hyrax 2.9.6 → 3.0.0.pre.beta1

data/spec/controllers/hyrax/downloads_controller_spec.rb

@@ -0,0 +1,145 @@
+RSpec.describe Hyrax::DownloadsController do
+  routes { Hyrax::Engine.routes }
+
+  describe '#show' do
+    let(:user) { create(:user) }
+    let(:file_set) do
+      create(:file_with_work, user: user, content: File.open(fixture_path + '/image.png'))
+    end
+
+    it 'raises an error if the object does not exist' do
+      expect do
+        get :show, params: { id: '8675309' }
+      end.to raise_error Blacklight::Exceptions::InvalidSolrID
+    end
+
+    context "when user doesn't have access" do
+      let(:another_user) { create(:user) }
+
+      before { sign_in another_user }
+
+      it 'returns :unauthorized status with image content' do
+        get :show, params: { id: file_set.to_param }
+        expect(response).to have_http_status(:unauthorized)
+        expect(response.content_type).to eq 'image/png'
+      end
+    end
+
+    context "when user isn't logged in" do
+      context "and the unauthorized image exists" do
+        before do
+          allow(File).to receive(:exist?).and_return(true)
+        end
+
+        it 'returns :unauthorized status with image content' do
+          get :show, params: { id: file_set.to_param }
+          expect(response).to have_http_status(:unauthorized)
+          expect(response.content_type).to eq 'image/png'
+        end
+      end
+
+      it 'authorizes the resource using only the id' do
+        expect(controller).to receive(:authorize!).with(:download, file_set.id)
+        get :show, params: { id: file_set.to_param }
+      end
+    end
+
+    context "when the user has access" do
+      before { sign_in user }
+
+      it 'sends the original file' do
+        get :show, params: { id: file_set }
+        expect(response.body).to eq file_set.original_file.content
+      end
+
+      context "with an alternative file" do
+        context "that is persisted" do
+          let(:file) { File.open(fixture_path + '/world.png', 'rb') }
+          let(:content) { file.read }
+
+          before do
+            allow(Hyrax::DerivativePath).to receive(:derivative_path_for_reference).and_return(fixture_path + '/world.png')
+          end
+
+          it 'sends requested file content' do
+            get :show, params: { id: file_set, file: 'thumbnail' }
+            expect(response).to be_success
+            expect(response.body).to eq content
+            expect(response.headers['Content-Length']).to eq "4218"
+            expect(response.headers['Accept-Ranges']).to eq "bytes"
+          end
+
+          it 'retrieves the thumbnail without contacting Fedora' do
+            expect(ActiveFedora::Base).not_to receive(:find).with(file_set.id)
+            get :show, params: { id: file_set, file: 'thumbnail' }
+          end
+
+          context "stream" do
+            it "head request" do
+              request.env["HTTP_RANGE"] = 'bytes=0-15'
+              head :show, params: { id: file_set, file: 'thumbnail' }
+              expect(response.headers['Content-Length']).to eq '4218'
+              expect(response.headers['Accept-Ranges']).to eq 'bytes'
+              expect(response.headers['Content-Type']).to start_with 'image/png'
+            end
+
+            it "sends the whole thing" do
+              request.env["HTTP_RANGE"] = 'bytes=0-4217'
+              get :show, params: { id: file_set, file: 'thumbnail' }
+              expect(response.headers["Content-Range"]).to eq 'bytes 0-4217/4218'
+              expect(response.headers["Content-Length"]).to eq '4218'
+              expect(response.headers['Accept-Ranges']).to eq 'bytes'
+              expect(response.headers['Content-Type']).to start_with "image/png"
+              expect(response.headers["Content-Disposition"]).to eq "inline; filename=\"world.png\""
+              expect(response.body).to eq content
+              expect(response.status).to eq 206
+            end
+
+            it "sends the whole thing when the range is open ended" do
+              request.env["HTTP_RANGE"] = 'bytes=0-'
+              get :show, params: { id: file_set, file: 'thumbnail' }
+              expect(response.body).to eq content
+            end
+
+            it "gets a range not starting at the beginning" do
+              request.env["HTTP_RANGE"] = 'bytes=4200-4217'
