resources: add param to filter shared with my uploads

invenio_rdm_records/assets/semantic-ui/js/invenio_rdm_records/src/deposit/components/CommunityHeader/CommunityHeader.js

@@ -31,11 +31,16 @@ class CommunityHeaderComponent extends Component {
       imagePlaceholderLink,
       showCommunitySelectionButton,
       disableCommunitySelectionButton,
-      showCommunityHeader,
+      userCanManageRecord,
       record,
+      showCommunityHeader,
     } = this.props;
     const { modalOpen } = this.state;
 
+    const isNewUpload = !record.id;
+    const isCommunitySelectionDisabled =
+      (!isNewUpload && !userCanManageRecord) || disableCommunitySelectionButton;
+
     return (
       showCommunityHeader && (
         <Container
@@ -82,7 +87,7 @@ class CommunityHeaderComponent extends Component {
                         <Overridable id="InvenioRdmRecords.CommunityHeader.CommunitySelectionButton.Container">
                           <Button
                             className="community-header-button"
-                            disabled={disableCommunitySelectionButton}
+                            disabled={isCommunitySelectionDisabled}
                             onClick={() => this.setState({ modalOpen: true })}
                             primary
                             size="mini"
@@ -110,7 +115,7 @@ class CommunityHeaderComponent extends Component {
                           onClick={() => changeSelectedCommunity(null)}
                           content={i18next.t("Remove")}
                           icon="close"
-                          disabled={disableCommunitySelectionButton}
+                          disabled={isCommunitySelectionDisabled}
                         />
                       )}
                     </Overridable>
@@ -133,6 +138,7 @@ CommunityHeaderComponent.propTypes = {
   showCommunityHeader: PropTypes.bool.isRequired,
   changeSelectedCommunity: PropTypes.func.isRequired,
   record: PropTypes.object.isRequired,
+  userCanManageRecord: PropTypes.bool.isRequired,
 };
 
 CommunityHeaderComponent.defaultProps = {
@@ -146,6 +152,7 @@ const mapStateToProps = (state) => ({
   showCommunitySelectionButton:
     state.deposit.editorState.ui.showCommunitySelectionButton,
   showCommunityHeader: state.deposit.editorState.ui.showCommunityHeader,
+  userCanManageRecord: state.deposit.permissions.can_manage,
 });
 
 const mapDispatchToProps = (dispatch) => ({

invenio_rdm_records/assets/semantic-ui/js/invenio_rdm_records/src/deposit/controls/PublishButton/SubmitReviewButton.js

@@ -42,10 +42,10 @@ class SubmitReviewButtonComponent extends Component {
   };
 
   isDisabled = (disableSubmitForReviewButton, filesState) => {
-    const { formik } = this.props;
+    const { formik, userCanManageRecord } = this.props;
     const { values, isSubmitting } = formik;
 
-    if (disableSubmitForReviewButton || isSubmitting) {
+    if (!userCanManageRecord || disableSubmitForReviewButton || isSubmitting) {
       return true;
     }
 
@@ -131,6 +131,7 @@ SubmitReviewButtonComponent.propTypes = {
   formik: PropTypes.object.isRequired,
   publishModalExtraContent: PropTypes.string,
   filesState: PropTypes.object,
+  userCanManageRecord: PropTypes.bool.isRequired,
 };
 
 SubmitReviewButtonComponent.defaultProps = {
@@ -150,6 +151,7 @@ const mapStateToProps = (state) => ({
     state.deposit.editorState.ui.disableSubmitForReviewButton,
   publishModalExtraContent: state.deposit.config.publish_modal_extra,
   filesState: state.files,
+  userCanManageRecord: state.deposit.permissions.can_manage,
 });
 
 export const SubmitReviewButton = connect(

invenio_rdm_records/requests/community_inclusion.py

@@ -107,6 +107,7 @@ class CommunityInclusion(RequestType):
     allowed_topic_ref_types = ["record"]
     needs_context = {
         "community_roles": ["owner", "manager", "curator"],
+        "record_permission": "preview",
     }
 
     available_actions = {

invenio_rdm_records/requests/community_submission.py

@@ -191,6 +191,7 @@ class CommunitySubmission(ReviewRequest):
     allowed_topic_ref_types = ["record"]
     needs_context = {
         "community_roles": ["owner", "manager", "curator"],
+        "record_permission": "preview",
     }
 
     available_actions = {

invenio_rdm_records/requests/entity_resolvers.py

@@ -24,6 +24,7 @@
 from invenio_users_resources.services.schemas import SystemUserSchema
 from sqlalchemy.orm.exc import NoResultFound
 
