More permissions tests (#487)

* more permissions tests * refactoring and permission integration tests for images * updated redaction policy * make linter happy
impresso · Jan 15, 2025 · 0a47d48 · 0a47d48
1 parent 289d2bb
commit 0a47d48
Show file tree

Hide file tree

Showing 18 changed files with 387 additions and 135 deletions.
diff --git a/src/hooks/redaction.ts b/src/hooks/redaction.ts
@@ -142,7 +142,7 @@ const webappAuthBitmapExtractor = (redactable: Redactable, kind: keyof Authoriza
  * - the request is made through the app (not the public API)
  * - user bitmap does not align with the content item bitmap
  */
-export const webAppTranscriptRedactionCondition: RedactCondition = (context, redactable) => {
+export const webAppExploreRedactionCondition: RedactCondition = (context, redactable) => {
   return (
     !inPublicApi(context, redactable) &&
     !bitmapsAlign(context, redactable, x => webappAuthBitmapExtractor(x, 'explore'))

diff --git a/src/models/articles.model.js b/src/models/articles.model.js
@@ -1,3 +1,5 @@
+import { OpenPermissions } from '../util/bigint'
+
 const { DataTypes } = require('sequelize')
 const lodash = require('lodash')
 const config = require('@feathersjs/configuration')()()
@@ -725,9 +727,9 @@ class Article extends BaseArticle {
         // permissions bitmaps
         // if it's not defined, set max permissions for compatibility
         // with old Solr version
-        bitmapExplore: BigInt(doc.rights_bm_explore_l ?? Number.MAX_SAFE_INTEGER),
-        bitmapGetTranscript: BigInt(doc.rights_bm_get_tr_l ?? Number.MAX_SAFE_INTEGER),
-        bitmapGetImages: BigInt(doc.rights_bm_get_img_l ?? Number.MAX_SAFE_INTEGER),
+        bitmapExplore: BigInt(doc.rights_bm_explore_l ?? OpenPermissions),
+        bitmapGetTranscript: BigInt(doc.rights_bm_get_tr_l ?? OpenPermissions),
+        bitmapGetImages: BigInt(doc.rights_bm_get_img_l ?? OpenPermissions),
       })
 
       if (!doc.pp_plain) {

diff --git a/src/models/images.model.js b/src/models/images.model.js
@@ -1,11 +1,13 @@
-const Page = require('./pages.model');
-const Issue = require('./issues.model');
-const Newspaper = require('./newspapers.model');
-const Article = require('./articles.model');
-const { getExternalFragment } = require('../hooks/iiif.js');
+import { OpenPermissions } from '../util/bigint'
+
+const Page = require('./pages.model')
+const Issue = require('./issues.model')
+const Newspaper = require('./newspapers.model')
+const Article = require('./articles.model')
+const { getExternalFragment } = require('../hooks/iiif.js')
 
 class Image {
-  constructor ({
+  constructor({
     uid = '',
     type = 'image',
     coords = [],
@@ -17,53 +19,61 @@ class Image {
     isFront = false,
     pages = [],
     article = null,
+    // permissions bitmaps
+    bitmapExplore = undefined,
+    bitmapGetTranscript = undefined,
+    bitmapGetImages = undefined,
   } = {}) {
-    this.uid = String(uid);
-    this.year = parseInt(year, 10);
-    this.type = String(type);
-    this.coords = coords;
-    this.pages = pages;
-    this.isFront = Boolean(isFront);
+    this.uid = String(uid)
+    this.year = parseInt(year, 10)
+    this.type = String(type)
+    this.coords = coords
+    this.pages = pages
+    this.isFront = Boolean(isFront)
 
