Staged Download auth (#1069)

Co-authored-by: JP Engstrom <jpengstrom@macbook-pro.lan>
yalelibrary · Oct 22, 2024 · 9d2ee92 · 9d2ee92
1 parent 83002db
commit 9d2ee92
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 1 deletion.
diff --git a/app/controllers/download_original_controller.rb b/app/controllers/download_original_controller.rb
@@ -6,7 +6,7 @@ class DownloadOriginalController < ApplicationController
   include Blacklight::Catalog
   include CheckAuthorization
 
-  before_action :check_authorization, except: [:staged]
+  before_action :check_authorization
 
   def tiff
     if S3Service.exists_in_s3(tiff_pairtree_path)

diff --git a/spec/requests/download_original_spec.rb b/spec/requests/download_original_spec.rb
@@ -168,14 +168,26 @@
       get "/download/tiff/#{yale_work[:child_oids_ssim].first}"
       expect(response).to have_http_status(:unauthorized) # 401
     end
+    it 'does not stage the download if set to YCO' do
+      get "/download/tiff/#{yale_work[:child_oids_ssim].first}/staged"
+      expect(response).to have_http_status(:unauthorized) # 401
+    end
     it 'does not display if set to OWP' do
       get "/download/tiff/#{owp_work_without_permission[:child_oids_ssim].first}"
       expect(response).to have_http_status(:unauthorized) # 401
     end
+    it 'does not stage the download if set to OWP' do
+      get "/download/tiff/#{owp_work_without_permission[:child_oids_ssim].first}/staged"
+      expect(response).to have_http_status(:unauthorized) # 401
+    end
     it 'does not display if set to private' do
       get "/download/tiff/#{private_work[:child_oids_ssim].first}"
       expect(response).to have_http_status(:not_found) # 404
     end
+    it 'does not stage the download if set to private' do
+      get "/download/tiff/#{private_work[:child_oids_ssim].first}/staged"
+      expect(response).to have_http_status(:not_found) # 404
+    end
   end
 
   context 'as an authenticated yale user' do