labimotion 2.3.3 → 2.3.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3b0302788cd4be249920160317e9a4bc999fe5446a61cadb5d356620da18290b
-  data.tar.gz: 8abc1cf487e158576fe998ae09f75cff30f44ac653525a27393e60cb46de1849
+  metadata.gz: 7f2a9943b6c1fd9c1d0e09f9b2917985db173634db909a8a3eb3b80ad99d61d4
+  data.tar.gz: 828d2be1b26596f926f2e7f4ff06a05925ef7cae8dad9db06f5318b5c5ce527e
 SHA512:
-  metadata.gz: 6b03a637a3cc878f8560b806da47301d9edfee557b59d83cb4944cee48df1aca4c35d13a74604f45ab5459a522d443095ecd01a02f35ae61b3ad577015e891b6
-  data.tar.gz: 1c7f622321fc6f0d4bac046a9f0b14c94d56dffe3b1cda9e0ee64ca6b0cfd63a09bcf12f41680843e1b4a0313265558658edd0ff64dd62dfd2a04afff27321ca
+  metadata.gz: 2566c6dc15a6acc91cb3cbc9264946b34c7a99be61c02a5916aea8de366bbc7e0b928319ff63b994b0b5fe48d82b6a5ee1a9c8a7e19b4e2a158471a9b9436a2f
+  data.tar.gz: ee020ae64b55ff37621cecc819a4675808b815530b3aa8bcea2c49a3b5aa2107779a1297424f986648ecdd2c477adbf5dcdc72b7327430bbe2091ef63414611c

