hyrax 5.2.0 → 5.3.0

data/app/assets/stylesheets/hyrax/sidebar.scss

@@ -2,6 +2,28 @@ $drawer-small: 40px;
 $drawer-large: 260px;
 $gutter-width: $grid-gutter-width/2;
 
+// Backdrop overlay for mobile sidebar - automatically shows when sidebar is maximized
+.sidebar-backdrop {
+  display: none;
+  position: fixed;
+  top: 0;
+  left: 0;
+  right: 0;
+  bottom: 0;
+  background-color: rgba(0, 0, 0, 0.5);
+  z-index: 1000;
+  opacity: 0;
+  transition: opacity 0.3s ease;
+
+  @media screen and (max-width: 991px) {
+    // Automatically show when sidebar is maximized preventing flash on page load
+    .sidebar.maximized.js-initialized ~ & {
+      display: block;
+      opacity: 1;
+    }
+  }
+}
+
 .main-content {
   padding-left: $drawer-small + $gutter-width;
   padding-right: $gutter-width;
@@ -9,10 +31,29 @@ $gutter-width: $grid-gutter-width/2;
   background-color: $admin-content-background-color;
   position: absolute;
   width: 100%;
+  transition: opacity 0.3s ease;
 
   &.maximized {
     padding-left: $drawer-large + $gutter-width;
   }
+
+  // On mobile, sidebar overlays content instead of pushing it
+  @media screen and (max-width: 991px) {
+    padding-left: $drawer-small + $gutter-width;
+    // Keep padding the same even when sidebar is maximized
+    // Only grey out after JS has initialized preventing flash on page load
+    &.maximized:not(.js-initialized) {
+      padding-left: $drawer-small + $gutter-width;
+      opacity: 1;
+      pointer-events: auto;
+    }
+    &.maximized.js-initialized {
+      padding-left: $drawer-small + $gutter-width;
+      // Grey out and disable content when sidebar is open
+      opacity: 0.5;
+      pointer-events: none;
+    }
+  }
 }
 
 // .sidebar is a class on the div
@@ -25,6 +66,40 @@ $gutter-width: $grid-gutter-width/2;
   width: $drawer-small;
   z-index: 1000;
 
+  // On mobile sidebar overlays content when maximized
+  @media screen and (max-width: 991px) {
+    width: $drawer-small;
+    
+    // Force sidebar to start collapsed on mobile preventing flash of open sidebar on page load
+    &:not(.js-initialized).maximized {
+      width: $drawer-small !important;
+      
+      // Hide maximized content initially on mobile
+      .sidebar-action-text,
+      a span + span,
+      h5 {
+        display: none !important;
+      }
+      
+      .h5,
+      .profile,
+      .collapse-toggle::after {
+        opacity: 0 !important;
+      }
+      
+      .sidebar-toggle {
+        transform: none !important;
+      }
+    }
+    
+    &.maximized.js-initialized {
+      position: fixed;
+      z-index: 1001;
+      box-shadow: 2px 0 8px rgba(0, 0, 0, 0.15);
+      width: $drawer-large;
+    }
+  }
+
   &.maximized {
     width: $drawer-large;
 
@@ -83,12 +158,32 @@ $gutter-width: $grid-gutter-width/2;
     cursor: pointer;
     background-color: $body-background-color;
     border-radius: 50%;
-    line-height: 18px;
+    border: none;
+    padding: 0;
+    line-height: 24px;
     position: absolute;
-    right: -10px;
+    right: -12px;
     text-align: center;
-    width: 18px;
+    width: 24px;
+    height: 24px;
+    min-width: 24px;
+    min-height: 24px;
     z-index: 1001;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+
+    // Focus styles for keyboard navigation
+    &:focus {
+      outline: 2px solid #005fcc;
+      outline-offset: 2px;
+      box-shadow: 0 0 0 2px #ffffff, 0 0 0 4px #005fcc;
+    }
+
+    // Centered icon
+    .fa {
+      display: block;
+    }
   }
 
   a {

data/app/authorities/qa/authorities/collections.rb

@@ -7,10 +7,7 @@ module Qa::Authorities
     def search(_q, controller)
       # The Hyrax::CollectionSearchBuilder expects a current_user
       return [] unless controller.current_user
-      response, = search_response(controller)
-      docs = response.documents
-
-      docs.map do |doc|
+      search_documents(controller).map do |doc|
         { id: doc.id, label: doc.title, value: doc.id }
       end
     end
@@ -27,13 +24,16 @@ module Qa::Authorities
       )
     end
 
