hyrax 2.9.6 → 3.0.0.pre.beta1

data/spec/abilities/file_set_abilities_spec.rb

@@ -0,0 +1,70 @@
+require 'cancan/matchers'
+
+RSpec.describe 'User' do
+  describe 'Abilities' do
+    subject { ability }
+
+    let(:ability) { Ability.new(current_user) }
+    let(:visibility) { Hydra::AccessControls::AccessRight::VISIBILITY_TEXT_VALUE_PRIVATE }
+    let(:creating_user) { create(:user) }
+    let(:user) { create(:user) }
+    let(:current_user) { user }
+    let(:generic_work) { create(:generic_work, visibility: visibility, user: creating_user) }
+    let(:file_set) { create(:file_set, visibility: visibility, user: creating_user) }
+
+    describe 'without embargo' do
+      describe 'creator of object' do
+        let(:creating_user) { user }
+        let(:current_user) { user }
+
+        it do
+          is_expected.to be_able_to(:create, FileSet.new)
+          is_expected.to be_able_to(:versions, file_set)
+          is_expected.to be_able_to(:read, file_set)
+          is_expected.to be_able_to(:update, file_set)
+          is_expected.not_to be_able_to(:delete, file_set)
+        end
+      end
+
+      describe 'as a repository manager' do
+        let(:manager_user) { create(:admin) }
+        let(:creating_user) { user }
+        let(:current_user) { manager_user }
+
+        it do
+          is_expected.to be_able_to(:create, FileSet.new)
+          is_expected.to be_able_to(:versions, file_set)
+          is_expected.to be_able_to(:read, file_set)
+          is_expected.to be_able_to(:update, file_set)
+          is_expected.to be_able_to(:destroy, file_set)
+        end
+      end
+
+      describe 'another authenticated user' do
+        let(:creating_user) { create(:user) }
+        let(:current_user) { user }
+
+        it do
+          is_expected.to be_able_to(:create, FileSet.new)
+          is_expected.not_to be_able_to(:versions, file_set)
+          is_expected.not_to be_able_to(:read, file_set)
+          is_expected.not_to be_able_to(:update, file_set)
+          is_expected.not_to be_able_to(:delete, file_set)
+        end
+      end
+
+      describe 'a nil user' do
+        let(:creating_user) { create(:user) }
+        let(:current_user) { nil }
+
+        it do
+          is_expected.not_to be_able_to(:create, FileSet.new)
+          is_expected.not_to be_able_to(:versions, file_set)
+          is_expected.not_to be_able_to(:read, file_set)
+          is_expected.not_to be_able_to(:update, file_set)
+          is_expected.not_to be_able_to(:delete, file_set)
+        end
+      end
+    end
+  end
+end

data/spec/abilities/generic_work_abilities_spec.rb

@@ -0,0 +1,63 @@
+require 'cancan/matchers'
+
+RSpec.describe 'User' do
+  describe 'Abilities' do
+    subject { Ability.new(current_user) }
+
+    let(:generic_work) { create(:private_generic_work, user: creating_user) }
+    let(:user) { create(:user) }
+
+    describe 'without embargo' do
+      describe 'creator of object' do
+        let(:creating_user) { user }
+        let(:current_user) { user }
+
+        it do
+          is_expected.to be_able_to(:create, GenericWork.new)
+          is_expected.to be_able_to(:read, generic_work)
+          is_expected.to be_able_to(:update, generic_work)
+          is_expected.to be_able_to(:destroy, generic_work)
+        end
+      end
+
+      describe 'as a repository manager' do
+        let(:manager_user) { create(:admin) }
+        let(:creating_user) { user }
+        let(:current_user) { manager_user }
+
+        it do
+          is_expected.to be_able_to(:create, GenericWork.new)
+          is_expected.to be_able_to(:read, generic_work)
+          is_expected.to be_able_to(:update, generic_work)
+          is_expected.to be_able_to(:destroy, generic_work)
+        end
+      end
+
+      describe 'another authenticated user' do
+        let(:creating_user) { create(:user) }
+        let(:current_user) { user }
+
+        it do
+          is_expected.to be_able_to(:create, GenericWork.new)
+          is_expected.not_to be_able_to(:read, generic_work)
+          is_expected.not_to be_able_to(:update, generic_work)
+          is_expected.not_to be_able_to(:destroy, generic_work)
+          is_expected.to be_able_to(:collect, generic_work)
+        end
+      end
+
+      describe 'a nil user' do
+        let(:creating_user) { create(:user) }
+        let(:current_user) { nil }
+
+        it do
+          is_expected.not_to be_able_to(:create, GenericWork.new)
+          is_expected.not_to be_able_to(:read, generic_work)
+          is_expected.not_to be_able_to(:update, generic_work)
+          is_expected.not_to be_able_to(:destroy, generic_work)
+          is_expected.not_to be_able_to(:collect, generic_work)
+        end
+      end
+    end
+  end
+end

