hyrax 2.9.5 → 3.0.0.pre.beta1

data/spec/abilities/embargo_and_lease_ability_spec.rb

@@ -0,0 +1,22 @@
+require 'cancan/matchers'
+
+RSpec.describe "Ability on embargos and leases" do
+  subject { Ability.new(current_user) }
+
+  let(:current_user) { create(:user) }
+
+  describe "a regular user" do
+    it do
+      is_expected.not_to be_able_to :index, Hydra::AccessControls::Embargo
+      is_expected.not_to be_able_to :index, Hydra::AccessControls::Lease
+    end
+  end
+
+  describe "an admin user" do
+    before { allow(current_user).to receive(:groups).and_return(['admin']) }
+    it do
+      is_expected.to be_able_to :index, Hydra::AccessControls::Embargo
+      is_expected.to be_able_to :index, Hydra::AccessControls::Lease
+    end
+  end
+end

data/spec/abilities/file_set_abilities_spec.rb

@@ -0,0 +1,70 @@
+require 'cancan/matchers'
+
+RSpec.describe 'User' do
+  describe 'Abilities' do
+    subject { ability }
+
+    let(:ability) { Ability.new(current_user) }
+    let(:visibility) { Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE }
+    let(:creating_user) { create(:user) }
+    let(:user) { create(:user) }
+    let(:current_user) { user }
+    let(:generic_work) { create(:generic_work, visibility: visibility, user: creating_user) }
+    let(:file_set) { create(:file_set, visibility: visibility, user: creating_user) }
+
+    describe 'without embargo' do
+      describe 'creator of object' do
+        let(:creating_user) { user }
+        let(:current_user) { user }
+
+        it do
+          is_expected.to be_able_to(:create, FileSet.new)
+          is_expected.to be_able_to(:versions, file_set)
+          is_expected.to be_able_to(:read, file_set)
+          is_expected.to be_able_to(:update, file_set)
+          is_expected.not_to be_able_to(:delete, file_set)
+        end
+      end
+
+      describe 'as a repository manager' do
+        let(:manager_user) { create(:admin) }
+        let(:creating_user) { user }
+        let(:current_user) { manager_user }
+
+        it do
+          is_expected.to be_able_to(:create, FileSet.new)
+          is_expected.to be_able_to(:versions, file_set)
+          is_expected.to be_able_to(:read, file_set)
+          is_expected.to be_able_to(:update, file_set)
+          is_expected.to be_able_to(:destroy, file_set)
+        end
+      end
+
+      describe 'another authenticated user' do
+        let(:creating_user) { create(:user) }
+        let(:current_user) { user }
+
+        it do
+          is_expected.to be_able_to(:create, FileSet.new)
+          is_expected.not_to be_able_to(:versions, file_set)
+          is_expected.not_to be_able_to(:read, file_set)
+          is_expected.not_to be_able_to(:update, file_set)
+          is_expected.not_to be_able_to(:delete, file_set)
+        end
+      end
+
+      describe 'a nil user' do
+        let(:creating_user) { create(:user) }
+        let(:current_user) { nil }
+
+        it do
+          is_expected.not_to be_able_to(:create, FileSet.new)
+          is_expected.not_to be_able_to(:versions, file_set)
+          is_expected.not_to be_able_to(:read, file_set)
+          is_expected.not_to be_able_to(:update, file_set)
+          is_expected.not_to be_able_to(:delete, file_set)
+        end
+      end
+    end
+  end
+end

