(controller).to receive(:authorize!).with(:destroy, permission_template_access)
-            expect do
-              delete :destroy, params: { id: permission_template_access }
-            end.to change { Hyrax::PermissionTemplateAccess.count }.by(-1)
-            expect(response).to redirect_to(hyrax.edit_dashboard_collection_path(source_id, locale: 'en', anchor: 'sharing'))
-            expect(flash[:notice]).to eq(I18n.t('sharing', scope: 'hyrax.dashboard.collections.form.permission_update_notices'))
-          end
-        end
-      end
-    end
-  end
-end

data/spec/controllers/hyrax/admin/permission_templates_controller_spec.rb

@@ -1,71 +0,0 @@
-RSpec.describe Hyrax::Admin::PermissionTemplatesController do
-  routes { Hyrax::Engine.routes }
-  before do
-    sign_in create(:user)
-    allow(Hyrax::Forms::PermissionTemplateForm).to receive(:new).with(permission_template).and_return(form)
-  end
-  let(:hyrax) { Hyrax::Engine.routes.url_helpers }
-  let(:form) { instance_double(Hyrax::Forms::PermissionTemplateForm) }
-
-  context "without admin privleges" do
-    describe "update" do
-      let(:permission_template) { create(:permission_template) }
-
-      before do
-        allow(controller.current_ability).to receive(:can?).with(:update, permission_template).and_return(false)
-      end
-
-      it "is unauthorized for admin sets" do
-        # This spec was not firing as expected. It was getting a nil permission template. This mock expectation is a bit
-        # odd, but it needs to go rather deep into CanCan to behave accordingly.
-        put :update, params: { id: permission_template, admin_set_id: permission_template.source_id }
-        expect(assigns(:permission_template)).to eq(permission_template)
-        expect(response).to be_unauthorized
-      end
-
-      it "is unauthorized for collections" do
-        # This spec was not firing as expected. It was getting a nil permission template. This mock expectation is a bit
-        # odd, but it needs to go rather deep into CanCan to behave accordingly.
-        put :update, params: { id: permission_template, collection_id: permission_template.source_id }
-        expect(assigns(:permission_template)).to eq(permission_template)
-        expect(response).to be_unauthorized
-      end
-    end
-  end
-
-  context "when signed in as an admin" do
-    let!(:permission_template) { create(:permission_template) }
-    let(:grant_attributes) { [{ "agent_type" => "user", "agent_id" => "bob", "access" => "view" }] }
-    let(:form_attributes) { { visibility: 'open', access_grants_attributes: grant_attributes } }
-
-    describe "update admin set participants" do
-      let(:input_params) do
-        { admin_set_id: permission_template.source_id,
-          permission_template: form_attributes }
-      end
-
-      it "is successful" do
-        expect(controller).to receive(:authorize!).with(:update, Hyrax::PermissionTemplate)
-        expect(form).to receive(:update).with(ActionController::Parameters.new(form_attributes).permit!).and_return(updated: true, content_tab: 'participants')
-        put :update, params: input_params
-        expect(response).to redirect_to(hyrax.edit_admin_admin_set_path(permission_template.source_id, locale: 'en', anchor: 'participants'))
-        expect(flash[:notice]).to eq(I18n.t('participants', scope: 'hyrax.admin.admin_sets.form.permission_update_notices'))
-      end
-    end
-
-    describe "update collection participants" do
-      let(:input_params) do
-        { collection_id: permission_template.source_id,
-          permission_template: form_attributes }
-      end
-
-      it "is successful" do
-        expect(controller).to receive(:authorize!).with(:update, Hyrax::PermissionTemplate)
-        expect(form).to receive(:update).with(ActionController::Parameters.new(form_attributes).permit!).and_return(updated: true, content_tab: 'sharing')
-        put :update, params: input_params
-        expect(response).to redirect_to(hyrax.edit_dashboard_collection_path(permission_template.source_id, locale: 'en', anchor: 'sharing'))
-        expect(flash[:notice]).to eq(I18n.t('sharing', scope: 'hyrax.dashboard.collections.form.permission_update_notices'))
-      end
-    end
-  end
-end