data/spec/abilities/operation_ability_spec.rb

@@ -0,0 +1,12 @@
+require 'cancan/matchers'
+
+RSpec.describe 'Abilities for Operations', type: :model do
+  describe "a registered user" do
+    subject { Ability.new(user) }
+
+    let(:user) { create(:user) }
+
+    it { is_expected.to be_able_to(:read, build(:operation, user: user)) }
+    it { is_expected.not_to be_able_to(:read, build(:operation)) }
+  end
+end

data/spec/abilities/permission_template_ability_spec.rb

@@ -0,0 +1,145 @@
+require 'cancan/matchers'
+
+RSpec.describe 'PermissionTemplateAbility' do
+  subject { ability }
+
+  let(:ability) { Ability.new(current_user) }
+  let(:user) { create(:user) }
+  let(:current_user) { user }
+  let(:collection_type_gid) { create(:collection_type).gid }
+
+  let!(:collection) { create(:collection, with_permission_template: true, collection_type_gid: collection_type_gid) }
+  let(:permission_template) { collection.permission_template }
+  let!(:permission_template_access) do
+    create(:permission_template_access,
+           :manage,
+           permission_template: permission_template,
+           agent_type: 'group',
+           agent_id: 'manage_group')
+  end
+
+  context 'when admin user' do
+    let(:user) { FactoryBot.create(:admin) }
+
+    it 'allows all template abilities' do
+      is_expected.to be_able_to(:manage, Hyrax::PermissionTemplate)
+      is_expected.to be_able_to(:create, permission_template)
+      is_expected.to be_able_to(:edit, permission_template)
+      is_expected.to be_able_to(:update, permission_template)
+      is_expected.to be_able_to(:destroy, permission_template)
+    end
+
+    it 'allows all template access abilities' do
+      is_expected.to be_able_to(:manage, Hyrax::PermissionTemplateAccess)
+      is_expected.to be_able_to(:create, permission_template_access)
+      is_expected.to be_able_to(:edit, permission_template_access)
+      is_expected.to be_able_to(:update, permission_template_access)
+      is_expected.to be_able_to(:destroy, permission_template_access)
+    end
+  end
+
+  context 'when user has manage access for the source' do
+    before do
+      create(:permission_template_access,
+             :manage,
+             permission_template: permission_template,
+             agent_type: 'user',
+             agent_id: user.user_key)
+      collection.reset_access_controls!
+    end
+
+    it 'allows most template abilities' do
+      is_expected.to be_able_to(:create, permission_template)
+      is_expected.to be_able_to(:edit, permission_template)
+      is_expected.to be_able_to(:update, permission_template)
+      is_expected.to be_able_to(:destroy, permission_template)
+    end
+
+    it 'denies manage ability for template' do
+      is_expected.not_to be_able_to(:manage, Hyrax::PermissionTemplate)
+    end
+
+    it 'allows most template access abilities' do
+      is_expected.to be_able_to(:create, permission_template_access)
+      is_expected.to be_able_to(:edit, permission_template_access)
+      is_expected.to be_able_to(:update, permission_template_access)
+      is_expected.to be_able_to(:destroy, permission_template_access)
+    end
+
+    it 'denies manage ability for template access' do