-    def search_response(controller)
+    def search_documents(controller)
       access = controller.params[:access] || 'read'
+      builder = search_service(controller).search_builder
+                                          .with(q: controller.params[:q])
+                                          .with_access(access)
 
-      search_service(controller).search_results do |builder|
-        builder.with({ q: controller.params[:q] })
-               .with_access(access)
-               .rows(100)
+      Hyrax::SolrService.fetch_all do |rows, start|
+        controller.blacklight_config.repository.search(
+          builder.query.merge(rows: rows, start: start, fl: 'id,title_tesim,has_model_ssim')
+        )
       end
     end
   end

data/app/controllers/concerns/hyrax/analytics_error_handling.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+require 'google/cloud/errors'
+
+module Hyrax
+  module AnalyticsErrorHandling
+    extend ActiveSupport::Concern
+
+    included do
+      rescue_from Google::Cloud::PermissionDeniedError, with: :handle_analytics_permission_error
+      rescue_from Google::Cloud::Error, with: :handle_analytics_general_error
+      rescue_from StandardError, with: :handle_analytics_general_error
+    end
+
+    private
+
+    def handle_analytics_permission_error(exception)
+      Rails.logger.error "Analytics permission error: #{exception.message}"
+      @analytics_error = {
+        type: 'permission',
+        title: I18n.t('hyrax.admin.analytics.errors.permission.title'),
+        message: I18n.t('hyrax.admin.analytics.errors.permission.message'),
+        details: exception.message,
+        troubleshooting_steps: Array.wrap(I18n.t('hyrax.admin.analytics.errors.permission.troubleshooting_steps')),
+        documentation_url: I18n.t('hyrax.admin.analytics.errors.permission.documentation_url')
+      }
+      set_empty_analytics_data
+      render_analytics_with_error
+    end
+
+    def handle_analytics_general_error(exception)
+      raise exception unless analytics_related_error?(exception)
+
+      Rails.logger.error "Analytics error: #{exception.message}"
+
+      error_type = determine_error_type(exception)
+
+      @analytics_error = {
+        type: error_type,
+        title: I18n.t("hyrax.admin.analytics.errors.#{error_type}.title"),
+        message: I18n.t("hyrax.admin.analytics.errors.#{error_type}.message"),
+        details: exception.message,
+        troubleshooting_steps: Array.wrap(I18n.t("hyrax.admin.analytics.errors.#{error_type}.troubleshooting_steps")),
+        documentation_url: I18n.t("hyrax.admin.analytics.errors.#{error_type}.documentation_url")
+      }
+      set_empty_analytics_data
+      render_analytics_with_error
+    end
+
+    def determine_error_type(exception)
+      case exception.message
+      when /property.*not found/i, /invalid property/i
+        'invalid_property'
+      when /authentication/i, /credentials/i, /unauthorized/i
+        'authentication'
+      when /quota/i, /rate limit/i
+        'quota_exceeded'
+      else
+        'general'
+      end
+    end
+
+    def analytics_related_error?(exception)
+      return true if exception.is_a?(Google::Cloud::Error)
+      exception.message.include?('analytics') ||
+        exception.message.include?('Google') ||
+        exception.message.include?('property') ||
+        exception.backtrace&.any? { |line| line.include?('analytics') || line.include?('google') }
+    end
+
+    def set_empty_analytics_data
+      # Set empty data structures to prevent view errors
+      empty_data = { pageviews: [], work_page_views: [], downloads: [], all_top_collections: [],
+                     top_collections: [], top_downloads: [], top_collection_pages: [], accessible_works: [],
+                     accessible_file_sets: [], works_count: 0, top_works: [], top_file_set_downloads: [],
+                     uniques: [], files: [] }
+
+      empty_data.each { |key, value| instance_variable_set("@#{key}", value) if instance_variable_get("@#{key}").nil? }
+    end
+
+    def render_analytics_with_error
+      respond_to do |format|
+        format.html { render :index }
+        format.csv { render plain: "Analytics data unavailable due to configuration error", status: :service_unavailable }
+      end
+    end
+
+    def safe_analytics_call(method_name, *args)
+      Hyrax::Analytics.send(method_name, *args)
+    rescue Google::Cloud::PermissionDeniedError, Google::Cloud::Error => e
+      Rails.logger.warn "Analytics call failed: #{method_name} - #{e.message}"
+      []
+    rescue StandardError => e
+      Rails.logger.warn "Unexpected analytics error: #{method_name} - #{e.message}"
+      []
+    end
+  end
+end

