hyrax 5.2.0 → 5.3.0

data/app/renderers/hyrax/renderers/rights_statement_attribute_renderer.rb

@@ -7,19 +7,18 @@ module Hyrax
       private
 
       ##
-      # Special treatment for license/rights.  A URL from the Hyrax gem's config/hyrax.rb is stored in the descMetadata of the
-      # curation_concern.  If that URL is valid in form, then it is used as a link.  If it is not valid, it is used as plain text.
+      # Special treatment for license/rights. A URL from the Hyrax gem's
+      # `config/hyrax.rb` is stored in the descMetadata of the
+      # curation_concern. If the stored value is an absolute http/https URI,
+      # render it as a link with the authority's label; otherwise render the
+      # value as plain text to avoid emitting unsafe href values (e.g.
+      # `javascript:`) or broken links for free-text values.
       def attribute_value_to_html(value)
-        begin
-          parsed_uri = URI.parse(value)
-        rescue URI::InvalidURIError
-          nil
-        end
-        if parsed_uri.nil?
-          ERB::Util.h(value)
-        else
+        if Hyrax::AuthorityRenderingHelper.linkable_uri?(value)
           label = Hyrax.config.rights_statement_service_class.new.label(value) { value }
-          %(<a href=#{ERB::Util.h(value)} target="_blank">#{label}</a>)
+          %(<a href="#{ERB::Util.h(value)}" target="_blank" rel="noopener noreferrer">#{ERB::Util.h(label)}</a>)
+        else
+          ERB::Util.h(value)
         end
       end
     end

data/app/search_builders/hyrax/dashboard/nested_collections_search_builder.rb

@@ -16,11 +16,7 @@ module Hyrax
 
       # Override for Hydra::AccessControlsEnforcement
       attr_reader :discovery_permissions
-      self.default_processor_chain += [:with_pagination, :show_only_other_collections_of_the_same_collection_type]
-
-      def with_pagination(solr_parameters)
-        solr_parameters[:rows] = 1000
-      end
+      self.default_processor_chain += [:show_only_other_collections_of_the_same_collection_type]
 
       # Solr can do graph traversal without the need of special indexing with the Graph query parser so
       # use this to compute both the parents and children of the current collection then exclude them

data/app/search_builders/hyrax/filter_by_type.rb

@@ -41,7 +41,7 @@ module Hyrax
     # types from appearing in search results
     # @return [Array<Class>] the list of work types to include in searches
     def work_types
-      Hyrax::ModelRegistry.work_classes
+      Hyrax::ModelRegistry.work_classes - Hyrax::ModelRegistry.file_set_classes
     end
 
     def work_classes

data/app/services/hyrax/action/create_valkyrie_work.rb

@@ -35,6 +35,7 @@ module Hyrax
         @params = params
         @work_attributes_key = work_attributes_key
         @work_attributes = @params.fetch(work_attributes_key, {})
+        @file_set_params = work_attributes[:file_set]&.map { |fs| fs.permit! } || []
       end
 
       attr_reader :form, :transactions, :user, :parent_id, :work_attributes, :uploaded_files, :params, :work_attributes_key
@@ -42,7 +43,7 @@ module Hyrax
       ##
       # @api public
       # @return [TrueClass] when the object is valid.
-      # @return [FalseClass] when the object is valid.
+      # @return [FalseClass] when the object is not valid.
       def validate
         form.validate(work_attributes)
       end
@@ -63,7 +64,7 @@ module Hyrax
       def step_args
         {
           'work_resource.add_to_parent' => { parent_id: params[:parent_id], user: user },
-          'work_resource.add_file_sets' => { uploaded_files: uploaded_files, file_set_params: work_attributes[:file_set] },
+          'work_resource.add_file_sets' => { uploaded_files: uploaded_files, file_set_params: @file_set_params },
           'change_set.set_user_as_depositor' => { user: user },
           'work_resource.change_depositor' => { user: ::User.find_by_user_key(form.on_behalf_of) },
           'work_resource.save_acl' => { permissions_params: form.input_params["permissions"] }