+              get :show, params: { id: file_set, file: 'thumbnail' }
+              expect(response.headers["Content-Range"]).to eq 'bytes 4200-4217/4218'
+              expect(response.headers["Content-Length"]).to eq '18'
+            end
+
+            it "gets a range not ending at the end" do
+              request.env["HTTP_RANGE"] = 'bytes=4-11'
+              get :show, params: { id: file_set, file: 'thumbnail' }
+              expect(response.headers["Content-Range"]).to eq 'bytes 4-11/4218'
+              expect(response.headers["Content-Length"]).to eq '8'
+            end
+          end
+        end
+
+        context "that isn't persisted" do
+          it "raises an error if the requested file does not exist" do
+            expect do
+              get :show, params: { id: file_set, file: 'thumbnail' }
+            end.to raise_error ActiveFedora::ObjectNotFoundError
+          end
+        end
+      end
+
+      it "raises an error if the requested association does not exist" do
+        expect do
+          get :show, params: { id: file_set, file: 'non-existant' }
+        end.to raise_error ActiveFedora::ObjectNotFoundError
+      end
+    end
+  end
+
+  describe "derivative_download_options" do
+    before do
+      allow(controller).to receive(:default_file).and_return 'world.png'
+    end
+    subject { controller.send(:derivative_download_options) }
+
+    it { is_expected.to eq(disposition: 'inline', type: 'image/png') }
+  end
+end

data/spec/controllers/hyrax/embargoes_controller_spec.rb

@@ -0,0 +1,147 @@
+RSpec.describe Hyrax::EmbargoesController do
+  let(:user) { create(:user) }
+  let(:a_work) { create(:generic_work, user: user) }
+  let(:not_my_work) { create(:generic_work) }
+  before { sign_in user }
+
+  describe '#index' do
+    context 'when I am NOT a repository manager' do
+      it 'redirects' do
+        get :index
+        expect(response).to redirect_to root_path
+      end
+    end
+    context 'when I am a repository manager' do
+      let(:user) { create(:user, groups: ['admin']) }
+
+      it 'shows me the page' do
+        expect(controller).to receive(:add_breadcrumb).with('Home', root_path)
+        expect(controller).to receive(:add_breadcrumb).with('Dashboard', dashboard_path)
+        expect(controller).to receive(:add_breadcrumb).with('Manage Embargoes', embargoes_path)
+        get :index
+        expect(response).to be_success
+        expect(response).to render_template('dashboard')
+      end
+    end
+  end
+
+  describe '#edit' do
+    context 'when I do not have edit permissions for the object' do
+      it 'redirects' do
+        get :edit, params: { id: not_my_work }
+        expect(response.status).to eq 302
+        expect(flash[:alert]).to eq 'You are not authorized to access this page.'
+      end
+    end
+    context 'when I have permission to edit the object' do
+      it 'shows me the page' do
+        expect(controller).to receive(:add_breadcrumb).with('Home', root_path)
+        expect(controller).to receive(:add_breadcrumb).with('Dashboard', dashboard_path)
+        expect(controller).to receive(:add_breadcrumb).with('Manage Embargoes', embargoes_path)
+        expect(controller).to receive(:add_breadcrumb).with('Update Embargo', '#')
+        get :edit, params: { id: a_work }
+        expect(response).to be_success
+        expect(response).to render_template('dashboard')
+      end
+    end
+  end
+
+  describe '#destroy' do
+    context 'when I do not have edit permissions for the object' do
+      it 'denies access' do
+        get :destroy, params: { id: not_my_work }
+        expect(response).to fail_redirect_and_flash(root_path, 'You are not authorized to access this page.')
+      end
+    end
+
+    context 'when I have permission to edit the object' do
+      before do
+        expect(Hyrax::Actors::EmbargoActor).to receive(:new).with(a_work).and_return(actor)
+      end
+
+      let(:actor) { double }
+
+      context 'that has no files' do
+        it 'deactivates embargo and redirects' do
+          expect(actor).to receive(:destroy)
+          get :destroy, params: { id: a_work }
+          expect(response).to redirect_to edit_embargo_path(a_work)
+        end
+      end
+
+      context 'that has files' do
+        before do
+          a_work.members << create(:file_set)
+          a_work.save!
