{"action":"created","issue":{"url":"https://api.github.com/repos/Islandora/islandora_scholar/issues/232","repository_url":"https://api.github.com/repos/Islandora/islandora_scholar","labels_url":"https://api.github.com/repos/Islandora/islandora_scholar/issues/232/labels{/name}","comments_url":"https://api.github.com/repos/Islandora/islandora_scholar/issues/232/comments","events_url":"https://api.github.com/repos/Islandora/islandora_scholar/issues/232/events","html_url":"https://github.com/Islandora/islandora_scholar/pull/232","id":149873913,"number":232,"title":"embargo roles whitelist","user":{"login":"qadan","id":3406327,"avatar_url":"https://avatars.githubusercontent.com/u/3406327?v=3","gravatar_id":"","url":"https://api.github.com/users/qadan","html_url":"https://github.com/qadan","followers_url":"https://api.github.com/users/qadan/followers","following_url":"https://api.github.com/users/qadan/following{/other_user}","gists_url":"https://api.github.com/users/qadan/gists{/gist_id}","starred_url":"https://api.github.com/users/qadan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/qadan/subscriptions","organizations_url":"https://api.github.com/users/qadan/orgs","repos_url":"https://api.github.com/users/qadan/repos","events_url":"https://api.github.com/users/qadan/events{/privacy}","received_events_url":"https://api.github.com/users/qadan/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":15,"created_at":"2016-04-20T20:16:47Z","updated_at":"2016-05-24T14:29:37Z","closed_at":"2016-05-24T13:16:36Z","pull_request":{"url":"https://api.github.com/repos/Islandora/islandora_scholar/pulls/232","html_url":"https://github.com/Islandora/islandora_scholar/pull/232","diff_url":"https://github.com/Islandora/islandora_scholar/pull/232.diff","patch_url":"https://github.com/Islandora/islandora_scholar/pull/232.patch"},"body":"**JIRA Ticket**: https://jira.duraspace.org/browse/ISLANDORA-1602\r\n\r\n* Other Relevant Links: https://github.com/Islandora/islandora_scholar/pull/220 (the original pull request for this issue)\r\n\r\n# What does this Pull Request do?\r\n\r\nAllows a roles whitelist to be configured and applied to embargoes.\r\n\r\n# What's new?\r\n\r\nThree things:\r\n* A configurable whitelist has been added to establish trusted roles with the 'can embargo any' permission that are added to embargoes when they are set via `islandora_scholar_embargo_set_embargo()`.\r\n* A batch has been added to reapply existing embargoes. It can be triggered via the configurable whitelist form, if desired.\r\n* A drush command has been added, `islandora_scholar_embargo_reapply_embargoes`, which also triggers the batch re-application.\r\n\r\n# How should this be tested?\r\n\r\n* The whitelist form should be tested to make sure the variables it sets take the form of an associative array pairing role IDs with role names.\r\n* The batch should be tested to ensure embargoes on objects and datastreams are applied properly\r\n* The drush command should also be tested to ensure it functions as expected.\r\n\r\nAs this has XACML security implications, we should be ensuring that when an embargo is created, a POLICY is applied that *only* contains the roles in the whitelist. POLICYs for entire objects should have viewing _and_ management permissions for whitelisted roles.\r\n\r\n# Additional Notes:\r\nCare has been taken to structure the descriptions of things so that there's no ambiguity, since ambiguous and misleading documentation seems to be part of the source of this issue. Documentation within the module should probably be checked to make sure it's internally consistent and communicates clearly.\r\n\r\nOne of the things that is documented in this pull but bears repeating is that due to the way the Fedora-Drupal filter works, matching role IDs between sites that share the same Fedora represent a method of seeing objects that would otherwise be hidden. Whitelist roles should likely be unique and/or namespaced to mitigate this issue.\r\n\r\n# Interested parties\r\nFrom the original PR: @bryjbrown @rosiel @jordandukart "},"comment":{"url":"https://api.github.com/repos/Islandora/islandora_scholar/issues/comments/221289219","html_url":"https://github.com/Islandora/islandora_scholar/pull/232#issuecomment-221289219","issue_url":"https://api.github.com/repos/Islandora/islandora_scholar/issues/232","id":221289219,"user":{"login":"manez","id":2371345,"avatar_url":"https://avatars.githubusercontent.com/u/2371345?v=3","gravatar_id":"","url":"https://api.github.com/users/manez","html_url":"https://github.com/manez","followers_url":"https://api.github.com/users/manez/followers","following_url":"https://api.github.com/users/manez/following{/other_user}","gists_url":"https://api.github.com/users/manez/gists{/gist_id}","starred_url":"https://api.github.com/users/manez/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/manez/subscriptions","organizations_url":"https://api.github.com/users/manez/orgs","repos_url":"https://api.github.com/users/manez/repos","events_url":"https://api.github.com/users/manez/events{/privacy}","received_events_url":"https://api.github.com/users/manez/received_events","type":"User","site_admin":false},"created_at":"2016-05-24T14:29:37Z","updated_at":"2016-05-24T14:29:37Z","body":"+1 for this being within the spirit of the law, if not quite the letter. As long as we've got clear communication around what's happening (and I think we do here), I don't see the benefit in backing this one out and redoing it. \r\n\r\nWhile noting that yes, it was technically a self-commit and shouldn't have gone in this way. "}}
{"actor":{"display_login":"manez"}}