data/app/services/hyrax/authority_rendering_helper.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+module Hyrax
+  # Shared rendering helpers for authority-backed values that may have been
+  # stored as either a real URI or as free text (the M3 metadata profile, plus
+  # bulk importers such as Bulkrax and Willow Sword, can both produce
+  # free-text values that the UI's authority dropdown did not constrain).
+  module AuthorityRenderingHelper
+    # Schemes considered safe to emit in an `<a href>`. Anything else (notably
+    # `javascript:`, `data:`, custom schemes, or non-absolute strings like
+    # `"moomin"`) is rendered as plain text so it cannot be activated as a
+    # link.
+    LINKABLE_URI_SCHEMES = %w[http https].freeze
+
+    module_function
+
+    # @param value [String, nil]
+    # @return [Boolean] true when the value parses as an absolute URI with an
+    #   allowed scheme, suitable to use as an anchor's href.
+    def linkable_uri?(value)
+      return false if value.blank?
+
+      parsed = URI.parse(value)
+      parsed.absolute? && LINKABLE_URI_SCHEMES.include?(parsed.scheme&.downcase)
+    rescue URI::InvalidURIError
+      false
+    end
+  end
+end

data/app/services/hyrax/authority_service.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+module Hyrax
+  # Shared behavior for authority-backed services. Module-level services
+  # (such as {Hyrax::ResourceTypesService}) `extend` this module to gain a
+  # tolerant `label` / `active?` / `include_current_value` API plus the
+  # declarative macros described below.
+  #
+  # The tolerant methods are intentionally forgiving of off-authority values:
+  # `label` falls back to the id itself, `active?` returns false for ids that
+  # aren't present in the authority at all, and `include_current_value`
+  # preserves such values in edit forms so they are not silently dropped on
+  # save.
+  #
+  # ## Declarative macros
+  #
+  # Hosts use the {#authority_name} and {#microdata_namespace} macros to
+  # declare the wrapped subauthority and the i18n namespace used for
+  # schema.org type lookup. These macros generate the rest of the host's
+  # API for free:
+  #
+  #     module Hyrax
+  #       module DisciplineService
+  #         extend Hyrax::AuthorityService
+  #
+  #         authority_name 'discipline'
+  #         microdata_namespace 'type.'
+  #       end
+  #     end
+  #
+  # `authority_name` provides `authority`, `authority=`, `select_options`,
+  # and `select_all_options` (the latter is an alias of the former — both
+  # names are in use in the wild). `microdata_namespace` provides
+  # `microdata_type`.
+  #
+  # @note This module is intended for use via `extend` on a host module. The
+  #   macros define singleton methods on the host and are not available via
+  #   `include`. Hosts that need instance-level tolerant lookup should
+  #   subclass {Hyrax::QaSelectService} instead.
+  module AuthorityService
+    # Declares which Qa::Authorities::Local subauthority this host wraps,
+    # generating `authority`, `authority=`, `select_options`, and
+    # `select_all_options` accessors on the host.
+    #
+    # @param subauthority_name [String] the YAML subauthority name (e.g.
+    #   `'discipline'`)
+    def authority_name(subauthority_name)
+      define_singleton_method(:authority) do
+        @authority ||= Qa::Authorities::Local.subauthority_for(subauthority_name)
+      end
+
+      define_singleton_method(:authority=) do |value|
+        @authority = value
+      end
+
+      define_singleton_method(:select_all_options) do
+        authority.all.map { |element| [element[:label], element[:id]] }
+      end
+      singleton_class.alias_method(:select_options, :select_all_options)
+    end
+
+    # Declares the Microdata i18n namespace this host uses for schema.org
+    # type lookup, generating a `microdata_type(id)` method on the host.
+    #
+    # @param namespace [String] the Microdata key prefix (e.g. `'type.'`,
+    #   `'resource_type.'`, `'accessibility_feature_type.'`)
+    def microdata_namespace(namespace)
+      define_singleton_method(:microdata_type) do |id|
+        return Hyrax.config.microdata_default_type if id.nil?
+        Microdata.fetch("#{namespace}#{id}", default: Hyrax.config.microdata_default_type)
+      end
+    end
+
+    # @param id [String]
+    # @return [String] the label for the authority entry, falling back to the
+    #   id itself when no matching term is found.
+    #
+    # @yield when no 'term' value is present for the id
+    # @yieldreturn [String] an alternate label to return
+    def label(id, &block)
+      block ||= ->(_key) { id }
+      authority.find(id).fetch('term', &block)
+    end
+
+    # @return [Boolean] whether the id is an active entry. Returns false for
+    #   ids that aren't present in the authority at all, so a caller can treat
+    #   unknown ids as inactive (and preserve them in edit forms via
+    #   {#include_current_value}).
+    def active?(id)
+      result = authority.find(id)
+      return false if result.blank?
+      result.fetch('active', true)
+    end
+
+    # Preserves an off-authority value as a forced-select option in a Simple
+    # Form input so it is not silently dropped on save. Intended for use as a
+    # Simple Form `item_helper:` callback or to augment a `collection:` array
+    # in a partial.
+    def include_current_value(value, _index, render_options, html_options)
+      force_select = html_options[:class].is_a?(Array) ? [' force-select'] : ' force-select'
+      unless value.blank? || active?(value)
+        html_options[:class] += force_select
+        render_options += [[label(value), value]]
+      end
+      [render_options, html_options]
+    end
+  end
+end

