UoE/Changing the resource policy for a bitstream during the submission process must be allowed only for administrators

UoE/Changing the resource policy for a bitstream during the submission process must be allowed only for administrators

Author: milanmajchrak

src/app/submission/sections/upload/file/edit/section-upload-file-edit.component.spec.ts

@@ -28,16 +28,21 @@ import {
 import { provideMockStore } from '@ngrx/store/testing';
 import { TranslateModule } from '@ngx-translate/core';
 import { NgxMaskModule } from 'ngx-mask';
-import { of } from 'rxjs';
+import {
+  of,
+  throwError,
+} from 'rxjs';
 
 import {
   APP_CONFIG,
   APP_DATA_SERVICES_MAP,
 } from '../../../../../../config/app-config.interface';
 import { environment } from '../../../../../../environments/environment.test';
+import { AuthorizationDataService } from '../../../../../core/data/feature-authorization/authorization-data.service';
 import { JsonPatchOperationPathCombiner } from '../../../../../core/json-patch/builder/json-patch-operation-path-combiner';
 import { JsonPatchOperationsBuilder } from '../../../../../core/json-patch/builder/json-patch-operations-builder';
 import { SubmissionJsonPatchOperationsService } from '../../../../../core/submission/submission-json-patch-operations.service';
+import { SubmissionScopeType } from '../../../../../core/submission/submission-scope-type';
 import { XSRFService } from '../../../../../core/xsrf/xsrf.service';
 import { dateToISOFormat } from '../../../../../shared/date.util';
 import { DsDynamicTypeBindRelationService } from '../../../../../shared/form/builder/ds-dynamic-form-ui/ds-dynamic-type-bind-relation.service';
@@ -79,6 +84,10 @@ const jsonPatchOpBuilder: any = jasmine.createSpyObj('jsonPatchOpBuilder', {
   remove: jasmine.createSpy('remove'),
 });
 
+const authorizationServiceMock: any = jasmine.createSpyObj('authorizationService', {
+  isAuthorized: of(true),
+});
+
 const formMetadataMock = ['dc.title', 'dc.description'];
 
 const initialState: any = {
@@ -108,6 +117,7 @@ describe('SubmissionSectionUploadFileEditComponent test suite', () => {
   let operationsService: any;
   let formService: any;
   let uploadService: any;
+  let authorizationService: any;
 
   const submissionJsonPatchOperationsServiceStub = new SubmissionJsonPatchOperationsServiceStub();
   const submissionId = mockSubmissionId;
@@ -145,6 +155,7 @@ describe('SubmissionSectionUploadFileEditComponent test suite', () => {
         { provide: SubmissionService, useClass: SubmissionServiceStub },
         { provide: SubmissionJsonPatchOperationsService, useValue: submissionJsonPatchOperationsServiceStub },
         { provide: JsonPatchOperationsBuilder, useValue: jsonPatchOpBuilder },
+        { provide: AuthorizationDataService, useValue: authorizationServiceMock },
         { provide: SectionUploadService, useValue: getMockSectionUploadService() },
         provideMockStore({ initialState }),
         FormBuilderService,
@@ -204,6 +215,7 @@ describe('SubmissionSectionUploadFileEditComponent test suite', () => {
       operationsService = TestBed.inject(SubmissionJsonPatchOperationsService);
       formService = TestBed.inject(FormService);
       uploadService = TestBed.inject(SectionUploadService);
+      authorizationService = TestBed.inject(AuthorizationDataService);
 
       comp.submissionId = submissionId;
       comp.collectionId = collectionId;
@@ -215,6 +227,8 @@ describe('SubmissionSectionUploadFileEditComponent test suite', () => {
       comp.configMetadataForm = configMetadataForm;
       comp.formMetadata = formMetadataMock;
 
+      submissionServiceStub.getSubmissionScope.and.returnValue(SubmissionScopeType.WorkspaceItem);
+      authorizationService.isAuthorized.and.returnValue(of(true));
       formService.isValid.and.returnValue(of(true));
     });
 
@@ -227,6 +241,7 @@ describe('SubmissionSectionUploadFileEditComponent test suite', () => {
     it('should init form model properly', () => {
       comp.fileData = fileData;
       comp.formId = 'testFileForm';
+      comp.canEditAccessConditions = true;
       const maxStartDate = { year: 2022, month: 1, day: 12 };
       const maxEndDate = { year: 2019, month: 7, day: 12 };
 
@@ -267,6 +282,7 @@ describe('SubmissionSectionUploadFileEditComponent test suite', () => {
 
       comp.fileData = fileData;
       comp.formId = 'testFileForm';
+      comp.canEditAccessConditions = true;
 
       comp.formModel = compAsAny.buildFileEditForm();
 
@@ -300,11 +316,40 @@ describe('SubmissionSectionUploadFileEditComponent test suite', () => {
       expect(compAsAny.retrieveValueFromField(field)).toBe('test');
     });
 
