record restriction grace period: add tombstone page

* closes inveniosoftware/product-rdm#178

invenio_app_rdm/config.py

@@ -684,6 +684,12 @@ def files_rest_permission_factory(obj, action):
 APP_RDM_DEPOSIT_FORM_TEMPLATE = "invenio_app_rdm/records/deposit.html"
 """Deposit page's form template."""
 
+RECORDS_RESTRICTION_GRACE_PERIOD = timedelta(days=30)
+"""Grace period for changing record access to restricted."""
+
+ALLOW_RECORD_RESTRICTION_AFTER_GRACE_PERIOD = False
+"""Whether record access restriction is allowed after the grace period or not."""
+
 APP_RDM_USER_DASHBOARD_ROUTES = {
     "uploads": "/me/uploads",
     "communities": "/me/communities",

invenio_app_rdm/records_ui/templates/semantic-ui/invenio_app_rdm/records/deposit.html

@@ -41,6 +41,15 @@
            value='{{ files | tojson }}'>
   {%- endif %}
 
+  {%- if config %}
+    <input type="hidden" name="deposits-groups-enabled"
+           value='{{ config.USERS_RESOURCES_GROUPS_ENABLED | tojson }}'>
+    <input type="hidden" name="deposits-record-restriction-grace-period"
+           value='{{ config.RECORDS_RESTRICTION_GRACE_PERIOD.days | tojson }}'>
+    <input type="hidden" name="deposits-allow-record-restriction"
+           value='{{ config.ALLOW_RECORD_RESTRICTION_AFTER_GRACE_PERIOD | tojson }}'>
+  {%- endif %}
+
   {%- if forms_config %}
     <input type="hidden" name="deposits-config"
            value='{{ forms_config | tojson }}'>

invenio_app_rdm/records_ui/templates/semantic-ui/invenio_app_rdm/records/restricted_tombstone.html

@@ -0,0 +1,38 @@
+{#
+  Copyright (C) 2024 CERN.
+
+  Invenio App RDM is free software; you can redistribute it and/or modify it
+  under the terms of the MIT License; see LICENSE file for more details.
+#}
+{% extends config.THEME_ERROR_TEMPLATE %}
+
+{%- block message %}
+<div class="container centered rel-pt-2">
+  <h1 class="ui header inline-block">
+    <i class="icon lightning" aria-hidden="true"></i>
+    <div class="content">
+      {{_('Permission required')}}
+    </div>
+  </h1>
+  <p>
+    {{_('The record was previously accessible to the public but is now restricted to users with access.')}}
+    <br/>
+    {{_('The Digital Object Identifier (DOI) associated with this record remains active for reference.')}}
+  </p>
+
+  <div class="ui message compact text-align-left">
+    <div class="content">
+      {%- if citation_text %}
+        <p>
+          <strong>{{ _("Citation:") }}</strong> {{ citation_text }}
+        </p>
+      {%- endif %}
+      {%- if record.pids.doi %}
+        <p>
+          <strong>{{ _("Identifier:") }}</strong> {{ record.pids.doi.identifier }}
+        </p>
+      {%- endif %}
+    </div>
+  </div>
+</div>
+{% endblock message %}

invenio_app_rdm/records_ui/views/records.py

@@ -22,13 +22,19 @@
 from invenio_communities.errors import CommunityDeletedError
 from invenio_communities.proxies import current_communities
 from invenio_communities.views.communities import render_community_theme_template
+from invenio_i18n.proxies import current_i18n
 from invenio_previewer.extensions import default as default_previewer
 from invenio_previewer.proxies import current_previewer
 from invenio_rdm_records.proxies import current_rdm_records
 from invenio_rdm_records.records.systemfields.access.access_settings import (
     AccessSettings,
 )
 from invenio_rdm_records.resources.serializers import UIJSONSerializer
+from invenio_rdm_records.resources.serializers.csl import (
+    CSLJSONSerializer,
+    get_citation_string,
+    get_style_location,
+)
 from invenio_stats.proxies import current_stats
 from invenio_users_resources.proxies import current_user_resources
 from marshmallow import ValidationError
@@ -412,8 +418,36 @@ def record_tombstone_error(error):
 