+from ..proxies import current_rdm_records_service
 from ..records.api import RDMDraft, RDMRecord
 from ..services.config import RDMRecordServiceConfig
 from ..services.dummy import DummyExpandingService
@@ -63,6 +64,20 @@ def ghost_record(self, record):
         """
         return {"id": record}
 
+    def get_needs(self, ctx=None):
+        """Enrich request with record needs.
+
+        A user that can preview a record can also read its requests.
+        """
+        record = self.resolve()
+        needs = []
+        record_permission = ctx.get("record_permission")
+        if record_permission:
+            needs = current_rdm_records_service.config.permission_policy_cls(
+                record_permission, record=record
+            ).needs
+        return needs
+
 
 class RDMRecordResolver(RecordResolver):
     """RDM Record entity resolver."""

invenio_rdm_records/resources/args.py

@@ -19,3 +19,4 @@ class RDMSearchRequestArgsSchema(SearchRequestArgsSchema):
     locale = fields.Str()
     status = fields.Str()
     include_deleted = fields.Bool()
+    shared_with_me = fields.Bool()

invenio_rdm_records/services/access/service.py

@@ -1,4 +1,4 @@
 # -*- coding: utf-8 -*-
 #
 # Copyright (C) 2020-2024 CERN.
 # Copyright (C) 2020-2021 Northwestern University.
@@ -22,7 +22,7 @@
 from invenio_notifications.services.uow import NotificationOp
 from invenio_records_resources.services.errors import PermissionDeniedError
 from invenio_records_resources.services.records.schema import ServiceSchemaWrapper
-from invenio_records_resources.services.uow import unit_of_work
+from invenio_records_resources.services.uow import unit_of_work, RecordCommitOp
 from invenio_requests.proxies import current_requests_service
 from invenio_search.engine import dsl
 from invenio_users_resources.proxies import current_user_resources
@@ -104,6 +104,16 @@
             GrantSubjectExpandableField("subject"),
         ]
 
+    #
+    # Update parent request on access changes
+    #
+
+    def _update_parent_request(self, parent, uow):
+        """Update the parent record request."""
+        if parent.review:
+            request = parent.review.get_object()
+            uow.register(RecordCommitOp(request, indexer=self.indexer))
+
     #
     # Secret links
     #
@@ -201,6 +211,7 @@
             )
 
         uow.register(ParentRecordCommitOp(parent, indexer_context=dict(service=self)))
+        self._update_parent_request(parent, uow)
 
         return self.link_result_item(
             self,
@@ -301,6 +312,7 @@
         link.description = data.get("description", link.description)
 
         uow.register(ParentRecordCommitOp(parent, indexer_context=dict(service=self)))
+        self._update_parent_request(parent, uow)
 
         return self.link_result_item(
             self,
@@ -330,6 +342,7 @@
         link.revoke()
 
         uow.register(ParentRecordCommitOp(parent, indexer_context=dict(service=self)))
+        self._update_parent_request(parent, uow)
 
         return True
 
@@ -423,6 +436,7 @@
             new_grants.append(new_grant)
 
         uow.register(ParentRecordCommitOp(parent, indexer_context=dict(service=self)))
+        self._update_parent_request(parent, uow)
 
         return self.grants_result_list(
             self,
@@ -517,6 +531,7 @@
         parent.access.grants[grant_id] = new_grant
 
         uow.register(ParentRecordCommitOp(parent, indexer_context=dict(service=self)))
+        self._update_parent_request(parent, uow)
 
         return self.grant_result_item(
             self,
@@ -575,6 +590,7 @@
         parent.access.grants.pop(grant_id)
 
         uow.register(ParentRecordCommitOp(parent, indexer_context=dict(service=self)))
+        self._update_parent_request(parent, uow)
 
         return True
 
@@ -942,6 +958,7 @@
         parent.access.grants[grant_index] = new_grant
 
         uow.register(ParentRecordCommitOp(parent, indexer_context=dict(service=self)))
+        self._update_parent_request(parent, uow)
 
         return self.grant_result_item(
             self,
@@ -972,5 +989,6 @@
             raise LookupError(subject_id)
 
         uow.register(ParentRecordCommitOp(parent, indexer_context=dict(service=self)))
+        self._update_parent_request(parent, uow)
 
         return True

invenio_rdm_records/services/config.py

@@ -1,4 +1,4 @@
 # -*- coding: utf-8 -*-
 #
 # Copyright (C) 2020-2024 CERN.
 # Copyright (C) 2020-2021 Northwestern University.
@@ -97,7 +97,7 @@
 from .schemas.tombstone import TombstoneSchema
 from .search_params import (
     MetricsParam,
-    MyDraftsParam,
+    SharedOrMineDraftsParam,
     PublishedRecordsParam,
     StatusParam,
 )
@@ -243,7 +243,7 @@
     }
 
     params_interpreters_cls = [
-        MyDraftsParam
+        SharedOrMineDraftsParam
     ] + SearchDraftsOptions.params_interpreters_cls
 
