hyrax 4.0.0 → 5.0.0.rc1

data/chart/hyrax/values.yaml

@@ -5,7 +5,7 @@
 replicaCount: 1
 
 image:
-  repository: samveralabs/dassie
+  repository: ghcr.io/samvera/hyrax/dassie
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
   tag: ""
@@ -193,7 +193,7 @@ worker:
   enabled: true
   replicaCount: 3
   image:
-    repository: samveralabs/dassie-worker
+    repository: ghcr.io/samvera/hyrax/dassie-worker
     pullPolicy: IfNotPresent
     tag: ""
   extraInitContainers: []
@@ -220,19 +220,35 @@ worker:
 
 fcrepo:
   enabled: true
-  externalDatabaseUsername: "hyrax"
   servicePort: 8080
   postgresql:
     enabled: false
     image:
       repository: bitnami/postgresql
-      tag: 12.3.0
+      tag: 12.11.0-debian-11-r12
+
+# configuration for an external/existing fits service;
+#   ignored if `fits.enabled` is true
+externalFits:
+  enabled: false
+  url: "" # existing FITS servlet endpoint
+
+fits:
+  enabled: true
+  servicePort: 8080
+  subPath: /fits
 
 memcached:
   enabled: false
+  image:
+    repository: bitnami/memcached
+    tag: 1.6.15-debian-11-r12
 
 minio:
   enabled: false
+  image:
+    repository: bitnami/minio
+    tag: 2022.7.4-debian-11-r0
   auth:
     rootUser: hyrax-access-key
     rootPassword: hyrax-secret-key
@@ -244,7 +260,7 @@ postgresql:
   enabled: true
   image:
     repository: bitnami/postgresql
-    tag: 12.3.0
+    tag: 12.11.0-debian-11-r12
   auth:
     database: hyrax
     password: hyrax_pass
@@ -262,12 +278,11 @@ postgresql:
 ## and to act as an auth proxy for Cantelope
 nginx:
   enabled: false
+  image:
+    repository: bitnami/nginx
+    tag: 1.23.0-debian-11-r1
   # The set up below does malicious bot / ip blocking and mounts
-  # vaolumes to allow nginx to server assets and other public directory items
-  # image:
-  #   registry: registry.gitlab.com
-  #   repository: notch8/scripts/bitnami-nginx
-  #   tag: 1.21.5-debian-10-r4
+  # volumes to allow nginx to server assets and other public directory items
   # extraVolumes:
   #   - name: "uploads"
   #     persistentVolumeClaim:
@@ -397,6 +412,9 @@ nginx:
 
 redis:
   enabled: true
+  image:
+    repository: bitnami/redis
+    tag: 7.0.2-debian-11-r7
   auth:
     password: mysecret
 
@@ -404,12 +422,14 @@ solr:
   enabled: true
   image:
     repository: bitnami/solr
-    tag: 8.11.1
+    tag: 8.11.2-debian-11-r4
+  containerPorts:
+    http: 8983
   auth:
     enabled: true
     adminUsername: admin
     adminPassword: admin
-  coreName: hyrax
+  coreNames: hyrax
   collection: hyrax
   cloudBootstrap: true
   cloudEnabled: true
@@ -428,9 +448,11 @@ autoscaling:
   # targetMemoryUtilizationPercentage: 80
 
 global:
+  # These global postgresql values are used by the fcrepo chart
   postgresql:
-    postgresqlUsername: hyrax
-    postgresqlPassword: hyrax_pass
+    auth:
+      username: hyrax
+      password: hyrax_pass
   # This is th name of the running rails server pod
   hyraxHostName: hyrax
 

data/config/initializers/listeners.rb

@@ -1,16 +1,10 @@
 # frozen_string_literal: true
 
-Hyrax.publisher.subscribe(Hyrax::Listeners::AclIndexListener.new)
 Hyrax.publisher.subscribe(Hyrax::Listeners::ActiveFedoraAclIndexListener.new) unless Hyrax.config.disable_wings
-Hyrax.publisher.subscribe(Hyrax::Listeners::BatchNotificationListener.new)
-Hyrax.publisher.subscribe(Hyrax::Listeners::FileMetadataListener.new)
-Hyrax.publisher.subscribe(Hyrax::Listeners::FileSetLifecycleListener.new)
-Hyrax.publisher.subscribe(Hyrax::Listeners::FileSetLifecycleNotificationListener.new)
-Hyrax.publisher.subscribe(Hyrax::Listeners::MemberCleanupListener.new)
-Hyrax.publisher.subscribe(Hyrax::Listeners::MetadataIndexListener.new)
-Hyrax.publisher.subscribe(Hyrax::Listeners::ObjectLifecycleListener.new)
-Hyrax.publisher.subscribe(Hyrax::Listeners::TrophyCleanupListener.new)
-Hyrax.publisher.subscribe(Hyrax::Listeners::WorkflowListener.new)
+
+Hyrax.publisher.default_listeners.each do |listener|
+  Hyrax.publisher.subscribe(listener)
+end
 