-    this.title = String(title);
+    this.title = String(title)
     if (date instanceof Date) {
-      this.date = date;
+      this.date = date
     } else {
-      this.date = new Date(date);
+      this.date = new Date(date)
     }
     if (newspaper instanceof Newspaper) {
-      this.newspaper = newspaper;
+      this.newspaper = newspaper
     } else {
-      this.newspaper = new Newspaper(newspaper);
+      this.newspaper = new Newspaper(newspaper)
     }
     if (issue instanceof Issue) {
-      this.issue = issue;
+      this.issue = issue
     } else {
-      this.issue = new Issue(issue);
+      this.issue = new Issue(issue)
     }
 
     if (article instanceof Article) {
-      this.article = article;
+      this.article = article
     } else if (typeof article === 'string') {
-      this.article = article;
+      this.article = article
     }
+
+    this.bitmapExplore = bitmapExplore
+    this.bitmapGetTranscript = bitmapGetTranscript
+    this.bitmapGetImages = bitmapGetImages
   }
 
-  assignIIIF () {
+  assignIIIF() {
     this.regions = this.pages.map(page => ({
       pageUid: page.uid,
       coords: this.coords,
       iiifFragment: getExternalFragment(page.iiif, { coords: this.coords, dim: '250,' }),
-    }));
+    }))
   }
 
   /**
    * Return an Image mapper for Solr response document
    *
    * @return {function} {Image} image instance.
    */
-  static solrFactory () {
-    return (doc) => {
+  static solrFactory() {
+    return doc => {
       const img = new Image({
         uid: doc.id,
         newspaper: new Newspaper({
@@ -72,26 +82,33 @@ class Image {
         issue: new Issue({
           uid: doc.meta_issue_id_s,
         }),
-        pages: Array.isArray(doc.page_nb_is)
-          ? doc.page_nb_is.map(num => new Page({
-            uid: `${doc.meta_issue_id_s}-p${String(num).padStart(4, '0')}`,
-            num,
-          }))
-          : [],
+        pages: (Array.isArray(doc.page_nb_is) ? doc.page_nb_is : []).map(
+          num =>
+            new Page({
+              uid: `${doc.meta_issue_id_s}-p${String(num).padStart(4, '0')}`,
+              num,
+            })
+        ),
         title: Article.getUncertainField(doc, 'title'),
         type: doc.item_type_s,
         year: doc.meta_year_i,
         date: doc.meta_date_dt,
         coords: doc.coords_is,
         isFront: doc.front_b,
         article: doc.linked_art_s,
-      });
-      return img;
-    };
+        // permissions bitmaps
+        // if it's not defined, set max permissions for compatibility
+        // with old Solr version
+        bitmapExplore: BigInt(doc.rights_bm_explore_l ?? OpenPermissions),
+        bitmapGetTranscript: BigInt(doc.rights_bm_get_tr_l ?? OpenPermissions),
+        bitmapGetImages: BigInt(doc.rights_bm_get_img_l ?? OpenPermissions),
+      })
+      return img
+    }
   }
 }
 
-module.exports = Image;
+module.exports = Image
 module.exports.SOLR_FL = [
   'id',
   'coords_is',
@@ -108,4 +125,9 @@ module.exports.SOLR_FL = [
   'item_type_s',
   'title_txt_fr',
   '_version_',
-];
+  // permissions bitmaps
+  // see https://github.com/search?q=org%3Aimpresso%20rights_bm_explore_l&type=code
+  'rights_bm_explore_l',
+  'rights_bm_get_tr_l',
+  'rights_bm_get_img_l',
+]
diff --git a/src/models/text-reuse-passages.model.js b/src/models/text-reuse-passages.model.js
@@ -1,3 +1,5 @@
+import { OpenPermissions } from '../util/bigint'
+
 const { invert } = require('lodash')
 const { solrDocsMapCallbackFn } = require('../util/solr/fields')
 
@@ -103,8 +105,8 @@ class TextReusePassage {
     this.pageNumbers = pageNumbers
     this.collections = collections
 