data/spec/controllers/hyrax/admin/stats_controller_spec.rb

@@ -1,61 +0,0 @@
-RSpec.describe Hyrax::Admin::StatsController, type: :controller do
-  let(:user) { create(:user) }
-
-  context "a non admin" do
-    describe "#show" do
-      it 'is unauthorized' do
-        get :show
-        expect(response).to be_redirect
-      end
-    end
-  end
-
-  context "as an admin" do
-    before do
-      allow(controller).to receive(:authorize!).and_return(true)
-    end
-
-    describe "#show" do
-      let(:expected_params) do
-        ActionController::Parameters.new
-      end
-
-      it 'allows an authorized user to view the page' do
-        get :show
-
-        expect(response).to be_success
-        expect(assigns[:presenter]).to be_kind_of Hyrax::AdminStatsPresenter
-        expect(assigns[:presenter])
-          .to have_attributes(limit: 5, stats_filters: {})
-      end
-
-      context 'with a custom presenter' do
-        let(:presenter_class) { Class.new(Hyrax::AdminStatsPresenter) }
-
-        before { described_class.admin_stats_presenter = presenter_class }
-
-        it 'allows an authorized user to view the page' do
-          get :show
-
-          expect(assigns[:presenter]).to be_kind_of presenter_class
-          expect(assigns[:presenter])
-            .to have_attributes(limit: 5, stats_filters: {})
-        end
-      end
-
-      context 'with custom stats services' do
-        let(:by_depositor_class) { Class.new(Hyrax::Statistics::Works::ByDepositor) }
-        let(:service_config)     { { by_depositor: by_depositor_class } }
-
-        before { described_class.admin_stats_services = service_config }
-
-        it 'allows an authorized user to view the page' do
-          get :show
-
-          expect(assigns[:presenter])
-            .to have_attributes(by_depositor: by_depositor_class)
-        end
-      end
-    end
-  end
-end

data/spec/controllers/hyrax/admin/strategies_controller_spec.rb

@@ -1,39 +0,0 @@
-RSpec.describe Hyrax::Admin::StrategiesController do
-  describe "#update" do
-    before do
-      # Added when Flipflop bumped to 2.3.2. See also https://github.com/voormedia/flipflop/issues/26
-      Flipflop::FeatureSet.current.instance_variable_set(:@features, original_feature_hash.merge(feature_id => feature))
-
-      sign_in user
-    end
-
-    after do
-      Flipflop::FeatureSet.current.instance_variable_set(:@features, original_feature_hash)
-    end
-
-    let(:original_feature_hash) { Flipflop::FeatureSet.current.instance_variable_get(:@features) }
-    let(:user) { create(:user) }
-    let(:strategy) { Flipflop::Strategies::ActiveRecordStrategy.new(class: Hyrax::Feature).key }
-    let(:feature) { double('feature', id: feature_id, key: 'foo') }
-    let(:feature_id) { :my_feature }
-
-    context "when not authorized" do
-      it "redirects away" do
-        patch :update, params: { feature_id: feature.id, id: strategy }
-        expect(response).to redirect_to root_path
-      end
-    end
-
-    context "when authorized" do
-      before do
-        allow(controller).to receive_messages(current_user: user)
-        expect(user).to receive(:groups).and_return(['admin', 'registered'])
-      end
-
-      it "is successful" do
-        patch :update, params: { feature_id: feature.id, id: strategy }
-        expect(response).to redirect_to Hyrax::Engine.routes.url_helpers.admin_features_path(locale: 'en')
-      end
-    end
-  end
-end