data/app/services/hyrax/callbacks.rb

@@ -48,7 +48,7 @@ module Hyrax
 
       # Defines a callback for a given hook.
       def set(hook, warn: true, &block)
-        Deprecation.warn(self, warning_for_set) if warn
+        Deprecation.warn(warning_for_set) if warn
         raise NoBlockGiven, "a block is required when setting a callback" unless block_given?
         @callbacks[hook] = proc(&block)
       end
@@ -60,7 +60,7 @@ module Hyrax
 
       # Runs the callback defined for a given hook, with the arguments provided
       def run(hook, *args, warn: true, **opts)
-        Deprecation.warn(self, warning_for_run) if warn
+        Deprecation.warn(warning_for_run) if warn
         raise NotEnabled unless enabled?(hook)
         return nil unless set?(hook)
         @callbacks[hook].call(*args, **opts)

data/app/services/hyrax/collections/nested_collection_query_service.rb

@@ -16,7 +16,7 @@ module Hyrax
       def self.available_child_collections(parent:, scope:, limit_to_id: nil)
         return [] unless nestable?(collection: parent)
         return [] unless scope.can?(:deposit, parent)
-        query_solr(collection: parent, access: :read, scope: scope, limit_to_id: limit_to_id, nest_direction: :as_child).documents
+        query_solr(collection: parent, access: :read, scope: scope, limit_to_id: limit_to_id, nest_direction: :as_child)
       end
 
       ##
@@ -34,7 +34,7 @@ module Hyrax
       def self.available_parent_collections(child:, scope:, limit_to_id: nil)
         return [] unless nestable?(collection: child)
         return [] unless scope.can?(:read, child)
-        query_solr(collection: child, access: :deposit, scope: scope, limit_to_id: limit_to_id, nest_direction: :as_parent).documents
+        query_solr(collection: child, access: :deposit, scope: scope, limit_to_id: limit_to_id, nest_direction: :as_parent)
       end
 
       ##
@@ -65,6 +65,7 @@ module Hyrax
       #   id is in the response. Useful for validation.
       # @param nest_direction [Symbol] :as_child or :as_parent
       def self.query_solr(collection:, access:, scope:, limit_to_id:, nest_direction:)
+        scope.blacklight_config.http_method = :post
         query_builder = Hyrax::Dashboard::NestedCollectionsSearchBuilder.new(
           access: access,
           collection: collection,
@@ -73,7 +74,12 @@ module Hyrax
         )
 
         query_builder.where(id: limit_to_id.to_s) if limit_to_id
-        scope.blacklight_config.repository.search(query_builder.query)
+
+        Hyrax::SolrService.fetch_all do |rows, start|
+          scope.blacklight_config.repository.search(
+            query_builder.query.merge(rows: rows, start: start, fl: 'id,title_tesim,has_model_ssim')
+          )
+        end
       end
       private_class_method :query_solr
 