-    this.bitmapExplore = BigInt(bitmapExplore ?? Number.MAX_SAFE_INTEGER)
-    this.bitmapGetTranscript = BigInt(bitmapGetTranscript ?? Number.MAX_SAFE_INTEGER)
+    this.bitmapExplore = BigInt(bitmapExplore ?? OpenPermissions)
+    this.bitmapGetTranscript = BigInt(bitmapGetTranscript ?? OpenPermissions)
   }
 
   static CreateFromSolr(fieldsToPropsMapper = SolrFieldsToPropsMapper) {

diff --git a/src/services/admin/admin.class.ts b/src/services/admin/admin.class.ts
@@ -7,7 +7,8 @@ import {
 import { getUserAccountsWithAvailablePermissions, UserAccount } from '../../useCases/getUsersPermissionsDetails'
 
 interface FindResponse {
-  permissionsDetails: ContentItemPermissionsDetails
+  contentItemsPermissionsDetails: ContentItemPermissionsDetails
+  imagesPermissionsDetails: ContentItemPermissionsDetails
   userAccounts: UserAccount[]
 }
 interface FindParams {}
@@ -18,8 +19,12 @@ export class Service implements IService {
   constructor(private readonly app: ImpressoApplication) {}
 
   async find(params?: Params<FindParams>): Promise<FindResponse> {
-    const permissionsDetails = await getContentItemsPermissionsDetails(this.app.service('simpleSolrClient'))
+    const [contentItemsPermissionsDetails, imagesPermissionsDetails] = await Promise.all([
+      getContentItemsPermissionsDetails(this.app.service('simpleSolrClient'), 'Search'),
+      getContentItemsPermissionsDetails(this.app.service('simpleSolrClient'), 'Images'),
+    ])
+
     const userAccounts = await getUserAccountsWithAvailablePermissions(this.app.get('sequelizeClient')!)
-    return { permissionsDetails, userAccounts } satisfies FindResponse
+    return { contentItemsPermissionsDetails, imagesPermissionsDetails, userAccounts } satisfies FindResponse
   }
 }
diff --git a/src/services/articles/articles.hooks.js b/src/services/articles/articles.hooks.js
@@ -4,7 +4,7 @@ import {
   redactResponse,
   redactResponseDataItem,
   publicApiTranscriptRedactionCondition,
-  webAppTranscriptRedactionCondition,
+  webAppExploreRedactionCondition,
   inPublicApi,
 } from '../../hooks/redaction'
 import { loadYamlFile } from '../../util/yaml'
@@ -107,7 +107,7 @@ export default {
       obfuscate(),
       transformResponseDataItem(transformContentItem, inPublicApi),
       redactResponseDataItem(contentItemRedactionPolicy, publicApiTranscriptRedactionCondition),
-      redactResponseDataItem(contentItemRedactionPolicyWebApp, webAppTranscriptRedactionCondition),
+      redactResponseDataItem(contentItemRedactionPolicyWebApp, webAppExploreRedactionCondition),
     ],
     get: [
       // save here cache, flush cache here
@@ -120,7 +120,7 @@ export default {
       obfuscate(),
       transformResponse(transformContentItem, inPublicApi),
       redactResponse(contentItemRedactionPolicy, publicApiTranscriptRedactionCondition),
-      redactResponse(contentItemRedactionPolicyWebApp, webAppTranscriptRedactionCondition),
+      redactResponse(contentItemRedactionPolicyWebApp, webAppExploreRedactionCondition),
     ],
     create: [],
     update: [],

diff --git a/src/services/articles/resources/contentItemRedactionPolicyWebApp.yml b/src/services/articles/resources/contentItemRedactionPolicyWebApp.yml
@@ -1,7 +1,21 @@
 # yaml-language-server: $schema=../../../schema/common/redactionPolicy.json
 name: content-item-redaction-policy
 items:
-  - jsonPath: $.title
-    valueConverterName: redact
+  # NOTE: decided to show title and fragment so that guest users can see at least something
+  # - jsonPath: $.title
+  #   valueConverterName: redact
   - jsonPath: $.excerpt
     valueConverterName: redact
+  - jsonPath: $.content
+    valueConverterName: redact
+  # NOTE: decided to show title and fragment so that guest users can see at least something
+  # - jsonPath: $.matches.[*].fragment
+  #   valueConverterName: redact
+  - jsonPath: $.regions.[*].iiifFragment
+    valueConverterName: contextNotAllowedImage
+  - jsonPath: $.pages.[*].iiif
+    valueConverterName: contextNotAllowedImage
+  - jsonPath: $.pages.[*].iiifThumbnail
+    valueConverterName: contextNotAllowedImage
+  - jsonPath: $.pages.[*].iiifFragment
+    valueConverterName: contextNotAllowedImage
diff --git a/src/services/images/images.hooks.js b/src/services/images/images.hooks.js
@@ -1,19 +1,24 @@
+import { loadYamlFile } from '../../util/yaml'
+import { redactResponse, redactResponseDataItem, webAppExploreRedactionCondition } from '../../hooks/redaction'
+
 // const { authenticate } = require('@feathersjs/authentication').hooks;
 const {
-  utils, validate, validateEach, queryWithCommonParams, displayQueryParams, REGEX_UID,
-} = require('../../hooks/params');
-const {
-  qToSolrFilter, filtersToSolrQuery,
-} = require('../../hooks/search');
+  utils,
+  validate,
+  validateEach,
+  queryWithCommonParams,
+  displayQueryParams,
+  REGEX_UID,
+} = require('../../hooks/params')
+const { qToSolrFilter, filtersToSolrQuery } = require('../../hooks/search')
 
-const {
-  resolveFacets,
-  resolveQueryComponents,
-} = require('../../hooks/search-info');
+const { resolveFacets, resolveQueryComponents } = require('../../hooks/search-info')
 
-const { eachFilterValidator } = require('../search/search.validators');
+const { eachFilterValidator } = require('../search/search.validators')
 
-module.exports = {
+export const imageRedactionPolicyWebApp = loadYamlFile(`${__dirname}/resources/imageRedactionPolicyWebApp.yml`)
+
+export default {
   before: {
     all: [
       // authenticate('jwt')
@@ -92,8 +97,9 @@ module.exports = {
       resolveFacets(),
       displayQueryParams(['queryComponents', 'filters']),
       resolveQueryComponents(),
+      redactResponseDataItem(imageRedactionPolicyWebApp, webAppExploreRedactionCondition),
     ],
-    get: [],
+    get: [redactResponse(imageRedactionPolicyWebApp, webAppExploreRedactionCondition)],
     create: [],
     update: [],
     patch: [],
@@ -109,4 +115,4 @@ module.exports = {
     patch: [],
     remove: [],
   },
-};
+}
diff --git a/src/services/images/images.service.js b/src/services/images/images.service.js
@@ -1,16 +1,19 @@
 // Initializes the `images` service on path `/images`
-const createService = require('./images.class.js');
-const hooks = require('./images.hooks');
+import hooks from './images.hooks'
+const createService = require('./images.class.js')
 
 module.exports = function (app) {
   // Initialize our service with any options it requires
-  app.use('/images', createService({
-    app,
-    name: 'images',
-  }));
+  app.use(
+    '/images',
+    createService({
+      app,
+      name: 'images',
+    })
+  )
 
   // Get our initialized service so that we can register hooks
-  const service = app.service('images');
+  const service = app.service('images')
 
-  service.hooks(hooks);
-};
+  service.hooks(hooks)
+}
diff --git a/src/services/images/resources/imageRedactionPolicyWebApp.yml b/src/services/images/resources/imageRedactionPolicyWebApp.yml
@@ -0,0 +1,17 @@
+# yaml-language-server: $schema=../../../schema/common/redactionPolicy.json
+name: image-redaction-policy
+items:
+  - jsonPath: $.title
+    valueConverterName: redact
+  - jsonPath: $.article.[*].title
+    valueConverterName: redact
+  - jsonPath: $.article.[*].excerpt
+    valueConverterName: redact
+  - jsonPath: $.article.[*].content
+    valueConverterName: redact
+  - jsonPath: $.regions.[*].iiifFragment
+    valueConverterName: contextNotAllowedImage
+  - jsonPath: $.pages.[*].iiifThumbnail
+    valueConverterName: contextNotAllowedImage
+  - jsonPath: $.pages.[*].iiif
+    valueConverterName: contextNotAllowedImage
diff --git a/src/services/search-exporter/search-exporter.class.js b/src/services/search-exporter/search-exporter.class.js
@@ -30,7 +30,7 @@ class Service {
 
     return client
       .run({
-        task: task,
+        task,
         args: [
           // user id
           params.user.id,