Skip to content

CADC-14486 give publisher group read access to files in the data folder when appropriate #29

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jburke-cadc merged 4 commits into from
Mar 6, 2026
Merged

CADC-14486 give publisher group read access to files in the data folder when appropriate #29

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2bf1665
CADC-14486 README update and integration test fix
jburke-cadc Mar 3, 2026
7459599
Merge branch 'main' into CADC-14486
jburke-cadc Mar 3, 2026
ea1594c
CADC-14486 give publisher group read permission to data files for rev…
jburke-cadc Mar 6, 2026
41e4c79
Merge branch 'main' into CADC-14486
jburke-cadc Mar 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions doi/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,9 +27,6 @@ The doi.properties configures the DataCite service used to register new DOIs.
# VOSpace uri to the parent DOI folder.
ca.nrc.cadc.doi.vospaceParentUri = {parent folder URI}

# DOI Identifier Prefix
ca.nrc.cadc.doi.doiIdentifierPrefix = {DOI Identifier Prefix}

# Prefix to the DOI metadata file
ca.nrc.cadc.doi.metaDataPrefix = {metadata file prefix}

Expand All @@ -50,11 +47,12 @@ ca.nrc.cadc.doi.datacite.password = {password}

# DataCite account prefix
ca.nrc.cadc.doi.datacite.accountPrefix = {account prefix}

# (optional) DOI Identifier Prefix
ca.nrc.cadc.doi.doiIdentifierPrefix = {DOI Identifier Prefix}
```
_parentUri_ is the URI to the DOI parent folder in the VOSpace service.

_doiIdentifierPrefix_ is prefix to the DOI Identifier.

_metaDataPrefix_ is the prefix prepended to the DOI name used to create the file for the DOI specific metadata stored in VOSpace.

_groupPrefix_ is the prefix prepended to the DOI name to create the group name for the DOI.
Expand All @@ -69,6 +67,8 @@ _password_ is the DataCite account password.

_accountPrefix_ is the registered prefix for a DataCite account.

_doiIdentifierPrefix_ is prefix to the DOI Identifier.

**For Alternative DOI Settings ONLY**
```
# Publisher Group URI
Expand Down
20 changes: 20 additions & 0 deletions doi/src/intTest/java/ca/nrc/cadc/doi/AltStatusTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,8 @@
import org.apache.log4j.Logger;
import org.junit.Assert;
import org.junit.Test;
import org.opencadc.vospace.ContainerNode;
import org.opencadc.vospace.DataNode;
import org.opencadc.vospace.Node;
import org.opencadc.vospace.VOSURI;
import org.opencadc.vospace.client.VOSpaceClient;
Expand Down Expand Up @@ -121,6 +123,10 @@ public void testUpdateStatus() {
checkPermissions(doiNode, false, false, 2,0);
log.debug("submitter - checked permissions");

// check /data files are readable by the doi group and publisher group
ContainerNode dataNode = getContainerNode(doiID + "/data", doiParentPathURI, vosClient);
checkDataNodePermission(dataNode, 2, 0);

// submitter can update status to 'in progress' from 'review ready'
log.debug("submitter - update status to 'in progress'");
updateStatus(doiID, Status.DRAFT, true);
Expand All @@ -132,6 +138,10 @@ public void testUpdateStatus() {
checkPermissions(doiNode, false, false, 1,1);
log.debug("submitter - checked permissions");

// check /data files are readable and writeable by the doi group only
dataNode = getContainerNode(doiID + "/data", doiParentPathURI, vosClient);
checkDataNodePermission(dataNode, 1, 1);

// submitter updates status to 'review ready' so a reviewer can review
log.debug("submitter - update status to 'review ready'");
updateStatus(doiID, Status.REVIEW_READY, true);
Expand Down Expand Up @@ -307,4 +317,14 @@ void checkPermissions(Node doiNode, boolean isLocked, boolean isPublic,
Assert.assertEquals(readWriteGroups, doiNode.getReadWriteGroup().size());
}

void checkDataNodePermission(ContainerNode dataNode, int readOnlyGroups, int readWriteGroups) {
for (Node child : dataNode.getNodes()) {
if (child instanceof DataNode) {
checkPermissions(child,false, false, readOnlyGroups, readWriteGroups);
} else {
checkDataNodePermission((ContainerNode) child, readOnlyGroups, readWriteGroups);
}
}
}

}
10 changes: 7 additions & 3 deletions doi/src/intTest/java/ca/nrc/cadc/doi/LifecycleTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -283,6 +283,8 @@ void update(Resource expected, String doiSuffix, URL doiServiceURL) throws Excep

// Update the DOI
Resource actual = doUpdateTest(expected, doiURL);
log.debug("expected: " + expected);
log.debug("actual: " + actual);
// tests randomly fails when the transfer to vospace is slow, hence the sleep cycles
Thread.sleep(3000);
compareResource(expected, actual, true);
Expand All @@ -295,9 +297,11 @@ void update(Resource expected, String doiSuffix, URL doiServiceURL) throws Excep