 # Publish events from old style Hyrax::Callbacks to trigger the listeners
 # When callbacks are removed and replaced with direct event publication, drop these blocks

data/config/initializers/storage_adapter_initializer.rb

@@ -7,6 +7,6 @@ Valkyrie::StorageAdapter.register(
 )
 
 Valkyrie::StorageAdapter.register(
-  Valkyrie::Storage::Disk.new(base_path: Hyrax.config.derivatives_path),
+  Valkyrie::Storage::Disk.new(base_path: Hyrax.config.derivatives_path, path_generator: Hyrax::DerivativeBucketedStorage),
   :derivatives_disk
 )

data/config/locales/hyrax.en.yml

@@ -459,6 +459,14 @@ en:
       workflows:
         index:
           header: Review Submissions
+          heading:
+            work: Work
+            depositor: Depositor
+            submission_date: Submission Date
+            status: status
+          works_published: "<strong>%{total_count} works</strong> published"
+          works_under_review: "<strong>%{total_count} works</strong> under review"
+          works_listing: Works listing
           tabs:
             published: Published
             under_review: Under Review

data/config/metadata/file_set_metadata.yaml

@@ -16,7 +16,7 @@ attributes:
     type: string
     multiple: true
     form:
-      required: true
+      required: false
       primary: true
 
   # Other attributes:

data/docker-compose-koppie.yml

@@ -9,7 +9,7 @@ services:
         - EXTRA_APK_PACKAGES=git less chromium
         - APP_PATH=.koppie
     image: ghcr.io/samvera/koppie
-    command: sh -l -c 'bundle && yarn && bundle exec puma -v -b tcp://0.0.0.0:3000'
+    command: sh -c 'bundle && yarn && bundle exec puma -v -b tcp://0.0.0.0:3000'
     stdin_open: true
     tty: true
     user: root
@@ -46,7 +46,7 @@ services:
       args:
         - APP_PATH=.koppie
     image: ghcr.io/samvera/koppie-worker
-    command: sh -l -c 'bundle && bundle exec sidekiq'
+    command: sh -c 'bundle && bundle exec sidekiq'
     user: root
     env_file:
       - .koppie/.env
@@ -78,7 +78,7 @@ services:
     user: root
     env_file:
       - .koppie/.env
-    command: sh -l -c 'bundle && db-migrate-seed.sh'
+    command: sh -c 'bundle && db-migrate-seed.sh'
     depends_on:
       - postgres
     volumes:
@@ -90,7 +90,9 @@ services:
       - koppie
 
   chrome:
-    image: selenium/standalone-chrome:3.141
+    image: seleniarm/standalone-chromium:114.0
+    environment:
+      - START_XVFB=false
     logging:
       driver: none
     volumes:
@@ -113,6 +115,13 @@ services:
     networks:
       - koppie
 
+  fits:
+    image: harvardlts/fitsservlet_container:1.5.0
+    ports:
+      - 8080
+    networks:
+      - koppie
+
   memcached:
     image: bitnami/memcached
     ports:
@@ -140,6 +149,10 @@ services:
     volumes:
       - solr_home:/var/solr/data:cached
       - .koppie/solr/conf:/opt/solr/server/configsets/hyraxconf
+    ulimits:
+      nofile:
+        soft: 65536
+        hard: 524288
     networks:
       - koppie
 

