Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

curation_concerns_type=() should raise if called twice #1133

Open
atz opened this issue Jan 13, 2017 · 0 comments
Open

curation_concerns_type=() should raise if called twice #1133

atz opened this issue Jan 13, 2017 · 0 comments

Comments

@atz
Copy link
Contributor

atz commented Jan 13, 2017

CC logic is highly dependent on curation_concerns_type=. Unfortunately that method relies on CanCan side-effects via load_and_authorize_resource (namely the addition of before_actions).

Code in question here:
https://github.com/projecthydra/curation_concerns/blob/aa46cbd2da3123ffbf11612395f0bbc8dbc613ac/app/controllers/concerns/curation_concerns/curation_concern_controller.rb#L23

The ramification of this pattern is that inheritance in downstream controllers (where a child might want to override the type) is impossible to do cleanly. The filters are aggregated because of LAAR, meaning the security is broken.

At a minimum, CC should check in curation_concerns_type= to see if _curation_concerns_type is already set and raise if so, since the results of compounding side-effects cannot be what the user desires. (I think it would even result in curation_concern being set twice during a request.)

More broadly, I would love to see a reworking by which curation_concerns_type= is replaced so that inheritance can still be practiced with downstream controllers. (The timing of the LAAR is still tricky though.)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant