Add Bulkrax::Ability concern and enforce importer/exporter ownership#1186
Open
orangewolf wants to merge 6 commits into
Open
Add Bulkrax::Ability concern and enforce importer/exporter ownership#1186orangewolf wants to merge 6 commits into
orangewolf wants to merge 6 commits into
Conversation
Introduces a shared Bulkrax::Ability concern so all Bulkrax authorization methods live in one place, and adds per-record ownership enforcement so users can only access importers/exporters they own (or admin all records via new can_admin_importers?/can_admin_exporters? methods). - Add app/models/concerns/bulkrax/ability.rb with default implementations of can_import_works?, can_export_works?, can_admin_importers?, and can_admin_exporters? (all safe/conservative defaults) - Add accessible_importers, accessible_exporters, and item_accessible? helpers to ApplicationController; admin users see all records, others see only their own - Scope importer_table, set_importer, continue, upload_corrected_entries, upload_corrected_entries_file, and export_errors to accessible_importers; API requests bypass the ownership scope to preserve existing API behavior - Scope exporter_table, set_exporter, and download to accessible_exporters - Check item_accessible? in entries_controller update/destroy and when loading parent importer/exporter in show actions - Guard edit/delete action links in datatables_behavior so they only appear for owners and admins; scope recordsTotal/recordsFiltered counts to accessible records - Update install_generator to include Bulkrax::Ability instead of injecting raw method definitions; add commented override examples - Update test app Ability to include Bulkrax::Ability - Add spec/models/concerns/bulkrax/ability_spec.rb for new concern - Add ownership enforcement specs to importers and exporters controller specs (non-owner denied, owner allowed, admin allowed) - Fix export_errors and datatables specs to account for ownership scoping Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
orangewolf
added
major-ver
orangewolf
marked this pull request as ready for review
April 28, 2026 16:00
laritakr
approved these changes
Apr 29, 2026
laritakr
left a comment
laritakr
left a comment
Contributor
There was a problem hiding this comment.
Looks great. I saw a few places referring to the API token work... would be ideal to update to reference an actual ticket.
| # NOTE: We're paginating this in the browser. | ||
| if api_request? | ||
| # TODO: Scope API index by token owner once token-to-user wiring is in | ||
| # place. Tracked in [ISSUE]. Until then, API clients see all importers |
Contributor
There was a problem hiding this comment.
Do we have an actual issue to link here for tracking?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Introduces a shared Bulkrax::Ability concern so all Bulkrax authorization methods live in one place, and adds per-record ownership enforcement so users can only access importers/exporters they own (or admin all records via new can_admin_importers?/can_admin_exporters? methods).