data/docker-compose.yml

@@ -8,7 +8,7 @@ services:
       args:
         - EXTRA_APK_PACKAGES=git less chromium
     image: ghcr.io/samvera/dassie
-    command: sh -l -c 'bundle && bundle exec puma -v -b tcp://0.0.0.0:3000'
+    command: sh -c 'bundle && bundle exec puma -v -b tcp://0.0.0.0:3000'
     stdin_open: true
     tty: true
     user: root
@@ -42,7 +42,7 @@ services:
       context: .
       target: hyrax-engine-dev-worker
     image: ghcr.io/samvera/dassie-worker
-    command: sh -l -c 'bundle && bundle exec sidekiq'
+    command: sh -c 'bundle && bundle exec sidekiq'
     user: root
     env_file:
       - .dassie/.env
@@ -73,7 +73,7 @@ services:
     user: root
     env_file:
       - .dassie/.env
-    command: sh -l -c 'bundle && db-migrate-seed.sh'
+    command: sh -c 'bundle && db-migrate-seed.sh'
     depends_on:
       - postgres
     volumes:
@@ -85,15 +85,17 @@ services:
       - hyrax
 
   chrome:
-    image: selenium/standalone-chrome:3.141
+    image: seleniarm/standalone-chromium:114.0
+    environment:
+      - START_XVFB=false
     logging:
       driver: none
     volumes:
       - /dev/shm:/dev/shm
     shm_size: 2G
     ports:
-      - "4444:4444"
-      - "5959:5900"
+      - "4445:4444"
+      - "5960:5900"
     networks:
       - hyrax
 
@@ -120,6 +122,13 @@ services:
     networks:
       - hyrax
 
+  fits:
+    image: harvardlts/fitsservlet_container:1.5.0
+    ports:
+      - 8080
+    networks:
+      - hyrax
+
   memcached:
     image: bitnami/memcached
     ports:
@@ -145,6 +154,10 @@ services:
     volumes:
       - solr_home:/var/solr/data:cached
       - .dassie/solr/conf:/opt/solr/server/configsets/hyraxconf
+    ulimits:
+      nofile:
+        soft: 65536
+        hard: 524288
     networks:
       - hyrax
 

data/documentation/developing-your-hyrax-based-app.md

@@ -30,7 +30,7 @@ A Hyrax-based application includes lots of dependencies. We provide a [Docker im
 You can also try [Running Hyrax-based application in local VM](https://github.com/samvera/hyrax/wiki/Hyrax-Development-Guide#running-hyrax-based-application-in-local-vm) which uses Ubuntu.
 
 This document contains instructions specific to setting up an app with __Hyrax
-v4.0.0.rc1__. If you are looking for instructions on installing a different
+v5.0.0.rc1__. If you are looking for instructions on installing a different
 version, be sure to select the appropriate branch or tag from the drop-down
 menu above.
 
@@ -95,7 +95,7 @@ Note here that the following commands assume you're setting up Hyrax in a develo
 
 First, you'll need a working Ruby installation. You can install this via your operating system's package manager -- you are likely to get farther with OSX, Linux, or UNIX than Windows but your mileage may vary -- but we recommend using a Ruby version manager such as [RVM](https://rvm.io/) or [rbenv](https://github.com/sstephenson/rbenv).
 
-Hyrax supports Ruby 2.5, 2.6, and 2.7. When starting a new project, we recommend using the latest Ruby 2.7 version.
+Hyrax supports Ruby 3.2. When starting a new project, we recommend using the latest Ruby 3.2 version.
 
 ## Redis
 
@@ -105,11 +105,11 @@ Starting up Redis will depend on your operating system, and may in fact already
 
 ## Rails
 
-Hyrax requires Rails 5. We recommend the latest Rails 5.2 release.
+Hyrax requires Rails 6. We recommend the latest Rails 6.1 release.
 
 ```
 # If you don't already have Rails at your disposal...
-gem install rails -v 5.2.6
+gem install rails -v 6.1.7.6
 ```
 
 ### JavaScript runtime
@@ -125,7 +125,7 @@ NOTE: The steps need to be done in order to create a new Hyrax based app.
 Generate a new Rails application using the template.
 
 ```
-rails _6.1.7.3_ new my_app -m https://raw.githubusercontent.com/samvera/hyrax/hyrax-v4.0.0.rc1/template.rb
+rails _6.1.7.6_ new my_app -m https://raw.githubusercontent.com/samvera/hyrax/hyrax-v5.0.0.rc1/template.rb
 ```
 
 Generating a new Rails application using Hyrax's template above takes cares of a number of steps for you, including:
@@ -223,7 +223,7 @@ You may wish to [customize your work type](https://github.com/samvera/hyrax/wiki
 
