hyrax 2.9.5 → 3.0.0.pre.beta1

data/spec/controllers/hyrax/citations_controller_spec.rb

@@ -0,0 +1,61 @@
+RSpec.describe Hyrax::CitationsController do
+  describe "#work" do
+    let(:user) { create(:user) }
+    let(:work) { create(:work, user: user) }
+
+    context "with an authenticated_user" do
+      before do
+        sign_in user
+        request.env['HTTP_REFERER'] = 'http://test.host/foo'
+        create(:sipity_entity, proxy_for_global_id: work.to_global_id.to_s)
+      end
+
+      it "is successful" do
+        expect(controller).to receive(:add_breadcrumb).with('Home', Hyrax::Engine.routes.url_helpers.root_path(locale: 'en'))
+        expect(controller).to receive(:add_breadcrumb).with('Dashboard', Hyrax::Engine.routes.url_helpers.dashboard_path(locale: 'en'))
+        get :work, params: { id: work }
+        expect(response).to be_successful
+        expect(response).to render_template('layouts/hyrax/1_column')
+        expect(assigns(:presenter)).to be_kind_of Hyrax::WorkShowPresenter
+      end
+    end
+
+    context "with an unauthenticated user" do
+      it "is not successful" do
+        get :work, params: { id: work }
+        expect(response).to redirect_to main_app.new_user_session_path(locale: 'en')
+        expect(flash[:alert]).to eq "You are not authorized to access this page."
+        expect(session['user_return_to']).to eq request.url
+      end
+    end
+  end
+  describe "#file" do
+    let(:user) { create(:user) }
+    let(:file_set) { create(:file_set, user: user) }
+
+    context "with an authenticated_user" do
+      before do
+        sign_in user
+        request.env['HTTP_REFERER'] = 'http://test.host/foo'
+      end
+
+      it "is successful" do
+        expect(controller).to receive(:add_breadcrumb).with('Home', Hyrax::Engine.routes.url_helpers.root_path(locale: 'en'))
+        expect(controller).to receive(:add_breadcrumb).with('Dashboard', Hyrax::Engine.routes.url_helpers.dashboard_path(locale: 'en'))
+        get :file, params: { id: file_set }
+        expect(response).to be_successful
+        expect(response).to render_template('layouts/hyrax/1_column')
+        expect(assigns(:presenter)).to be_kind_of Hyrax::FileSetPresenter
+      end
+    end
+
+    context "with an unauthenticated user" do
+      it "is not successful" do
+        get :file, params: { id: file_set }
+        expect(response).to redirect_to main_app.new_user_session_path(locale: 'en')
+        expect(flash[:alert]).to eq "You are not authorized to access this page."
+        expect(session['user_return_to']).to eq request.url
+      end
+    end
+  end
+end

data/spec/controllers/hyrax/collections_controller_spec.rb

@@ -0,0 +1,126 @@
+RSpec.describe Hyrax::CollectionsController do
+  routes { Hyrax::Engine.routes }
+  let(:user)  { create(:user) }
+  let(:other) { build(:user) }
+
+  let(:collection) do
+    create(:public_collection, title: ["My collection"],
+                               description: ["My incredibly detailed description of the collection"],
+                               user: user)
+  end
+
+  let(:asset1)         { create(:work, title: ["First of the Assets"], user: user) }
+  let(:asset2)         { create(:work, title: ["Second of the Assets"], user: user) }
+  let(:asset3)         { create(:work, title: ["Third of the Assets"], user: user) }
+  let(:asset4)         { create(:collection, title: ["First subcollection"], user: user) }
+  let(:asset5)         { create(:collection, title: ["Second subcollection"], user: user) }
+  let(:unowned_asset)  { create(:work, user: other) }
+