data/CHANGELOG.md

@@ -1,6 +1,24 @@
 # LabIMotion Changelog
 
-## [Unreleased]
+## [2.3.4]
+> Unreleased
+* Bug fixes:
+  * `upload_generics_files` stays on the element it was authorized for ([chemotion#684](https://github.com/ComPlat/chemotion/issues/684)). `delfiles` detached any generic-element attachment by id; it now only detaches the updated element's own. Uploads take `ElementProps`/`SegmentProps` from the server instead of the `type` the client sends in `elInfo`/`seInfo`, and the segment lookup also matches the element type, so an upload authorized for sample 5 no longer reaches the segment of reaction 5 or generic element 5. `att_type` is limited to `Element`, `Sample`, `Reaction`, `ResearchPlan` and `Screen` (400 otherwise, instead of `constantize` on the request value; the client's `CellLineSample`, which already failed in `constantize`, now gets the 400). `elfiles`, `attfiles` and `delfiles` are only handled for `Element`: an `elfiles` upload authorized for a sample used to write into the generic element with the same id. No client change.
+  * `GET /generic_elements/export` checks read permission before building the docx (labimotion#358, port of labimotion#336). It exported any Element, Segment or Dataset by id to any signed-in user. It now answers 404 for a missing record and 401 unless the user passes the matrix check (`genericElement` for an element, `segment` for a segment, `genericDataset` for a dataset) and `ElementPolicy#read?` on the element that holds the record: the element itself, a segment's element, or the root element of a dataset's container. A dataset also needs `ElementPolicy#read_dataset?`, so a share below the dataset detail level cannot export one. The table xlsx export (`GET /exporter/table_xlsx/:id`), which already ran these checks for elements and segments, now shares them through the new `Labimotion::ExportAuthorizationHelpers`.
+  * A dataset the gem builds itself — by the converter, or through `Labimotion::DatasetBuilder` — stores the metadata of its klass's active release (labimotion#343, port of labimotion#342). Both builders stored the klass's own `metadata`, which follows every save, drafts included, so a dataset created after a draft save got the released layers with the draft's layer groups and group restrictions, and the form then used them. A klass with no revision matching its uuid still uses its own `metadata`. `Labimotion::ReleaseMetadata.for_klass` returns that value for one klass.
+
+## [2.3.3]
+> 2026-10-19
+* Bug fixes:
+  * New records and element Reload build from the release's metadata (labimotion#326, port of labimotion#321 and labimotion#324, [chem-generic-ui#1438](https://github.com/cllde8/chem-generic-ui/issues/1438), port of [chem-generic-ui#1430](https://github.com/cllde8/chem-generic-ui/issues/1430)). A klass's `metadata` follows every save, drafts included, so a new element, segment or dataset, and an element brought up to the release by Reload, combined the released layers with the draft's layer groups and restrictions. Klass payloads now carry `metadata_release`: the metadata of the klass's active release, read from its revision row, or `null` when no revision matches the klass's uuid. Sent by `generic_elements/klass`, `segments/list_segment_klass` (nested element klasses included), `generic_dataset/klasses`, and on the nested `element_klass` of the element `GET`, create and update responses, with one revision query per klass family; every other payload is unchanged. A client reading `metadata_release ?? metadata` builds from one version. Read-only: no migration.
+
+## [2.3.2]
+> 2026-10-02
+* Bug fixes:
+  * A copied element, segment or dataset keeps the template release its properties were built on (labimotion#301, labimotion#303). Saves used to stamp every new segment and every dataset save with the klass's current `uuid` and `properties_release`, and an element with whatever the client sent, so a copy of a v1.0.0 record was labelled v2.0.0 and the client never offered Reload. `Labimotion::KlassVersion` now resolves the submitted `properties['klass_uuid']` against the klass's current release and its `*_klasses_revisions`, deleted revisions included, and stores that uuid together with the matching `properties_release`. A new record whose uuid is missing or unknown follows the current release; an existing record keeps its stored uuid when none is sent, then the uuid its stored `properties_release` names, and follows the current release only when it has neither, and a uuid this instance never released (a record imported from an instance with its own release history) keeps the release stored with the record. A new element whose properties carry no uuid follows the template the client built it on; a new segment does the same, and a copied one falls back to the `klass_uuid` of the row it was copied from. The collection import stamps the release the archive names instead of the importing instance's current one: it tries the uuid inside the archived `properties_release`, then `properties['klass_uuid']`, then the `klass_uuid` column, and stores the first one this instance knows with the local release; when none resolves, the archived release keeps the uuid it names (or, naming none, the first uuid the archive carries), and the imported properties carry the same `klass_uuid` as the column. A `klass_uuid` that is not a string is ignored, and a dataset whose klass changed follows the new klass and ignores the client's release. Element create returns 404 when the template is missing or deleted, element update resolves a soft-deleted template (`with_deleted`) before writing anything, and segments and datasets of a deleted template are skipped on save. A new record whose `klass_uuid` this instance cannot resolve keeps it with the `properties_release` the client sent, only when that release names the same uuid. No migration and no client change.
+
+## [2.3.0]
+> 2026-08-26
 * Features and enhancements:
   * Element variations can be exported to and imported from Excel (`.xlsx`). The exported workbook is itself the import template: `GET /api/v1/element_variations/:element_id/export` and `POST /api/v1/element_variations/:element_id/import`.
   * The exported sheet carries the grid's grouped header -- group, sub-group and field rows, merged as the grid draws them -- above the hidden key and unit rows. Workbooks from the earlier single-row header still import.
@@ -8,8 +26,6 @@
   * `number`, `integer` and `system-defined` columns accept numbers only. A cell holding anything else is cleared with a warning rather than stored as text, which also cleans up text those columns already hold.
   * Import warnings name the cell they came from (`Cell I6: ...`), so the user can go straight to it in the spreadsheet.
 * Bug fixes:
-  * New records and element Reload build from the release's metadata (labimotion#326, port of labimotion#321 and labimotion#324, [chem-generic-ui#1438](https://github.com/cllde8/chem-generic-ui/issues/1438), port of [chem-generic-ui#1430](https://github.com/cllde8/chem-generic-ui/issues/1430)). A klass's `metadata` follows every save, drafts included, so a new element, segment or dataset, and an element brought up to the release by Reload, combined the released layers with the draft's layer groups and restrictions. Klass payloads now carry `metadata_release`: the metadata of the klass's active release, read from its revision row, or `null` when no revision matches the klass's uuid. Sent by `generic_elements/klass`, `segments/list_segment_klass` (nested element klasses included), `generic_dataset/klasses`, and on the nested `element_klass` of the element `GET`, create and update responses, with one revision query per klass family; every other payload is unchanged. A client reading `metadata_release ?? metadata` builds from one version. Read-only: no migration.
-  * A copied element, segment or dataset keeps the template release its properties were built on (labimotion#301, labimotion#303). Saves used to stamp every new segment and every dataset save with the klass's current `uuid` and `properties_release`, and an element with whatever the client sent, so a copy of a v1.0.0 record was labelled v2.0.0 and the client never offered Reload. `Labimotion::KlassVersion` now resolves the submitted `properties['klass_uuid']` against the klass's current release and its `*_klasses_revisions`, deleted revisions included, and stores that uuid together with the matching `properties_release`. A new record whose uuid is missing or unknown follows the current release; an existing record keeps its stored uuid when none is sent, then the uuid its stored `properties_release` names, and follows the current release only when it has neither, and a uuid this instance never released (a record imported from an instance with its own release history) keeps the release stored with the record. A new element whose properties carry no uuid follows the template the client built it on; a new segment does the same, and a copied one falls back to the `klass_uuid` of the row it was copied from. The collection import stamps the release the archive names instead of the importing instance's current one: it tries the uuid inside the archived `properties_release`, then `properties['klass_uuid']`, then the `klass_uuid` column, and stores the first one this instance knows with the local release; when none resolves, the archived release keeps the uuid it names (or, naming none, the first uuid the archive carries), and the imported properties carry the same `klass_uuid` as the column. A `klass_uuid` that is not a string is ignored, and a dataset whose klass changed follows the new klass and ignores the client's release. Element create returns 404 when the template is missing or deleted, element update resolves a soft-deleted template (`with_deleted`) before writing anything, and segments and datasets of a deleted template are skipped on save. A new record whose `klass_uuid` this instance cannot resolve keeps it with the `properties_release` the client sent, only when that release names the same uuid. No migration and no client change.
   * `fetch_for_user`: the shared-records branch joined `collection_shares` directly on the element model (an association that only exists on `Collection`), raising `ActiveRecord::ConfigurationError` — rescued into empty search results. Now joins through `collections`. Fixed for both the basic elements (`ElementFetchable`) and the generic element (`Labimotion::Element`), so `search_by_like` and `search_basic_by_like` return shared records again.
 * Dependencies:
   * Added `roo` (~> 2.10) for reading the uploaded workbook.