+        end
+
+        it 'deactivates embargo and checks to see if we want to copy the visibility to files' do
+          expect(actor).to receive(:destroy)
+          get :destroy, params: { id: a_work }
+          expect(response).to redirect_to confirm_permission_path(a_work)
+        end
+      end
+    end
+  end
+
+  describe '#update' do
+    context 'when I have permission to edit the object' do
+      let(:file_set) { create(:file_set, visibility: Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED) }
+      let(:release_date) { Time.zone.today + 2 }
+
+      before do
+        a_work.members << file_set
+        a_work.visibility = Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
+        a_work.visibility_during_embargo = Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
+        a_work.visibility_after_embargo = Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PUBLIC
+        a_work.embargo_release_date = release_date.to_s
+        a_work.embargo.save(validate: false)
+        a_work.save(validate: false)
+      end
+
+      context 'with an expired embargo' do
+        let(:release_date) { Time.zone.today - 2 }
+
+        it 'deactivates embargo, update the visibility and redirect' do
+          patch :update, params: { batch_document_ids: [a_work.id], embargoes: { '0' => { copy_visibility: a_work.id } } }
+          expect(a_work.reload.visibility).to eq Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PUBLIC
+          expect(file_set.reload.visibility).to eq Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PUBLIC
+          expect(response).to redirect_to embargoes_path
+          expect(flash[:notice]).to be_present
+        end
+      end
+
+      context 'with an expired embargo and filesets in batch_document_ids and in embargoes' do
+        let(:file_set2) { create(:file_set, id: 'fileset_2', visibility: Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED) }
+        let(:file_set3) { create(:file_set, id: 'fileset_3', visibility: Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED) }
+        let(:release_date) { Time.zone.today - 2 }
+        let(:batch) { [file_set2.id, a_work.id] }
+        before do
+          file_set2.visibility = Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
+          file_set2.visibility_during_embargo = Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
+          file_set2.visibility_after_embargo = Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PUBLIC
+          file_set2.embargo_release_date = release_date.to_s
+          file_set2.embargo.save(validate: false)
+          file_set2.save(validate: false)
+          file_set3.visibility = Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
+          file_set3.visibility_during_embargo = Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
+          file_set3.visibility_after_embargo = Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PUBLIC
+          file_set3.embargo_release_date = release_date.to_s
+          file_set3.embargo.save(validate: false)
+          file_set3.save(validate: false)
+        end
+
+        it 'deactivates embargo, updates the visibility and redirects' do
+          allow(controller).to receive(:filter_docs_with_edit_access!).and_return(true)
+          patch :update, params: { batch_document_ids: batch, embargoes: { '0' => { copy_visibility: file_set2.id }, '1' => { copy_visibility: a_work.id } } }
+          expect(a_work.reload.visibility).to eq Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PUBLIC
+          expect(file_set.reload.visibility).to eq Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PUBLIC
+          expect(file_set2.reload.visibility).to eq Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PUBLIC
+          expect(file_set3.reload.visibility).to eq Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_AUTHENTICATED
+          expect(response).to redirect_to embargoes_path
+          expect(flash[:notice]).to be_present
+        end
+      end
+    end
+  end
+end

data/spec/controllers/hyrax/featured_work_lists_controller_spec.rb

@@ -0,0 +1,20 @@
+RSpec.describe Hyrax::FeaturedWorkListsController, type: :controller do
+  describe "#create" do
+    before do
+      expect(controller).to receive(:authorize!).with(:update, FeaturedWork)
+    end
+
+    let(:feature1) { create(:featured_work) }
+    let(:feature2) { create(:featured_work) }
+
+    it "is successful" do
+      post :create, params: {
+        format: :json,
+        featured_work_list: {
+          featured_works_attributes: [{ id: feature1.id, order: "2" }, { id: feature2.id, order: "1" }]
+        }
+      }
+      expect(feature1.reload.order).to eq 2
+    end
+  end
+end

data/spec/controllers/hyrax/featured_works_controller_spec.rb

@@ -0,0 +1,56 @@
+RSpec.describe Hyrax::FeaturedWorksController, type: :controller do