 

invenio_rdm_records/services/review/service.py

@@ -111,7 +111,7 @@ def read(self, identity, id_):
     def update(self, identity, id_, data, revision_id=None, uow=None):
         """Create or update an existing review."""
         draft = self.draft_cls.pid.resolve(id_, registered_only=False)
-        self.require_permission(identity, "update_draft", record=draft)
+        self.require_permission(identity, "manage", record=draft)
 
         # If an existing review exists, delete it.
         if draft.parent.review is not None:
@@ -124,7 +124,7 @@ def update(self, identity, id_, data, revision_id=None, uow=None):
     def delete(self, identity, id_, revision_id=None, uow=None):
         """Delete a review."""
         draft = self.draft_cls.pid.resolve(id_, registered_only=False)
-        self.require_permission(identity, "update_draft", record=draft)
+        self.require_permission(identity, "manage", record=draft)
 
         # Preconditions
         if draft.parent.review is None:
@@ -176,7 +176,7 @@ def submit(self, identity, id_, data=None, require_review=False, uow=None):
         community = draft.parent.review.receiver.resolve()
 
         # Check permission
-        self.require_permission(identity, "update_draft", record=draft)
+        self.require_permission(identity, "manage", record=draft)
 
         community_id = (
             draft.parent.review.get_object().get("receiver", {}).get("community", "")

invenio_rdm_records/services/search_params.py

@@ -1,4 +1,4 @@
 # -*- coding: utf-8 -*-
 #
 # Copyright (C) 2023-2024 CERN.
 #
@@ -6,11 +6,14 @@
 # modify it under the terms of the MIT License; see LICENSE file for more
 # details.
 
-"""Sort parameter interpreter API."""
+"""Search parameter interpreter API."""
+
+from invenio_search.engine import dsl
 
 from invenio_access.permissions import authenticated_user
 from invenio_records_resources.services.records.params.base import ParamInterpreter
 
+from invenio_rdm_records.records.systemfields.access.grants import Grant
 from invenio_rdm_records.records.systemfields.deletion_status import (
     RecordDeletionStatusEnum,
 )
@@ -42,8 +45,38 @@
         return search
 
 
-class MyDraftsParam(ParamInterpreter):
-    """Evaluates the include_deleted parameter."""
+class SharedOrMineDraftsParam(ParamInterpreter):
+    """Evaluates the shared_with_me parameter.
+
+    Returns only drafts owned by the user or shared with the user via grant subject user or role.
+    """
+
+    def _make_grant_token(self, subj_type, subj_id, permission):
+        """Create a grant token from the specified parts."""
+        # NOTE: `Grant.to_token()` doesn't need the actual subject to be set
+        return Grant(
+            subject=None,
+            origin=None,
+            permission=permission,
+            subject_type=subj_type,
+            subject_id=subj_id,
+        ).to_token()
+
+    def _grant_tokens(self, identity, permissions):
+        """Parse a list of grant tokens provided by the given identity."""
+        tokens = []
+        for _permission in permissions:
+            for need in identity.provides:
+                token = None
+                if need.method == "id":
+                    token = self._make_grant_token("user", need.value, _permission)
+                elif need.method == "role":
+                    token = self._make_grant_token("role", need.value, _permission)
+
+                if token is not None:
+                    tokens.append(token)
+
+        return tokens
 
     def apply(self, identity, search, params):
         """Evaluate the include_deleted parameter on the search."""
@@ -55,9 +88,21 @@
             return authenticated_user in identity.provides
 
         if value is None and is_user_authenticated():
-            search = search.filter(
-                "term", **{"parent.access.owned_by.user": identity.id}
-            )
+            if params.get("shared_with_me") is True:
+                # Shared with me
+                tokens = self._grant_tokens(
+                    identity, permissions=["preview", "edit", "manage"]
+                )
+                shared_with_me = dsl.Q(
+                    "terms", **{"parent.access.grant_tokens": tokens}
+                )
+                return search.filter(shared_with_me)
+            elif params.get("shared_with_me") is False:
+                # My uploads
+                my_uploads = dsl.Q(
+                    "term", **{"parent.access.owned_by.user": identity.id}
+                )
+                search = search.filter(my_uploads)
         return search