+  let(:collection_attrs) do
+    { title: ['My First Collection'], description: ["The Description\r\n\r\nand more"] }
+  end
+
+  describe "#show" do # public landing page
+    context "when signed in" do
+      before do
+        sign_in user
+        [asset1, asset2, asset3, asset4, asset5].each do |asset|
+          asset.member_of_collections = [collection]
+          asset.save
+        end
+      end
+
+      it "returns the collection and its members" do # rubocop:disable RSpec/ExampleLength
+        expect(controller).to receive(:add_breadcrumb).with('Home', Hyrax::Engine.routes.url_helpers.root_path(locale: 'en'))
+        expect(controller).to receive(:add_breadcrumb).with(I18n.t('hyrax.dashboard.title'), Hyrax::Engine.routes.url_helpers.dashboard_path(locale: 'en'))
+        get :show, params: { id: collection }
+        expect(response).to be_successful
+        expect(response).to render_template("layouts/hyrax/1_column")
+        expect(assigns[:presenter]).to be_kind_of Hyrax::CollectionPresenter
+        expect(assigns[:presenter].title).to match_array collection.title
+        expect(assigns[:member_docs].map(&:id)).to match_array [asset1, asset2, asset3].map(&:id)
+        expect(assigns[:subcollection_docs].map(&:id)).to match_array [asset4, asset5].map(&:id)
+        expect(assigns[:members_count]).to eq(3)
+        expect(assigns[:subcollection_count]).to eq(2)
+      end
+
+      context "and searching" do
+        it "returns some works and subcollections" do
+          # "/collections/4m90dv529?utf8=%E2%9C%93&cq=King+Louie&sort="
+          get :show, params: { id: collection, cq: "Second" }
+          expect(assigns[:presenter]).to be_kind_of Hyrax::CollectionPresenter
+          expect(assigns[:member_docs].map(&:id)).to match_array [asset2].map(&:id)
+          expect(assigns[:subcollection_docs].map(&:id)).to match_array [asset5].map(&:id)
+          expect(assigns[:members_count]).to eq(1)
+          expect(assigns[:subcollection_count]).to eq(1)
+        end
+      end
+
+      context 'when the page parameter is passed' do
+        it 'loads the collection (paying no attention to the page param)' do
+          get :show, params: { id: collection, page: '2' }
+          expect(response).to be_successful
+          expect(assigns[:presenter]).to be_kind_of Hyrax::CollectionPresenter
+          expect(assigns[:presenter].to_s).to eq 'My collection'
+        end
+      end
+
+      context "without a referer" do
+        it "sets breadcrumbs" do
+          expect(controller).to receive(:add_breadcrumb).with('Home', Hyrax::Engine.routes.url_helpers.root_path(locale: 'en'))
+          expect(controller).to receive(:add_breadcrumb).with(I18n.t('hyrax.dashboard.title'), Hyrax::Engine.routes.url_helpers.dashboard_path(locale: 'en'))
+          get :show, params: { id: collection }
+          expect(response).to be_successful
+        end
+      end
+
+      context "with a referer" do
+        before do
+          request.env['HTTP_REFERER'] = 'http://test.host/foo'
+        end
+
+        it "sets breadcrumbs" do
+          expect(controller).to receive(:add_breadcrumb).with('Home', Hyrax::Engine.routes.url_helpers.root_path(locale: 'en'))
+          expect(controller).to receive(:add_breadcrumb).with('Dashboard', Hyrax::Engine.routes.url_helpers.dashboard_path(locale: 'en'))
+          expect(controller).to receive(:add_breadcrumb).with('Collections', Hyrax::Engine.routes.url_helpers.my_collections_path(locale: 'en'))
+          expect(controller).to receive(:add_breadcrumb).with('My collection', collection_path(collection.id, locale: 'en'), "aria-current" => "page")