+      is_expected.not_to be_able_to(:manage, Hyrax::PermissionTemplateAccess)
+    end
+  end
+
+  context 'when user has deposit access for the source' do
+    before do
+      create(:permission_template_access,
+             :deposit,
+             permission_template: permission_template,
+             agent_type: 'user',
+             agent_id: user.user_key)
+      collection.reset_access_controls!
+    end
+
+    it 'denies all template abilities' do
+      is_expected.not_to be_able_to(:manage, Hyrax::PermissionTemplate)
+      is_expected.not_to be_able_to(:create, permission_template)
+      is_expected.not_to be_able_to(:edit, permission_template)
+      is_expected.not_to be_able_to(:update, permission_template)
+      is_expected.not_to be_able_to(:destroy, permission_template)
+    end
+
+    it 'denies all template access abilities' do
+      is_expected.not_to be_able_to(:manage, Hyrax::PermissionTemplateAccess)
+      is_expected.not_to be_able_to(:create, permission_template_access)
+      is_expected.not_to be_able_to(:edit, permission_template_access)
+      is_expected.not_to be_able_to(:update, permission_template_access)
+      is_expected.not_to be_able_to(:destroy, permission_template_access)
+    end
+  end
+
+  context 'when user has view access for the source' do
+    before do
+      create(:permission_template_access,
+             :view,
+             permission_template: permission_template,
+             agent_type: 'user',
+             agent_id: user.user_key)
+      collection.reset_access_controls!
+    end
+
+    it 'denies all template abilities' do
+      is_expected.not_to be_able_to(:manage, Hyrax::PermissionTemplate)
+      is_expected.not_to be_able_to(:create, permission_template)
+      is_expected.not_to be_able_to(:edit, permission_template)
+      is_expected.not_to be_able_to(:update, permission_template)
+      is_expected.not_to be_able_to(:destroy, permission_template)
+    end
+
+    it 'denies all template access abilities' do
+      is_expected.not_to be_able_to(:manage, Hyrax::PermissionTemplateAccess)
+      is_expected.not_to be_able_to(:create, permission_template_access)
+      is_expected.not_to be_able_to(:edit, permission_template_access)
+      is_expected.not_to be_able_to(:update, permission_template_access)
+      is_expected.not_to be_able_to(:destroy, permission_template_access)
+    end
+  end
+
+  context 'when user has no special access' do
+    it 'denies all template abilities' do
+      is_expected.not_to be_able_to(:manage, Hyrax::PermissionTemplate)
+      is_expected.not_to be_able_to(:create, permission_template)
+      is_expected.not_to be_able_to(:edit, permission_template)
+      is_expected.not_to be_able_to(:update, permission_template)
+      is_expected.not_to be_able_to(:destroy, permission_template)
+    end
+
+    it 'denies all template access abilities' do
+      is_expected.not_to be_able_to(:manage, Hyrax::PermissionTemplateAccess)
+      is_expected.not_to be_able_to(:create, permission_template_access)
+      is_expected.not_to be_able_to(:edit, permission_template_access)
+      is_expected.not_to be_able_to(:update, permission_template_access)
+      is_expected.not_to be_able_to(:destroy, permission_template_access)
+    end
+  end
+end

