Files for work under review can be downloaded by public via direct link

[rjkati]

Descriptive summary

In hyrax 4.0.0.beta2, I can download files for works under review if I am logged out and have a direct link to the file.

Expected behavior

Files for works under review should only be downloaded by users with appropriate permissions

Actual behavior

Logged out users can access files for a work under review if they have a direct link to the file

Steps to reproduce the behavior

While logged out, attempt to access:

• Work: https://nurax-dev.curationexperts.com/concern/generic_works/k643b1453?locale=en
• Fileset for work under review: https://nurax-dev.curationexperts.com/concern/parent/k643b1453/file_sets/xs55mc34x

Both of the links above should not allow access

Next, download the file for the example work: https://nurax-dev.curationexperts.com/downloads/xs55mc34x?locale=en

[gamontoya]

@dlpierce The first two bulleted cases work as expected. However, when I try to download the file from https://nurax-dev.curationexperts.com/downloads/xs55mc34x?locale=en I get the following error:

[dlpierce]

That is caused by nurax missing the file app/assets/images/unauthorized.png and should not affect freshly generated hyrax applications.