data/lib/labimotion/apis/exporter_api.rb

@@ -8,6 +8,7 @@ module Labimotion
 
     helpers Labimotion::ParamHelpers
     helpers Labimotion::ExporterHelpers
+    helpers Labimotion::ExportAuthorizationHelpers
 
     resource :exporter do
       resource :table_xlsx do
@@ -46,9 +47,7 @@ module Labimotion
         klass = fetch_klass
         @element = klass.find_by(id: params[:id])
 
-        error!('404 Not Found', 404) if @element.nil?
-
-        authorize_element_access!
+        authorize_export!(params[:klass], @element)
       rescue ActiveRecord::RecordNotFound
         error!('404 Not Found', 404)
       rescue NameError => e
@@ -61,22 +60,6 @@ module Labimotion
         Labimotion::Utils.resolve_class(params[:klass])
       end
 
-      # Authorize element access based on user permissions
-      def authorize_element_access!
-        element_policy = if params[:klass] == 'Element'
-                           ElementPolicy.new(current_user,
-                                             @element)
-                         else
-                           ElementPolicy.new(current_user,
-                                             @element.element)
-                         end
-        matrix_name = params[:klass] == 'Element' ? 'genericElement' : 'segment'
-
-        return if current_user.matrix_check_by_name(matrix_name) && element_policy.read?
-
-        error!('401 Unauthorized', 401)
-      end
-
       # Fetch layer from element properties
       def fetch_layer
         properties = @element.properties

data/lib/labimotion/apis/generic_element_api.rb

@@ -17,6 +17,7 @@ module Labimotion
     helpers Labimotion::GenericHelpers
     helpers Labimotion::ElementHelpers
     helpers Labimotion::ParamHelpers
+    helpers Labimotion::ExportAuthorizationHelpers
 
