use the file_download_item helper on download links

previously this would show the active storage blob url and not check for authorization
ualbertalib · Apr 15, 2019 · 7dcc45f · 7dcc45f
1 parent f40ac7b
commit 7dcc45f
Show file tree

Hide file tree

Showing 4 changed files with 37 additions and 19 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,6 +6,14 @@ and releases in Jupiter project adheres to [Semantic Versioning](http://semver.o
 
 ## [Unreleased]
 
+### Added
+- regression tests for downloading restricted items from search results [PR#1070](https://github.com/ualbertalib/jupiter/pull/1070)
+
+### Fixed
+- use the download url helper on the search results page [PR#1079](https://github.com/ualbertalib/jupiter/pull/1079)
+
+## [1.2.11] - 2019-04-05
+
 ### Fixed
 - anonymous users should not be able to download ccid protected items from search results [#1068](https://github.com/ualbertalib/jupiter/issues/1068)
 

diff --git a/app/views/application/_item.html.erb b/app/views/application/_item.html.erb
@@ -6,18 +6,19 @@
   <div class="media-body ml-3">
     <div class="d-flex flex-wrap flex-lg-nowrap align-items-start">
       <h3 class="mt-0 h5 mr-auto"><%= link_to item.title, item_path(item) %></h3>
-
-      <% primary_file = item.files.first %>
-      <% if policy(item).download? && primary_file.present?%>
-        <%= link_to url_for(primary_file),
-                    class: 'btn btn-secondary mr-2 mb-2 mb-md-0',
-                    rel: 'nofollow',
-                    download: primary_file.filename.to_s do %>
-          <%= fa_icon 'cloud-download' %>
-          <%= t('download') %>
+      <% if policy(item).download? %>
+        <% primary_file = item.files.first %>
+        <% if primary_file.present? && primary_file.fileset_uuid.present? %>
+          <%= link_to file_download_item_url(id: primary_file.record.owner.id,
+                                 file_set_id: primary_file.fileset_uuid),
+                      class: 'btn btn-secondary mr-2 mb-2 mb-md-0',
+                      rel: 'nofollow',
+                      download: primary_file.filename.to_s do %>
+            <%= fa_icon 'cloud-download' %>
+            <%= t('download') %>
+          <% end %>
         <% end %>
       <% end %>
-
       <% if policy(item).update? || policy(item).destroy? %>
         <div class="btn-group">
           <% if policy(item).update? %>

diff --git a/app/views/application/_thesis.html.erb b/app/views/application/_thesis.html.erb
@@ -6,14 +6,17 @@
     <div class="d-flex flex-wrap flex-lg-nowrap align-items-start">
       <h3 class="mt-0 h5 mr-auto"><%= link_to thesis.title, item_path(thesis) %></h3>
 
-      <% primary_file = thesis.files.first %>
-      <% if primary_file.present? %>
-        <%= link_to url_for(primary_file),
-                    class: 'btn btn-secondary mr-2 mb-2 mb-md-0',
-                    rel: 'nofollow',
-                    download: primary_file.filename.to_s do %>
-          <%= fa_icon 'cloud-download' %>
-          <%= t('download') %>
+      <% if policy(thesis).download? %>
+        <% primary_file = thesis.files.first %>
+        <% if primary_file.present? && primary_file.fileset_uuid.present? %>
+          <%= link_to file_download_item_url(id: primary_file.record.owner.id,
+                                 file_set_id: primary_file.fileset_uuid),
+                      class: 'btn btn-secondary mr-2 mb-2 mb-md-0',
+                      rel: 'nofollow',
+                      download: primary_file.filename.to_s do %>
+            <%= fa_icon 'cloud-download' %>
+            <%= t('download') %>
+          <% end %>
         <% end %>
       <% end %>
 

diff --git a/test/system/search_test.rb b/test/system/search_test.rb
@@ -326,7 +326,13 @@ def before_all
     assert_selector 'a', text: 'Fancy Private Item 12'
     assert_selector 'a', text: 'Fancy Private Item 14'
     assert_selector 'a', text: 'Fancy Private Item 16'
-    assert_selector 'a', text: 'Fancy Private Item 18'
+
+    # Should see the download link for CCID item
+    within '.list-group-item', text: 'Fancy CCID Item' do
+      assert_selector 'a', text: 'Download'
+      assert_link href: /download/
+      assert_no_link href: /active_storage/
+    end
 
     # A checkbox for the facet should be unchecked, and link should turn on facet
     within 'div.jupiter-filters a', text: 'Fancy Collection 1' do