Feature/edit metadata authorization

I assume that pds_handle contain user group name(s) and thus we don't need to add roles. To reflect this I added customized method "groups" to user model. If the assumption is incorrect I will fix it and edit roles file.

So just to summarize, we decide to setup permissions the following way:
1. for all objects - read and discovery to public (that will be done in
nyucore controller, in post-creation block)
2. for sdr objects - edit by gis_cataloger (in data loader)
3. for FDA objects - edit by FDA cataloger (in data loader)
4. for all objects - delete only by admin ( now it is controlled in
ability.rb, I suggest we add some people to admin group in roles map)

Is it correct ?

Kate


On Fri, Jun 20, 2014 at 12:53 PM, barnabyalter <notifications@github.com>
wrote:

> In app/controllers/nyucores_controller.rb:
>
> > @@ -29,6 +29,7 @@ def edit
> >
> >    def create
> >      @item = Nyucore.new(item_params)
> > +    @item.set_edit_groups(['public'],[])
> >
> >      flash[:notice] = 'Item was successfully created.' if @item.save
> >      respond_with(@item)
>
> @ekate <https://github.com/ekate> Also setting these groups will allow
> permissions but then you need to make the controller authorize the actions.
> There are some commented out lines in there already that will helper with
> this and a brief review of the cancan page:
> https://github.com/ryanb/cancan/wiki/authorizing-controller-actions
>
> And then there are those lines in the catalog_controller which setup gated
> access and make setting read_groups on objects actually work correctly:
> https://github.com/projecthydra/hydra-head/wiki/Lesson%3A-gated-discovery---filter-search-results-based-on-permissions
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/NYULibraries/ichabod/pull/30/files#r14029584>.
>



-- 
Ekaterina Pechekhonova
Digital Library Programmer/Analyst
New York University
Libraries
email: ekate@nyu.edu
phone: 212-992-9993