+  describe "#create" do
+    before do
+      sign_in create(:user)
+      expect(controller).to receive(:authorize!).with(:create, FeaturedWork).and_return(true)
+    end
+
+    context "when there are no featured works" do
+      it "creates one" do
+        expect do
+          post :create, params: { id: '1234abcd', format: :json }
+        end.to change { FeaturedWork.count }.by(1)
+        expect(response).to be_successful
+      end
+    end
+
+    context "when there are 5 featured works" do
+      before do
+        5.times do |n|
+          FeaturedWork.create(work_id: n.to_s)
+        end
+      end
+      it "does not create another" do
+        expect do
+          post :create, params: { id: '1234abcd', format: :json }
+        end.not_to change { FeaturedWork.count }
+        expect(response.status).to eq 422
+      end
+    end
+  end
+
+  describe "#destroy" do
+    before do
+      sign_in create(:user)
+      expect(controller).to receive(:authorize!).with(:destroy, FeaturedWork).and_return(true)
+    end
+
+    context "when the work exists" do
+      before { create(:featured_work, work_id: '1234abcd') }
+
+      it "removes it" do
+        expect do
+          delete :destroy, params: { id: '1234abcd', format: :json }
+        end.to change { FeaturedWork.count }.by(-1)
+        expect(response.status).to eq 204
+      end
+    end
+
+    context "when it was already removed" do
+      it "doesn't raise an error" do
+        delete :destroy, params: { id: '1234abcd', format: :json }
+        expect(response.status).to eq 204
+      end
+    end
+  end
+end

data/spec/controllers/hyrax/file_sets_controller_spec.rb

@@ -0,0 +1,322 @@
+RSpec.describe Hyrax::FileSetsController do
+  routes { Rails.application.routes }
+  let(:user) { create(:user) }
+  let(:actor) { controller.send(:actor) }
+
+  context "when signed in" do
+    before do
+      sign_in user
+    end
+
+    describe "#destroy" do
+      context "file_set with a parent" do
+        let(:file_set) do
+          create(:file_set, user: user)
+        end
+        let(:work) do
+          create(:work, title: ['test title'], user: user)
+        end
+
+        let(:delete_message) { double('delete message') }
+
+        before do
+          work.ordered_members << file_set
+          work.save!
+        end
+
+        it "deletes the file" do
+          expect(ContentDeleteEventJob).to receive(:perform_later).with(file_set.id, user)
+          expect do
+            delete :destroy, params: { id: file_set }
+          end.to change { FileSet.exists?(file_set.id) }.from(true).to(false)
+          expect(response).to redirect_to main_app.hyrax_generic_work_path(work, locale: 'en')
+        end
+      end
+    end
+
+    describe "#edit" do
+      let(:parent) do
+        create(:work, :public, user: user)
+      end
+      let(:file_set) do
+        create(:file_set, user: user).tap do |file_set|
+          parent.ordered_members << file_set
+          parent.save!
+        end
+      end
+
+      before do
+        binary = StringIO.new("hey")
+        Hydra::Works::AddFileToFileSet.call(file_set, binary, :original_file, versioning: true)
+        request.env['HTTP_REFERER'] = 'http://test.host/foo'
+      end
+
+      it "sets the breadcrumbs and versions presenter" do
+        expect(controller).to receive(:add_breadcrumb).with('Home', Hyrax::Engine.routes.url_helpers.root_path(locale: 'en'))
+        expect(controller).to receive(:add_breadcrumb).with(I18n.t('hyrax.dashboard.title'), Hyrax::Engine.routes.url_helpers.dashboard_path(locale: 'en'))
+        expect(controller).to receive(:add_breadcrumb).with(I18n.t('hyrax.dashboard.my.works'), Hyrax::Engine.routes.url_helpers.my_works_path(locale: 'en'))
+        expect(controller).to receive(:add_breadcrumb).with(I18n.t('hyrax.file_set.browse_view'), Rails.application.routes.url_helpers.hyrax_file_set_path(file_set, locale: 'en'))
+        get :edit, params: { id: file_set }
+
+        expect(response).to be_success
+        expect(assigns[:file_set]).to eq file_set
+        expect(assigns[:version_list]).to be_kind_of Hyrax::VersionListPresenter
+        expect(assigns[:parent]).to eq parent
+        expect(response).to render_template(:edit)
+        expect(response).to render_template('dashboard')
+      end
+    end
+
+    describe "#update" do
+      let(:file_set) do
+        create(:file_set, user: user)
+      end
+
+      context "when updating metadata" do
+        it "spawns a content update event job" do
+          expect(ContentUpdateEventJob).to receive(:perform_later).with(file_set, user)
+          post :update, params: {
+            id: file_set,
+            file_set: {
+              title: ['new_title'],
+              keyword: [''],
+              permissions_attributes: [{ type: 'person',
