labimotion 2.3.2 → 2.3.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b2682c1c72815cd6376ed94350afc4289a414a4f09c71b9788230ec4430b3f8f
-  data.tar.gz: 603d30166812d812c7c03fdc3c985cc78b2f47965ec76abbfa4481f07d41b88e
+  metadata.gz: 7f2a9943b6c1fd9c1d0e09f9b2917985db173634db909a8a3eb3b80ad99d61d4
+  data.tar.gz: 828d2be1b26596f926f2e7f4ff06a05925ef7cae8dad9db06f5318b5c5ce527e
 SHA512:
-  metadata.gz: b5dae89c2091aa2f7f4e6b59079d13f3c777c07ba0d0891ecc97daa51b8eb571e90b9517c332d035438aaa45d671184b8d0090db382d3b23fa6e96568cf0e940
-  data.tar.gz: d66337f46db2b8d49e170bd7078cfae5b45d31fcd8deb92d0c625a09037d4858f21c919339d2547500f5bef0aec67728b7221adb73652961e8ae07c81336aee2
+  metadata.gz: 2566c6dc15a6acc91cb3cbc9264946b34c7a99be61c02a5916aea8de366bbc7e0b928319ff63b994b0b5fe48d82b6a5ee1a9c8a7e19b4e2a158471a9b9436a2f
+  data.tar.gz: ee020ae64b55ff37621cecc819a4675808b815530b3aa8bcea2c49a3b5aa2107779a1297424f986648ecdd2c477adbf5dcdc72b7327430bbe2091ef63414611c