data/spec/abilities/generic_work_abilities_spec.rb

@@ -0,0 +1,63 @@
+require 'cancan/matchers'
+
+RSpec.describe 'User' do
+  describe 'Abilities' do
+    subject { Ability.new(current_user) }
+
+    let(:generic_work) { create(:private_generic_work, user: creating_user) }
+    let(:user) { create(:user) }
+
+    describe 'without embargo' do
+      describe 'creator of object' do
+        let(:creating_user) { user }
+        let(:current_user) { user }
+
+        it do
+          is_expected.to be_able_to(:create, GenericWork.new)
+          is_expected.to be_able_to(:read, generic_work)
+          is_expected.to be_able_to(:update, generic_work)
+          is_expected.to be_able_to(:destroy, generic_work)
+        end
+      end
+
+      describe 'as a repository manager' do
+        let(:manager_user) { create(:admin) }
+        let(:creating_user) { user }
+        let(:current_user) { manager_user }
+
+        it do
+          is_expected.to be_able_to(:create, GenericWork.new)
+          is_expected.to be_able_to(:read, generic_work)
+          is_expected.to be_able_to(:update, generic_work)
+          is_expected.to be_able_to(:destroy, generic_work)
+        end
+      end
+
+      describe 'another authenticated user' do
+        let(:creating_user) { create(:user) }
+        let(:current_user) { user }
+
+        it do
+          is_expected.to be_able_to(:create, GenericWork.new)
+          is_expected.not_to be_able_to(:read, generic_work)
+          is_expected.not_to be_able_to(:update, generic_work)
+          is_expected.not_to be_able_to(:destroy, generic_work)
+          is_expected.to be_able_to(:collect, generic_work)
+        end
+      end
+
+      describe 'a nil user' do
+        let(:creating_user) { create(:user) }
+        let(:current_user) { nil }
+
+        it do
+          is_expected.not_to be_able_to(:create, GenericWork.new)
+          is_expected.not_to be_able_to(:read, generic_work)
+          is_expected.not_to be_able_to(:update, generic_work)
+          is_expected.not_to be_able_to(:destroy, generic_work)
+          is_expected.not_to be_able_to(:collect, generic_work)
+        end
+      end
+    end
+  end
+end

data/spec/abilities/operation_ability_spec.rb

@@ -0,0 +1,12 @@
+require 'cancan/matchers'
+
+RSpec.describe 'Abilities for Operations', type: :model do
+  describe "a registered user" do
+    subject { Ability.new(user) }
+
+    let(:user) { create(:user) }
+
+    it { is_expected.to be_able_to(:read, build(:operation, user: user)) }
+    it { is_expected.not_to be_able_to(:read, build(:operation)) }
+  end
+end

