hyrax 2.9.6 → 3.0.0.pre.beta1

data/spec/controllers/hyrax/content_blocks_controller_spec.rb

@@ -0,0 +1,71 @@
+RSpec.describe Hyrax::ContentBlocksController, type: :controller do
+  let!(:announcement_text) do
+    create(:content_block, name: 'announcement_text')
+  end
+  let!(:marketing_text) do
+    create(:content_block, name: 'marketing_text')
+  end
+  let!(:featured_researcher) do
+    create(:content_block, name: 'featured_researcher')
+  end
+
+  before do
+    sign_in user
+  end
+
+  context 'with an unprivileged user' do
+    let(:user) { create(:user) }
+
+    describe "GET #edit" do
+      it "denies the request" do
+        get :edit
+        expect(response).to have_http_status(401)
+      end
+    end
+
+    describe "PATCH #update" do
+      it "denies the request" do
+        patch :update, params: { id: 1 }
+        expect(response).to have_http_status(401)
+      end
+    end
+  end
+
+  context 'with an administrator' do
+    let(:user) { create(:admin) }
+
+    describe "GET #edit" do
+      it "renders breadcrumbs" do
+        expect(controller).to receive(:add_breadcrumb).with('Home', root_path)
+        expect(controller).to receive(:add_breadcrumb).with('Dashboard', dashboard_path)
+        expect(controller).to receive(:add_breadcrumb).with('Configuration', '#')
+        expect(controller).to receive(:add_breadcrumb).with('Content Blocks', edit_content_blocks_path)
+        get :edit
+        expect(response).to have_http_status(200)
+      end
+    end
+
+    describe "PATCH #update" do
+      it "updates the announcement text" do
+        patch :update, params: { id: announcement_text.id, content_block: { announcement: 'Now Hiring!' } }
+        expect(response).to redirect_to(edit_content_blocks_path)
+        expect(flash[:notice]).to include 'Content blocks updated'
+        expect(ContentBlock.announcement_text.value).to eq "Now Hiring!"
+      end
+
+      it "updates the marketing text" do
+        patch :update, params: { id: marketing_text.id, content_block: { marketing: '99 days since last crash!' } }
+        expect(response).to redirect_to(edit_content_blocks_path)
+        expect(flash[:notice]).to include 'Content blocks updated'
+        expect(ContentBlock.marketing_text.value).to eq "99 days since last crash!"
+      end
+
+      it "updates the featured researcher" do
+        patch :update, params: { id: featured_researcher.id, content_block: { researcher: 'Jane Doe is unimpeachable' } }
+        expect(response).to redirect_to(edit_content_blocks_path)
+        expect(flash[:notice]).to include 'Content blocks updated'
+        expect(ContentBlock.featured_researcher.value).to eq "Jane Doe is unimpeachable"
+      end
+    end
+  end
+end

data/spec/controllers/hyrax/dashboard/collection_members_controller_spec.rb

@@ -0,0 +1,408 @@
+RSpec.describe Hyrax::Dashboard::CollectionMembersController, :clean_repo do
+  routes { Hyrax::Engine.routes }
+  let(:user)  { create(:user) }
+  let(:other) { build(:user) }
+
+  let(:work_1_own) { create(:work, id: 'work-1-own', title: ['First of the Assets'], user: user) }
+  let(:work_2_own) { create(:work, id: 'work-2-own', title: ['Second of the Assets'], user: user) }
+  let(:work_3_own) { create(:work, id: 'work-3-own', title: ['Third of the Assets'], user: user) }
+  let(:work_4_edit) { create(:work, id: 'work-4-edit', title: ["Other's work with edit access"], user: other, edit_users: [user]) }
+  let(:work_5_read) { create(:work, id: 'work-5-read', title: ["Other's work with read access"], user: other, read_users: [user]) }
+  let(:work_6_noaccess) { create(:work, id: 'work-6-no_access', title: ["Other's work with no access"], user: other) }
+
+  let(:coll_1_own) { create(:private_collection, id: 'col-1-own', title: ['User created'], user: user, create_access: true) }
+  let(:coll_2_mgr) do
+    create(:private_collection, id: 'col-2-mgr', title: ['User has manage access'], user: other,
+                                with_permission_template: { manage_users: [user] }, create_access: true)
+  end
+  let(:coll_3_dep) do
+    create(:private_collection, id: 'col-3-dep', title: ['User has deposit access'], user: other,
+                                with_permission_template: { deposit_users: [user] }, create_access: true)
+  end
+  let(:coll_4_view) do
+    create(:private_collection, id: 'col-4-dep', title: ['User has view access'], user: other,
+                                with_permission_template: { view_users: [user] }, create_access: true)
+  end
+  let(:coll_5_noaccess) { create(:private_collection, id: 'col-5-no_access', title: ['Other user created'], user: other, create_access: true) }
+
+  describe '#update_members' do
+    context 'when user created the collection' do
+      before do
+        sign_in user
+        [work_1_own, work_2_own].each do |asset|
+          asset.member_of_collections << coll_1_own
+          asset.save!