data/CHANGELOG.md

@@ -1,6 +1,24 @@
 # LabIMotion Changelog
 
-## [Unreleased]
+## [2.3.4]
+> Unreleased
+* Bug fixes:
+  * `upload_generics_files` stays on the element it was authorized for ([chemotion#684](https://github.com/ComPlat/chemotion/issues/684)). `delfiles` detached any generic-element attachment by id; it now only detaches the updated element's own. Uploads take `ElementProps`/`SegmentProps` from the server instead of the `type` the client sends in `elInfo`/`seInfo`, and the segment lookup also matches the element type, so an upload authorized for sample 5 no longer reaches the segment of reaction 5 or generic element 5. `att_type` is limited to `Element`, `Sample`, `Reaction`, `ResearchPlan` and `Screen` (400 otherwise, instead of `constantize` on the request value; the client's `CellLineSample`, which already failed in `constantize`, now gets the 400). `elfiles`, `attfiles` and `delfiles` are only handled for `Element`: an `elfiles` upload authorized for a sample used to write into the generic element with the same id. No client change.
+  * `GET /generic_elements/export` checks read permission before building the docx (labimotion#358, port of labimotion#336). It exported any Element, Segment or Dataset by id to any signed-in user. It now answers 404 for a missing record and 401 unless the user passes the matrix check (`genericElement` for an element, `segment` for a segment, `genericDataset` for a dataset) and `ElementPolicy#read?` on the element that holds the record: the element itself, a segment's element, or the root element of a dataset's container. A dataset also needs `ElementPolicy#read_dataset?`, so a share below the dataset detail level cannot export one. The table xlsx export (`GET /exporter/table_xlsx/:id`), which already ran these checks for elements and segments, now shares them through the new `Labimotion::ExportAuthorizationHelpers`.
+  * A dataset the gem builds itself — by the converter, or through `Labimotion::DatasetBuilder` — stores the metadata of its klass's active release (labimotion#343, port of labimotion#342). Both builders stored the klass's own `metadata`, which follows every save, drafts included, so a dataset created after a draft save got the released layers with the draft's layer groups and group restrictions, and the form then used them. A klass with no revision matching its uuid still uses its own `metadata`. `Labimotion::ReleaseMetadata.for_klass` returns that value for one klass.
+
+## [2.3.3]
+> 2026-10-19
+* Bug fixes:
+  * New records and element Reload build from the release's metadata (labimotion#326, port of labimotion#321 and labimotion#324, [chem-generic-ui#1438](https://github.com/cllde8/chem-generic-ui/issues/1438), port of [chem-generic-ui#1430](https://github.com/cllde8/chem-generic-ui/issues/1430)). A klass's `metadata` follows every save, drafts included, so a new element, segment or dataset, and an element brought up to the release by Reload, combined the released layers with the draft's layer groups and restrictions. Klass payloads now carry `metadata_release`: the metadata of the klass's active release, read from its revision row, or `null` when no revision matches the klass's uuid. Sent by `generic_elements/klass`, `segments/list_segment_klass` (nested element klasses included), `generic_dataset/klasses`, and on the nested `element_klass` of the element `GET`, create and update responses, with one revision query per klass family; every other payload is unchanged. A client reading `metadata_release ?? metadata` builds from one version. Read-only: no migration.
+
+## [2.3.2]
+> 2026-10-02
+* Bug fixes:
+  * A copied element, segment or dataset keeps the template release its properties were built on (labimotion#301, labimotion#303). Saves used to stamp every new segment and every dataset save with the klass's current `uuid` and `properties_release`, and an element with whatever the client sent, so a copy of a v1.0.0 record was labelled v2.0.0 and the client never offered Reload. `Labimotion::KlassVersion` now resolves the submitted `properties['klass_uuid']` against the klass's current release and its `*_klasses_revisions`, deleted revisions included, and stores that uuid together with the matching `properties_release`. A new record whose uuid is missing or unknown follows the current release; an existing record keeps its stored uuid when none is sent, then the uuid its stored `properties_release` names, and follows the current release only when it has neither, and a uuid this instance never released (a record imported from an instance with its own release history) keeps the release stored with the record. A new element whose properties carry no uuid follows the template the client built it on; a new segment does the same, and a copied one falls back to the `klass_uuid` of the row it was copied from. The collection import stamps the release the archive names instead of the importing instance's current one: it tries the uuid inside the archived `properties_release`, then `properties['klass_uuid']`, then the `klass_uuid` column, and stores the first one this instance knows with the local release; when none resolves, the archived release keeps the uuid it names (or, naming none, the first uuid the archive carries), and the imported properties carry the same `klass_uuid` as the column. A `klass_uuid` that is not a string is ignored, and a dataset whose klass changed follows the new klass and ignores the client's release. Element create returns 404 when the template is missing or deleted, element update resolves a soft-deleted template (`with_deleted`) before writing anything, and segments and datasets of a deleted template are skipped on save. A new record whose `klass_uuid` this instance cannot resolve keeps it with the `properties_release` the client sent, only when that release names the same uuid. No migration and no client change.
+
+## [2.3.0]
+> 2026-08-26
 * Features and enhancements:
   * Element variations can be exported to and imported from Excel (`.xlsx`). The exported workbook is itself the import template: `GET /api/v1/element_variations/:element_id/export` and `POST /api/v1/element_variations/:element_id/import`.
   * The exported sheet carries the grid's grouped header -- group, sub-group and field rows, merged as the grid draws them -- above the hidden key and unit rows. Workbooks from the earlier single-row header still import.
@@ -8,7 +26,6 @@
   * `number`, `integer` and `system-defined` columns accept numbers only. A cell holding anything else is cleared with a warning rather than stored as text, which also cleans up text those columns already hold.
   * Import warnings name the cell they came from (`Cell I6: ...`), so the user can go straight to it in the spreadsheet.
 * Bug fixes:
-  * A copied element, segment or dataset keeps the template release its properties were built on (labimotion#301, labimotion#303). Saves used to stamp every new segment and every dataset save with the klass's current `uuid` and `properties_release`, and an element with whatever the client sent, so a copy of a v1.0.0 record was labelled v2.0.0 and the client never offered Reload. `Labimotion::KlassVersion` now resolves the submitted `properties['klass_uuid']` against the klass's current release and its `*_klasses_revisions`, deleted revisions included, and stores that uuid together with the matching `properties_release`. A new record whose uuid is missing or unknown follows the current release; an existing record keeps its stored uuid when none is sent, then the uuid its stored `properties_release` names, and follows the current release only when it has neither, and a uuid this instance never released (a record imported from an instance with its own release history) keeps the release stored with the record. A new element whose properties carry no uuid follows the template the client built it on; a new segment does the same, and a copied one falls back to the `klass_uuid` of the row it was copied from. The collection import stamps the release the archive names instead of the importing instance's current one: it tries the uuid inside the archived `properties_release`, then `properties['klass_uuid']`, then the `klass_uuid` column, and stores the first one this instance knows with the local release; when none resolves, the archived release keeps the uuid it names (or, naming none, the first uuid the archive carries), and the imported properties carry the same `klass_uuid` as the column. A `klass_uuid` that is not a string is ignored, and a dataset whose klass changed follows the new klass and ignores the client's release. Element create returns 404 when the template is missing or deleted, element update resolves a soft-deleted template (`with_deleted`) before writing anything, and segments and datasets of a deleted template are skipped on save. A new record whose `klass_uuid` this instance cannot resolve keeps it with the `properties_release` the client sent, only when that release names the same uuid. No migration and no client change.
   * `fetch_for_user`: the shared-records branch joined `collection_shares` directly on the element model (an association that only exists on `Collection`), raising `ActiveRecord::ConfigurationError` — rescued into empty search results. Now joins through `collections`. Fixed for both the basic elements (`ElementFetchable`) and the generic element (`Labimotion::Element`), so `search_by_like` and `search_basic_by_like` return shared records again.
 * Dependencies:
   * Added `roo` (~> 2.10) for reading the uploaded workbook.