 ### Enable notifications
 
-Hyrax 2 uses a WebSocket-based user notifications system, which requires Redis. To enable user notifications, make sure that you have configured ActionCable to use Redis as the adapter in your application's `config/cable.yml`. E.g., for the `development` Rails environment:
+Hyrax 2+ uses a WebSocket-based user notifications system, which requires Redis. To enable user notifications, make sure that you have configured ActionCable to use Redis as the adapter in your application's `config/cable.yml`. E.g., for the `development` Rails environment:
 
 ```yaml
 development:
@@ -231,14 +231,6 @@ development:
   url: redis://localhost:6379
 ```
 
-Using Rails up to version 5.1.4, ActionCable will not work with the 4.x series of the `redis` gem, so you will also need to pin your application to a 3.x release by adding this to your `Gemfile`:
-
-```ruby
-gem 'redis', '~> 3.0'
-```
-
-And then run `bundle update redis`.
-
 Note that the Hyrax Management Guide contains additional information on [how to configure ActionCable in production environments](https://github.com/samvera/hyrax/wiki/Hyrax-Management-Guide#notifications).
 
 ## Managing a Hyrax-based app

data/documentation/legacyREADME.md

@@ -1,6 +1,8 @@
 # Legacy README
 
-This is a deprecated document that might have some useful information.
+## Deprecated Document
+
+This is a deprecated document that might have some useful information. **It is no longer being updated.**
 
 # Table of Contents
 

data/hyrax.gemspec

@@ -17,7 +17,7 @@ SUMMARY
 
   spec.homepage      = "http://github.com/samvera/hyrax"
 
-  spec.files         = `git ls-files`.split($OUTPUT_RECORD_SEPARATOR).select { |f| File.dirname(f) !~ %r{\A"?spec\/?} }
+  spec.files         = `git ls-files`.split($OUTPUT_RECORD_SEPARATOR).select { |f| File.dirname(f) !~ %r{\A"?spec\/?} && f != 'bin/rails' }
   spec.executables   = spec.files.grep(%r{^bin/}).map { |f| File.basename(f) }
   spec.name          = "hyrax"
   spec.require_paths = ["lib"]
@@ -25,7 +25,7 @@ SUMMARY
   spec.license       = 'Apache-2.0'
   spec.metadata      = { "rubygems_mfa_required" => "true" }
 
-  spec.required_ruby_version = '>= 2.7'
+  spec.required_ruby_version = '>= 3.2'
 
   # NOTE: rails does not follow sem-ver conventions, it's
   # minor version releases can include breaking changes; see

data/karma.conf.js

@@ -66,6 +66,7 @@ module.exports = function(config) {
     },
 
     // web server port
+    hostname: process.env.KARMA_HOSTNAME || 'localhost', // This is the host the remote browser connects to
     port: 9876,
 
     // enable / disable colors in the output (reporters and logs)
@@ -80,16 +81,14 @@ module.exports = function(config) {
 
     // start these browsers
     // available browser launchers: https://www.npmjs.com/search?q=keywords:karma-launcher
-    browsers: [process.env.KARMA_BROWSER],
+    browsers: [process.env.KARMA_BROWSER || 'ChromiumHeadless'],
 
     customLaunchers: {
-      ChromiumHeadlessCustom: {
-        base: 'ChromiumHeadless',
-        flags: ['--no-sandbox']
-      },
-      ChromeHeadlessCustom: {
-        base: 'ChromeHeadless',
-        flags: ['--no-sandbox']
+      'remote-chromium': {
+        base: 'SeleniumGrid',
+        gridUrl: process.env.HUB_URL || 'http://localhost:4444/wd/hub',
+        browserName: 'chrome',
+        arguments: [ '--headless=new']
       }
     },
 
@@ -99,6 +98,6 @@ module.exports = function(config) {
 
     // Concurrency level
     // how many browser instances should be started simultaneously
-    concurrency: 4
+    concurrency: 1
   })
 }

data/lib/generators/hyrax/templates/config/initializers/hyrax.rb

@@ -95,7 +95,7 @@ Hyrax.config do |config|
 
   # Location autocomplete uses geonames to search for named regions
   # Username for connecting to geonames
-  # config.geonames_username = ''
+  config.geonames_username = ENV['GEONAMES_USERNAME'] || ''
 
   # Should the acceptance of the licence agreement be active (checkbox), or
   # implied when the save button is pressed? Set to true for active

data/lib/generators/hyrax/templates/config/initializers/riiif.rb

@@ -14,11 +14,21 @@ ActiveSupport::Reloader.to_prepare do
     { height: doc['height_is'], width: doc['width_is'], format: doc['mime_type_ssi'], channels: doc['alpha_channels_ssi'] }
   end
 