+        end
+      end
+
+      context 'and user created the work' do
+        it 'adds members to the collection' do
+          expect do
+            post :update_members, params: { id: coll_1_own,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_3_own.id] }
+          end.to change { coll_1_own.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(coll_1_own, locale: 'en')
+          expect(coll_1_own.member_objects).to match_array [work_1_own, work_2_own, work_3_own]
+        end
+      end
+
+      context 'and user has edit access to works' do
+        it 'adds members to the collection' do
+          expect do
+            post :update_members, params: { id: coll_1_own,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_4_edit.id] }
+          end.to change { coll_1_own.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(coll_1_own, locale: 'en')
+          expect(coll_1_own.member_objects).to match_array [work_1_own, work_2_own, work_4_edit]
+        end
+      end
+
+      context 'and user has read access to works' do
+        it 'adds members to the collection' do
+          expect do
+            post :update_members, params: { id: coll_1_own,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_5_read.id] }
+          end.to change { coll_1_own.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(coll_1_own, locale: 'en')
+          expect(coll_1_own.member_objects).to match_array [work_1_own, work_2_own, work_5_read]
+        end
+      end
+
+      context 'and user has no access to a work' do
+        it 'adds only members with read access' do
+          expect do
+            post :update_members, params: { id: coll_1_own,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_3_own.id, work_6_noaccess.id] }
+          end.to change { coll_1_own.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(coll_1_own, locale: 'en')
+          expect(coll_1_own.member_objects).to match_array [work_1_own, work_2_own, work_3_own]
+        end
+
+        it 'displays error message if none of the members have read access' do
+          expect do
+            post :update_members, params: { id: coll_1_own,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_6_noaccess.id] }
+          end.to change { coll_1_own.reload.member_objects.size }.by(0)
+          expect(flash[:alert]).to eq 'You do not have sufficient privileges to any of the selected members'
+          expect(response).to redirect_to routes.url_helpers.dashboard_collections_path(locale: 'en')
+          expect(coll_1_own.member_objects).to match_array [work_1_own, work_2_own]
+        end
+      end
+
+      context 'and user adds a subcollection' do
+        let(:parent_collection) { create(:private_collection, id: 'pcol', title: ['User created another'], user: user, create_access: true) }
+
+        it 'adds collection user created' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_1_own.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(parent_collection, locale: 'en')
+          expect(parent_collection.member_objects).to match_array [coll_1_own]
+        end
+
+        it 'adds collection with manage access' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_2_mgr.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(parent_collection, locale: 'en')
+          expect(parent_collection.member_objects).to match_array [coll_2_mgr]
+        end
+
+        it 'adds collection with deposit access' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_3_dep.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(parent_collection, locale: 'en')
+          expect(parent_collection.member_objects).to match_array [coll_3_dep]
+        end
+
+        it 'adds collection with view access' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_4_view.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(parent_collection, locale: 'en')
+          expect(parent_collection.member_objects).to match_array [coll_4_view]
+        end
+
+        it 'displays error message for collection with no access' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_5_noaccess.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(0)
+          expect(flash[:alert]).to eq 'You do not have sufficient privileges to any of the selected members'
+          expect(response).to redirect_to routes.url_helpers.dashboard_collections_path(locale: 'en')
+          expect(parent_collection.member_objects).to match_array []
+        end
+      end
+    end
+
+    context 'when user is manager of the collection' do
+      before do
+        sign_in user
+        [work_1_own, work_2_own].each do |asset|
+          asset.member_of_collections << coll_2_mgr
+          asset.save!