data/lib/labimotion/apis/exporter_api.rb

@@ -8,6 +8,7 @@ module Labimotion
 
     helpers Labimotion::ParamHelpers
     helpers Labimotion::ExporterHelpers
+    helpers Labimotion::ExportAuthorizationHelpers
 
     resource :exporter do
       resource :table_xlsx do
@@ -46,9 +47,7 @@ module Labimotion
         klass = fetch_klass
         @element = klass.find_by(id: params[:id])
 
-        error!('404 Not Found', 404) if @element.nil?
-
-        authorize_element_access!
+        authorize_export!(params[:klass], @element)
       rescue ActiveRecord::RecordNotFound
         error!('404 Not Found', 404)
       rescue NameError => e
@@ -61,22 +60,6 @@ module Labimotion
         Labimotion::Utils.resolve_class(params[:klass])
       end
 
-      # Authorize element access based on user permissions
-      def authorize_element_access!
-        element_policy = if params[:klass] == 'Element'
-                           ElementPolicy.new(current_user,
-                                             @element)
-                         else
-                           ElementPolicy.new(current_user,
-                                             @element.element)
-                         end
-        matrix_name = params[:klass] == 'Element' ? 'genericElement' : 'segment'
-
-        return if current_user.matrix_check_by_name(matrix_name) && element_policy.read?
-
-        error!('401 Unauthorized', 401)
-      end
-
       # Fetch layer from element properties
       def fetch_layer
         properties = @element.properties

data/lib/labimotion/apis/generic_dataset_api.rb

@@ -13,7 +13,9 @@ module Labimotion
         desc 'get dataset klasses'
         get do
           list = klass_list(true, false)
-          present list.sort_by(&:place), with: Labimotion::DatasetKlassEntity, root: 'klass'
+          # New datasets are built from these klasses, so they need the release's metadata.
+          present list.sort_by(&:place), with: Labimotion::DatasetKlassEntity, root: 'klass',
+                                         metadata_releases: Labimotion::ReleaseMetadata.map_for(list)
         end
       end
 

data/lib/labimotion/apis/generic_element_api.rb

@@ -17,6 +17,7 @@ module Labimotion
     helpers Labimotion::GenericHelpers
     helpers Labimotion::ElementHelpers
     helpers Labimotion::ParamHelpers
+    helpers Labimotion::ExportAuthorizationHelpers
 