data/app/controllers/concerns/hyrax/collections_controller_behavior.rb

@@ -3,7 +3,9 @@ module Hyrax
   module CollectionsControllerBehavior
     extend ActiveSupport::Concern
     include Blacklight::AccessControls::Catalog
-    include Blacklight::Base
+    include Blacklight::Configurable
+    include Blacklight::SearchContext
+    include Hyrax::RedirectToDisplayUrl
 
     included do
       # include the display_trophy_link view helper method

data/app/controllers/concerns/hyrax/ensure_migrated_behavior.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Hyrax
+  ##
+  # A shared module for controllers to ensure that a resource has been fully
+  # migrated from a Wings-backed ActiveFedora object to a native Valkyrie resource
+  # before an action (like `edit`) is performed.
+  #
+  # This is a temporary solution to handle just-in-time migrations for legacy
+  # objects when `Hyrax.config.flexible?` is true.
+  #
+  # @example
+  #   class MyController < ApplicationController
+  #     include Hyrax::EnsureMigratedBehavior
+  #
+  #     before_action do
+  #       @resource = find_my_resource
+  #       @resource = ensure_migrated(resource: @resource, form: build_form, transaction_key: 'my.transaction')
+  #     end
+  #   end
+  module EnsureMigratedBehavior
+    extend ActiveSupport::Concern
+
+    private
+
+    ##
+    # @param resource [Valkyrie::Resource] the resource to check
+    # @param transaction_key [String] the key for the update transaction
+    #
+    # @return [Valkyrie::Resource] the migrated resource if migration was needed,
+    #   otherwise the original resource.
+    def ensure_migrated(resource:, transaction_key:)
+      return resource unless resource.flexible? && wings_backed?(resource)
+
+      # Create a minimal form object to run the transaction.
+      # We can't use the controller's form because it may fail to build
+      # for a Wings-backed object, creating a circular dependency.
+      form = Hyrax::Forms::ResourceForm.for(resource: resource)
+      result = transactions[transaction_key].call(form)
+
+      raise "Valkyrie lazy migration failed for #{resource.class} #{resource.id}: #{result.failure}" unless result.success?
+
+      result.value!
+    end
+
+    def wings_backed?(resource)
+      resource.respond_to?(:wings?) && resource.wings?
+    end
+  end
+end