+    it('should show access-condition form controls for admin users', () => {
+      comp.fileData = fileData;
+      comp.formId = 'testFileForm';
+      authorizationService.isAuthorized.and.returnValue(of(true));
+      // only the form model is under test — don't render the template
+      spyOn(compAsAny.cdr, 'detectChanges');
+
+      comp.ngOnInit();
+
+      expect(comp.canEditAccessConditions).toBeTrue();
+      expect(comp.formModel).toBeDefined();
+      expect(formbuilderService.findById('accessConditions', comp.formModel)).not.toBeNull();
+    });
+
+    it('should hide access-condition form controls for non-admin users', () => {
+      comp.fileData = fileData;
+      comp.formId = 'testFileForm';
+      authorizationService.isAuthorized.and.returnValue(of(false));
+      // only the form model is under test — don't render the template
+      spyOn(compAsAny.cdr, 'detectChanges');
+
+      comp.ngOnInit();
+
+      expect(comp.canEditAccessConditions).toBeFalse();
+      expect(comp.formModel).toBeDefined();
+      expect(formbuilderService.findById('accessConditions', comp.formModel)).toBeNull();
+    });
+
     it('should save Bitstream File data properly when form is valid', fakeAsync(() => {
       compAsAny.formRef = { formGroup: null };
       compAsAny.fileData = fileData;
       compAsAny.pathCombiner = pathCombiner;
       compAsAny.isPrimary = null;
+      comp.canEditAccessConditions = true;
       formService.validateAllFormFields.and.callFake(() => null);
       formService.isValid.and.returnValue(of(true));
       formService.getFormData.and.returnValue(of(mockFileFormData));
@@ -381,6 +426,56 @@ describe('SubmissionSectionUploadFileEditComponent test suite', () => {
       expect(uploadService.updateFileData).toHaveBeenCalled();
     }));
 
+    it('should not patch access conditions for non-admin users', fakeAsync(() => {
+      compAsAny.formRef = { formGroup: null };
+      compAsAny.fileData = fileData;
+      compAsAny.pathCombiner = pathCombiner;
+      compAsAny.canEditAccessConditions = false;
+
+      operationsBuilder.add.calls.reset();
+      formService.validateAllFormFields.and.callFake(() => null);
+      formService.isValid.and.returnValue(of(true));
+      formService.getFormData.and.returnValue(of(mockFileFormData));
+
+      const response = [
+        Object.assign(mockSubmissionObject, {
+          sections: {
+            upload: {
+              files: mockUploadFiles,
+            },
+          },
+        }),
+      ];
+      operationsService.jsonPatchByResourceID.and.returnValue(of(response));
+
+      comp.saveBitstreamData();
+      tick();
+
+      expect(operationsBuilder.add).not.toHaveBeenCalledWith(
+        pathCombiner.getPath(['files', fileIndex, 'accessConditions']),
+        jasmine.anything(),
+        true,
+      );
+    }));
+
+    it('should clear isSaving and keep the modal open when the patch request fails', fakeAsync(() => {
+      compAsAny.formRef = { formGroup: null };
+      compAsAny.fileData = fileData;
+      compAsAny.pathCombiner = pathCombiner;
+      spyOn(compAsAny.cdr, 'detectChanges');
+      const modalCloseSpy = spyOn(compAsAny.activeModal, 'close');
+      formService.validateAllFormFields.and.callFake(() => null);
+      formService.isValid.and.returnValue(of(true));
+      formService.getFormData.and.returnValue(of(mockFileFormData));
+      operationsService.jsonPatchByResourceID.and.returnValue(throwError(() => new Error('patch failed')));
+
+      comp.saveBitstreamData();
+      tick();
+
+      expect(compAsAny.isSaving).toBeFalse();
+      expect(modalCloseSpy).not.toHaveBeenCalled();
+    }));
+
     it('should not save Bitstream File data properly when form is not valid', fakeAsync(() => {
       compAsAny.formRef = { formGroup: null };
       compAsAny.pathCombiner = pathCombiner;

src/app/submission/sections/upload/file/edit/section-upload-file-edit.component.ts

@@ -34,8 +34,11 @@ import { DynamicCustomSwitchModel } from 'src/app/shared/form/builder/ds-dynamic
 
 import { AccessConditionOption } from '../../../../../core/config/models/config-access-condition-option.model';
 import { SubmissionFormsModel } from '../../../../../core/config/models/config-submission-forms.model';
+import { AuthorizationDataService } from '../../../../../core/data/feature-authorization/authorization-data.service';
+import { FeatureID } from '../../../../../core/data/feature-authorization/feature-id';
 import { JsonPatchOperationPathCombiner } from '../../../../../core/json-patch/builder/json-patch-operation-path-combiner';
 import { JsonPatchOperationsBuilder } from '../../../../../core/json-patch/builder/json-patch-operations-builder';
+import { SubmitDataResponseDefinitionObject } from '../../../../../core/shared/submit-data-response-definition.model';
 import { WorkspaceitemSectionUploadFileObject } from '../../../../../core/submission/models/workspaceitem-section-upload-file.model';
 import { SubmissionJsonPatchOperationsService } from '../../../../../core/submission/submission-json-patch-operations.service';
 import { BtnDisabledDirective } from '../../../../../shared/btn-disabled.directive';
@@ -186,6 +189,12 @@ implements OnInit, OnDestroy {
 
   protected subscriptions: Subscription[] = [];
 