+          get :show, params: { id: collection }
+          expect(response).to be_successful
+        end
+      end
+    end
+
+    context "not signed in" do
+      it "does not show me files in the collection" do
+        get :show, params: { id: collection }
+        expect(assigns[:member_docs].count).to eq 0
+        expect(assigns[:subcollection_docs].count).to eq 0
+      end
+    end
+
+    context "without a referer" do
+      it "sets breadcrumbs" do
+        expect(controller).not_to receive(:add_breadcrumb).with(I18n.t('hyrax.dashboard.title'), Hyrax::Engine.routes.url_helpers.dashboard_path(locale: 'en'))
+        expect(controller).not_to receive(:add_breadcrumb).with('Your Collections', Hyrax::Engine.routes.url_helpers.my_collections_path(locale: 'en'))
+        expect(controller).not_to receive(:add_breadcrumb).with('My collection', collection_path(collection.id, locale: 'en'))
+
+        get :show, params: { id: collection }
+        expect(response).to be_successful
+      end
+    end
+
+    context "with a referer" do
+      before do
+        request.env['HTTP_REFERER'] = 'http://test.host/foo'
+      end
+
+      it "sets breadcrumbs" do
+        expect(controller).not_to receive(:add_breadcrumb).with(I18n.t('hyrax.dashboard.title'), Hyrax::Engine.routes.url_helpers.dashboard_path(locale: 'en'))
+        expect(controller).not_to receive(:add_breadcrumb).with('Your Collections', Hyrax::Engine.routes.url_helpers.my_collections_path(locale: 'en'))
+        expect(controller).to receive(:add_breadcrumb).with('My collection', collection_path(collection.id, locale: 'en'), "aria-current" => "page")
+        get :show, params: { id: collection }
+        expect(response).to be_successful
+      end
+    end
+  end
+end

data/spec/controllers/hyrax/contact_form_controller_spec.rb

@@ -0,0 +1,96 @@
+RSpec.describe Hyrax::ContactFormController do
+  let(:user) { create(:user) }
+  let(:required_params) do
+    {
+      category: "Depositing content",
+      name: "Rose Tyler",
+      email: "rose@timetraveler.org",
+      subject: "The Doctor",
+      message: "Run."
+    }
+  end
+
+  before { sign_in(user) }
+
+  describe "#new" do
+    subject { response }
+
+    before { get :new }
+    it { is_expected.to be_success }
+  end
+
+  describe "#create" do
+    subject { flash }
+
+    before { post :create, params: { contact_form: params } }
+    context "with the required parameters" do
+      let(:params) { required_params }
+
+      its(:notice) { is_expected.to eq("Thank you for your message!") }
+    end
+
+    context "without a category" do
+      let(:params)  { required_params.except(:category) }
+
+      its([:error]) { is_expected.to eq("Sorry, this message was not sent successfully. Category can't be blank") }
+    end
+
+    context "without a name" do
+      let(:params)  { required_params.except(:name) }
+
+      its([:error]) { is_expected.to eq("Sorry, this message was not sent successfully. Name can't be blank") }
+    end
+
+    context "without an email" do
+      let(:params)  { required_params.except(:email) }
+
+      its([:error]) { is_expected.to eq("Sorry, this message was not sent successfully. Email can't be blank") }
+    end
+
+    context "without a subject" do
+      let(:params)  { required_params.except(:subject) }
+
+      its([:error]) { is_expected.to eq("Sorry, this message was not sent successfully. Subject can't be blank") }
+    end
+
+    context "without a message" do
+      let(:params)  { required_params.except(:message) }
+