data/spec/abilities/proxies_and_transfer_abilities_spec.rb

@@ -0,0 +1,109 @@
+require 'cancan/matchers'
+
+RSpec.describe 'Proxy and Transfer Abilities' do
+  subject { ability }
+
+  let(:ability) { Ability.new(user) }
+  let(:user) { create(:user) }
+
+  describe "Transfers" do
+    before do
+      allow(Flipflop).to receive(:transfer_works?).and_return(enabled)
+      allow(ability).to receive(:user_is_depositor?).with('777').and_return(mine)
+    end
+    let(:work_id) { '777' }
+
+    describe "when transfers are enabled" do
+      let(:enabled) { true }
+
+      context "a work belonging to someone else" do
+        let(:mine) { false }
+
+        it { is_expected.not_to be_able_to(:transfer, work_id) }
+      end
+
+      context "my own work" do
+        let(:mine) { true }
+
+        it { is_expected.to be_able_to(:transfer, work_id) }
+      end
+    end
+
+    describe "when transfers are disabled" do
+      let(:enabled) { false }
+
+      let(:mine) { true }
+
+      it { is_expected.not_to be_able_to(:transfer, work_id) }
+    end
+  end
+
+  describe "#user_is_depositor?" do
+    let(:work) { create(:work) }
+
+    subject { ability.send(:user_is_depositor?, work.id) }
+
+    it { is_expected.to be false }
+  end
+
+  describe "ProxyDepositRequests" do
+    let(:sender) { create(:user) }
+    let(:work) { create(:work, user: sender) }
+
+    context "creating a ProxyDepositRequest" do
+      before do
+        allow(Flipflop).to receive(:proxy_deposit?).and_return(enabled)
+      end
+      describe "when proxy deposit is enabled" do
+        let(:enabled) { true }
+
+        context "for a registered user" do
+          it { is_expected.to be_able_to(:create, ProxyDepositRequest) }
+        end
+        context "for a guest user" do
+          let(:user) { create(:user, :guest) }
+
+          it { is_expected.not_to be_able_to(:create, ProxyDepositRequest) }
+        end
+      end
+
+      context "when disabled" do
+        let(:enabled) { false }
+
+        it { is_expected.not_to be_able_to(:create, ProxyDepositRequest) }
+      end
+    end
+
+    context "with a ProxyDepositRequest that they receive" do
+      let(:request) { ProxyDepositRequest.create!(work_id: work.id, receiving_user: user, sending_user: sender) }
+
+      it { is_expected.to be_able_to(:accept, request) }
+      it { is_expected.to be_able_to(:reject, request) }
+      it { is_expected.not_to be_able_to(:destroy, request) }
+
+      context "and the request has already been accepted" do
+        let(:request) { ProxyDepositRequest.create!(work_id: work.id, receiving_user: user, sending_user: sender, status: 'accepted') }
+
+        it { is_expected.not_to be_able_to(:accept, request) }
+        it { is_expected.not_to be_able_to(:reject, request) }
+        it { is_expected.not_to be_able_to(:destroy, request) }
+      end
+    end
+
+    context "with a ProxyDepositRequest they are the sender of" do
+      let(:request) { ProxyDepositRequest.create!(work_id: work.id, receiving_user: sender, sending_user: user) }
+
+      it { is_expected.not_to be_able_to(:accept, request) }
+      it { is_expected.not_to be_able_to(:reject, request) }
+      it { is_expected.to be_able_to(:destroy, request) }
+
+      context "and the request has already been accepted" do
+        let(:request) { ProxyDepositRequest.create!(work_id: work.id, receiving_user: sender, sending_user: user, status: 'accepted') }
+
+        it { is_expected.not_to be_able_to(:accept, request) }
+        it { is_expected.not_to be_able_to(:reject, request) }
+        it { is_expected.not_to be_able_to(:destroy, request) }
+      end
+    end
+  end
+end

data/spec/abilities/solr_document_ability_spec.rb

@@ -0,0 +1,27 @@
+require 'cancan/matchers'
+
+# rubocop:disable RSpec/EmptyExampleGroup
+RSpec.describe 'SolrDocumentAbility' do
+  subject { ability }
+
+  let(:ability) { Ability.new(current_user) }
+  let(:user) { create(:user) }
+  let(:current_user) { user }
+
+  context 'with Collection solr doc' do
+    # tested with collection's solr doc in collection_ability_spec.rb
+  end
+
+  context 'with admin_set' do
+    # tested with admin_set's solr doc in admin_set_ability_spec.rb
+  end
+
+  context 'with works' do
+    # TODO: Need tests for works
+  end
+
+  context 'with files' do
+    # TODO: Need tests for files
+  end
+end
+# rubocop:enable RSpec/EmptyExampleGroup