data/spec/controllers/hyrax/admin/users_controller_spec.rb

@@ -1,17 +0,0 @@
-RSpec.describe Hyrax::Admin::UsersController, type: :controller do
-  before do
-    expect(controller).to receive(:authorize!).with(:read, :admin_dashboard).and_return(true)
-  end
-
-  describe "#index" do
-    it "is successful" do
-      expect(controller).to receive(:add_breadcrumb).with(I18n.t('hyrax.controls.home'), root_path)
-      expect(controller).to receive(:add_breadcrumb).with(I18n.t('hyrax.dashboard.breadcrumbs.admin'), dashboard_path)
-      expect(controller).to receive(:add_breadcrumb).with(I18n.t('hyrax.admin.users.index.title'), admin_users_path)
-
-      get :index
-      expect(response).to be_successful
-      expect(assigns[:presenter]).to be_kind_of Hyrax::Admin::UsersPresenter
-    end
-  end
-end

data/spec/controllers/hyrax/admin/workflow_roles_controller_spec.rb

@@ -1,76 +0,0 @@
-RSpec.describe Hyrax::Admin::WorkflowRolesController do
-  describe '#index' do
-    context "when you have permission" do
-      before do
-        allow(controller).to receive(:authorize!).with(:read, :admin_dashboard).and_return(true)
-      end
-
-      it "is successful" do
-        expect(controller).to receive(:add_breadcrumb).with('Home', root_path(locale: 'en'))
-        expect(controller).to receive(:add_breadcrumb).with('Dashboard', dashboard_path(locale: 'en'))
-        expect(controller).to receive(:add_breadcrumb).with('Workflow Roles', admin_workflow_roles_path(locale: 'en'))
-        get :index
-        expect(response).to be_success
-        expect(assigns[:presenter]).to be_kind_of Hyrax::Admin::WorkflowRolesPresenter
-        expect(response).to render_template('hyrax/dashboard')
-      end
-    end
-
-    context "when they don't have permission" do
-      it "throws a CanCan error" do
-        get :index
-        expect(response).to redirect_to main_app.new_user_session_path(locale: 'en')
-      end
-    end
-  end
-
-  describe '#create' do
-    context 'when you have permission' do
-      let(:form) { instance_double(Hyrax::Forms::WorkflowResponsibilityForm, save!: true) }
-
-      before do
-        allow(controller).to receive(:authorize!).with(:read, :admin_dashboard).and_return(true)
-        allow(controller).to receive(:authorize!).and_return(true)
-        allow(Hyrax::Forms::WorkflowResponsibilityForm).to receive(:new).and_return(form)
-      end
-
-      it 'is successful' do
-        post :create, params: { sipity_workflow_responsibility: {} }
-        expect(controller).to have_received(:authorize!).with(:create, Sipity::WorkflowResponsibility)
-        expect(form).to have_received(:save!)
-        expect(response).to redirect_to admin_workflow_roles_path
-      end
-    end
-
-    context "when they don't have permission" do
-      it 'throws a CanCan error' do
-        post :create, params: { sipity_workflow_responsibility: {} }
-        expect(response).to redirect_to main_app.new_user_session_path(locale: 'en')
-      end
-    end
-  end
-
-  describe '#destroy' do
-    context "when you have permission" do
-      let(:responsibility) { mock_model(Sipity::WorkflowResponsibility) }
-
-      before do
-        allow(controller).to receive(:authorize!).and_return(true)
-        allow(Sipity::WorkflowResponsibility).to receive(:find).with('1').and_return(responsibility)
-      end
-
-      it "is successful" do
-        delete :destroy, params: { id: 1 }
-        expect(controller).to have_received(:authorize!).with(:destroy, Sipity::WorkflowResponsibility)
-        expect(response).to redirect_to admin_workflow_roles_path
-      end
-    end
-
-    context "when they don't have permission" do
-      it "throws a CanCan error" do
-        get :index
-        expect(response).to redirect_to main_app.new_user_session_path(locale: 'en')
-      end
-    end
-  end
-end

data/spec/controllers/hyrax/admin/workflows_controller_spec.rb

@@ -1,18 +0,0 @@
-RSpec.describe Hyrax::Admin::WorkflowsController do
-  describe "#index" do
-    before do
-      expect(controller).to receive(:authorize!).with(:review, :submissions).and_return(true)
-    end
-    it "is successful" do
-      expect(controller).to receive(:add_breadcrumb).with('Home', root_path)
-      expect(controller).to receive(:add_breadcrumb).with('Dashboard', dashboard_path)
-      expect(controller).to receive(:add_breadcrumb).with('Tasks', '#')
-      expect(controller).to receive(:add_breadcrumb).with('Review Submissions', "/admin/workflows")
-
-      get :index
-      expect(response).to be_successful
-      expect(assigns[:status_list]).to be_kind_of Hyrax::Workflow::StatusListService
-      expect(assigns[:published_list]).to be_kind_of Hyrax::Workflow::StatusListService
-    end
-  end
-end

