{"action":"created","issue":{"url":"https://api.github.com/repos/samvera/hyrax/issues/3272","repository_url":"https://api.github.com/repos/samvera/hyrax","labels_url":"https://api.github.com/repos/samvera/hyrax/issues/3272/labels{/name}","comments_url":"https://api.github.com/repos/samvera/hyrax/issues/3272/comments","events_url":"https://api.github.com/repos/samvera/hyrax/issues/3272/events","html_url":"https://github.com/samvera/hyrax/pull/3272","id":360021215,"node_id":"MDExOlB1bGxSZXF1ZXN0MjE1MzgwMjU3","number":3272,"title":"[WIP] Lock unauthorized permissions from update","user":{"login":"laritakr","id":17851674,"node_id":"MDQ6VXNlcjE3ODUxNjc0","avatar_url":"https://avatars3.githubusercontent.com/u/17851674?v=4","gravatar_id":"","url":"https://api.github.com/users/laritakr","html_url":"https://github.com/laritakr","followers_url":"https://api.github.com/users/laritakr/followers","following_url":"https://api.github.com/users/laritakr/following{/other_user}","gists_url":"https://api.github.com/users/laritakr/gists{/gist_id}","starred_url":"https://api.github.com/users/laritakr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/laritakr/subscriptions","organizations_url":"https://api.github.com/users/laritakr/orgs","repos_url":"https://api.github.com/users/laritakr/repos","events_url":"https://api.github.com/users/laritakr/events{/privacy}","received_events_url":"https://api.github.com/users/laritakr/received_events","type":"User","site_admin":false},"labels":[{"id":503705298,"node_id":"MDU6TGFiZWw1MDM3MDUyOTg=","url":"https://api.github.com/repos/samvera/hyrax/labels/in%20progress","name":"in progress","color":"ededed","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-09-13T18:51:40Z","updated_at":"2018-09-14T20:16:47Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/samvera/hyrax/pulls/3272","html_url":"https://github.com/samvera/hyrax/pull/3272","diff_url":"https://github.com/samvera/hyrax/pull/3272.diff","patch_url":"https://github.com/samvera/hyrax/pull/3272.patch"},"body":"Fixes https://github.com/samvera/hyrax/issues/3166\r\n\r\n## Details:\r\n\r\n- user is permitted to update any work permissions coming from collections they manage\r\n- user is permitted to update work permissions which are non-manager permissions from any collections work belongs to\r\n- user is permitted to update work permissions which are not related to its collections\r\n\r\nProcess used:\r\n- find all of the work's collections a user can manage\r\n- find all of the work's collections a user cannot manage\r\n- find all of the other managers of collections a user can manage\r\n- find all of the other managers of collections a user cannot manage who are not also managers in collections that the user CAN manage.\r\n\r\nThis gives us the permissions the user is not authorized to update. \r\n\r\nPermission logic was moved into a new shared partial `currently_shared.html.erb` which embeds all of the above logic and uses it to display all of the work or file set's permissions in either a fixed or editable format.\r\n\r\nThe new shared partial results in a slight reformat of the display of these permissions, as there were previously minor differences between the two displays.\r\n\r\n### Work Permissions View\r\n![screen shot 2018-09-13 at 2 45 02 pm](https://user-images.githubusercontent.com/17851674/45509016-5ece6f80-b764-11e8-9790-4b57e631b67f.png)\r\n\r\n### File Set Permissions View\r\n![screen shot 2018-09-13 at 2 44 53 pm](https://user-images.githubusercontent.com/17851674/45509022-6130c980-b764-11e8-9676-7a065dd9ca84.png)\r\n\r\n@samvera/hyrax-code-reviewers\r\n"},"comment":{"url":"https://api.github.com/repos/samvera/hyrax/issues/comments/421472772","html_url":"https://github.com/samvera/hyrax/pull/3272#issuecomment-421472772","issue_url":"https://api.github.com/repos/samvera/hyrax/issues/3272","id":421472772,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMTQ3Mjc3Mg==","user":{"login":"laritakr","id":17851674,"node_id":"MDQ6VXNlcjE3ODUxNjc0","avatar_url":"https://avatars3.githubusercontent.com/u/17851674?v=4","gravatar_id":"","url":"https://api.github.com/users/laritakr","html_url":"https://github.com/laritakr","followers_url":"https://api.github.com/users/laritakr/followers","following_url":"https://api.github.com/users/laritakr/following{/other_user}","gists_url":"https://api.github.com/users/laritakr/gists{/gist_id}","starred_url":"https://api.github.com/users/laritakr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/laritakr/subscriptions","organizations_url":"https://api.github.com/users/laritakr/orgs","repos_url":"https://api.github.com/users/laritakr/repos","events_url":"https://api.github.com/users/laritakr/events{/privacy}","received_events_url":"https://api.github.com/users/laritakr/received_events","type":"User","site_admin":false},"created_at":"2018-09-14T20:16:47Z","updated_at":"2018-09-14T20:16:47Z","author_association":"CONTRIBUTOR","body":"Note: the spec failures are (at least mostly) due to needing access_grants to exist for the feature specs to pass. No spec changes were made yet... I was waiting to clarify the desired changes were in place before trying to write specs for them. \r\n\r\nMy intention was to move the code out of the view to isolate the testing, once the desired behavior is achieved. I'm not sure yet if we are at this point, but I believe so."}}
{"actor":{"display_login":"laritakr"}}