data/app/controllers/concerns/hyrax/flexible_catalog_behavior.rb

@@ -0,0 +1,206 @@
+# frozen_string_literal: true
+
+module Hyrax
+  module FlexibleCatalogBehavior
+    extend ActiveSupport::Concern
+
+    class_methods do
+      def load_flexible_schema
+        previous_profile, current_profile = Hyrax::FlexibleSchema.order("created_at asc").last(2).map(&:profile)
+        return if previous_profile.blank? && current_profile.blank?
+
+        current_profile = previous_profile if current_profile.nil?
+        remove_old_properties!(previous_profile['properties'], current_profile['properties'].keys) if current_profile != previous_profile
+        properties_hash = current_profile['properties']
+        properties_hash.each do |itemprop, prop|
+          label = display_label_for(itemprop, prop)
+
+          view_options = prop['view']
+          indexing = prop['indexing']
+          next if indexing.nil?
+
+          # prevents all restricted fields from being added to blacklight config
+          # to prevent them from being exposed in catalog search results.
+          # They remain available on show pages, based on visibility.
+          if restricted_field?(indexing)
+            remove_from_blacklight_config!(itemprop, indexing)
+            next
+          end
+
+          # `view.search_results: false` in the m3 profile hides this property from catalog
+          # search-result columns. Only gates the dynamic add_index_field path below;
+          # properties already declared in CatalogController are left untouched, and
+          # the `qf` (query-field relevance) list is unaffected. Facet registration below
+          # is intentionally not gated — a hidden property can still be facetable.
+          if catalog_indexable?(view_options) && stored_searchable?(indexing, itemprop)
+            index_args = { itemprop:, label: }
+
+            if facetable?(indexing, itemprop)
+              index_args[:link_to_facet] = "#{itemprop}_sim"
+            end
+
+            name = blacklight_config.index_fields.keys.detect { |key| key.start_with?(itemprop) }
+            name ||= "#{itemprop}_tesim"
+
+            # for properties that DO exist in the CatalogController
+            if blacklight_config.index_fields[name].present?
+              if label
+                blacklight_config.index_fields[name].label = label
+                blacklight_config.index_fields[name].custom_label = true
+              end
+              blacklight_config.index_fields[name].itemprop = itemprop
+
+              blacklight_config.index_fields[name].link_to_facet = index_args[:link_to_facet]
+
+              if require_view_helper_method?(view_options)
+                # add or update the helper method so linked fields will render correctly in the index view
+                blacklight_config.index_fields[name].helper_method = view_option_for_helper_method(view_options)
+                # the helper method for index_field_link needs the field name
+                blacklight_config.index_fields[name].field_name = itemprop
+              end
+            else
+              # for properties that DO NOT exist in the catalog controller
+              if require_view_helper_method?(view_options)
+                # add the view helper method to the arguments hash when creating a property
+                index_args[:helper_method] = view_option_for_helper_method(view_options)
+                # the helper method for index_field_link needs the field name
+                index_args[:field_name] = itemprop
+              end
+              # if a property in the metadata profile doesn't exist in the CatalogController, add it
+              blacklight_config.add_index_field(name, index_args)
+
+              # all index fields get this property so an admin can hide a property from the catalog search results
+              # by adding the name of the property via admin dashboard > Settings > Accounts > Hidden index fields
+              # NOTE: it is likely this will be handled by the metadata profile in the future
+              blacklight_config.index_fields[name].if = :render_optionally?
+            end
+
+            qf = blacklight_config.search_fields['all_fields'].solr_parameters[:qf]
+            unless qf.include?(name)
+              qf << " #{name}"
+            end
+          end
+
+          if facetable?(indexing, itemprop)
+            name = "#{itemprop}_sim"
+            unless blacklight_config.facet_fields[name].present?
+              blacklight_config.add_facet_field(name, label: label)
+            end
+          else
+            # if the property does not have facetable in the indexing section of the metadata profile, remove the facet field from the blacklight config
+            name = "#{itemprop}_sim"
+            blacklight_config.facet_fields.delete(name)
+          end
+        end
+      end
+
+      private
+
+      # Returns true if the view options require a helper method to render the linked field correctly in the index view
+      # @param view_options [Hash] the view options ex: {"render_as"=>"linked", "html_dl"=>true}
+      # @return [Boolean] to determine if the view_option_for_helper_method should be called
+      def require_view_helper_method?(view_options)
+        view_options.present? && %w[external_link linked rights_statement].include?(view_options.dig('render_as'))
+      end
+
+      # Returns the helper method that will render the linked field correctly in the index view
+      # @param view_options [Hash] the view options ex: {"render_as"=>"linked", "html_dl"=>true}
+      # @return [Symbol] helper method from Hyrax::HyraxHelperBehavior
+      def view_option_for_helper_method(view_options)
+        render_as = view_options.dig('render_as')
+        return :iconify_auto_link if render_as == 'external_link'
+        return :index_field_link if render_as == 'linked'
+        return :rights_statement_links if render_as == 'rights_statement'
+      end
+
+      def display_label_for(field_name, config)
+        display_label = config.fetch('display_label', {})&.with_indifferent_access || {}
+        display_label = { default: display_label } if display_label.is_a?(String)
+        display_label[:default] = field_name.to_s.humanize if display_label[:default].blank?
+        # Return a lambda so locale and translation are resolved at render time,
+        # not at initialize time (before before_action :set_locale runs).
+        lambda { |*|
+          label = display_label[I18n.locale] || display_label[:default]
+          I18n.t(label, default: label)
+        }
+      end
+
+      def stored_searchable?(indexing, itemprop)
+        indexing.include?('stored_searchable') || indexing.include?("#{itemprop}_tesim")
+      end
+
+      # True when the property declares `admin_only` or `editor_only` in its
+      # indexing array. Restricted fields are never exposed through the
+      # Blacklight catalog (no index column, no facet, no free-text match);
+      # visibility is enforced on show pages by the `field_visible?` view
+      # helper.
+      def restricted_field?(indexing)
+        indexing.include?("admin_only") || indexing.include?("editor_only")
+      end
+
+      # Returns false only when the m3 profile sets `view.search_results: false`
+      # for the property; absent or `true` keeps existing catalog-display behavior.
+      def catalog_indexable?(view_options)
+        return true unless view_options.is_a?(Hash)
+        view_options['search_results'] != false
+      end
+
+      def facetable?(indexing, itemprop)
+        indexing.include?('facetable')
+      end
+
+      def remove_old_properties!(previous_profile_properties, current_property_keys)
+        props = previous_profile_properties.keys - current_property_keys
+        props.each do |prop|
+          indexing = previous_profile_properties.dig(prop, 'indexing')
+          remove_from_blacklight_config!(prop, indexing)
+        end
+      end
+
+      # Evict every Blacklight registration for `itemprop`. Collects the set of
+      # Solr field names to remove from three sources:
+      # - "<itemprop>_tesim" — the default Solr field name used as the
+      #   index field for this property,
+      # - "<itemprop>_sim"   — the default Solr field name used as the
+      #   facet field for this property,
+      # - any additional Solr-field names explicitly declared in `indexing:`
+      #   (filtering out the directive flags `stored_searchable`, `facetable`,
+      #   `admin_only`, and `editor_only`).
+      # Then removes those exact names from `facet_fields`, `index_fields`, and
+      # the all_fields qf. Exact-name matching avoids prefix collisions where
+      # e.g. `title` would otherwise match `title_alternative_*`.
+      INDEXING_DIRECTIVES = %w[stored_searchable facetable admin_only editor_only].freeze
+
+      def remove_from_blacklight_config!(itemprop, indexing = nil)
+        names = solr_field_names_for(itemprop, indexing)
+        names.each do |name|
+          blacklight_config.facet_fields.delete(name)
+          blacklight_config.index_fields.delete(name)
+        end
+
+        qf = blacklight_config.search_fields['all_fields']&.solr_parameters&.dig(:qf)
+        return if qf.nil?
+        names.each do |name|
+          qf.slice!(" #{name}")
+          qf.slice!(name)
+        end
+      end
+
+      def solr_field_names_for(itemprop, indexing)
+        default_fields = ["#{itemprop}_tesim", "#{itemprop}_sim"]
+        declared_fields = (indexing || []) - INDEXING_DIRECTIVES
+        (default_fields + declared_fields).uniq
+      end
+    end
+
+    def initialize
+      self.class.load_flexible_schema
+      super
+    end
+
+    # Hook to allow optional rendering at the app level
+    def render_optionally?
+      true
+    end
+  end
+end