data/spec/controllers/hyrax/api/items_controller_spec.rb

@@ -1,404 +0,0 @@
-RSpec.describe Hyrax::API::ItemsController, type: :controller do
-  let(:arkivo_actor) { double Hyrax::Arkivo::Actor }
-  let!(:user) { create(:user) }
-  let!(:default_work) do
-    create(:work,
-           title: ['Foo Bar'],
-           user: user,
-           arkivo_checksum: '6872d21557992f6ad1d07375f19fbfaf')
-  end
-
-  before do
-    # Mock Arkivo Actor
-    allow(controller).to receive(:actor).and_return(arkivo_actor)
-    # Don't test characterization on these items; it breaks TravisCI and it's slow
-    allow(CharacterizeJob).to receive(:perform_later)
-  end
-
-  subject { response }
-
-  context 'with an HTTP GET or HEAD' do
-    let(:token) { user.arkivo_token }
-    let(:item) { FactoryBot.json(:post_item, token: token) }
-    let(:item_hash) { JSON.parse(item) }
-
-    context 'with a missing token' do
-      before { get :show, params: { format: :json, id: default_work.id } }
-
-      it "is unauthorized" do
-        expect(subject).to have_http_status(401)
-        expect(subject.body).to include('invalid user token:')
-      end
-    end
-
-    context 'with an unfamiliar token' do
-      before { get :show, params: { format: :json, id: default_work.id, token: get_token } }
-      let(:get_token) { 'foobar' }
-
-      it "is unauthorized" do
-        expect(subject).to have_http_status(401)
-        expect(subject.body).to include("invalid user token: #{get_token}")
-      end
-    end
-
-    context 'with an unauthorized resource' do
-      before do
-        allow_any_instance_of(User).to receive(:can?).with(:edit, default_work) { false }
-        get :show, params: { format: :json, id: default_work.id, token: token }
-      end
-
-      it 'is unauthorized' do
-        expect(subject).to have_http_status(401)
-        expect(assigns[:work]).to eq default_work
-        expect(subject.body).to include("#{user} lacks access to #{default_work}")
-      end
-    end
-
-    context 'with a resource not deposited via Arkivo' do
-      before do
-        allow_any_instance_of(GenericWork).to receive(:arkivo_checksum) { nil }
-        get :show, params: { format: :json, id: default_work.id, token: token }
-      end
-
-      it "is forbidden" do
-        expect(subject).to have_http_status(403)
-        expect(subject.body).to include("Forbidden: #{default_work} not deposited via Arkivo")
-      end
-    end
-
-    context 'with a resource not found in the repository' do
-      let(:relation) { double }
-
-      before do
-        allow(Hyrax::WorkRelation).to receive(:new).and_return(relation)
-        allow(relation).to receive(:find).with(default_work.id).and_raise(ActiveFedora::ObjectNotFoundError)
-        get :show, params: { format: :json, id: default_work.id, token: token }
-      end
-
-      it "is not found" do
-        expect(subject).to have_http_status(404)
-        expect(subject.body).to include("id '#{default_work.id}' not found")
-      end
-    end
-
-    context 'with an authorized Arkivo-deposited resource' do
-      before { get :show, params: { format: :json, id: default_work.id, token: token } }
-
-      specify do
-        expect(subject).to have_http_status(204)
-        expect(subject.body).to be_blank
-      end
-    end
-  end
-
-  context 'with an HTTP POST' do
-    context 'without an item' do
-      before { post :create, params: { format: :json } }
-
-      it "is an bad request" do
-        expect(subject).to have_http_status(400)
-        expect(subject.body).to include('no item parameter')
-      end
-    end
-
-    context 'with an invalid item' do
-      before { post :create, body: item, params: { format: :json } }
-      let(:item) { { foo: 'bar' }.to_json }
-
-      it "is a bad request" do
-        expect(subject).to have_http_status(400)