+                                         name: 'archivist1',
+                                         access: 'edit' }]
+            }
+          }
+          expect(response).to redirect_to main_app.hyrax_file_set_path(file_set, locale: 'en')
+        end
+      end
+
+      context "when updating the attached file" do
+        let(:actor) { double }
+
+        before do
+          allow(Hyrax::Actors::FileActor).to receive(:new).and_return(actor)
+        end
+
+        it "spawns a ContentNewVersionEventJob", perform_enqueued: [IngestJob] do
+          expect(ContentNewVersionEventJob).to receive(:perform_later).with(file_set, user)
+          expect(actor).to receive(:ingest_file).with(JobIoWrapper).and_return(true)
+          file = fixture_file_upload('/world.png', 'image/png')
+          post :update, params: { id: file_set, filedata: file, file_set: { keyword: [''], permissions_attributes: [{ type: 'person', name: 'archivist1', access: 'edit' }] } }
+          post :update, params: { id: file_set, file_set: { files: [file], keyword: [''], permissions_attributes: [{ type: 'person', name: 'archivist1', access: 'edit' }] } }
+        end
+      end
+
+      context "with two existing versions from different users", :perform_enqueued do
+        let(:file1)       { "world.png" }
+        let(:file2)       { "image.jpg" }
+        let(:second_user) { create(:user) }
+        let(:version1)    { "version1" }
+        let(:actor1)      { Hyrax::Actors::FileSetActor.new(file_set, user) }
+        let(:actor2)      { Hyrax::Actors::FileSetActor.new(file_set, second_user) }
+
+        before do
+          ActiveJob::Base.queue_adapter.filter = [IngestJob]
+          actor1.create_content(fixture_file_upload(file1))
+          actor2.create_content(fixture_file_upload(file2))
+        end
+
+        describe "restoring a previous version" do
+          context "as the first user" do
+            before do
+              sign_in user
+              post :update, params: { id: file_set, revision: version1 }
+            end
+
+            let(:restored_content) { file_set.reload.original_file }
+            let(:versions)         { restored_content.versions }
+            let(:latest_version)   { Hyrax::VersioningService.latest_version_of(restored_content) }
+
+            it "restores the first versions's content and metadata" do
+              # expect(restored_content.mime_type).to eq "image/png"
+              expect(restored_content).to be_a(Hydra::PCDM::File)
+              expect(restored_content.original_name).to eq file1
+              expect(versions.all.count).to eq 3
+              expect(versions.last.label).to eq latest_version.label
+              expect(Hyrax::VersionCommitter.where(version_id: versions.last.uri).pluck(:committer_login)).to eq [user.user_key]
+            end
+          end
+
+          context "as a user without edit access" do
+            before do
+              sign_in second_user
+            end
+
+            it "is unauthorized" do
+              post :update, params: { id: file_set, revision: version1 }
+              expect(response.code).to eq '401'
+              expect(response).to render_template 'unauthorized'
+              expect(response).to render_template('dashboard')
+            end
+          end
+        end
+      end
+
+      it "adds new groups and users" do
+        post :update, params: {
+          id: file_set,
+          file_set: { keyword: [''],
+                      permissions_attributes: [
+                        { type: 'person', name: 'user1', access: 'edit' },
+                        { type: 'group', name: 'group1', access: 'read' }
+                      ] }
+        }
+
+        expect(assigns[:file_set].read_groups).to eq ["group1"]
+        expect(assigns[:file_set].edit_users).to include("user1", user.user_key)
+      end
+
+      it "updates existing groups and users" do
+        file_set.edit_groups = ['group3']
+        file_set.save
+        post :update, params: {
+          id: file_set,
+          file_set: { keyword: [''],
+                      permissions_attributes: [
+                        { id: file_set.permissions.last.id, type: 'group', name: 'group3', access: 'read' }
+                      ] }
+        }
+
+        expect(assigns[:file_set].read_groups).to eq(["group3"])
+      end
+
+      context "when there's an error saving" do
+        let(:file_set) do
+          create(:file_set, user: user)
+        end
+
+        before do
+          allow(FileSet).to receive(:find).and_return(file_set)
+        end
+        it "draws the edit page" do
+          expect(file_set).to receive(:valid?).and_return(false)
+          post :update, params: { id: file_set, file_set: { keyword: [''] } }
+          expect(response.code).to eq '422'
+          expect(response).to render_template('edit')