     resource :generic_elements do
       # might be removed because the file is moved to public folder
@@ -129,14 +130,8 @@ module Labimotion
           optional :export_format, type: String, desc: 'export format'
         end
         get do
-          case params[:klass]
-          when 'Element'
-            element = Labimotion::Element.find(params[:id])
-          when 'Segment'
-            element = Labimotion::Segment.find(params[:id])
-          when 'Dataset'
-            element = Labimotion::Dataset.find(params[:id])
-          end
+          element = "Labimotion::#{params[:klass]}".constantize.find_by(id: params[:id])
+          authorize_export!(params[:klass], element)
           export = Labimotion::ExportElement.new current_user, element, params[:export_format]
           env['api.format'] = :binary
           content_type 'application/vnd.openxmlformats-officedocument.wordprocessingml.document'
@@ -264,14 +259,10 @@ module Labimotion
         desc 'upload generic files'
         params do
           requires :att_id, type: Integer, desc: 'Element Id'
-          requires :att_type, type: String, desc: 'Element Type'
+          requires :att_type, type: String, values: Labimotion::Prop::UPLOAD_ELEMENT_TYPES.keys, desc: 'Element Type'
         end
         after_validation do
-          if params[:att_type] == 'Sample' || params[:att_type] == 'Reaction' || params[:att_type] == 'ResearchPlan'
-            el = "#{params[:att_type]}".constantize.find_by(id: params[:att_id])
-          else
-            el = "Labimotion::#{params[:att_type]}".constantize.find_by(id: params[:att_id])
-          end
+          el = Labimotion::Prop::UPLOAD_ELEMENT_TYPES[params[:att_type]].constantize.find_by(id: params[:att_id])
           error!('401 Unauthorized', 401) if el.nil?
 
           policy_updatable = ElementPolicy.new(current_user, el).update?

data/lib/labimotion/helpers/element_helpers.rb

@@ -182,13 +182,18 @@ module Labimotion
 
     def upload_generics_files(current_user, params)
       attach_ary = []
+      element_type = Labimotion::Prop::UPLOAD_ELEMENT_TYPES.fetch(params[:att_type])
+      generic_element = element_type == Labimotion::Prop::L_ELEMENT
+      # Element properties and direct attachments only exist on generic elements; for any
+      # other att_type, att_id names a different table, so they are not touched.
       att_ary = create_uploads(
         Labimotion::Prop::ELEMENT,
         params[:att_id],
         params[:elfiles],
         params[:elInfo],
         current_user.id,
-      ) if params[:elfiles].present? && params[:elInfo].present?
+        element_type
+      ) if generic_element && params[:elfiles].present? && params[:elInfo].present?
 
       (attach_ary << att_ary).flatten! unless att_ary&.empty?
 
@@ -197,16 +202,17 @@ module Labimotion
         params[:att_id],
         params[:sefiles],
         params[:seInfo],
-        current_user.id
+        current_user.id,
+        element_type
       ) if params[:sefiles].present? && params[:seInfo].present?
 
       (attach_ary << att_ary).flatten! unless att_ary&.empty?
 
-      if params[:attfiles].present? || params[:delfiles].present? then
+      if generic_element && (params[:attfiles].present? || params[:delfiles].present?)
         att_ary = create_attachments(
           params[:attfiles],
           params[:delfiles],
-          "Labimotion::#{params[:att_type]}",
+          element_type,
           params[:att_id],
           params[:attfilesIdentifier],
           current_user.id