data/spec/abilities/permission_template_ability_spec.rb

@@ -0,0 +1,145 @@
+require 'cancan/matchers'
+
+RSpec.describe 'PermissionTemplateAbility' do
+  subject { ability }
+
+  let(:ability) { Ability.new(current_user) }
+  let(:user) { create(:user) }
+  let(:current_user) { user }
+  let(:collection_type_gid) { create(:collection_type).gid }
+
+  let!(:collection) { create(:collection, with_permission_template: true, collection_type_gid: collection_type_gid) }
+  let(:permission_template) { collection.permission_template }
+  let!(:permission_template_access) do
+    create(:permission_template_access,
+           :manage,
+           permission_template: permission_template,
+           agent_type: 'group',
+           agent_id: 'manage_group')
+  end
+
+  context 'when admin user' do
+    let(:user) { FactoryBot.create(:admin) }
+
+    it 'allows all template abilities' do
+      is_expected.to be_able_to(:manage, Hyrax::PermissionTemplate)
+      is_expected.to be_able_to(:create, permission_template)
+      is_expected.to be_able_to(:edit, permission_template)
+      is_expected.to be_able_to(:update, permission_template)
+      is_expected.to be_able_to(:destroy, permission_template)
+    end
+
+    it 'allows all template access abilities' do
+      is_expected.to be_able_to(:manage, Hyrax::PermissionTemplateAccess)
+      is_expected.to be_able_to(:create, permission_template_access)
+      is_expected.to be_able_to(:edit, permission_template_access)
+      is_expected.to be_able_to(:update, permission_template_access)
+      is_expected.to be_able_to(:destroy, permission_template_access)
+    end
+  end
+
+  context 'when user has manage access for the source' do
+    before do
+      create(:permission_template_access,
+             :manage,
+             permission_template: permission_template,
+             agent_type: 'user',
+             agent_id: user.user_key)
+      collection.reset_access_controls!
+    end
+
+    it 'allows most template abilities' do
+      is_expected.to be_able_to(:create, permission_template)
+      is_expected.to be_able_to(:edit, permission_template)
+      is_expected.to be_able_to(:update, permission_template)
+      is_expected.to be_able_to(:destroy, permission_template)
+    end
+
+    it 'denies manage ability for template' do
+      is_expected.not_to be_able_to(:manage, Hyrax::PermissionTemplate)
+    end
+
+    it 'allows most template access abilities' do
+      is_expected.to be_able_to(:create, permission_template_access)
+      is_expected.to be_able_to(:edit, permission_template_access)
+      is_expected.to be_able_to(:update, permission_template_access)
+      is_expected.to be_able_to(:destroy, permission_template_access)
+    end
+
+    it 'denies manage ability for template access' do
+      is_expected.not_to be_able_to(:manage, Hyrax::PermissionTemplateAccess)
+    end
+  end
+
+  context 'when user has deposit access for the source' do
+    before do
+      create(:permission_template_access,
+             :deposit,
+             permission_template: permission_template,
+             agent_type: 'user',
+             agent_id: user.user_key)
+      collection.reset_access_controls!
+    end
+
+    it 'denies all template abilities' do
+      is_expected.not_to be_able_to(:manage, Hyrax::PermissionTemplate)
+      is_expected.not_to be_able_to(:create, permission_template)
+      is_expected.not_to be_able_to(:edit, permission_template)
+      is_expected.not_to be_able_to(:update, permission_template)
+      is_expected.not_to be_able_to(:destroy, permission_template)
+    end
+
+    it 'denies all template access abilities' do
+      is_expected.not_to be_able_to(:manage, Hyrax::PermissionTemplateAccess)
+      is_expected.not_to be_able_to(:create, permission_template_access)
+      is_expected.not_to be_able_to(:edit, permission_template_access)
+      is_expected.not_to be_able_to(:update, permission_template_access)
+      is_expected.not_to be_able_to(:destroy, permission_template_access)
+    end
+  end
+
+  context 'when user has view access for the source' do
+    before do
+      create(:permission_template_access,
+             :view,
+             permission_template: permission_template,
+             agent_type: 'user',
+             agent_id: user.user_key)
+      collection.reset_access_controls!
+    end
+
+    it 'denies all template abilities' do
+      is_expected.not_to be_able_to(:manage, Hyrax::PermissionTemplate)
+      is_expected.not_to be_able_to(:create, permission_template)
+      is_expected.not_to be_able_to(:edit, permission_template)
+      is_expected.not_to be_able_to(:update, permission_template)
+      is_expected.not_to be_able_to(:destroy, permission_template)
+    end
+
+    it 'denies all template access abilities' do
+      is_expected.not_to be_able_to(:manage, Hyrax::PermissionTemplateAccess)
+      is_expected.not_to be_able_to(:create, permission_template_access)
+      is_expected.not_to be_able_to(:edit, permission_template_access)
+      is_expected.not_to be_able_to(:update, permission_template_access)
+      is_expected.not_to be_able_to(:destroy, permission_template_access)
+    end
+  end
+
+  context 'when user has no special access' do
+    it 'denies all template abilities' do
+      is_expected.not_to be_able_to(:manage, Hyrax::PermissionTemplate)
+      is_expected.not_to be_able_to(:create, permission_template)
+      is_expected.not_to be_able_to(:edit, permission_template)
+      is_expected.not_to be_able_to(:update, permission_template)
+      is_expected.not_to be_able_to(:destroy, permission_template)
+    end
+
+    it 'denies all template access abilities' do
+      is_expected.not_to be_able_to(:manage, Hyrax::PermissionTemplateAccess)
+      is_expected.not_to be_able_to(:create, permission_template_access)
+      is_expected.not_to be_able_to(:edit, permission_template_access)
+      is_expected.not_to be_able_to(:update, permission_template_access)
+      is_expected.not_to be_able_to(:destroy, permission_template_access)
+    end
+  end
+end