     resource :generic_elements do
       # might be removed because the file is moved to public folder
@@ -39,7 +40,9 @@ module Labimotion
         end
         get do
           ek = Labimotion::ElementKlass.find_by(name: params[:name])
-          present ek, with: Labimotion::ElementKlassEntity, root: 'klass'
+          # The ELN builds a new element from this klass, so it needs the release's metadata.
+          present ek, with: Labimotion::ElementKlassEntity, root: 'klass',
+                      metadata_releases: Labimotion::ReleaseMetadata.map_for([ek])
         rescue StandardError => e
           Labimotion.log_exception(e, current_user)
           { klass: [] }
@@ -127,14 +130,8 @@ module Labimotion
           optional :export_format, type: String, desc: 'export format'
         end
         get do
-          case params[:klass]
-          when 'Element'
-            element = Labimotion::Element.find(params[:id])
-          when 'Segment'
-            element = Labimotion::Segment.find(params[:id])
-          when 'Dataset'
-            element = Labimotion::Dataset.find(params[:id])
-          end
+          element = "Labimotion::#{params[:klass]}".constantize.find_by(id: params[:id])
+          authorize_export!(params[:klass], element)
           export = Labimotion::ExportElement.new current_user, element, params[:export_format]
           env['api.format'] = :binary
           content_type 'application/vnd.openxmlformats-officedocument.wordprocessingml.document'
@@ -262,14 +259,10 @@ module Labimotion
         desc 'upload generic files'
         params do
           requires :att_id, type: Integer, desc: 'Element Id'
-          requires :att_type, type: String, desc: 'Element Type'
+          requires :att_type, type: String, values: Labimotion::Prop::UPLOAD_ELEMENT_TYPES.keys, desc: 'Element Type'
         end
         after_validation do
-          if params[:att_type] == 'Sample' || params[:att_type] == 'Reaction' || params[:att_type] == 'ResearchPlan'
-            el = "#{params[:att_type]}".constantize.find_by(id: params[:att_id])
-          else
-            el = "Labimotion::#{params[:att_type]}".constantize.find_by(id: params[:att_id])
-          end
+          el = Labimotion::Prop::UPLOAD_ELEMENT_TYPES[params[:att_type]].constantize.find_by(id: params[:att_id])
           error!('401 Unauthorized', 401) if el.nil?
 
           policy_updatable = ElementPolicy.new(current_user, el).update?
@@ -474,7 +467,10 @@ module Labimotion
             element: Labimotion::ElementEntity.represent(
               element,
               detail_levels: ElementDetailLevelCalculator.new(user: current_user, element: element).detail_levels,
-              policy: @element_policy
+              policy: @element_policy,
+              # Reload brings the record up to the release, so it needs the release's metadata,
+              # not the latest save's.
+              metadata_releases: Labimotion::ReleaseMetadata.map_for([element.element_klass])
             ),
             attachments: Entities::AttachmentEntity.represent(element&.attachments)
           }
@@ -495,6 +491,7 @@ module Labimotion
             with: Labimotion::ElementEntity,
             root: :element,
             detail_levels: ElementDetailLevelCalculator.new(user: current_user, element: element).detail_levels,
+            metadata_releases: Labimotion::ReleaseMetadata.map_for([element.element_klass])
           )
         rescue StandardError => e
           Labimotion.log_exception(e, current_user)
@@ -518,6 +515,7 @@ module Labimotion
               element: Labimotion::ElementEntity.represent(
                 element,
                 detail_levels: ElementDetailLevelCalculator.new(user: current_user, element: element).detail_levels,
+                metadata_releases: Labimotion::ReleaseMetadata.map_for([element.element_klass])
               ),
               attachments: Entities::AttachmentEntity.represent(element&.attachments),
             }

data/lib/labimotion/apis/segment_api.rb

@@ -26,7 +26,11 @@ module Labimotion
         end
         get do
           list = klass_list(nil, params[:is_active], false)
-          present list, with: Labimotion::SegmentKlassEntity, root: 'klass', displayed_in_list: false
+          # New segments are built from these klasses. The nested element klasses read the same
+          # map, since they are serialized with the same options.
+          metadata_releases = Labimotion::ReleaseMetadata.map_for(list.to_a + list.map(&:element_klass))
+          present list, with: Labimotion::SegmentKlassEntity, root: 'klass', displayed_in_list: false,
+                        metadata_releases: metadata_releases
         end
       end
 

data/lib/labimotion/constants.rb

@@ -32,7 +32,7 @@ module Labimotion
     module Tpa
       # Segments and layers sent along with reaction variations to a third-party
       # app (see ExportTpaSegments), as segment-klass label => layer keys.
-      SEGMENT_LAYERS = { 'Mol interactions' => %w[binding_props bind_partners].freeze }.freeze
+      SEGMENT_LAYERS = { 'Mol interactions' => %w[general binding_props bind_partners].freeze }.freeze
     end
   end
 end