-  Riiif::Image.file_resolver.id_to_uri = lambda do |id|
-    Hyrax::Base.id_to_uri(CGI.unescape(id)).tap do |url|
-      Hyrax.logger.info "Riiif resolved #{id} to #{url}"
-    end
-  end
+  Riiif::Image.file_resolver.id_to_uri = if Hyrax.config.use_valkyrie?
+                                           # Use Valkyrie adapter to make sure file is available locally. Riiif will just open it then
+                                           # id comes in with the format "FILE_SET_ID/files/FILE_ID"
+                                           lambda do |id|
+                                             file_metadata = Hyrax.query_service.find_by(id: id.split('/').last)
+                                             file = Hyrax.storage_adapter.find_by(id: file_metadata.file_identifier)
+                                             file.disk_path.to_s
+                                           end
+                                         else
+                                           lambda do |id|
+                                             Hyrax::Base.id_to_uri(CGI.unescape(id)).tap do |url|
+                                               Rails.logger.info "Riiif resolved #{id} to #{url}"
+                                             end
+                                           end
+                                         end
 
   Riiif::Image.authorization_service = Hyrax::IiifAuthorizationService
 

data/lib/hyrax/active_fedora_dummy_model.rb

@@ -69,7 +69,12 @@ module Hyrax
     ##
     # @api public
     def to_global_id
-      URI::GID.build app: GlobalID.app, model_name: model_name.name, model_id: @id
+      # this covers the use case of creating a non Valkyrie::Resource, while using Valkyrie
+      if model_name.name.constantize <= Valkyrie::Resource
+        URI::GID.build app: GlobalID.app, model_name: Hyrax::ValkyrieGlobalIdProxy.to_s, model_id: @id
+      else
+        URI::GID.build app: GlobalID.app, model_name: model_name.name, model_id: @id
+      end
     end
   end
 end

data/lib/hyrax/configuration.rb

@@ -518,6 +518,12 @@ module Hyrax
       @characterization_proxy ||= :original_file
     end
 
+    ##
+    # Options to pass to the characterization service
+    # @!attribute [rw] characterization_options
+    #  @return [Hash] of options like {ch12n_tool: :fits_servlet}
+    attr_accessor :characterization_options
+
     # Attributes for the lock manager which ensures a single process/thread is mutating a ore:Aggregation at once.
     # @!attribute [w] lock_retry_count
     #   How many times to retry to acquire the lock before raising UnableToAcquireLockError

data/lib/hyrax/engine.rb

@@ -20,6 +20,8 @@ module Hyrax
     require 'qa'
     require 'tinymce-rails'
     require 'valkyrie'
+    require 'cancancan'
+    require 'blacklight'
 
     require 'hydra/derivatives'
     require 'hyrax/active_fedora_dummy_model'

data/lib/hyrax/publisher.rb

@@ -137,6 +137,10 @@ module Hyrax
     #     a system user.
     register_event('file.metadata.updated')
 
+    # @since 5.0.0
+    # @macro a_registered_event
+    register_event('file.uploaded')
+
     # @since 3.0.0
     # @macro a_registered_event
     register_event('file.set.audited')
@@ -191,8 +195,20 @@ module Hyrax
     #     `#member_ids`)
     register_event('object.metadata.updated')
 
-    # @since 3.2.0
-    # @macro a_registered_event
-    register_event('object.file.uploaded')
+    ##
+    # @return Array[Object] the listeners Hyrax subscribes by default.
+    def default_listeners
+      @default_listeners ||=
+        [Hyrax::Listeners::AclIndexListener.new,
+         Hyrax::Listeners::BatchNotificationListener.new,
+         Hyrax::Listeners::FileMetadataListener.new,
+         Hyrax::Listeners::FileSetLifecycleListener.new,
+         Hyrax::Listeners::FileSetLifecycleNotificationListener.new,
+         Hyrax::Listeners::MemberCleanupListener.new,
+         Hyrax::Listeners::MetadataIndexListener.new,
+         Hyrax::Listeners::ObjectLifecycleListener.new,
+         Hyrax::Listeners::TrophyCleanupListener.new,
+         Hyrax::Listeners::WorkflowListener.new].freeze
+    end
   end
 end

