Open kstapelfeldt opened 3 years ago
Need to replicate the functionality of Islandora 7x in the Islandora 2.0 stack
This module has some inheritance features that might be valuable to review: https://www.drupal.org/project/access_by_ref
/var/www/D9-test/web/sites/default/private_files
By default, the following media are private. the below links are "Access denied" (without login):
To flip private to public,
Edit directory
button and set Enabled Users
and Enable Roles
Pro: everything configuration is in the UI, little cmd involved.
Con: The module https://www.drupal.org/project/private_files_download_permission use hook_file_download
to check permission of the file, and return a BinaryFileResponse which is a Response Object contains a SplFileInfo File object. With this factor, the loading performance maybe effected if the file is big, or a view contains many objects, or Searching functionality.
If we decide to go with this approach, the next development piece is automate the process of add directory the table above.
composer require 'drupal/flysystem:^2.0@beta'
web/sites/defaults/settings
added :$settings['flysystem'] = [
'local' => [ // The name of the stream wrapper.
'driver' => 'local', // The plugin key.
'config' => [
'root' => 'sites/default/flysystem',
'public' => TRUE,
'name' => 'islandora_lite', // Defaults to Flysystem: scheme.
'description' => 'islandora_lite', // Defaults to Flysystem: scheme.
'cache' => TRUE, // Cache filesystem metadata. Not necessary for
'replicate' => 'ftpexample', // 'replicate' writes to both filesystems, but
'serve_js' => TRUE, // Serve Javascript or CSS via this stream wrapper.
'serve_css' => TRUE, // This is useful for adapters that function as
],
],
]
In web/sites/default
, create directory call flysystem
In /admin/structure/media
, in each media type, select operation Manage field
, Select any File Field, and choose Upload Destination as "Flysystem: local" (as screenshot below). Live Demo
Then select Edit mode change File Directory
to something like audio/[random:number]
. which will enforce audio file uploaded to sites/default/flysystem/audio/[random number]/....
(Live Demo)
Usage:
To apply Private
or Public
mode to a file, according to Flysystem API at https://flysystem.thephpleague.com/v2/docs/adapter/local/, use command line to change permission:
chmod 7604 web/sites/default/flysystem/video/599725582
==> Works, with Access denied at http://d9.dsu-pp.server.utsc.utoronto.ca/sites/default/flysystem/video/599725582/test.mp4 (in Incognito Chrome), still access if logged in. chmod 0604 web/sites/default/flysystem/audio/1069098879/file_example_MP3_5MG.mp3
==> Not work, still be able to access the file direct link http://d9.dsu-pp.server.utsc.utoronto.ca/sites/default/flysystem/audio/1069098879/file_example_MP3_5MG.mp3==> To be implement: Need to organize files uploaded for media in a directory (ie. named with media ID), then set 7604
for private and 0740
for public.
Pro:
Con: No interface available, use more in command-line
Example: http://d9.dsu-pp.server.utsc.utoronto.ca/node/5/embargoes
Add embargos to the above node:
on FIles: Not work: direct link to file can be still be accessed (For Islandora lite stack, but for Islandora stack, it works). However, still need to switch over to Drupal private file system to protect the thumbnails.
on Node: Works, http://d9.dsu-pp.server.utsc.utoronto.ca/node/5 will get "Access Denied"
Drupal groups seems to provide a solution, but we need to be able to hide selected media (putting media in groups)
Found that File Entity and Group have a conflict on handling the access control for Private File system.
/admin/people/permissions
./group/{{ group ID }}/permissions
In fact, we use the File Entity module for Fits. so it usually comes to our sites by default (if the sites needs Fits). If we also use Group to handle more use cases for access control in the same sites, these two module can cause the conflict. To solve that, have to cancel Access control handler in File Entity with this manual fix (for now):
->setAccessClass('Drupal\file_entity\FileEntityAccessControlHandler')
under the function file_entity_entity_type_alter(&$entity_types)
at line 163 of file_entity.moduleSolve the issue with a patch: https://github.com/digitalutsc/override_permission_file_entity
Deployment has been built into installation process: https://github.com/digitalutsc/islandora_lite_installation/blob/main/scripts/access_control.sh
Include this in the config sync deployment
(Respecting to the File level)