NYULibraries/ichabod — pull request #35 by barnabyalter (2014-08-06 19:37:26+00:00)
Title: Feature/rethinking permissions

@NYULibraries/hydra This is a branch off @ekate's branch which she's been working on for editing permissions. She put a lot of work into this that made me finally realize that maybe I had been thinking about the way we were trying to manage the permissions in Ichabod. I had previously told @eshadatta to use CanCan in a way that actually bypasses the default Hydra permissions, this is obviously far from ideal. Thanks to @ekate for pointing this out.

Unfortunately there is a lot of whitespace changes and VHS re-recordings so this PR became a little unreadable but I am almost done writing the wiki page which points out the few key files. In summary:

1- We include the Hydra permissions mixins in Nyucore model
2- We set an edit_group based on which collection we're loading in. @ekate put this in the DataLoader which I think is fine. This is a good candidate for a mapper from collection to group which we can set in an after_create callback, but I think that's a task for iteration.
3- We include the test users in the various role mapper files. This is fine for testing but in iteration we probably want to map users to their appropriate groups based on Grouper or whatever. I believe there is an existing user story for that.
4- We can remove the `custom_permissions` in the ability.rb but override Hydra's default `create_permissions` to allow our admin users (still just test users) to create records native in the system. This is the preferred way to do it in Hydra.
5- Finally we add the authorize statements to the NyucoreController and update the nyucore_controller_spec and ability_spec to make sure that the permissions all match up with the tasks.

For full details on this implementation see the wiki page on [Access Controls](https://github.com/NYULibraries/ichabod/wiki/Access-Controls).