 
 def record_permission_denied_error(error):
-    """Handle permission denier error on record views."""
+    """Handle permission denied error on record views."""
     if not current_user.is_authenticated:
         # trigger the flask-login unauthorized handler
         return current_app.login_manager.unauthorized()
+
+    record = getattr(error, "record", None)
+
+    if (
+        record
+        and record.get("access", {}).get("record", None) == "restricted"
+        and "doi" in record.get("pids", {})
+    ):
+        default_citation_style = current_app.config.get(
+            "RDM_CITATION_STYLES_DEFAULT", "apa"
+        )
+
+        citation = get_citation_string(
+            CSLJSONSerializer().dump_obj(record),
+            record.pid.pid_value,
+            get_style_location(default_citation_style),
+            locale=current_i18n.language,
+        )
+
+        return (
+            render_template(
+                "invenio_app_rdm/records/restricted_tombstone.html",
+                record=record,
+                citation_text=citation,
+            ),
+            403,
+        )
+
     return render_template(current_app.config["THEME_403_TEMPLATE"]), 403

invenio_app_rdm/theme/assets/semantic-ui/js/invenio_app_rdm/deposit/RDMDepositForm.js

@@ -97,8 +97,15 @@ export class RDMDepositForm extends Component {
   sidebarRef = createRef();
 
   render() {
-    const { record, files, permissions, preselectedCommunity, filesLocked } =
-      this.props;
+    const {
+      record,
+      files,
+      permissions,
+      preselectedCommunity,
+      filesLocked,
+      recordRestrictionGracePeriod,
+      allowRecordRestriction,
+    } = this.props;
     const customFieldsUI = this.config.custom_fields.ui;
     return (
       <DepositFormApp
@@ -624,9 +631,12 @@ export class RDMDepositForm extends Component {
                   >
                     <AccessRightField
                       label={i18next.t("Visibility")}
+                      record={record}
                       labelIcon="shield"
                       fieldPath="access"
                       showMetadataAccess={permissions?.can_manage_record_access}
+                      recordRestrictionGracePeriod={recordRestrictionGracePeriod}
+                      allowRecordRestriction={allowRecordRestriction}
                     />
                   </Overridable>
                   {permissions?.can_delete_draft && (
@@ -653,6 +663,8 @@ export class RDMDepositForm extends Component {
 
 RDMDepositForm.propTypes = {
   config: PropTypes.object.isRequired,
+  recordRestrictionGracePeriod: PropTypes.object.isRequired,
+  allowRecordRestriction: PropTypes.bool.isRequired,
   record: PropTypes.object.isRequired,
   preselectedCommunity: PropTypes.object,
   files: PropTypes.object,

invenio_app_rdm/theme/assets/semantic-ui/js/invenio_app_rdm/deposit/index.js

@@ -22,6 +22,10 @@ ReactDOM.render(
       config={getInputFromDOM("deposits-config")}
       permissions={getInputFromDOM("deposits-record-permissions")}
       filesLocked={getInputFromDOM("deposits-record-locked-files")}
+      recordRestrictionGracePeriod={getInputFromDOM(
+        "deposits-record-restriction-grace-period"
+      )}
+      allowRecordRestriction={getInputFromDOM("deposits-allow-record-restriction")}
     />
   </OverridableContext.Provider>,
   document.getElementById("deposit-form")

invenio_app_rdm/theme/assets/semantic-ui/js/invenio_app_rdm/landing_page/ShareOptions/ShareModal.js

@@ -158,7 +158,7 @@ export class ShareModal extends Component {
         ),
       },
       {
-        menuItem: { icon: "cog", content: i18next.t("Access requests") },
+        menuItem: { icon: "cog", content: i18next.t("Settings") },
         render: () => (
           <Tab.Pane key="accessRequests" as={Container}>
             <AccessRequestsTab

invenio_app_rdm/theme/assets/semantic-ui/less/invenio_app_rdm/theme/elements/icon.overrides

@@ -28,3 +28,7 @@
     z-index: 1;
   }
 }
+
+.right-floated {
+  float: right;
+}