-        expect(subject.body).to include('The property \'#/\' did not contain a required property of \'token\'')
-      end
-    end
-
-    context 'post with a valid item and matching token' do
-      let(:deposited_file) { FileSet.where(label: item_hash['file']['filename']).take }
-      let(:a_work) { build :generic_work, id: '123' }
-      let!(:token) { user.arkivo_token }
-      let(:item) { FactoryBot.json(:post_item, token: token) }
-      let(:item_hash) { JSON.parse(item) }
-
-      before do
-        # Mock arkivo actor functions
-        allow(arkivo_actor).to receive(:create_work_from_item).and_return(a_work)
-        # https://github.com/samvera/active_fedora/issues/1251
-        allow(a_work).to receive(:persisted?).and_return(true)
-      end
-
-      it "delegates creating the work to the actor" do
-        expect(arkivo_actor).to receive(:create_work_from_item)
-        post :create, body: item, params: { format: :json }
-      end
-
-      # TODO: This test belongs in the Actor test as an integration test.
-      specify do
-        pending 'move test to arkivo actor spec as integration test.'
-        expect(response).to be_success
-        expect(response.status).to eq 201
-        expect(response.headers['Location']).to match %r{/api/items/.{9}}
-        expect(deposited_file).not_to be_nil
-        expect(deposited_work.arkivo_checksum).to eq item_hash['file']['md5']
-        expect(deposited_file.original_file.content).to eq "arkivo\n"
-        expect(deposited_work.resource_type).to eq [item_hash['metadata']['resourceType']]
-        expect(deposited_work.title).to eq [item_hash['metadata']['title']]
-        expect(deposited_work.description).to eq [item_hash['metadata']['description']]
-        expect(deposited_work.publisher).to eq [item_hash['metadata']['publisher']]
-        expect(deposited_work.date_created).to eq [item_hash['metadata']['dateCreated']]
-        expect(deposited_work.based_near).to eq [item_hash['metadata']['basedNear']]
-        expect(deposited_work.identifier).to eq [item_hash['metadata']['identifier']]
-        expect(deposited_work.related_url).to eq [item_hash['metadata']['url']]
-        expect(deposited_work.language).to eq [item_hash['metadata']['language']]
-        expect(deposited_work.rights).to eq [item_hash['metadata']['rights']]
-        expect(deposited_work.keyword).to match_array item_hash['metadata']['tags']
-        expect(deposited_work.creator).to match_array ['Doe, John', 'Babs McGee']
-        expect(deposited_work.contributor).to match_array ['Nadal, Rafael', 'Jane Doeski']
-      end
-    end
-
-    context 'with a valid item and unfamiliar token' do
-      before { post :create, body: item, params: { format: :json } }
-
-      let(:token) { 'unfamiliar_token' }
-      let(:item) { FactoryBot.json(:post_item, token: token) }
-
-      it "is unathorized" do
-        expect(response).not_to be_success
-        expect(subject.status).to eq 401
-        expect(subject.body).to include("invalid user token: #{token}")
-      end
-    end
-  end
-
-  context 'with an HTTP PUT' do
-    let(:put_item) { FactoryBot.json(:put_item, token: token) }
-    let(:token) { user.arkivo_token }
-    let(:gw) { build :generic_work, id: '123' }
-    let(:relation) { double }
-
-    before do
-      # Mock ActiveFedora
-      allow(Hyrax::WorkRelation).to receive(:new).and_return(relation)
-      allow(relation).to receive(:find).with(gw.id).and_return(gw)
-      # Mock Arkivo Actor
-      allow(arkivo_actor).to receive(:update_work_from_item)
-    end
-
-    context 'put update with a valid item, matching token, and authorized resource' do
-      let(:put_item_hash) { JSON.parse(put_item) }
-
-      let(:validator) { double Hyrax::Arkivo::SchemaValidator }
-
-      before do
-        # Mock Arkivo Validator and Actor
-        allow(Hyrax::Arkivo::SchemaValidator).to receive(:new).and_return(validator)