+        end
+      end
+
+      context 'and user created the work' do
+        it 'adds members to the collection' do
+          expect do
+            post :update_members, params: { id: coll_2_mgr,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_3_own.id] }
+          end.to change { coll_2_mgr.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(coll_2_mgr, locale: 'en')
+          expect(coll_2_mgr.member_objects).to match_array [work_1_own, work_2_own, work_3_own]
+        end
+      end
+
+      context 'and user has edit access to works' do
+        it 'adds members to the collection' do
+          expect do
+            post :update_members, params: { id: coll_2_mgr,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_4_edit.id] }
+          end.to change { coll_2_mgr.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(coll_2_mgr, locale: 'en')
+          expect(coll_2_mgr.member_objects).to match_array [work_1_own, work_2_own, work_4_edit]
+        end
+      end
+
+      context 'and user has read access to works' do
+        it 'adds members to the collection' do
+          expect do
+            post :update_members, params: { id: coll_2_mgr,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_5_read.id] }
+          end.to change { coll_2_mgr.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(coll_2_mgr, locale: 'en')
+          expect(coll_2_mgr.member_objects).to match_array [work_1_own, work_2_own, work_5_read]
+        end
+      end
+
+      context 'and user has no access to a work' do
+        it 'adds only members with read access' do
+          expect do
+            post :update_members, params: { id: coll_2_mgr,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_3_own.id, work_6_noaccess.id] }
+          end.to change { coll_2_mgr.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(coll_2_mgr, locale: 'en')
+          expect(coll_2_mgr.member_objects).to match_array [work_1_own, work_2_own, work_3_own]
+        end
+      end
+
+      context 'and user adds a subcollection' do
+        let(:parent_collection) do
+          create(:private_collection, id: 'pcol-mgr', title: ['User has manage access to another'], user: other,
+                                      with_permission_template: { manage_users: [user] }, create_access: true)
+        end
+
+        it 'adds collection user created' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_1_own.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(parent_collection, locale: 'en')
+          expect(parent_collection.member_objects).to match_array [coll_1_own]
+        end
+
+        it 'adds collection with manage access' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_2_mgr.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(parent_collection, locale: 'en')
+          expect(parent_collection.member_objects).to match_array [coll_2_mgr]
+        end
+
+        it 'adds collection with deposit access' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_3_dep.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(parent_collection, locale: 'en')
+          expect(parent_collection.member_objects).to match_array [coll_3_dep]
+        end
+
+        it 'adds collection with view access' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_4_view.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(parent_collection, locale: 'en')
+          expect(parent_collection.member_objects).to match_array [coll_4_view]
+        end
+
+        it 'displays error message for collection with no access' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_5_noaccess.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(0)
+          expect(flash[:alert]).to eq 'You do not have sufficient privileges to any of the selected members'
+          expect(response).to redirect_to routes.url_helpers.dashboard_collections_path(locale: 'en')
+          expect(parent_collection.member_objects).to match_array []
+        end
+      end
+    end
+
+    context 'when user is depositor of the collection' do
+      before do
+        sign_in user
+        [work_1_own, work_2_own].each do |asset|
+          asset.member_of_collections << coll_3_dep
+          asset.save!
