Merge pull request #1155 from projecthydra/depositor-authority-1_7

prevents child relationship when parent is owned by a different depositor

app/actors/curation_concerns/actors/add_to_work_actor.rb

@@ -22,13 +22,17 @@ def add_to_works(new_work_ids)
             work.save
           end
 
-          # add to new
+          # add to new so long as the depositor for the parent and child matches, otherwise inject an error
           (new_work_ids - curation_concern.in_works_ids).each do |work_id|
             work = ::ActiveFedora::Base.find(work_id)
-            work.ordered_members << curation_concern
-            work.save
+            if work.depositor != curation_concern.depositor
+              curation_concern.errors[:in_works_ids] << "Works can only be related to each other if they were deposited by the same user."
+            else
+              work.ordered_members << curation_concern
+              work.save
+            end
           end
-          true
+          curation_concern.errors[:in_works_ids].empty?
         end
     end
   end

app/views/curation_concerns/base/_form.html.erb

@@ -4,6 +4,7 @@
     <div class="alert alert-danger fade in">
       <strong>Wait don't go!</strong> There was a problem with your submission. Please review the errors below:
       <a class="close" data-dismiss="alert" href="#">&times;</a>
+      <%= render 'form_in_works_error', f: f %>
     </div>
   <% end %>
 

app/views/curation_concerns/base/_form_in_works_error.html.erb

@@ -0,0 +1,3 @@
+<% unless f.object.model.errors[:in_works_ids].empty? %>
+  <%= f.full_error(:in_works_ids) %>
+<% end %>

spec/actors/curation_concerns/work_actor_spec.rb

@@ -88,9 +88,15 @@
           )
         end
         it "attaches the parent" do
+          allow(curation_concern).to receive(:depositor).and_return(parent.depositor)
           expect(subject.create(attributes)).to be true
           expect(curation_concern.in_works).to eq [parent]
         end
+        it "does not attach the parent" do
+          allow(curation_concern).to receive(:depositor).and_return("blahblahblah")
+          expect(subject.create(attributes)).to be false
+          expect(curation_concern.in_works).to eq []
+        end
       end
 
       context 'with a file' do
@@ -204,6 +210,7 @@
         old_parent.save!
       end
       it "attaches the parent" do
+        allow(curation_concern).to receive(:depositor).and_return(parent.depositor)
         expect(subject.update(attributes)).to be true
         expect(curation_concern.in_works).to eq [parent]
 
@@ -224,6 +231,7 @@
         old_parent.save!
       end
       it "removes the old parent" do
+        allow(curation_concern).to receive(:depositor).and_return(old_parent.depositor)
         expect(subject.update(attributes)).to be true
         expect(curation_concern.in_works).to eq []
         expect(old_parent.reload.members).to eq []

spec/features/create_child_work_spec.rb

@@ -64,5 +64,19 @@
 
       expect(curation_concern.reload.in_works_ids.length).to eq 2
     end
+
+    context "with a parent that doesn't belong to this user" do
+      let(:new_user) { create(:user) }
+      let(:new_parent) { create(:generic_work, user: new_user) }
+      it "fails to update" do
+        visit "/concern/parent/#{parent.id}/generic_works/#{curation_concern.id}/edit"
+        first("input#generic_work_in_works_ids", visible: false).set new_parent.id
+        first("input#parent_id", visible: false).set new_parent.id
+        click_on "Update Generic work"
+
+        expect(new_parent.reload.ordered_members.to_a.length).to eq 0
+        expect(page).to have_content "Works can only be related to each other if they were deposited by the same user."
+      end
+    end
   end
 end