data/spec/abilities/proxies_and_transfer_abilities_spec.rb

@@ -0,0 +1,109 @@
+require 'cancan/matchers'
+
+RSpec.describe 'Proxy and Transfer Abilities' do
+  subject { ability }
+
+  let(:ability) { Ability.new(user) }
+  let(:user) { create(:user) }
+
+  describe "Transfers" do
+    before do
+      allow(Flipflop).to receive(:transfer_works?).and_return(enabled)
+      allow(ability).to receive(:user_is_depositor?).with('777').and_return(mine)
+    end
+    let(:work_id) { '777' }
+
+    describe "when transfers are enabled" do
+      let(:enabled) { true }
+
+      context "a work belonging to someone else" do
+        let(:mine) { false }
+
+        it { is_expected.not_to be_able_to(:transfer, work_id) }
+      end
+
+      context "my own work" do
+        let(:mine) { true }
+
+        it { is_expected.to be_able_to(:transfer, work_id) }
+      end
+    end
+
+    describe "when transfers are disabled" do
+      let(:enabled) { false }
+
+      let(:mine) { true }
+
+      it { is_expected.not_to be_able_to(:transfer, work_id) }
+    end
+  end
+
+  describe "#user_is_depositor?" do
+    let(:work) { create(:work) }
+
+    subject { ability.send(:user_is_depositor?, work.id) }
+
+    it { is_expected.to be false }
+  end
+
+  describe "ProxyDepositRequests" do
+    let(:sender) { create(:user) }
+    let(:work) { create(:work, user: sender) }
+
+    context "creating a ProxyDepositRequest" do
+      before do
+        allow(Flipflop).to receive(:proxy_deposit?).and_return(enabled)
+      end
+      describe "when proxy deposit is enabled" do
+        let(:enabled) { true }
+
+        context "for a registered user" do
+          it { is_expected.to be_able_to(:create, ProxyDepositRequest) }
+        end
+        context "for a guest user" do
+          let(:user) { create(:user, :guest) }
+
+          it { is_expected.not_to be_able_to(:create, ProxyDepositRequest) }
+        end
+      end
+
+      context "when disabled" do
+        let(:enabled) { false }
+
+        it { is_expected.not_to be_able_to(:create, ProxyDepositRequest) }
+      end
+    end
+
+    context "with a ProxyDepositRequest that they receive" do
+      let(:request) { ProxyDepositRequest.create!(work_id: work.id, receiving_user: user, sending_user: sender) }
+
+      it { is_expected.to be_able_to(:accept, request) }
+      it { is_expected.to be_able_to(:reject, request) }
+      it { is_expected.not_to be_able_to(:destroy, request) }
+
+      context "and the request has already been accepted" do
+        let(:request) { ProxyDepositRequest.create!(work_id: work.id, receiving_user: user, sending_user: sender, status: 'accepted') }
+
+        it { is_expected.not_to be_able_to(:accept, request) }
+        it { is_expected.not_to be_able_to(:reject, request) }
+        it { is_expected.not_to be_able_to(:destroy, request) }
+      end
+    end
+
+    context "with a ProxyDepositRequest they are the sender of" do
+      let(:request) { ProxyDepositRequest.create!(work_id: work.id, receiving_user: sender, sending_user: user) }
+
+      it { is_expected.not_to be_able_to(:accept, request) }
+      it { is_expected.not_to be_able_to(:reject, request) }
+      it { is_expected.to be_able_to(:destroy, request) }
+
+      context "and the request has already been accepted" do
+        let(:request) { ProxyDepositRequest.create!(work_id: work.id, receiving_user: sender, sending_user: user, status: 'accepted') }
+
+        it { is_expected.not_to be_able_to(:accept, request) }
+        it { is_expected.not_to be_able_to(:reject, request) }
+        it { is_expected.not_to be_able_to(:destroy, request) }
+      end
+    end
+  end
+end

data/spec/abilities/solr_document_ability_spec.rb

@@ -0,0 +1,27 @@
+require 'cancan/matchers'
+
+# rubocop:disable RSpec/EmptyExampleGroup
+RSpec.describe 'SolrDocumentAbility' do
+  subject { ability }
+
+  let(:ability) { Ability.new(current_user) }
+  let(:user) { create(:user) }
+  let(:current_user) { user }
+
+  context 'with Collection solr doc' do
+    # tested with collection's solr doc in collection_ability_spec.rb
+  end
+
+  context 'with admin_set' do
+    # tested with admin_set's solr doc in admin_set_ability_spec.rb
+  end
+
+  context 'with works' do
+    # TODO: Need tests for works
+  end
+
+  context 'with files' do
+    # TODO: Need tests for files
+  end
+end
+# rubocop:enable RSpec/EmptyExampleGroup