data/spec/actors/hyrax/actors/apply_order_actor_spec.rb

@@ -0,0 +1,92 @@
+RSpec.describe Hyrax::Actors::ApplyOrderActor do
+  let(:curation_concern) { create(:work_with_two_children, user: user) }
+  let(:ability) { ::Ability.new(user) }
+  let(:user) { create(:admin) }
+  let(:terminator) { Hyrax::Actors::Terminator.new }
+  let(:env) { Hyrax::Actors::Environment.new(curation_concern, ability, attributes) }
+
+  subject(:middleware) do
+    stack = ActionDispatch::MiddlewareStack.new.tap do |middleware|
+      middleware.use described_class
+      middleware.use Hyrax::Actors::GenericWorkActor
+    end
+    stack.build(terminator)
+  end
+
+  describe '#update' do
+    context 'with ordered_member_ids that are already associated with the parent' do
+      let(:attributes) { { ordered_member_ids: ["BlahBlah1"] } }
+
+      before do
+        allow(terminator).to receive(:update).with(Hyrax::Actors::Environment).and_return(true)
+        curation_concern.apply_depositor_metadata(user.user_key)
+        curation_concern.save!
+      end
+      it "attaches the parent" do
+        expect(subject.update(env)).to be true
+      end
+    end
+  end
+
+  describe '#update' do
+    let(:user) { create(:admin) }
+    let(:curation_concern) { create(:work_with_one_child, user: user) }
+    let(:child) { GenericWork.new }
+
+    context 'with ordered_members_ids that arent associated with the curation concern yet.' do
+      let(:attributes) { { ordered_member_ids: [child.id] } }
+      let(:root_actor) { double }
+
+      before do
+        allow(terminator).to receive(:update).with(Hyrax::Actors::Environment).and_return(true)
+        # TODO: This can be moved into the Factory
+        child.title = ["Generic Title"]
+        child.apply_depositor_metadata(user.user_key)
+        child.save!
+        curation_concern.apply_depositor_metadata(user.user_key)
+        curation_concern.save!
+      end
+
+      it "attaches the parent" do
+        expect(subject.update(env)).to be true
+      end
+    end
+
+    context 'without an ordered_member_id that was associated with the curation concern' do
+      let(:curation_concern) { create(:work_with_two_children, user: user) }
+      let(:attributes) { { ordered_member_ids: ["BlahBlah2"] } }
+
+      before do
+        allow(terminator).to receive(:update).with(Hyrax::Actors::Environment).and_return(true)
+        child.title = ["Generic Title"]
+        child.apply_depositor_metadata(user.user_key)
+        child.save!
+        curation_concern.apply_depositor_metadata(user.user_key)
+        curation_concern.save!
+      end
+      it "removes the first child" do
+        expect(subject.update(env)).to be true
+        expect(curation_concern.members.size).to eq(1)
+        expect(curation_concern.ordered_member_ids.size).to eq(1)
+      end
+    end
+
+    context 'with ordered_member_ids that include a work owned by a different user' do
+      # set user not a non-admin for this test to ensure the actor disallows adding the child
+      let(:user) { create(:user) }
+      let(:other_user) { create(:user) }
+      let(:child) { create(:generic_work, user: other_user) }
+      let(:attributes) { { ordered_member_ids: [child.id] } }
+
+      before do
+        allow(terminator).to receive(:update).with(Hyrax::Actors::Environment).and_return(true)
+        curation_concern.apply_depositor_metadata(user.user_key)
+        curation_concern.save!
+      end
+
+      it "does not attach the work" do
+        expect(subject.update(env)).to be false
+      end
+    end
+  end
+end