+      its([:error]) { is_expected.to eq("Sorry, this message was not sent successfully. Message can't be blank") }
+    end
+
+    context "with an invalid email" do
+      let(:params)  { required_params.merge(email: "bad-wolf") }
+
+      its([:error]) { is_expected.to eq("Sorry, this message was not sent successfully. Email is invalid") }
+    end
+  end
+
+  describe "#after_deliver" do
+    context "with a successful email" do
+      it "calls #after_deliver" do
+        expect(controller).to receive(:after_deliver)
+        post :create, params: { contact_form: required_params }
+      end
+    end
+    context "with an unsuccessful email" do
+      it "does not call #after_deliver" do
+        expect(controller).not_to receive(:after_deliver)
+        post :create, params: { contact_form: required_params.except(:email) }
+      end
+    end
+  end
+
+  context "when encoutering a RuntimeError" do
+    let(:logger) { double(info?: true) }
+
+    before do
+      allow(controller).to receive(:logger).and_return(logger)
+      allow(Hyrax::ContactMailer).to receive(:contact).and_raise(RuntimeError)
+    end
+    it "is logged via Rails" do
+      expect(logger).to receive(:error).with("Contact form failed to send: #<RuntimeError: RuntimeError>")
+      post :create, params: { contact_form: required_params }
+    end
+  end
+end

data/spec/controllers/hyrax/content_blocks_controller_spec.rb

@@ -0,0 +1,71 @@
+RSpec.describe Hyrax::ContentBlocksController, type: :controller do
+  let!(:announcement_text) do
+    create(:content_block, name: 'announcement_text')
+  end
+  let!(:marketing_text) do
+    create(:content_block, name: 'marketing_text')
+  end
+  let!(:featured_researcher) do
+    create(:content_block, name: 'featured_researcher')
+  end
+
+  before do
+    sign_in user
+  end
+
+  context 'with an unprivileged user' do
+    let(:user) { create(:user) }
+
+    describe "GET #edit" do
+      it "denies the request" do
+        get :edit
+        expect(response).to have_http_status(401)
+      end
+    end
+
+    describe "PATCH #update" do
+      it "denies the request" do
+        patch :update, params: { id: 1 }
+        expect(response).to have_http_status(401)
+      end
+    end
+  end
+
+  context 'with an administrator' do
+    let(:user) { create(:admin) }
+
+    describe "GET #edit" do
+      it "renders breadcrumbs" do
+        expect(controller).to receive(:add_breadcrumb).with('Home', root_path)
+        expect(controller).to receive(:add_breadcrumb).with('Dashboard', dashboard_path)
+        expect(controller).to receive(:add_breadcrumb).with('Configuration', '#')
+        expect(controller).to receive(:add_breadcrumb).with('Content Blocks', edit_content_blocks_path)
+        get :edit
+        expect(response).to have_http_status(200)
+      end
+    end
+
+    describe "PATCH #update" do
+      it "updates the announcement text" do
+        patch :update, params: { id: announcement_text.id, content_block: { announcement: 'Now Hiring!' } }
+        expect(response).to redirect_to(edit_content_blocks_path)
+        expect(flash[:notice]).to include 'Content blocks updated'
+        expect(ContentBlock.announcement_text.value).to eq "Now Hiring!"
+      end
+
+      it "updates the marketing text" do
+        patch :update, params: { id: marketing_text.id, content_block: { marketing: '99 days since last crash!' } }
+        expect(response).to redirect_to(edit_content_blocks_path)
+        expect(flash[:notice]).to include 'Content blocks updated'
+        expect(ContentBlock.marketing_text.value).to eq "99 days since last crash!"