data/lib/labimotion/helpers/export_authorization_helpers.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Labimotion
+  # Gate shared by the routes that export an Element, Segment or Dataset to a file.
+  # A segment or dataset is readable when the element that holds it is; a dataset
+  # sits on an analysis container, so its element is that container's root element.
+  module ExportAuthorizationHelpers
+    # Answers 404 for a missing record and 401 unless the user passes the matrix
+    # check for the record's family and may read the element that holds it.
+    def authorize_export!(klass_name, record)
+      error!('404 Not Found', 404) if record.nil?
+      return if export_readable?(klass_name, record)
+
+      error!('401 Unauthorized', 401)
+    end
+
+    # The matrix right that shows each family in the UI.
+    EXPORT_MATRIX = { 'Element' => 'genericElement', 'Segment' => 'segment', 'Dataset' => 'genericDataset' }.freeze
+
+    def export_readable?(klass_name, record)
+      return false unless current_user.matrix_check_by_name(EXPORT_MATRIX.fetch(klass_name))
+
+      policy = ElementPolicy.new(current_user, export_parent_element(klass_name, record))
+      return policy.read? unless klass_name == 'Dataset'
+
+      # A dataset holds analysis data, which a share below the dataset detail
+      # level hides.
+      policy.read? && policy.read_dataset?
+    end
+
+    def export_parent_element(klass_name, record)
+      case klass_name
+      when 'Element' then record
+      when 'Segment' then record.element
+      when 'Dataset' then record.element&.root_element
+      end
+    end
+  end
+end

data/lib/labimotion/helpers/generic_helpers.rb

@@ -142,16 +142,20 @@ module Labimotion
       raise e
     end
 
-    def create_uploads(type, id, files, param_info, user_id)
+    # element_type is the class name of the element that id names, so a segment
+    # lookup cannot reach another element type's segment with the same element_id.
+    def create_uploads(type, id, files, param_info, user_id, element_type)
       return if files.nil? || param_info.nil? || files.empty? || param_info.empty?
 
       attach_ary = []
       map_info = JSON.parse(param_info)
+      # Derived here, not taken from param_info, so the request cannot pick the attachable_type
+      attachable_type = type == Labimotion::Prop::SEGMENT ? Labimotion::Prop::SEGMENTPROPS : Labimotion::Prop::ELEMENTPROPS
       map_info&.keys&.each do |key|
         next if map_info[key]['files'].empty?
 
         if type == Labimotion::Prop::SEGMENT
-          element = Labimotion::Segment.find_by(element_id: id, segment_klass_id: key)
+          element = Labimotion::Segment.find_by(element_type: element_type, element_id: id, segment_klass_id: key)
         elsif type == Labimotion::Prop::ELEMENT
           element = Labimotion::Element.find_by(id: id)
         end
@@ -172,7 +176,7 @@ module Labimotion
             created_by: user_id,
             created_for: user_id,
             content_type: file[:type],
-            attachable_type: map_info[key]['type'],
+            attachable_type: attachable_type,
             attachable_id: element.id,
           )
           begin
@@ -221,7 +225,8 @@ module Labimotion
         end
       end
       unless (del_files || []).empty?
-        Attachment.where('id IN (?) AND attachable_type = (?)', del_files.map!(&:to_i), type).update_all(attachable_id: nil)
+        # Scoped to the element, so ids of another element's attachments are left alone
+        Attachment.where(id: del_files.map(&:to_i), attachable_type: type, attachable_id: id).update_all(attachable_id: nil)
       end
       attach_ary
     rescue StandardError => e

data/lib/labimotion/libs/converter.rb

@@ -262,7 +262,7 @@ module Labimotion
         properties: props,
         properties_release: klass.properties_release,
         klass_uuid: klass.uuid,
-        metadata: klass.metadata
+        metadata: Labimotion::ReleaseMetadata.for_klass(klass)
       )
     end
 

data/lib/labimotion/libs/dataset_builder.rb

@@ -45,7 +45,7 @@ module Labimotion
         properties: props,
         properties_release: klass.properties_release,
         klass_uuid: klass.uuid,
-        metadata: klass.metadata
+        metadata: Labimotion::ReleaseMetadata.for_klass(klass)
       )
     end
 

data/lib/labimotion/libs/release_metadata.rb

@@ -8,9 +8,10 @@ require 'active_support/core_ext/string/inflections'
 
 module Labimotion
   ## ReleaseMetadata
-  # Builds the `metadata_releases:` option the klass entities read: each klass's metadata as
-  # of its active release. The klass row's own `metadata` follows every save, drafts included,
-  # so a client building a record from `properties_release` needs the copy kept on the revision.
+  # Each klass's metadata as of its active release, for the `metadata_releases:` option the
+  # klass entities read and for records the gem builds itself. The klass row's own `metadata`
+  # follows every save, drafts included, so a record built from `properties_release` needs the
+  # copy kept on the revision.
   # The active revision is the one whose uuid equals the klass's, which changes only on release.
   class ReleaseMetadata
     # A klass with no revision matching its uuid (never released, or imported without one)
@@ -21,6 +22,13 @@ module Labimotion
       end
     end
 