data/app/services/hyrax/collections_service.rb

@@ -25,5 +25,22 @@ module Hyrax
 
       response.documents
     end
+
+    # Like {#search_results}, but pages through every matching collection
+    # (up to Hyrax.config.solr_max_results). Use this only for surfaces that
+    # need the full set, e.g. the "Add to Collection" dropdown where a user
+    # must see every collection they can deposit into.
+    #
+    # @param [Symbol] access :read or :edit
+    # @return [Array<SolrDocument>]
+    def all_search_results(access = nil)
+      builder = search_builder.with(user_params)
+      builder.with_access(access) if access
+      yield builder if block_given?
+
+      Hyrax::SolrService.fetch_all do |rows, start|
+        blacklight_config.repository.search(builder.query.merge(rows: rows, start: start))
+      end
+    end
   end
 end

data/app/services/hyrax/custom_queries/find_by_property_value.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+module Hyrax
+  module CustomQueries
+    ##
+    # Finds resources for arbitrary properties using the Solr index.
+    # @see https://github.com/samvera/valkyrie/wiki/Queries#custom-queries
+    class FindByPropertyValue
+      def self.queries
+        [:find_ids_by_property_pairs,
+         :find_many_by_property_pairs,
+         :find_many_by_property_value,
+         :find_by_property_value]
+      end
+
+      def initialize(query_service:, query_rows: 1_000)
+        @query_service = query_service
+        @query_rows = query_rows
+      end
+
+      ##
+      # Returns ids for resources matching all specified property/value pairs.
+      # @param pairs [Hash<String, String>] properties and values to match
+      # @param field_suffix Hash,Symbol which solr field suffix to use; Use a hash to set per field pair
+      # @param options Hash options to pass to solr
+      #
+      # @return [Array<String>] found ids, if any
+      def find_ids_by_property_pairs(pairs:, field_suffix: :ssim, **options)
+        options = { rows: @query_rows }.merge(options)
+        query = pairs.map do |k, v|
+          suffix = if field_suffix.is_a? Hash
+                     field_suffix[k] || :ssim
+                   else
+                     field_suffix
+                   end
+          "+#{k}_#{suffix}:\"#{RSolr.solr_escape(v)}\""
+        end
+        response = Hyrax::SolrService.query_result(query.join(' '), fl: 'id', **options)
+        response['response']['docs'].map { |doc| doc['id'] }
+      end
+
+      ##
+      # Returns resources matching all specified property/value pairs.
+      # @param pairs [Hash<String, String>] properties and values to match
+      # @param field_suffix Hash,Symbol which solr field suffix to use; Use a hash to set per field pair
+      # @param options Hash options to pass to solr
+      #
+      # @return [Array<Valkyrie::Resource>] found resources, if any
+      def find_many_by_property_pairs(pairs:, field_suffix: :ssim, **options)
+        found_ids = find_ids_by_property_pairs(pairs: pairs, field_suffix: field_suffix, **options)
+        @query_service.find_many_by_ids(ids: found_ids).to_a # Wings emits an Enumerator
+      end
+
+      ##
+      # Returns resources matching the specified property and value.
+      # @param property [#to_s] the name of the property we're attempting to query.
+      # @param value [#to_s] the property value we're trying to match.
+      # @param field_suffix Symbol which solr field suffix to use
+      # @param search_field String alt way to set property and suffix for compatibility
+      # @param options Hash options to pass to solr
+      #
+      # @return [Array<Valkyrie::Resource>] found resources, if any
+      def find_many_by_property_value(property:, value:, field_suffix: :ssim, search_field: nil, **options)
+        if search_field
+          search_field_array = search_field.split('_')
+          field_suffix = search_field_array.last
+          property = search_field_array[0...-1].join('_')
+        end
+        find_many_by_property_pairs(pairs: { property => value }, field_suffix: field_suffix, **options)
+      end
+
+      ##
+      # Returns one resource matching the specified property and value.
+      # @param property [#to_s] the name of the property we're attempting to query.
+      # @param value [#to_s] the property value we're trying to match.
+      # @param field_suffix Symbol which solr field suffix to use
+      # @param search_field String alt way to set property and suffix for compatibility
+      # @param options Hash options to pass to solr
+      #
+      # @return [NilClass] when no record was found
+      # @return [Valkyrie::Resource] when a resource was found
+      def find_by_property_value(property:, value:, field_suffix: :ssim, search_field: nil, **options)
+        options[:rows] = 1
+        find_many_by_property_value(property: property, value: value,
+                                    field_suffix: field_suffix, search_field: search_field, **options).first
+      end
+    end
+  end
+end