-        allow(validator).to receive(:call).and_return(true)
-        # Mock loading and authorizing
-        allow(controller).to receive(:my_load_and_authorize_resource).and_return(gw)
-      end
-
-      it 'calls the arkivo actor to update the work' do
-        expect(arkivo_actor).to receive(:update_work_from_item)
-        request.env['RAW_POST_DATA'] = put_item
-        put :update, params: { id: gw.id, format: :json }
-      end
-    end
-
-    context 'with a valid item, matching token, authorized resource, but not Arkivo-deposited' do
-      let(:non_arkivo_gw) { create :generic_work, id: 'abc123xyz', arkivo_checksum: nil }
-      let(:relation) { double }
-
-      before do
-        # Mock user authorization
-        allow(controller).to receive(:user).and_return(user)
-        allow(user).to receive(:can?).and_return(true)
-        # Mock ActiveFedora for non_arkivo_work
-        allow(Hyrax::WorkRelation).to receive(:new).and_return(relation)
-        allow(relation).to receive(:find).with(non_arkivo_gw.id).and_return(non_arkivo_gw)
-
-        # Post an update to a work with a nil arkivo_checksum
-        request.env['RAW_POST_DATA'] = put_item
-        put :update, params: { id: non_arkivo_gw.id, format: :json }
-      end
-
-      it "is forbidden" do
-        expect(subject).not_to be_success
-        expect(subject.status).to eq 403
-        expect(subject.body).to include("Forbidden: #{non_arkivo_gw} not deposited via Arkivo")
-      end
-    end
-
-    context 'with a valid item, matching token, missing resource' do
-      let(:relation) { double }
-
-      before do
-        allow(Hyrax::WorkRelation).to receive(:new).and_return(relation)
-        allow(relation).to receive(:find).with(gw.id) do
-          raise(ActiveFedora::ObjectNotFoundError)
-        end
-        request.env['RAW_POST_DATA'] = put_item
-        put :update, params: { id: gw.id, format: :json }
-      end
-
-      it "is not found" do
-        expect(subject).to have_http_status(404)
-        expect(subject.body).to include("id '#{gw.id}' not found")
-      end
-    end
-
-    context 'with a valid item, matching token, and unauthorized resource' do
-      before do
-        # Mock user authorization
-        allow(controller).to receive(:user).and_return(user)
-        allow(user).to receive(:can?).and_return(false)
-        # Post an update with an resource unauthorized for the user
-        request.env['RAW_POST_DATA'] = put_item
-        put :update, params: { id: gw.id, format: :json }
-      end
-
-      it "is unauthorized" do
-        expect(subject).not_to be_success
-        expect(assigns[:work]).to eq gw
-        expect(subject.status).to eq 401
-        expect(subject.body).to include("#{user} lacks access to #{gw}")
-      end
-    end
-
-    context 'with a valid item and unfamiliar token' do
-      let(:bad_token) { 'unfamiliar_token' }
-      let(:bad_token_item) { FactoryBot.json(:put_item, token: bad_token) }
-
-      before do
-        request.env['RAW_POST_DATA'] = bad_token_item
-        put :update, params: { id: gw.id, format: :json }
-      end
-
-      it "is unauthorized" do
-        expect(subject).not_to be_success
-        expect(subject.status).to eq 401
-        expect(subject.body).to include("invalid user token: #{bad_token}")
-      end
-    end
-
-    context 'with an invalid item' do
-      let(:invalid_item) { { foo: 'bar' }.to_json }
-
-      before do
-        request.env['RAW_POST_DATA'] = invalid_item
-        put :update, params: { id: gw.id, format: :json }
-      end
-
-      it "is a bad request" do
-        expect(subject).to have_http_status(400)
-        expect(subject.body).to include('The property \'#/\' did not contain a required property of \'token\'')
-      end
-    end
-  end
-
-  context 'with an HTTP DELETE' do
-    let(:token) { user.arkivo_token }