data/spec/actors/hyrax/actors/apply_permission_template_actor_spec.rb

@@ -0,0 +1,135 @@
+RSpec.describe Hyrax::Actors::ApplyPermissionTemplateActor do
+  let(:ability) { ::Ability.new(depositor) }
+  let(:env) { Hyrax::Actors::Environment.new(work, ability, attributes) }
+  let(:terminator) { Hyrax::Actors::Terminator.new }
+  let(:depositor) { create(:user) }
+  let(:work) do
+    build(:generic_work,
+          user: depositor,
+          edit_users: ['Kevin'],
+          read_users: ['Taraji'])
+  end
+  let(:attributes) { { source_id: admin_set.id } }
+  let(:admin_set) { create(:admin_set, with_permission_template: true) }
+  let(:as_permission_template) { admin_set.permission_template }
+  let(:collection) { create(:collection, with_permission_template: true) }
+  let(:col_permission_template) { collection.permission_template }
+
+  subject(:middleware) do
+    stack = ActionDispatch::MiddlewareStack.new.tap do |middleware|
+      middleware.use described_class
+    end
+    stack.build(terminator)
+  end
+
+  describe "create" do
+    context "when source_id is blank" do
+      let(:attributes) { { admin_set_id: '' } }
+
+      it "returns true" do
+        expect(middleware.create(env)).to be true
+      end
+    end
+
+    context "when admin_set_id only is provided" do
+      let(:attributes) { { admin_set_id: admin_set.id } }
+
+      before do
+        admin_set_access(as_permission_template)
+        allow(terminator).to receive(:create).and_return(true)
+      end
+
+      it "adds the template users to the work" do
+        expect(middleware.create(env)).to be true
+        expect(work.edit_users).to match_array [depositor.user_key, 'Kevin', 'hannah a. smith']
+        expect(work.edit_groups).to match_array ['librarians_as']
+        expect(work.read_users).to match_array ['Taraji', 'gary a. stevens']
+        expect(work.read_groups).to match_array ['readers_as']
+      end
+    end
+
+    context "when admin_set_id and collection_id is provided" do
+      let(:attributes) { { admin_set_id: admin_set.id, collection_id: collection.id } }
+
+      before do
+        admin_set_access(as_permission_template)
+        collection_access(col_permission_template)
+        allow(terminator).to receive(:create).and_return(true)
+      end
+
+      it "adds the template users to the work" do
+        expect(middleware.create(env)).to be true
+        expect(work.edit_users).to match_array [depositor.user_key, 'Kevin', 'hannah a. smith', 'joe conrad']
+        expect(work.edit_groups).to match_array ['librarians_as', 'managers_c']
+        expect(work.read_users).to match_array ['Taraji', 'gary a. stevens', 'carol cassidy']
+        expect(work.read_groups).to match_array ['readers_as', 'viewers_c']
+      end
+    end
+
+    def admin_set_access(permission_template) # rubocop:disable Metrics/MethodLength
+      create(:permission_template_access,
+             :manage,
+             permission_template: permission_template,
+             agent_type: 'user',
+             agent_id: 'hannah a. smith')
+      create(:permission_template_access,
+             :manage,
+             permission_template: permission_template,
+             agent_type: 'group',
+             agent_id: 'librarians_as')
+      create(:permission_template_access,
+             :deposit,
+             permission_template: permission_template,
+             agent_type: 'user',
+             agent_id: 'mike a. steward')
+      create(:permission_template_access,
+             :deposit,
+             permission_template: permission_template,
+             agent_type: 'group',
+             agent_id: 'staff_as')
+      create(:permission_template_access,
+             :view,
+             permission_template: permission_template,
+             agent_type: 'user',
+             agent_id: 'gary a. stevens')
+      create(:permission_template_access,
+             :view,
+             permission_template: permission_template,
+             agent_type: 'group',
+             agent_id: 'readers_as')
+    end
+
+    def collection_access(permission_template) # rubocop:disable Metrics/MethodLength
+      create(:permission_template_access,
+             :manage,
+             permission_template: permission_template,
+             agent_type: 'user',
+             agent_id: "joe conrad")
+      create(:permission_template_access,
+             :manage,
+             permission_template: permission_template,
+             agent_type: 'group',
+             agent_id: "managers_c")
+      create(:permission_template_access,
+             :deposit,
+             permission_template: permission_template,
+             agent_type: 'user',
+             agent_id: "donny cartwright")
+      create(:permission_template_access,
+             :deposit,
+             permission_template: permission_template,
+             agent_type: 'group',
+             agent_id: "depositors_c")
+      create(:permission_template_access,
+             :view,
+             permission_template: permission_template,
+             agent_type: 'user',
+             agent_id: "carol cassidy")
+      create(:permission_template_access,
+             :view,
+             permission_template: permission_template,
+             agent_type: 'group',
+             agent_id: "viewers_c")
+    end
+  end
+end