data/app/services/hyrax/edit_permissions_service.rb

@@ -42,11 +42,11 @@ module Hyrax
         # (+Hyrax::Forms::FileSetForm+), +:in_works_ids+ is prepopulated onto
         # the form object itself. For +Hyrax::Forms::FileSetEditForm+, the
         # +:in_works+ method is present on the wrapped +:model+.
-        if obj.is_a?(Hyrax.config.file_set_form)
+        if obj.model.respond_to?(:in_works)
+          new(object: obj.model.in_works.first, ability: ability)
+        else
           object_id = obj.in_works_ids.first
           new(object: Hyrax.query_service.find_by(id: object_id), ability: ability)
-        else
-          new(object: obj.model.in_works.first, ability: ability)
         end
       elsif obj.file_set?
         # The provided form object is a FileSet.
@@ -171,7 +171,7 @@ module Hyrax
       unauthorized_managers = []
       unauthorized_collection_managers = []
       object_unauthorized_collection_ids.each do |id|
-        Hyrax::PermissionTemplate.find_by(source_id: id).access_grants.each do |grant|
+        Hyrax::PermissionTemplate.find_by(source_id: id)&.access_grants&.each do |grant|
           if grant.access == "manage"
             unauthorized_managers << grant.agent_id
             unauthorized_collection_managers += Array.wrap({ name: grant.agent_id }.merge(id: id))

data/app/services/hyrax/file_set_type_service.rb

@@ -8,9 +8,6 @@ module Hyrax
   # @note this service is for `Hyrax::FileSet` Valkyrie Resources. for
   #   ActiveFedora file sets see Hydra::Works::MimeTypes
   class FileSetTypeService
-    DEFAULT_AUDIO_TYPES = ['audio/mp3', 'audio/mpeg', 'audio/wav',
-                           'audio/x-wave', 'audio/x-wav', 'audio/ogg'].freeze
-
     ##
     # @!attribute [r] file_set
     #   @return [Hyrax::FileSet]
@@ -42,11 +39,22 @@ module Hyrax
       audio_types.include?(mime_type)
     end
 
+    ##
+    # @return [Boolean]
+    def video?
+      video_types.include?(mime_type)
+    end
+
     private
 
     def audio_types
       return ::FileSet.audio_mime_types if defined?(::FileSet) && ::FileSet.respond_to?(:audio_mime_types)
-      DEFAULT_AUDIO_TYPES
+      Hyrax.config.mime_types_map.fetch(:audio_mime_types)
+    end
+
+    def video_types
+      return ::FileSet.video_mime_types if defined?(::FileSet) && ::FileSet.respond_to?(:video_mime_types)
+      Hyrax.config.mime_types_map.fetch(:video_mime_types)
     end
   end
 end