data/lib/labimotion/entities/generic_klass_entity.rb

@@ -10,5 +10,16 @@ module Labimotion
     expose :properties_release, **DISPLAYED_IN_LIST_CONDITION, anonymize_with: {}
     expose :metadata, **DISPLAYED_IN_LIST_CONDITION, anonymize_with: {}
     expose_timestamps(timestamp_fields: %i[released_at created_at updated_at sync_time])
+
+    # The klass's own `metadata` follows every save, drafts included, so a client building a
+    # record from `properties_release` reads this instead: the metadata that release was cut
+    # with, or nil when no revision matches the klass's uuid (never released, or imported
+    # without one). Exposed only where the endpoint preloaded the map, so no other payload pays
+    # a revision query per row.
+    expose :metadata_release, **DISPLAYED_IN_LIST_CONDITION, if: :metadata_releases
+
+    def metadata_release
+      options[:metadata_releases][Labimotion::ReleaseMetadata.key_of(object)]
+    end
   end
 end

data/lib/labimotion/helpers/element_helpers.rb

@@ -182,13 +182,18 @@ module Labimotion
 
     def upload_generics_files(current_user, params)
       attach_ary = []
+      element_type = Labimotion::Prop::UPLOAD_ELEMENT_TYPES.fetch(params[:att_type])
+      generic_element = element_type == Labimotion::Prop::L_ELEMENT
+      # Element properties and direct attachments only exist on generic elements; for any
+      # other att_type, att_id names a different table, so they are not touched.
       att_ary = create_uploads(
         Labimotion::Prop::ELEMENT,
         params[:att_id],
         params[:elfiles],
         params[:elInfo],
         current_user.id,
-      ) if params[:elfiles].present? && params[:elInfo].present?
+        element_type
+      ) if generic_element && params[:elfiles].present? && params[:elInfo].present?
 
       (attach_ary << att_ary).flatten! unless att_ary&.empty?
 
@@ -197,16 +202,17 @@ module Labimotion
         params[:att_id],
         params[:sefiles],
         params[:seInfo],
-        current_user.id
+        current_user.id,
+        element_type
       ) if params[:sefiles].present? && params[:seInfo].present?
 
       (attach_ary << att_ary).flatten! unless att_ary&.empty?
 
-      if params[:attfiles].present? || params[:delfiles].present? then
+      if generic_element && (params[:attfiles].present? || params[:delfiles].present?)
         att_ary = create_attachments(
           params[:attfiles],
           params[:delfiles],
-          "Labimotion::#{params[:att_type]}",
+          element_type,
           params[:att_id],
           params[:attfilesIdentifier],
           current_user.id

data/lib/labimotion/helpers/export_authorization_helpers.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Labimotion
+  # Gate shared by the routes that export an Element, Segment or Dataset to a file.
+  # A segment or dataset is readable when the element that holds it is; a dataset
+  # sits on an analysis container, so its element is that container's root element.
+  module ExportAuthorizationHelpers
+    # Answers 404 for a missing record and 401 unless the user passes the matrix
+    # check for the record's family and may read the element that holds it.
+    def authorize_export!(klass_name, record)
+      error!('404 Not Found', 404) if record.nil?
+      return if export_readable?(klass_name, record)
+
+      error!('401 Unauthorized', 401)
+    end
+
+    # The matrix right that shows each family in the UI.
+    EXPORT_MATRIX = { 'Element' => 'genericElement', 'Segment' => 'segment', 'Dataset' => 'genericDataset' }.freeze
+
+    def export_readable?(klass_name, record)
+      return false unless current_user.matrix_check_by_name(EXPORT_MATRIX.fetch(klass_name))
+
+      policy = ElementPolicy.new(current_user, export_parent_element(klass_name, record))
+      return policy.read? unless klass_name == 'Dataset'
+
+      # A dataset holds analysis data, which a share below the dataset detail
+      # level hides.
+      policy.read? && policy.read_dataset?
+    end
+
+    def export_parent_element(klass_name, record)
+      case klass_name
+      when 'Element' then record
+      when 'Segment' then record.element
+      when 'Dataset' then record.element&.root_element
+      end
+    end
+  end
+end

data/lib/labimotion/helpers/generic_helpers.rb

@@ -142,16 +142,20 @@ module Labimotion
       raise e
     end
 
-    def create_uploads(type, id, files, param_info, user_id)
+    # element_type is the class name of the element that id names, so a segment
+    # lookup cannot reach another element type's segment with the same element_id.
+    def create_uploads(type, id, files, param_info, user_id, element_type)
       return if files.nil? || param_info.nil? || files.empty? || param_info.empty?
 
       attach_ary = []
       map_info = JSON.parse(param_info)
+      # Derived here, not taken from param_info, so the request cannot pick the attachable_type
+      attachable_type = type == Labimotion::Prop::SEGMENT ? Labimotion::Prop::SEGMENTPROPS : Labimotion::Prop::ELEMENTPROPS
       map_info&.keys&.each do |key|
         next if map_info[key]['files'].empty?
 
