User with only depositor role cannot deposit into admin set

[jillpe]

Summary

I think I've found another bug related to groups and sharing, but want to make sure that I understand the intended functionality first. A user added a depositor to an admin set should be able to deposit works through that set even if they don't have any other roles, right? (Because the user depositor role already allows a user to deposit into any admin set.) That isn't working in our instance, for individuals or groups.

Accepted Criteria

• As a user that has been added as a depositor to an admin set, I can deposit works through that set (even if I don't have any other roles)
• As a user in a group that has been added as a depositor to an admin set, I can deposit works through that set (even if I don't have any other roles)

Testing Instructions

Giving a user deposit access

1. Login to a tenant as an admin
2. Navigate to Dashboard > Collections
3. Create an Admin Set
4. On the Admin Set edit form, under the participants tab, add a user who has no special roles (including admin) as a depositor
5. Login to the tenant as that user
6. Navigate to Dashboard > Works
7. Verify that you see the Add New Work button and can create a work

Giving a group deposit access

1. Login to a tenant as an admin
2. Navigate to Dashboard > Manage Groups
3. Create a new group. Do not give it any roles
4. Add a user with no roles as a member of the group (do not use the same user from the instructions above unless you removed its deposit access)
5. Navigate to Dashboard > Collections
6. Create an Admin Set
7. On the Admin Set edit form, under the participants tab, add the group as a depositor
8. Login to the tenant as the user from Step 4
9. Navigate to Dashboard > Works
10. Verify that you see the Add New Work button and can create a work

[bkiahstroud]

Investigation Notes

Users being able to create a work depends on two conditions being true:

1. The user has CanCan permission to create the work type (e.g. can?(:create, GenericWork))
2. The user has at least one Admin Set they can deposit into

Currently, when a user is granted deposit access to an Admin Set, only the second condition is met. The CanCan permission for registered users (i.e. non-admin users with no roles) to be able to :create works was removed when the Groups with Roles feature was introduced; the reasoning being "restricting base permissions makes sense now that we can more easily hand out permissions".

However, a registered user given deposit access to a specific admin set should be able to deposit works into it, even without any additional roles. Thus, this logic needs to be rethought.

Possible Fixes

The most obvious possible path forward would be to restore CanCan permissions to be able to :create works to all registered users. That way, Condition 1 is always true and we simply rely on Condition 2 to be met in order for users to be able to actually create works. This is worth looking into, but we need to be careful that granting this CanCan permission does not lead to undesired behavior elsewhere in the app.

[ShanaLMoore]

https://github.com/samvera/hyrax/blob/368fe3cbc909438f7ebea0e1e04c6a46c8527134/.dassie/app/models/ability.rb#L5

[ShanaLMoore]

QA Results: PASS ✅

Tested on: softserv-qa.commons-archive.org, user with no roles: [email protected]

• As a user that has been added as a depositor to an admin set, I can deposit works through that set (even if I don't have any other roles)

DEMO: https://share.zight.com/llu8o709

• As a user in a group that has been added as a depositor to an admin set, I can deposit works through that set (even if I don't have any other roles)

DEMO: https://share.zight.com/X6unlK5v

[ShanaLMoore]

Moving to prod deploy column and I've added this to the client's board too