+      end
+
+      it "updates the featured researcher" do
+        patch :update, params: { id: featured_researcher.id, content_block: { researcher: 'Jane Doe is unimpeachable' } }
+        expect(response).to redirect_to(edit_content_blocks_path)
+        expect(flash[:notice]).to include 'Content blocks updated'
+        expect(ContentBlock.featured_researcher.value).to eq "Jane Doe is unimpeachable"
+      end
+    end
+  end
+end

data/spec/controllers/hyrax/dashboard/collection_members_controller_spec.rb

@@ -0,0 +1,408 @@
+RSpec.describe Hyrax::Dashboard::CollectionMembersController, :clean_repo do
+  routes { Hyrax::Engine.routes }
+  let(:user)  { create(:user) }
+  let(:other) { build(:user) }
+
+  let(:work_1_own) { create(:work, id: 'work-1-own', title: ['First of the Assets'], user: user) }
+  let(:work_2_own) { create(:work, id: 'work-2-own', title: ['Second of the Assets'], user: user) }
+  let(:work_3_own) { create(:work, id: 'work-3-own', title: ['Third of the Assets'], user: user) }
+  let(:work_4_edit) { create(:work, id: 'work-4-edit', title: ["Other's work with edit access"], user: other, edit_users: [user]) }
+  let(:work_5_read) { create(:work, id: 'work-5-read', title: ["Other's work with read access"], user: other, read_users: [user]) }
+  let(:work_6_noaccess) { create(:work, id: 'work-6-no_access', title: ["Other's work with no access"], user: other) }
+
+  let(:coll_1_own) { create(:private_collection, id: 'col-1-own', title: ['User created'], user: user, create_access: true) }
+  let(:coll_2_mgr) do
+    create(:private_collection, id: 'col-2-mgr', title: ['User has manage access'], user: other,
+                                with_permission_template: { manage_users: [user] }, create_access: true)
+  end
+  let(:coll_3_dep) do
+    create(:private_collection, id: 'col-3-dep', title: ['User has deposit access'], user: other,
+                                with_permission_template: { deposit_users: [user] }, create_access: true)
+  end
+  let(:coll_4_view) do
+    create(:private_collection, id: 'col-4-dep', title: ['User has view access'], user: other,
+                                with_permission_template: { view_users: [user] }, create_access: true)
+  end
+  let(:coll_5_noaccess) { create(:private_collection, id: 'col-5-no_access', title: ['Other user created'], user: other, create_access: true) }
+
+  describe '#update_members' do
+    context 'when user created the collection' do
+      before do
+        sign_in user
+        [work_1_own, work_2_own].each do |asset|
+          asset.member_of_collections << coll_1_own
+          asset.save!
+        end
+      end
+
+      context 'and user created the work' do
+        it 'adds members to the collection' do
+          expect do
+            post :update_members, params: { id: coll_1_own,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_3_own.id] }
+          end.to change { coll_1_own.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(coll_1_own, locale: 'en')
+          expect(coll_1_own.member_objects).to match_array [work_1_own, work_2_own, work_3_own]
+        end
+      end
+
+      context 'and user has edit access to works' do
+        it 'adds members to the collection' do
+          expect do
+            post :update_members, params: { id: coll_1_own,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_4_edit.id] }
+          end.to change { coll_1_own.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(coll_1_own, locale: 'en')
+          expect(coll_1_own.member_objects).to match_array [work_1_own, work_2_own, work_4_edit]
+        end
+      end
+
+      context 'and user has read access to works' do
+        it 'adds members to the collection' do
+          expect do
+            post :update_members, params: { id: coll_1_own,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_5_read.id] }
+          end.to change { coll_1_own.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(coll_1_own, locale: 'en')
+          expect(coll_1_own.member_objects).to match_array [work_1_own, work_2_own, work_5_read]
+        end
+      end
+
+      context 'and user has no access to a work' do
+        it 'adds only members with read access' do
+          expect do
+            post :update_members, params: { id: coll_1_own,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_3_own.id, work_6_noaccess.id] }
+          end.to change { coll_1_own.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(coll_1_own, locale: 'en')
+          expect(coll_1_own.member_objects).to match_array [work_1_own, work_2_own, work_3_own]
+        end
+
+        it 'displays error message if none of the members have read access' do
+          expect do
+            post :update_members, params: { id: coll_1_own,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_6_noaccess.id] }
+          end.to change { coll_1_own.reload.member_objects.size }.by(0)
+          expect(flash[:alert]).to eq 'You do not have sufficient privileges to any of the selected members'
+          expect(response).to redirect_to routes.url_helpers.dashboard_collections_path(locale: 'en')
+          expect(coll_1_own.member_objects).to match_array [work_1_own, work_2_own]
+        end
+      end
+
+      context 'and user adds a subcollection' do
+        let(:parent_collection) { create(:private_collection, id: 'pcol', title: ['User created another'], user: user, create_access: true) }
+
+        it 'adds collection user created' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_1_own.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(parent_collection, locale: 'en')
+          expect(parent_collection.member_objects).to match_array [coll_1_own]
+        end
+
+        it 'adds collection with manage access' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_2_mgr.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(parent_collection, locale: 'en')
+          expect(parent_collection.member_objects).to match_array [coll_2_mgr]
+        end
+
+        it 'adds collection with deposit access' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_3_dep.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(parent_collection, locale: 'en')
+          expect(parent_collection.member_objects).to match_array [coll_3_dep]
+        end
+
+        it 'adds collection with view access' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_4_view.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(parent_collection, locale: 'en')
+          expect(parent_collection.member_objects).to match_array [coll_4_view]
+        end
+
+        it 'displays error message for collection with no access' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_5_noaccess.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(0)
+          expect(flash[:alert]).to eq 'You do not have sufficient privileges to any of the selected members'
+          expect(response).to redirect_to routes.url_helpers.dashboard_collections_path(locale: 'en')
+          expect(parent_collection.member_objects).to match_array []
+        end
+      end
+    end
+
+    context 'when user is manager of the collection' do
+      before do
+        sign_in user
+        [work_1_own, work_2_own].each do |asset|
+          asset.member_of_collections << coll_2_mgr
+          asset.save!