data/lib/hyrax/specs/capybara.rb

@@ -20,10 +20,15 @@ require 'webdrivers' unless ENV['IN_DOCKER'].present? || ENV['HUB_URL'].present?
 Capybara.save_path = ENV['CI'] ? "/tmp/test-results" : Rails.root.join('tmp', 'capybara')
 
 if ENV['IN_DOCKER'].present? || ENV['HUB_URL'].present?
-  args = %w[disable-gpu no-sandbox whitelisted-ips window-size=1400,1400]
-  args.push('headless') if ActiveModel::Type::Boolean.new.cast(ENV['CHROME_HEADLESS_MODE'])
-
-  options = Selenium::WebDriver::Options.chrome("goog:chromeOptions" => { args: args })
+  options = Selenium::WebDriver::Chrome::Options.new.tap do |opts|
+    opts.add_argument("--headless") if ENV["CHROME_HEADLESS_MODE"]
+    opts.add_argument("--disable-gpu") if Gem.win_platform?
+    # Workaround https://bugs.chromium.org/p/chromedriver/issues/detail?id=2650&q=load&sort=-id&colspec=ID%20Status%20Pri%20Owner%20Summary
+    opts.add_argument("--disable-site-isolation-trials")
+    opts.add_argument("--window-size=1440,1440")
+    opts.add_argument("--enable-features=NetworkService,NetworkServiceInProcess")
+    opts.add_argument("--disable-features=VizDisplayCompositor")
+  end
 
   Capybara.register_driver :selenium_chrome_headless_sandboxless do |app|
     driver = Capybara::Selenium::Driver.new(app,

data/lib/hyrax/transactions/container.rb

@@ -31,6 +31,7 @@ module Hyrax
       require 'hyrax/transactions/steps/add_to_collections'
       require 'hyrax/transactions/steps/add_to_parent'
       require 'hyrax/transactions/steps/apply_collection_type_permissions'
+      require 'hyrax/transactions/steps/apply_permission_template'
       require 'hyrax/transactions/steps/change_depositor'
       require 'hyrax/transactions/steps/check_for_empty_admin_set'
       require 'hyrax/transactions/steps/delete_access_control'
@@ -203,6 +204,10 @@ module Hyrax
           Steps::AddToParent.new
         end
 
+        ops.register 'apply_permission_template' do
+          Steps::ApplyPermissionTemplate.new
+        end
+
         ops.register 'change_depositor' do
           Steps::ChangeDepositor.new
         end

data/lib/hyrax/transactions/steps/add_file_sets.rb

@@ -25,6 +25,12 @@ module Hyrax
         # @return [Dry::Monads::Result]
         def call(obj, uploaded_files: [], file_set_params: [])
           if @handler.new(work: obj).add(files: uploaded_files, file_set_params: file_set_params).attach
+            file_sets = obj.member_ids.map do |member|
+              Hyrax.query_service.find_by(id: member) if Hyrax.query_service.find_by(id: member).is_a? Hyrax::FileSet
+            end
+
+            Hyrax::LeaseManager.create_or_update_lease_on_members(file_sets, obj) if obj.lease
+            Hyrax::EmbargoManager.create_or_update_embargo_on_members(file_sets, obj) if obj.embargo
             Success(obj)
           else
             Failure[:failed_to_attach_file_sets, uploaded_files]

data/lib/hyrax/transactions/steps/apply_permission_template.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+module Hyrax
+  module Transactions
+    module Steps
+      ##
+      # A `dry-transcation` step that applies a permission template
+      # to a saved object.
+      #
+      # @note by design, this step should succeed even if for some reason a
+      #   permission template could not be applied. it's better to complete the
+      #   rest of the creation process with missing ACL grants than to crash and
+      #   miss other crucial steps.
+      #
+      # @since 4.1.0
+      class ApplyPermissionTemplate
+        include Dry::Monads[:result]
+
+        ##
+        # @param [Hyrax::Work] object
+        #
+        # @return [Dry::Monads::Result]
+        def call(object)
+          template = Hyrax::PermissionTemplate.find_by(source_id: object&.admin_set_id)
+
+          if template.blank?
+            Hyrax.logger.info("At create time, #{object} doesn't have a " \
+                              "PermissionTemplate, which it should have via " \
+                              "AdministrativeSet #{object&.admin_set_id}). " \
+                              "Continuing to create this object anyway.")
+
+            return Success(object)
+          end
+
+          Hyrax::PermissionTemplateApplicator.apply(template).to(model: object) &&
+            Success(object)
+        end
+      end
+    end
+  end
+end