         if type == Labimotion::Prop::SEGMENT
-          element = Labimotion::Segment.find_by(element_id: id, segment_klass_id: key)
+          element = Labimotion::Segment.find_by(element_type: element_type, element_id: id, segment_klass_id: key)
         elsif type == Labimotion::Prop::ELEMENT
           element = Labimotion::Element.find_by(id: id)
         end
@@ -172,7 +176,7 @@ module Labimotion
             created_by: user_id,
             created_for: user_id,
             content_type: file[:type],
-            attachable_type: map_info[key]['type'],
+            attachable_type: attachable_type,
             attachable_id: element.id,
           )
           begin
@@ -221,7 +225,8 @@ module Labimotion
         end
       end
       unless (del_files || []).empty?
-        Attachment.where('id IN (?) AND attachable_type = (?)', del_files.map!(&:to_i), type).update_all(attachable_id: nil)
+        # Scoped to the element, so ids of another element's attachments are left alone
+        Attachment.where(id: del_files.map(&:to_i), attachable_type: type, attachable_id: id).update_all(attachable_id: nil)
       end
       attach_ary
     rescue StandardError => e

data/lib/labimotion/libs/converter.rb

@@ -262,7 +262,7 @@ module Labimotion
         properties: props,
         properties_release: klass.properties_release,
         klass_uuid: klass.uuid,
-        metadata: klass.metadata
+        metadata: Labimotion::ReleaseMetadata.for_klass(klass)
       )
     end
 

data/lib/labimotion/libs/dataset_builder.rb

@@ -45,7 +45,7 @@ module Labimotion
         properties: props,
         properties_release: klass.properties_release,
         klass_uuid: klass.uuid,
-        metadata: klass.metadata
+        metadata: Labimotion::ReleaseMetadata.for_klass(klass)
       )
     end
 

data/lib/labimotion/libs/release_metadata.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+# `underscore`, `constantize` and `index_by` are ActiveSupport core extensions, not plain
+# Ruby. A booted host always has them; declaring them here keeps this file from depending on
+# load order.
+require 'active_support/core_ext/enumerable'
+require 'active_support/core_ext/string/inflections'
+
+module Labimotion
+  ## ReleaseMetadata
+  # Each klass's metadata as of its active release, for the `metadata_releases:` option the
+  # klass entities read and for records the gem builds itself. The klass row's own `metadata`
+  # follows every save, drafts included, so a record built from `properties_release` needs the
+  # copy kept on the revision.
+  # The active revision is the one whose uuid equals the klass's, which changes only on release.
+  class ReleaseMetadata
+    # A klass with no revision matching its uuid (never released, or imported without one)
+    # is left out of the map, and the entity reads it as nil.
+    def self.map_for(klasses)
+      Array(klasses).compact.group_by(&:class).each_with_object({}) do |(model, group), map|
+        map.merge!(map_for_family(model, group))
+      end
+    end
+
+    # The metadata a record built from the klass's `properties_release` stores: the active
+    # release's, or the klass's own when no revision matches its uuid. A failed lookup also
+    # falls back to the klass's own, so building the record never fails on it.
+    def self.for_klass(klass)
+      map_for([klass])[key_of(klass)] || klass.metadata || {}
+    end
+
+    # Family as well as id: a segment klass payload nests its element klass, and ids repeat
+    # across the klass tables.
+    def self.key_of(klass)
+      "#{klass.class.name.split('::').last}:#{klass.id}"
+    end
+
+    def self.map_for_family(model, klasses)
+      by_pair = klasses.reject { |klass| klass.uuid.nil? }.index_by { |klass| [klass.id, klass.uuid] }
+      return {} if by_pair.empty?
+
+      revisions_for(model, by_pair.keys).each_with_object({}) do |(klass_id, uuid, metadata), map|
+        # The IN lists cross-match: a revision of one listed klass can carry the uuid of
+        # another. Only the exact pair is that klass's active release.
+        klass = by_pair[[klass_id, uuid]]
+        map[key_of(klass)] = metadata unless klass.nil?
+      end
+    rescue StandardError => e
+      # The release metadata is an addition to a list that must still render, and a failing
+      # family must not blank the families that resolved. A record builder falls back too.
+      Labimotion.log_exception(e)
+      {}
+    end
+
+    # The revision model and its foreign key are named after the klass model.
+    def self.revisions_for(model, pairs)
+      foreign_key = "#{model.name.underscore.split('/').last}_id"
+      "#{model.name}esRevision".constantize
+                               .where(foreign_key => pairs.map(&:first), uuid: pairs.map(&:last))
+                               .pluck(foreign_key, :uuid, :metadata)
+    end
+    private_class_method :map_for_family, :revisions_for
+  end
+end