+        end
+      end
+
+      context 'and user created the work' do
+        it 'adds members to the collection' do
+          expect do
+            post :update_members, params: { id: coll_2_mgr,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_3_own.id] }
+          end.to change { coll_2_mgr.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(coll_2_mgr, locale: 'en')
+          expect(coll_2_mgr.member_objects).to match_array [work_1_own, work_2_own, work_3_own]
+        end
+      end
+
+      context 'and user has edit access to works' do
+        it 'adds members to the collection' do
+          expect do
+            post :update_members, params: { id: coll_2_mgr,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_4_edit.id] }
+          end.to change { coll_2_mgr.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(coll_2_mgr, locale: 'en')
+          expect(coll_2_mgr.member_objects).to match_array [work_1_own, work_2_own, work_4_edit]
+        end
+      end
+
+      context 'and user has read access to works' do
+        it 'adds members to the collection' do
+          expect do
+            post :update_members, params: { id: coll_2_mgr,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_5_read.id] }
+          end.to change { coll_2_mgr.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(coll_2_mgr, locale: 'en')
+          expect(coll_2_mgr.member_objects).to match_array [work_1_own, work_2_own, work_5_read]
+        end
+      end
+
+      context 'and user has no access to a work' do
+        it 'adds only members with read access' do
+          expect do
+            post :update_members, params: { id: coll_2_mgr,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_3_own.id, work_6_noaccess.id] }
+          end.to change { coll_2_mgr.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(coll_2_mgr, locale: 'en')
+          expect(coll_2_mgr.member_objects).to match_array [work_1_own, work_2_own, work_3_own]
+        end
+      end
+
+      context 'and user adds a subcollection' do
+        let(:parent_collection) do
+          create(:private_collection, id: 'pcol-mgr', title: ['User has manage access to another'], user: other,
+                                      with_permission_template: { manage_users: [user] }, create_access: true)
+        end
+
+        it 'adds collection user created' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_1_own.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(parent_collection, locale: 'en')
+          expect(parent_collection.member_objects).to match_array [coll_1_own]
+        end
+
+        it 'adds collection with manage access' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_2_mgr.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(parent_collection, locale: 'en')
+          expect(parent_collection.member_objects).to match_array [coll_2_mgr]
+        end
+
+        it 'adds collection with deposit access' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_3_dep.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(parent_collection, locale: 'en')
+          expect(parent_collection.member_objects).to match_array [coll_3_dep]
+        end
+
+        it 'adds collection with view access' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_4_view.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(parent_collection, locale: 'en')
+          expect(parent_collection.member_objects).to match_array [coll_4_view]
+        end
+
+        it 'displays error message for collection with no access' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_5_noaccess.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(0)
+          expect(flash[:alert]).to eq 'You do not have sufficient privileges to any of the selected members'
+          expect(response).to redirect_to routes.url_helpers.dashboard_collections_path(locale: 'en')
+          expect(parent_collection.member_objects).to match_array []
+        end
+      end
+    end
+
+    context 'when user is depositor of the collection' do
+      before do
+        sign_in user
+        [work_1_own, work_2_own].each do |asset|
+          asset.member_of_collections << coll_3_dep
+          asset.save!
