Add non-searchable tags

[jrcastro2]

• closes names vocab: allow names vocab to have 2 types of objects CERNDocumentServer/cds-rdm#193
• closes Vocab: Add non-searchable tag CERNDocumentServer/cds-rdm#194

[slint]

Suggested change

	class AnyUser(Generator):
	"""Allows any user."""
	def needs(self, **kwargs):
	"""Enabling Needs."""
	return [any_user]
	def query_filter(self, **kwargs):
	"""Match only searchable values in search."""
	return dsl.Q(
	"bool",
	must_not=[dsl.Q("term", tags="non-searchable")],
	)
	class Tags(Generator):
	"""Search filter based on tags."""
	def __init__(self, include=None, exclude=None):
	...
	def query_filter(self, **kwargs):
	"""Search based on configured tags."""
	return dsl.Q(
	"bool",
	must=[dsl.Q("term", tags=self.include)],
	must_not=[dsl.Q("term", tags=self.exclude)],
	)

• major: I would not reuse the name AnyUser since we might start mixing them up and misinterpret its meaning
• minor: defining a Tags generator might be a more flexible approach since it allows us to combine like the following:

class VocabularyPermissionPolicy:

    can_search = [
        SystemProcess(), 
        Administration(),
        Tags(exclude=["non-searchable"])
    ]

This assumes that Administration() makes sure that admins search/see everything (which I'm not sure if is the case today).

[slint]

Suggested change

	can_read = [SystemProcess(), AnyUser()]
	can_read = [SystemProcess()]

minor: reads should always be possible, since we just want to control the search behaviour for end-users

[kpsherva]

side question, for me to understand how this works. How can I know what tags are available?

[jrcastro2]

Hmm, I think it's only documented in the RFC: https://github.com/inveniosoftware/rfcs/blob/fdb09b8b86263607364c8cc554b3a6580ccba2e2/rfcs/rdm-0077-vocabulary-harvesting.md#data-model

There is PR adding the non-searchableexplanation, however maybe we should document htis better in the docs (?)

[ptamarit]

Is it really what we want here that nobody at all can search non-searchable names?

[jrcastro2]

People with admin permission can search for it. If there is other permissions that should have access to it let me know. But to me it makes sense that only administrators do have.

[slint]

Suggested change

	can_search = [
	SystemProcess(),
	IfTags(exclude=["unlisted"], only_authenticated=True),
	]
	can_search = [
	SystemProcess(),
	IfTags(exclude=["unlisted"]),
	AuthenticatedUser(),
	]

minor: wouldn't that be possible in terms of reusing/composing with existing generators? The only_authenticated parameter feels a bit ad-hoc

[jrcastro2]

Right! I agree but unfortunately it doesn't work like that, at the moment if we change it to your suggestion (which was my first thought/try as well) it will simply grant access if any of the needs is matched, meaning that ti will match for unlisted OR authenticated, while what we want to achieve is to grant access to unlisted AND authenticated for Names vocab while for the rest we want to grant access to unlisted AND any user.

That's why I added that param. The only easy alternative I can think of is creating 2 generators that would be AnyUserIfTags and AuthenticatedUserIfTags maybe this would be more readable ... Unless there are better sugesstions, they are more than welcomed!