data/app/controllers/concerns/hyrax/flexible_schema_behavior.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Hyrax
+  module FlexibleSchemaBehavior
+    extend ActiveSupport::Concern
+
+    included do
+      before_action :set_latest_schema_version, only: [:new, :edit]
+    end
+
+    private
+
+    def set_latest_schema_version
+      @latest_schema_version = Hyrax::FlexibleSchema.current_schema_id.to_f
+    end
+  end
+end

data/app/controllers/concerns/hyrax/redirect_to_display_url.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+module Hyrax
+  # Controller concern that sends visitors who land on a path with a
+  # redirect-table row pointing elsewhere to that other path. Included on
+  # work and collection show controllers via the curation-concerns
+  # behavior modules.
+  #
+  # Two request shapes hit this concern:
+  #
+  # - Direct UUID URL visits (`/concern/generic_works/<uuid>`) — Rails
+  #   routes natively to the show action. If the resource has a display
+  #   alias, the row keyed on the UUID URL has `to_path` pointing at the
+  #   alias, and the before_action 301s the visitor there.
+  # - In-process dispatches from `Hyrax::RedirectsController` — the
+  #   resolver finds a display-URL row and re-dispatches the request
+  #   through `recognize_path` + `controller.dispatch`. To avoid the
+  #   before_action firing again on the same logical request, the
+  #   resolver sets `request.env['hyrax.redirects.dispatched'] = true`
+  #   before dispatching; this concern checks the same env key and
+  #   no-ops when set.
+  #
+  # See documentation/redirects.md.
+  module RedirectToDisplayUrl
+    extend ActiveSupport::Concern
+
+    included do
+      before_action :redirect_to_display_url_if_needed, only: :show
+    end
+
+    private
+
+    def redirect_to_display_url_if_needed
+      return if request.env['hyrax.redirects.dispatched']
+      return unless Hyrax.config.redirects_active?
+      row = Hyrax::RedirectsLookup.find_row(request.path)
+      return if row.blank?
+      return if row.to_path == request.path
+      redirect_to with_locale(row.to_path), status: :moved_permanently
+    end
+
+    # Carry the visitor's requested locale (set by Hyrax::Controller#set_locale
+    # from `params[:locale]`) across the 301 so the destination page renders in
+    # the same language. Appended as `?locale=<value>` so this works whether the
+    # host app uses path-prefix or query-string locales. The locale value is
+    # URL-encoded via Rack::Utils.build_query so attacker-controlled chars in
+    # params[:locale] can't inject extra query params into the Location header.
+    def with_locale(path)
+      return path if params[:locale].blank?
+      separator = path.include?('?') ? '&' : '?'
+      "#{path}#{separator}#{Rack::Utils.build_query(locale: params[:locale])}"
+    end
+  end
+end