+        end
+      end
+
+      context 'and user created the work' do
+        it 'adds members to the collection' do
+          expect do
+            post :update_members, params: { id: coll_3_dep,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_3_own.id] }
+          end.to change { coll_3_dep.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(coll_3_dep, locale: 'en')
+          expect(coll_3_dep.member_objects).to match_array [work_1_own, work_2_own, work_3_own]
+        end
+      end
+
+      context 'and user has edit access to works' do
+        it 'adds members to the collection' do
+          expect do
+            post :update_members, params: { id: coll_3_dep,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_4_edit.id] }
+          end.to change { coll_3_dep.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(coll_3_dep, locale: 'en')
+          expect(coll_3_dep.member_objects).to match_array [work_1_own, work_2_own, work_4_edit]
+        end
+      end
+
+      context 'and user has read access to works' do
+        it 'adds members to the collection' do
+          expect do
+            post :update_members, params: { id: coll_3_dep,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_5_read.id] }
+          end.to change { coll_3_dep.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(coll_3_dep, locale: 'en')
+          expect(coll_3_dep.member_objects).to match_array [work_1_own, work_2_own, work_5_read]
+        end
+      end
+
+      context 'and user has no access to a work' do
+        it 'adds only members with read access' do
+          expect do
+            post :update_members, params: { id: coll_3_dep,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_3_own.id, work_6_noaccess.id] }
+          end.to change { coll_3_dep.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(coll_3_dep, locale: 'en')
+          expect(coll_3_dep.member_objects).to match_array [work_1_own, work_2_own, work_3_own]
+        end
+      end
+
+      context 'and user adds a subcollection' do
+        let(:parent_collection) do
+          create(:private_collection, id: 'pcol-dep', title: ['User has deposit access to another'], user: other,
+                                      with_permission_template: { deposit_users: [user] }, create_access: true)
+        end
+
+        it 'adds collection user created' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_1_own.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(parent_collection, locale: 'en')
+          expect(parent_collection.member_objects).to match_array [coll_1_own]
+        end
+
+        it 'adds collection with manage access' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_2_mgr.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(parent_collection, locale: 'en')
+          expect(parent_collection.member_objects).to match_array [coll_2_mgr]
+        end
+
+        it 'adds collection with deposit access' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_3_dep.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(parent_collection, locale: 'en')
+          expect(parent_collection.member_objects).to match_array [coll_3_dep]
+        end
+
+        it 'adds collection with view access' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_4_view.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(parent_collection, locale: 'en')
+          expect(parent_collection.member_objects).to match_array [coll_4_view]
+        end
+
+        it 'displays error message for collection with no access' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_5_noaccess.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(0)
+          expect(flash[:alert]).to eq 'You do not have sufficient privileges to any of the selected members'
+          expect(response).to redirect_to routes.url_helpers.dashboard_collections_path(locale: 'en')
+          expect(parent_collection.member_objects).to match_array []
+        end
+      end
+    end
+
+    context 'when user is viewer of the collection' do
+      before do
+        sign_in user
+        [work_1_own, work_2_own].each do |asset|
+          asset.member_of_collections << coll_4_view
+          asset.save!
+        end
+      end
+
+      context 'and user created the work' do
+        it "displays error message if user can't deposit to collection" do
+          expect do
+            post :update_members, params: { id: coll_4_view,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_3_own.id] }
+          end.to change { coll_4_view.reload.member_objects.size }.by(0)
+          expect(flash[:alert]).to eq 'You do not have sufficient privileges to add members to the collection'
+          expect(response).to redirect_to routes.url_helpers.dashboard_collections_path(locale: 'en')
+          expect(coll_4_view.member_objects).to match_array [work_1_own, work_2_own]
+        end
+      end
+    end
+  end
+end