i152 - Collection links would lead user to unauthorize page

app/controllers/concerns/hyrax/works_controller_behavior.rb

@@ -152,7 +152,7 @@ def inspect_work
     def manifest
       headers['Access-Control-Allow-Origin'] = '*'
 
-      json = iiif_manifest_builder.manifest_for(presenter: iiif_manifest_presenter)
+      json = iiif_manifest_builder.manifest_for(presenter: iiif_manifest_presenter, current_ability: current_ability)
 
       respond_to do |wants|
         wants.json { render json: json }

app/services/hyrax/manifest_builder_service_decorator.rb

@@ -4,6 +4,17 @@
 # will allow metadata to be seen in the UV side panel
 module Hyrax
   module ManifestBuilderServiceDecorator
+    ##
+    # @api public
+    #
+    # @param presenter [Hyrax::WorkShowPresenter]
+    #
+    # @return [Hash] a Ruby hash representation of a IIIF manifest document
+    def manifest_for(presenter:, current_ability:)
+      @current_ability = current_ability
+      sanitized_manifest(presenter: presenter)
+    end
+
     private
 
       # OVERRIDE Hyrax 2.9.6 to make customizations to the manifest that
@@ -74,11 +85,9 @@ def cast_to_value(image:, field_name:, options:)
         end
       end
 
-      def make_collection_link(collection_ids, collection_titles)
-        collection_ids_and_titles_map = {}
-        collection_ids.each_with_index.map { |id, i| collection_ids_and_titles_map[id] = collection_titles[i] }
-        collection_ids_and_titles_map.map do |id, title|
-          "<a href='/collections/#{id}'>#{title}</a>"
+      def make_collection_link(collection_documents)
+        collection_documents.map do |collection|
+          "<a href='/collections/#{collection.slug}'>#{collection.title.first}</a>"
         end
       end
 
@@ -123,9 +132,11 @@ def get_canvas_metadata(metadata_fields, image)
           label = Hyrax::Renderers::AttributeRenderer.new(field_name, nil).label
           if field_name == :collection
             next unless image[:member_of_collection_ids_ssim]&.present?
+            viewable_collections = Hyrax::CollectionMemberService.run(image, @current_ability)
+            next if viewable_collections.blank?
             {
               label: label,
-              value: make_collection_link(image[:member_of_collection_ids_ssim], image[:member_of_collections_ssim])
+              value: make_collection_link(viewable_collections)
             }
           else
             next if image.try(field_name)&.first.blank?