Passing model into the BatchCreateJob

Then pulling it out again.

app/controllers/concerns/sufia/batch_uploads_controller_behavior.rb

@@ -8,14 +8,19 @@ module BatchUploadsControllerBehavior
       self.work_form_service = BatchUploadFormService
       self.curation_concern_type = work_form_service.form_class.model_class # includes CanCan side-effects
       # We use BatchUploadItem as a null stand-in curation_concern_type.
-      # The actual permission is checked dynamically via `authorize!` during #create.
+      # The actual permission is checked dynamically during #create.
     end
 
     # The permissions to create a batch are not as important as the permissions for the concern being batched.
+    # @note we don't call `authorize!` directly, since `authorized_models` already checks `user.can? :create, ...`
     def create
       authenticate_user!
-      authorize! :create, params[:batch_upload_item][:payload_concern].constantize
-      create_update_job
+      unsafe_pc = params[:batch_upload_item][:payload_concern]
+      # Calling constantize on user params is disfavored (per brakeman), so we sanitize by matching it against an authorized model.
+      safe_pc = Sufia::SelectTypeListPresenter.new(current_user).authorized_models.map(&:to_s).find { |x| x == unsafe_pc }
+      raise CanCan::AccessDenied, "Cannot create an object of class '#{unsafe_pc}'" unless safe_pc
+      authorize! :create, safe_pc
+      create_update_job(safe_pc.constantize)
       flash[:notice] = t('sufia.works.new.after_create_html', application_name: view_context.application_name)
       redirect_after_update
     end
@@ -42,15 +47,16 @@ def redirect_after_update
         end
       end
 
-      def create_update_job
+      # @param [Class] klass the Sufia Work Class being created by the batch
+      def create_update_job(klass)
         log = BatchCreateOperation.create!(user: current_user,
                                            operation_type: "Batch Create")
         # ActionController::Parameters are not serializable, so cast to a hash
         BatchCreateJob.perform_later(current_user,
                                      params[:title].permit!.to_h,
                                      params[:resource_type].permit!.to_h,
                                      params[:uploaded_files],
-                                     attributes_for_actor.to_h,
+                                     attributes_for_actor.to_h.merge!(model: klass),
                                      log)
       end
 

app/jobs/batch_create_job.rb

@@ -16,10 +16,8 @@ class BatchCreateJob < ActiveJob::Base
   # @param [BatchCreateOperation] log
   def perform(user, titles, resource_types, uploaded_files, attributes, log)
     log.performing!
-
     titles ||= {}
     resource_types ||= {}
-
     create(user, titles, resource_types, uploaded_files, attributes, log)
   end
 
@@ -32,18 +30,12 @@ def create(user, titles, resource_types, uploaded_files, attributes, log)
         attributes = attributes.merge(uploaded_files: [upload_id],
                                       title: title,
                                       resource_type: resource_type)
-        model = model_to_create(attributes)
+        model = attributes.delete(:model)
+        raise ArgumentError, "attributes must include :model" unless model
         child_log = CurationConcerns::Operation.create!(user: user,
                                                         operation_type: "Create Work",
                                                         parent: log)
         CreateWorkJob.perform_later(user, model, attributes, child_log)
       end
     end
-
-    # Override this method if you have a different rubric for choosing the model
-    # @param [Hash] attributes
-    # @return String the model to create
-    def model_to_create(attributes)
-      Sufia.config.model_to_create.call(attributes)
-    end
 end