feat: unify staged upload params behind an ownership-enforcing resolver#7551
Closed
orangewolf wants to merge 1 commit into
Closed
feat: unify staged upload params behind an ownership-enforcing resolver#7551orangewolf wants to merge 1 commit into
orangewolf wants to merge 1 commit into
Conversation
Introduces Hyrax::UploadedFileResolver as the single seam turning staged-upload id params into Hyrax::UploadedFile records, enforcing server side that the acting user owns every file being attached, and routes the non-ActiveFedora attach paths through it: - work updates (WorksControllerBehavior#uploaded_files) and work creates (Hyrax::Action::CreateValkyrieWork#uploaded_files) — closing a real gap: the Valkyrie transaction path attached any user's staged file ids, while the ActiveFedora actor stack has always validated ownership in CreateWithFilesActor - file set version uploads (both branches of FileSetsController#attempt_update*) - collection branding (banner_files/logo_files ids validated at the parameter edge in Dashboard::CollectionsController, covering the ActiveFedora and Valkyrie branding paths alike) Violations raise Hyrax::UploadedFileResolver::OwnershipError, logged and rescued by the new Hyrax::EnforcesStagedUploadOwnership concern (HTML: redirect back with a translated alert; JSON: 403). The version upload field is also unified: FileSetsController#update now accepts the canonical uploaded_files parameter used by the work form, keeping files_files as a deprecated alias (Deprecation.warn), one step in consolidating the four staged-file field names the upload UIs submit. The ownership check now also covers the ActiveFedora version-upload and branding parameter paths, which previously had no such check; flagged for reviewer attention since it tightens (already-anomalous) requests. Tests (koppie/Valkyrie app, dockerized Postgres/Solr/Redis, all green): spec/services/hyrax/uploaded_file_resolver_spec.rb (new), spec/controllers/hyrax/monographs_controller_spec.rb (foreign-file work update refused), spec/controllers/hyrax/file_sets_controller_spec.rb (canonical param ingests, files_files deprecation warning, foreign file refused), spec/controllers/hyrax/dashboard/collections_controller_spec.rb (branding fixtures now owned by the acting user; foreign banner refused). AF-side suite portions deferred to CI. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This was referenced Jul 17, 2026
Member
Author
|
Superseded by #7557 — same change moved to an in-repo branch (active-storage-for-all/attach-contract) and retitled. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Unifies how staged uploads (
Hyrax::UploadedFileids) travel from forms into attach code, behind a single ownership-enforcing resolver. Part of the upload-unification chain (#7547–#7550) but independent — based directly onmain.What it does
Hyrax::UploadedFileResolver— the one seam that turns staged-upload id params into records, raisingOwnershipErrorwhen a file belongs to another user. Adopted by:WorksControllerBehavior#uploaded_files) and work creates (Hyrax::Action::CreateValkyrieWork#uploaded_files)FileSetsController#attempt_update*)banner_files[]/ newlogo_files[]ids, validated at the parameter edge ofDashboard::CollectionsController, covering both backends' branding paths)CreateWithFilesActorsince forever. Now both do.Hyrax::EnforcesStagedUploadOwnershipconcern rescues violations (HTML: redirect back + translated alert, added to all 7 locales; JSON: 403).uploaded_files[](same field the work form uses); the oddballfiles_filesstill works as a deprecated alias (Deprecation.warn). This is the first step in collapsing the four field names (uploaded_files[]/files_files/banner_files[]/logo_files[]) the audit flagged — the upcoming uploader-UI PR can then emit one name.Reviewer attention
Dependencies
None (merges independently of #7547–#7550).
Tests
Run locally against the koppie (Valkyrie) test app — dockerized Postgres/Solr/Redis, all green:
spec/services/hyrax/uploaded_file_resolver_spec.rb(new): resolution, order preservation, blanks, foreign-file rejection incl. batch, logging, RecordNotFoundspec/controllers/hyrax/monographs_controller_spec.rb: work update with a foreign staged file is refused with the alertspec/controllers/hyrax/file_sets_controller_spec.rb: canonicaluploaded_files[]ingests likefiles_files;files_filesemits a deprecation warning; foreign staged file is refusedspec/controllers/hyrax/dashboard/collections_controller_spec.rb: branding save paths green with owned fixtures; foreign banner refused (104 examples, 0 failures)AF-side (dassie) suite portions not run locally; CI covers them. RuboCop clean on touched files;
git diff --checkclean.🤖 Generated with Claude Code