data/app/services/hyrax/flexible_schema_validator_service.rb

@@ -0,0 +1,153 @@
+# frozen_string_literal: true
+
+module Hyrax
+  class FlexibleSchemaValidatorService
+    DEFAULT_SCHEMA = Hyrax::Engine.root.join('config', 'metadata_profiles', 'm3_json_schema.json')
+    REQUIRED_CLASSES = [
+      Hyrax.config.admin_set_model,
+      Hyrax.config.collection_model,
+      Hyrax.config.file_set_model
+    ].map { |str| str.gsub(/^::/, '') }
+
+    attr_reader :profile, :schema, :schemer, :errors, :warnings
+
+    # Initializes a new FlexibleSchemaValidatorService.
+    #
+    # @param profile [Hash] the flexible metadata profile to validate
+    # @param schema [Pathname, String] the JSON schema to validate against.
+    #   Defaults to {DEFAULT_SCHEMA}.
+    # @return [void]
+    def initialize(profile:, schema: default_schema)
+      @profile = profile
+      @schema = schema
+      @schemer = JSONSchemer.schema(schema)
+      @errors = []
+      @warnings = []
+    end
+
+    # Execute all validation routines and populate {#errors} with any
+    # issues discovered.
+    #
+    # @return [void]
+    def validate!
+      validate_required_classes
+      validate_class_availability
+      validate_available_on_classes_defined
+      validate_existing_records_classes_defined
+      validate_schema
+      validate_label_prop
+      validate_core_metadata
+      validate_sort_properties
+      validate_redirects
+    end
+
+    # The default JSON schema used when no custom schema is provided.
+    #
+    # @return [Pathname]
+    def default_schema
+      DEFAULT_SCHEMA
+    end
+
+    # Classes that MUST be present in every flexible metadata profile.
+    #
+    # @return [Array<String>]
+    def required_classes
+      REQUIRED_CLASSES
+    end
+
+    private
+
+    # Validates core metadata requirements using the CoreMetadataValidator.
+    #
+    # This delegates to CoreMetadataValidator to check that essential metadata
+    # properties are properly configured across all classes in the profile.
+    #
+    # @return [void]
+    def validate_core_metadata
+      FlexibleSchemaValidators::CoreMetadataValidator.new(profile: profile, errors: @errors).validate!
+    end
+
+    # Runs JSON schema validation and translates resulting errors into
+    # user-friendly messages appended to {#errors}.
+    #
+    # @return [void]
+    def validate_schema
+      FlexibleSchemaValidators::SchemaValidator.new(schemer, profile, @errors).validate!
+    end
+
+    # Ensures that all required classes are defined in the profile.
+    #
+    # @return [void]
+    def validate_required_classes
+      missing_classes = clean_class_names(required_classes) - clean_class_names(profile['classes'].keys)
+      return if missing_classes.empty?
+
+      @errors << "Missing required classes: #{missing_classes.join(', ')}."
+    end
+
+    def clean_class_names(names)
+      names.map { |name| name.to_s.strip.gsub(/^::/, '') }
+    end
+
+    # Checks that any class referenced in the profile is a registered
+    # Hyrax curation concern type.
+    #
+    # @return [void]
+    def validate_class_availability
+      FlexibleSchemaValidators::ClassValidator.new(profile, required_classes, @errors).validate_availability!
+    end
+
+    # Validates that every class referenced under `available_on.class` is also
+    # defined in the profile's top-level `classes` section.
+    #
+    # @return [void]
+    def validate_available_on_classes_defined
+      FlexibleSchemaValidators::ClassValidator.new(profile, required_classes, @errors).validate_references!
+    end
+
+    # Delegates to {ExistingRecordsValidator} to ensure that no classes with
+    # existing repository records have been removed from the profile.
+    #
+    # @return [void]
+    def validate_existing_records_classes_defined
+      FlexibleSchemaValidators::ExistingRecordsValidator.new(profile, required_classes, @errors).validate!
+    end
+
+    # Validates that any properties needed to support sorting catalog search results.
+    #
+    # @return [void]
+    def validate_sort_properties
+      FlexibleSchemaValidators::SortPropertiesValidator.new(profile, @warnings).validate!
+    end
+
+    # Validates that the `redirects` property is declared on every work and
+    # collection class when both `Hyrax.config.redirects_enabled?` and
+    # `Flipflop.redirects?` are true. When either gate is closed, this
+    # validator is a no-op.
+    #
+    # @return [void]
+    def validate_redirects
+      FlexibleSchemaValidators::RedirectsValidator.new(
+        profile: profile, errors: @errors, warnings: @warnings
+      ).validate!
+    end
+
+    # Validates that a `label` property exists and that it is available on
+    # `Hyrax.config.file_set_model`.
+    #
+    # @return [void]
+    def validate_label_prop
+      label_prop = profile.dig('properties', 'label')
+      unless label_prop
+        @errors << "A `label` property is required."
+        return
+      end
+
+      available_on_classes = label_prop.dig('available_on', 'class')
+      file_set_model_name = Hyrax.config.file_set_model.gsub(/^::/, '')
+      return if available_on_classes&.include?(file_set_model_name)
+
+      @errors << "Label must be available on #{file_set_model_name}."
+    end
+  end
+end