+          expect(response).to render_template('dashboard')
+          expect(assigns[:file_set]).to eq file_set
+        end
+      end
+    end
+
+    describe "#edit" do
+      let(:file_set) do
+        create(:file_set, read_groups: ['public'])
+      end
+
+      let(:file) do
+        Hydra::Derivatives::IoDecorator.new(File.open(fixture_path + '/world.png'),
+                                            'image/png', 'world.png')
+      end
+
+      before do
+        Hydra::Works::UploadFileToFileSet.call(file_set, file)
+      end
+
+      context "someone else's files" do
+        it "sets flash error" do
+          get :edit, params: { id: file_set }
+          expect(response.code).to eq '401'
+          expect(response).to render_template('unauthorized')
+          expect(response).to render_template('dashboard')
+        end
+      end
+    end
+
+    describe "#show" do
+      let(:file_set) do
+        create(:file_set, title: ['test file'], user: user)
+      end
+
+      context "without a referer" do
+        it "shows me the file and set breadcrumbs" do
+          expect(controller).to receive(:add_breadcrumb).with('Home', Hyrax::Engine.routes.url_helpers.root_path(locale: 'en'))
+          expect(controller).to receive(:add_breadcrumb).with(I18n.t('hyrax.dashboard.title'), Hyrax::Engine.routes.url_helpers.dashboard_path(locale: 'en'))
+          get :show, params: { id: file_set }
+          expect(response).to be_successful
+          expect(flash).to be_empty
+          expect(assigns[:presenter]).to be_kind_of Hyrax::FileSetPresenter
+          expect(assigns[:presenter].id).to eq file_set.id
+          expect(assigns[:presenter].events).to be_kind_of Array
+          expect(assigns[:presenter].fixity_check_status).to eq 'Fixity checks have not yet been run on this object'
+        end
+      end
+
+      context "with a referer" do
+        let(:work) do
+          create(:generic_work, :public,
+                 title: ['test title'],
+                 user: user)
+        end
+
+        before do
+          request.env['HTTP_REFERER'] = 'http://test.host/foo'
+          work.ordered_members << file_set
+          work.save!
+          file_set.save!
+        end
+
+        it "shows me the breadcrumbs" do
+          expect(controller).to receive(:add_breadcrumb).with('Home', Hyrax::Engine.routes.url_helpers.root_path(locale: 'en'))
+          expect(controller).to receive(:add_breadcrumb).with('Dashboard', Hyrax::Engine.routes.url_helpers.dashboard_path(locale: 'en'))
+          expect(controller).to receive(:add_breadcrumb).with('Works', Hyrax::Engine.routes.url_helpers.my_works_path(locale: 'en'))
+          expect(controller).to receive(:add_breadcrumb).with('test title', main_app.hyrax_generic_work_path(work.id, locale: 'en'))
+          expect(controller).to receive(:add_breadcrumb).with('test file', main_app.hyrax_file_set_path(file_set, locale: 'en'))
+          get :show, params: { id: file_set }
+          expect(response).to be_successful
+        end
+      end
+    end
+
+    context 'someone elses (public) files' do
+      let(:creator) { create(:user, email: 'archivist1@example.com') }
+      let(:public_file_set) { create(:file_set, user: creator, read_groups: ['public']) }
+
+      before { sign_in user }
+
+      describe '#edit' do
+        it 'gives me the unauthorized page' do
+          get :edit, params: { id: public_file_set }
+          expect(response.code).to eq '401'
+          expect(response).to render_template(:unauthorized)
+          expect(response).to render_template('dashboard')
+        end
+      end
+
+      describe '#show' do
+        it 'allows access to the file' do
+          get :show, params: { id: public_file_set }
+          expect(response).to be_success
+        end
+      end
+    end
+  end
+
+  context 'when not signed in' do
+    let(:private_file_set) { create(:file_set) }
+    let(:public_file_set) { create(:file_set, read_groups: ['public']) }
+
+    describe '#edit' do
+      it 'requires login' do
+        get :edit, params: { id: public_file_set }
+        expect(response).to fail_redirect_and_flash(main_app.new_user_session_path, 'You need to sign in or sign up before continuing.')
+      end
+    end
+
+    describe '#show' do
+      it 'denies access to private files' do
+        get :show, params: { id: private_file_set }
+        expect(response).to fail_redirect_and_flash(main_app.new_user_session_path(locale: 'en'), 'You are not authorized to access this page.')
+      end
+
+      it 'allows access to public files' do
+        expect(controller).to receive(:additional_response_formats).with(ActionController::MimeResponds::Collector)
+        get :show, params: { id: public_file_set }
+        expect(response).to be_success
+      end
+    end
+  end
+end