+  /**
+   * Whether the current user may edit bitstream access conditions.
+   * Fail-closed: stays false until the site-administrator check resolves in ngOnInit.
+   */
+  public canEditAccessConditions = false;
+
   /**
    * Initialize instance variables
    *
@@ -201,6 +210,7 @@ implements OnInit, OnDestroy {
   constructor(
     protected activeModal: NgbActiveModal,
     private cdr: ChangeDetectorRef,
+    private authorizationService: AuthorizationDataService,
     private formBuilderService: FormBuilderService,
     private formService: FormService,
     private submissionService: SubmissionService,
@@ -294,8 +304,17 @@ implements OnInit, OnDestroy {
    */
   ngOnInit() {
     if (this.fileData && this.formId) {
-      this.formModel = this.buildFileEditForm();
-      this.cdr.detectChanges();
+      const initSubscription = this.authorizationService.isAuthorized(FeatureID.AdministratorOf).pipe(
+        take(1),
+      ).subscribe({
+        next: (canEdit: boolean) => {
+          this.canEditAccessConditions = canEdit;
+          this.formModel = this.buildFileEditForm();
+          this.cdr.detectChanges();
+        },
+      });
+
+      this.subscriptions.push(initSubscription);
     }
   }
 
@@ -337,7 +356,7 @@ implements OnInit, OnDestroy {
     const accessConditionsArrayConfig = Object.assign({}, BITSTREAM_ACCESS_CONDITIONS_FORM_ARRAY_CONFIG);
     const accessConditionTypeOptions = [];
 
-    if (this.collectionPolicyType === POLICY_DEFAULT_WITH_LIST) {
+    if (this.collectionPolicyType === POLICY_DEFAULT_WITH_LIST && this.canEditAccessConditions) {
       for (const accessCondition of this.availableAccessConditionOptions) {
         accessConditionTypeOptions.push(
           {
@@ -455,7 +474,7 @@ implements OnInit, OnDestroy {
             this.operationsBuilder.remove(this.pathCombiner.getPath([...pathFragment, path]));
           });
         const accessConditionsToSave = [];
-        if (formData.hasOwnProperty('accessConditions')) {
+        if (this.canEditAccessConditions && formData.hasOwnProperty('accessConditions')) {
           formData.accessConditions
             .filter((accessConditions) => isNotNull(accessConditions))
             .map((accessConditions) => accessConditions.accessConditionGroup)
@@ -517,22 +536,32 @@ implements OnInit, OnDestroy {
           this.pathCombiner.rootElement,
           this.pathCombiner.subRootElement);
       }),
-    ).subscribe((result: SubmissionObject[]) => {
-      const section = result[0].sections[this.sectionId];
-      if (!section) {
-        return;
-      }
-      const uploadSection = (section as WorkspaceitemSectionUploadObject);
-
-      this.uploadService.updateFilePrimaryBitstream(this.submissionId, this.sectionId, uploadSection.primary);
-
-      Object.keys(uploadSection.files)
-        .filter((key) => uploadSection.files[key].uuid === this.fileId)
-        .forEach((key) => this.uploadService.updateFileData(
-          this.submissionId, this.sectionId, this.fileId, uploadSection.files[key]),
-        );
-      this.isSaving = false;
-      this.activeModal.close();
+    ).subscribe({
+      next: (result: SubmitDataResponseDefinitionObject) => {
+        const submissionObject = result[0] as SubmissionObject;
+        const section = submissionObject?.sections?.[this.sectionId];
+        if (!section) {
+          this.isSaving = false;
+          this.cdr.detectChanges();
+          return;
+        }
+        const uploadSection = (section as WorkspaceitemSectionUploadObject);
+
+        this.uploadService.updateFilePrimaryBitstream(this.submissionId, this.sectionId, uploadSection.primary);
+
+        Object.keys(uploadSection.files)
+          .filter((key) => uploadSection.files[key].uuid === this.fileId)
+          .forEach((key) => this.uploadService.updateFileData(
+            this.submissionId, this.sectionId, this.fileId, uploadSection.files[key]),
+          );
+        this.isSaving = false;
+        this.activeModal.close();
+      },
+      error: () => {
+        // keep the modal usable when the PATCH request fails
+        this.isSaving = false;
+        this.cdr.detectChanges();
+      },
     });
     this.subscriptions.push(saveBitstreamDataSubscription);
   }