search

cwrc / cwrc_dtoc_edition

CWRC Digital Table Of Context Edition
0 stars 0 forks source link

add xacml handling for source documents #16

Open ilovan opened 4 years ago

ilovan commented 4 years ago

Expected Behaviour

If a user who does not have viewing permissions for one of the source documents included in the corpus, they should not be able to view the current DToC object

Current Behaviour

viewing the DToC object does not take into account the viewing permissions of the source documents

Objects for testing

  1. https://dev-01.cwrc.ca/islandora/object/cwrc%3A186 (visible to CWRC Admins only) with https://dev-01.cwrc.ca/islandora/object/cwrc%3A238#
  2. https://dev-01.cwrc.ca/islandora/object/cwrc%3A435 (visible to CWRC authenticated users) with https://dev-01.cwrc.ca/islandora/object/cwrc%3A436
  3. https://dev-01.cwrc.ca/islandora/object/islandora%3A3d0994b6-a20e-43bc-ac8e-ebb0f0c8a395 (visible to CWRC authenticated users) and https://dev-01.cwrc.ca/islandora/object/islandora%3Ad661e8c3-452f-4a85-ac43-822a2b6a036a (visible to everyone) , corpus at https://dev-01.cwrc.ca/islandora/object/cwrc%3A80#
ilovan commented 4 years ago

(2) https://dev-01.cwrc.ca/islandora/object/cwrc%3A436 should be visible for CWRCTestEditor, who is an authenticated user (#) same https://dev-01.cwrc.ca/islandora/object/cwrc%3A80#

I suspect it's a caching problem.

To reproduce:

  1. Go to Chrome Incognito
  2. Go to https://dev-01.cwrc.ca/islandora/object/cwrc%3A238# (Accesss denied message, which is expected)
  3. Log in as CWRCTestEditor (pwd sent over slack)
  4. Go to https://dev-01.cwrc.ca/islandora/object/cwrc%3A238# (Accesss denied message, which is expected)
  5. Go to https://dev-01.cwrc.ca/islandora/object/cwrc%3A436 (Access deniedmessage, which should not happen)
  6. Go to https://dev-01.cwrc.ca/islandora/object/cwrc%3A80# (Access denied message, which should also not happen)