// Update the DOI
actual = doUpdateTest(expected, doiURL);
log.info("expected: " + expected);
log.info("actual: " + actual);
// compareResource(expected, actual, true);
log.debug("expected: " + expected);
log.debug("actual: " + actual);
// tests randomly fails when the transfer to vospace is slow, hence the sleep cycles
Thread.sleep(3000);
compareResource(expected, actual, true);
}

void publish(Resource expected, String doiSuffix, DOISettingsType doiSettingsType) throws Exception {
Expand Down
2 changes: 1 addition & 1 deletion doi/src/intTest/java/ca/nrc/cadc/doi/TestUtil.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,7 +126,7 @@ public class TestUtil {

static URI DOI_ALT_VOSPACE_RESOURCE_ID;

static String DOI_ALT_IDENTIFIER_PREFIX;
static String DOI_ALT_IDENTIFIER_PREFIX = "doi-alt-";

static {

Expand Down
35 changes: 27 additions & 8 deletions doi/src/main/java/ca/nrc/cadc/doi/PostAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,7 @@
import ca.nrc.cadc.net.HttpPost;
import ca.nrc.cadc.net.HttpTransfer;
import ca.nrc.cadc.net.HttpUpload;
import ca.nrc.cadc.net.ResourceNotFoundException;
import ca.nrc.cadc.util.Base64;
import ca.nrc.cadc.util.StringUtil;
import java.io.ByteArrayInputStream;
Expand Down Expand Up @@ -560,7 +561,13 @@ private void updatePermissions(Node doiNode, Status current, Status updated) thr
updateNodePermissions(doiNode, readGroups, writeGroups);

// update doi metadata file and data folder permissions
updateDOIPermissions(doiSuffix, readGroups, writeGroups);
String dataPath = String.format("%s/data", doiSuffix);
VOSURI dataURI = getVOSURI(dataPath);
ContainerNode dataNode = vospaceDoiClient.getContainerNode(dataPath);
updateDOIPermissions(doiSuffix, dataURI, dataNode, readGroups, writeGroups);

// give the publisher group read permission to files in the data folder
updateDataFilePermissions(dataURI, dataNode, readGroups);
} else {
throw new IllegalArgumentException("Invalid status change: 'in progress' -> 'review ready'");
}
Expand Down Expand Up @@ -605,7 +612,13 @@ private void updatePermissions(Node doiNode, Status current, Status updated) thr
updateNodePermissions(doiNode, readGroups, writeGroups);

// update doi data folder permissions
updateDOIPermissions(doiSuffix, readGroups, writeGroups);
String dataPath = String.format("%s/data", doiSuffix);
VOSURI dataURI = getVOSURI(dataPath);
ContainerNode dataNode = vospaceDoiClient.getContainerNode(dataPath);
updateDOIPermissions(doiSuffix, dataURI, dataNode, readGroups, writeGroups);

// remove publisher group read permission for files in the data folder
updateDataFilePermissions(dataURI, dataNode, readGroups);
} else {
String message = String.format("Status change denied: '%s' -> '%s'", current, updated);
throw new IllegalArgumentException(message);
Expand Down Expand Up @@ -646,7 +659,7 @@ private void updateNodePermissions(Node doiNode, Set<GroupURI> readGroups, Set<G
doiNode.isPublic = false;
}

private void updateDOIPermissions(String doiSuffix, Set<GroupURI> readGroups, Set<GroupURI> writeGroups) throws Exception {
private void updateDOIPermissions(String doiSuffix, VOSURI dataURI, ContainerNode dataNode, Set<GroupURI> readGroups, Set<GroupURI> writeGroups) throws Exception {
// update metadata file permissions
String metadataFilename = getDoiFilename(doiSuffix);
String metadataPath = String.format("%s/%s", doiSuffix, metadataFilename);
Expand All @@ -656,11 +669,17 @@ private void updateDOIPermissions(String doiSuffix, Set<GroupURI> readGroups, Se
vospaceDoiClient.getVOSpaceClient().setNode(metadataVOSURI, metadataNode);

// update data folder permissions
String dataPath = String.format("%s/data", doiSuffix);
VOSURI dataURI = getVOSURI(dataPath);
ContainerNode dataFolderNode = vospaceDoiClient.getContainerNode(dataPath);
updateNodePermissions(dataFolderNode, readGroups, writeGroups);
vospaceDoiClient.getVOSpaceClient().setNode(dataURI, dataFolderNode);
updateNodePermissions(dataNode, readGroups, writeGroups);
vospaceDoiClient.getVOSpaceClient().setNode(dataURI, dataNode);
}

private void updateDataFilePermissions(VOSURI dataURI, ContainerNode dataNode, Set<GroupURI> readGroups)
throws IOException, ResourceNotFoundException, InterruptedException {
dataNode.getReadOnlyGroup().clear();
dataNode.getReadOnlyGroup().addAll(readGroups);
RecursiveSetNode setNode = vospaceDoiClient.getVOSpaceClient().createRecursiveSetNode(dataURI, dataNode);
setNode.setMonitor(true);
setNode.run();
}

private Map<URI, String> getNodeProperties(JSONObject nodeData) {
Expand Down