+        end
+      end
+
+      context 'and user created the work' do
+        it 'adds members to the collection' do
+          expect do
+            post :update_members, params: { id: coll_3_dep,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_3_own.id] }
+          end.to change { coll_3_dep.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(coll_3_dep, locale: 'en')
+          expect(coll_3_dep.member_objects).to match_array [work_1_own, work_2_own, work_3_own]
+        end
+      end
+
+      context 'and user has edit access to works' do
+        it 'adds members to the collection' do
+          expect do
+            post :update_members, params: { id: coll_3_dep,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_4_edit.id] }
+          end.to change { coll_3_dep.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(coll_3_dep, locale: 'en')
+          expect(coll_3_dep.member_objects).to match_array [work_1_own, work_2_own, work_4_edit]
+        end
+      end
+
+      context 'and user has read access to works' do
+        it 'adds members to the collection' do
+          expect do
+            post :update_members, params: { id: coll_3_dep,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_5_read.id] }
+          end.to change { coll_3_dep.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(coll_3_dep, locale: 'en')
+          expect(coll_3_dep.member_objects).to match_array [work_1_own, work_2_own, work_5_read]
+        end
+      end
+
+      context 'and user has no access to a work' do
+        it 'adds only members with read access' do
+          expect do
+            post :update_members, params: { id: coll_3_dep,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_3_own.id, work_6_noaccess.id] }
+          end.to change { coll_3_dep.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(coll_3_dep, locale: 'en')
+          expect(coll_3_dep.member_objects).to match_array [work_1_own, work_2_own, work_3_own]
+        end
+      end
+
+      context 'and user adds a subcollection' do
+        let(:parent_collection) do
+          create(:private_collection, id: 'pcol-dep', title: ['User has deposit access to another'], user: other,
+                                      with_permission_template: { deposit_users: [user] }, create_access: true)
+        end
+
+        it 'adds collection user created' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_1_own.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(parent_collection, locale: 'en')
+          expect(parent_collection.member_objects).to match_array [coll_1_own]
+        end
+
+        it 'adds collection with manage access' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_2_mgr.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(parent_collection, locale: 'en')
+          expect(parent_collection.member_objects).to match_array [coll_2_mgr]
+        end
+
+        it 'adds collection with deposit access' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_3_dep.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(parent_collection, locale: 'en')
+          expect(parent_collection.member_objects).to match_array [coll_3_dep]
+        end
+
+        it 'adds collection with view access' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_4_view.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(1)
+          expect(response).to redirect_to routes.url_helpers.dashboard_collection_path(parent_collection, locale: 'en')
+          expect(parent_collection.member_objects).to match_array [coll_4_view]
+        end
+
+        it 'displays error message for collection with no access' do
+          expect do
+            post :update_members, params: { id: parent_collection,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [coll_5_noaccess.id] }
+          end.to change { parent_collection.reload.member_objects.size }.by(0)
+          expect(flash[:alert]).to eq 'You do not have sufficient privileges to any of the selected members'
+          expect(response).to redirect_to routes.url_helpers.dashboard_collections_path(locale: 'en')
+          expect(parent_collection.member_objects).to match_array []
+        end
+      end
+    end
+
+    context 'when user is viewer of the collection' do
+      before do
+        sign_in user
+        [work_1_own, work_2_own].each do |asset|
+          asset.member_of_collections << coll_4_view
+          asset.save!
+        end
+      end
+
+      context 'and user created the work' do
+        it "displays error message if user can't deposit to collection" do
+          expect do
+            post :update_members, params: { id: coll_4_view,
+                                            collection: { members: 'add' },
+                                            batch_document_ids: [work_3_own.id] }
+          end.to change { coll_4_view.reload.member_objects.size }.by(0)
+          expect(flash[:alert]).to eq 'You do not have sufficient privileges to add members to the collection'
+          expect(response).to redirect_to routes.url_helpers.dashboard_collections_path(locale: 'en')
+          expect(coll_4_view.member_objects).to match_array [work_1_own, work_2_own]
+        end
+      end
+    end
+  end
+end