-    let(:item) { FactoryBot.json(:post_item, token: token) }
-    let(:item_hash) { JSON.parse(item) }
-    let(:gw) { build :generic_work, id: '123' }
-    let(:relation) { double }
-
-    before do
-      # Mock ActiveFedora
-      allow(Hyrax::WorkRelation).to receive(:new).and_return(relation)
-      allow(relation).to receive(:find).with(gw.id).and_return(gw)
-      # Mock ArkivoActor destroy work
-      allow(arkivo_actor).to receive(:destroy_work)
-    end
-
-    context 'with a missing token' do
-      before { delete :destroy, params: { format: :json, id: gw.id } }
-
-      it "is unauthorized." do
-        expect(subject).to have_http_status(401)
-        expect(subject.body).to include('invalid user token:')
-      end
-    end
-
-    context 'with an unfamiliar token' do
-      let(:bad_token) { 'foobar' }
-
-      before do
-        # Mock not being able to find the user due to bad token
-        allow(controller).to receive(:user).and_return(nil)
-        delete :destroy, params: { format: :json, id: gw.id, token: bad_token }
-      end
-
-      specify do
-        expect(subject).to have_http_status(401)
-        expect(subject.body).to include("invalid user token: #{bad_token}")
-      end
-    end
-
-    context 'with an unauthorized resource' do
-      before do
-        # Mock user being unauthorized
-        allow(controller).to receive(:user).and_return(user)
-        allow(user).to receive(:can?).with(:edit, gw) { false }
-        delete :destroy, params: { format: :json, id: gw.id, token: token }
-      end
-
-      it 'is unauthorized' do
-        expect(subject).to have_http_status(401)
-        expect(assigns[:work]).to eq gw
-        expect(subject.body).to include("#{user} lacks access to #{gw}")
-      end
-    end
-
-    context 'with a resource not deposited via Arkivo' do
-      let(:non_arkivo_gw) { create :generic_work, id: 'xyz789abc', arkivo_checksum: nil }
-
-      before do
-        # Mock user authorization
-        allow(controller).to receive(:user).and_return(user)
-        allow(user).to receive(:can?).and_return(true)
-        # Mock ActiveFedora for non_arkivo_work
-        allow(Hyrax::WorkRelation).to receive(:new).and_return(relation)
-        allow(relation).to receive(:find).with(non_arkivo_gw.id).and_return(non_arkivo_gw)
-        # Make call to destroy
-        delete :destroy, params: { format: :json, id: non_arkivo_gw.id, token: token }
-      end
-
-      it "is forbidden" do
-        expect(subject).to have_http_status(403)
-        expect(subject.body).to include("Forbidden: #{gw} not deposited via Arkivo")
-      end
-    end
-
-    context 'with a resource not found in the repository' do
-      let(:not_found_id) { '409' }
-
-      before do
-        # Mock ActiveFedora
-        allow(Hyrax::WorkRelation).to receive(:new).and_return(relation)
-        allow(relation).to receive(:find).with(not_found_id).and_raise(ActiveFedora::ObjectNotFoundError)
-        delete :destroy, params: { format: :json, id: not_found_id, token: token }
-      end
-
-      it "is not found" do
-        expect(subject).to have_http_status(404)
-        expect(subject.body).to include("id '#{not_found_id}' not found")
-      end
-    end
-
-    context 'with an authorized Arkivo-deposited resource' do
-      before do
-        # Mock user authorization
-        allow(controller).to receive(:user).and_return(user)
-        allow(user).to receive(:can?).and_return(true)
-        # Mock loading and authorizing
-        allow(controller).to receive(:my_load_and_authorize_resource).and_return(gw)
-      end
-
-      it "calls the actor to destroy the work" do
-        expect(arkivo_actor).to receive(:destroy_work)
-        delete :destroy, params: { format: :json, id: gw.id, token: token }
-        expect(subject).to have_http_status(204)
-        expect(subject.body).to be_blank
-      end
-    end
-  end
-end