data/lib/labimotion/utils/prop.rb

@@ -19,10 +19,17 @@ module Labimotion
     SAMPLE = 'Sample'.freeze
     MOLECULE = 'Molecule'.freeze
     REACTION = 'Reaction'.freeze
+    RESEARCH_PLAN = 'ResearchPlan'.freeze
+    SCREEN = 'Screen'.freeze
     CONTAINER = 'Container'.freeze
     ELEMENTPROPS = 'ElementProps'.freeze
     SEGMENTPROPS = 'SegmentProps'.freeze
     DATASETPROPS = 'DatasetProps'.freeze
     UPLOADPROPS = [ELEMENTPROPS, SEGMENTPROPS, DATASETPROPS].freeze
+    # att_type accepted by upload_generics_files => class name of the element it names
+    UPLOAD_ELEMENT_TYPES = {
+      ELEMENT => L_ELEMENT, SAMPLE => SAMPLE, REACTION => REACTION, RESEARCH_PLAN => RESEARCH_PLAN,
+      SCREEN => SCREEN
+    }.freeze
   end
 end

data/lib/labimotion/version.rb

@@ -2,5 +2,5 @@
 
 ## Labimotion Version
 module Labimotion
-  VERSION = '2.3.2'
+  VERSION = '2.3.4'
 end

data/lib/labimotion.rb

@@ -73,6 +73,7 @@ module Labimotion
   autoload :ParamHelpers, 'labimotion/helpers/param_helpers'
   autoload :ConverterHelpers, 'labimotion/helpers/converter_helpers'
   autoload :ExporterHelpers, 'labimotion/helpers/exporter_helpers'
+  autoload :ExportAuthorizationHelpers, 'labimotion/helpers/export_authorization_helpers'
   autoload :SampleAssociationHelpers, 'labimotion/helpers/sample_association_helpers'
   autoload :RepositoryHelpers, 'labimotion/helpers/repository_helpers'
   autoload :VocabularyHelpers, 'labimotion/helpers/vocabulary_helpers'
@@ -95,6 +96,7 @@ module Labimotion
   autoload :SampleAssociation, 'labimotion/libs/sample_association'
   autoload :PropertiesHandler, 'labimotion/libs/properties_handler'
   autoload :KlassVersion, 'labimotion/libs/klass_version'
+  autoload :ReleaseMetadata, 'labimotion/libs/release_metadata'
   autoload :AttachmentHandler, 'labimotion/libs/attachment_handler'
   autoload :VocabularyHandler, 'labimotion/libs/vocabulary_handler'
   autoload :XlsxExporter, 'labimotion/libs/xlsx_exporter'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: labimotion
 version: !ruby/object:Gem::Version
-  version: 2.3.2
+  version: 2.3.4
 platform: ruby
 authors:
 - Chia-Lin Lin
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-10-02 00:00:00.000000000 Z
+date: 2026-11-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: caxlsx
@@ -114,6 +114,7 @@ files:
 - lib/labimotion/helpers/converter_helpers.rb
 - lib/labimotion/helpers/dataset_helpers.rb
 - lib/labimotion/helpers/element_helpers.rb
+- lib/labimotion/helpers/export_authorization_helpers.rb
 - lib/labimotion/helpers/exporter_helpers.rb
 - lib/labimotion/helpers/generic_helpers.rb
 - lib/labimotion/helpers/mtt_helpers.rb
@@ -140,6 +141,7 @@ files:
 - lib/labimotion/libs/klass_version.rb
 - lib/labimotion/libs/nmr_mapper.rb
 - lib/labimotion/libs/properties_handler.rb
+- lib/labimotion/libs/release_metadata.rb
 - lib/labimotion/libs/sample_association.rb
 - lib/labimotion/libs/template_hub.rb
 - lib/labimotion/libs/template_matcher.rb