+    # The metadata a record built from the klass's `properties_release` stores: the active
+    # release's, or the klass's own when no revision matches its uuid. A failed lookup also
+    # falls back to the klass's own, so building the record never fails on it.
+    def self.for_klass(klass)
+      map_for([klass])[key_of(klass)] || klass.metadata || {}
+    end
+
     # Family as well as id: a segment klass payload nests its element klass, and ids repeat
     # across the klass tables.
     def self.key_of(klass)
@@ -39,7 +47,7 @@ module Labimotion
       end
     rescue StandardError => e
       # The release metadata is an addition to a list that must still render, and a failing
-      # family must not blank the families that resolved.
+      # family must not blank the families that resolved. A record builder falls back too.
       Labimotion.log_exception(e)
       {}
     end

data/lib/labimotion/utils/prop.rb

@@ -19,10 +19,17 @@ module Labimotion
     SAMPLE = 'Sample'.freeze
     MOLECULE = 'Molecule'.freeze
     REACTION = 'Reaction'.freeze
+    RESEARCH_PLAN = 'ResearchPlan'.freeze
+    SCREEN = 'Screen'.freeze
     CONTAINER = 'Container'.freeze
     ELEMENTPROPS = 'ElementProps'.freeze
     SEGMENTPROPS = 'SegmentProps'.freeze
     DATASETPROPS = 'DatasetProps'.freeze
     UPLOADPROPS = [ELEMENTPROPS, SEGMENTPROPS, DATASETPROPS].freeze
+    # att_type accepted by upload_generics_files => class name of the element it names
+    UPLOAD_ELEMENT_TYPES = {
+      ELEMENT => L_ELEMENT, SAMPLE => SAMPLE, REACTION => REACTION, RESEARCH_PLAN => RESEARCH_PLAN,
+      SCREEN => SCREEN
+    }.freeze
   end
 end

data/lib/labimotion/version.rb

@@ -2,5 +2,5 @@
 
 ## Labimotion Version
 module Labimotion
-  VERSION = '2.3.3'
+  VERSION = '2.3.4'
 end

data/lib/labimotion.rb

@@ -73,6 +73,7 @@ module Labimotion
   autoload :ParamHelpers, 'labimotion/helpers/param_helpers'
   autoload :ConverterHelpers, 'labimotion/helpers/converter_helpers'
   autoload :ExporterHelpers, 'labimotion/helpers/exporter_helpers'
+  autoload :ExportAuthorizationHelpers, 'labimotion/helpers/export_authorization_helpers'
   autoload :SampleAssociationHelpers, 'labimotion/helpers/sample_association_helpers'
   autoload :RepositoryHelpers, 'labimotion/helpers/repository_helpers'
   autoload :VocabularyHelpers, 'labimotion/helpers/vocabulary_helpers'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: labimotion
 version: !ruby/object:Gem::Version
-  version: 2.3.3
+  version: 2.3.4
 platform: ruby
 authors:
 - Chia-Lin Lin
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-10-19 00:00:00.000000000 Z
+date: 2026-11-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: caxlsx
@@ -114,6 +114,7 @@ files:
 - lib/labimotion/helpers/converter_helpers.rb
 - lib/labimotion/helpers/dataset_helpers.rb
 - lib/labimotion/helpers/element_helpers.rb
+- lib/labimotion/helpers/export_authorization_helpers.rb
 - lib/labimotion/helpers/exporter_helpers.rb
 - lib/labimotion/helpers/generic_helpers.rb
 - lib/labimotion/helpers/mtt_helpers.rb