From e67084493bcffad9bdedf706d44a27480994042d Mon Sep 17 00:00:00 2001 From: Masaharu Hayashi Date: Fri, 30 Oct 2026 03:45:45 +0000 Subject: [PATCH 1/3] =?UTF-8?q?fix:=20=E3=82=B2=E3=82=B9=E3=83=88=E7=94=A8?= =?UTF-8?q?=E3=83=88=E3=83=BC=E3=82=AF=E3=83=B3=E3=81=AE=E7=99=BA=E8=A1=8C?= =?UTF-8?q?=E3=83=BB=E5=8F=97=E4=BB=98=E3=82=92=E6=97=A2=E5=AE=9A=E3=81=A7?= =?UTF-8?q?=E7=84=A1=E5=8A=B9=E3=81=AB=E3=81=99=E3=82=8B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - scripts/instance.cfg の WEKO_WORKFLOW_GUEST_TOKEN_ISSUE_ENABLED / WEKO_WORKFLOW_GUEST_TOKEN_ACCEPT_ENABLED を False に変更 Co-Authored-By: Claude Opus 5.5 --- scripts/instance.cfg | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/instance.cfg b/scripts/instance.cfg index 0f3ad4fd5b..66348587d6 100644 --- a/scripts/instance.cfg +++ b/scripts/instance.cfg @@ -765,9 +765,9 @@ WEKO_WORKFLOW_ENABLE_AUTO_SET_INDEX_FOR_ITEM_TYPE = True #--- Enable showing term of use WEKO_WORKFLOW_ENABLE_SHOWING_TERM_OF_USE = True #--- Enable issuing tokens for guest activities -WEKO_WORKFLOW_GUEST_TOKEN_ISSUE_ENABLED = True +WEKO_WORKFLOW_GUEST_TOKEN_ISSUE_ENABLED = False #--- Enable accepting tokens for guest activities -WEKO_WORKFLOW_GUEST_TOKEN_ACCEPT_ENABLED = True +WEKO_WORKFLOW_GUEST_TOKEN_ACCEPT_ENABLED = False from weko_user_profiles.config import WEKO_USERPROFILES_GENERAL_ROLE, WEKO_USERPROFILES_GRADUATED_STUDENT_ROLE, WEKO_USERPROFILES_STUDENT_ROLE From 6548cc70433ac29b2c0f6bf14239f319fef0d690 Mon Sep 17 00:00:00 2001 From: Masaharu Hayashi Date: Fri, 30 Oct 2026 10:42:27 +0000 Subject: [PATCH 2/3] =?UTF-8?q?fix:=20deposit=20=E3=81=AE=20actions=20?= =?UTF-8?q?=E3=82=A8=E3=83=B3=E3=83=89=E3=83=9D=E3=82=A4=E3=83=B3=E3=83=88?= =?UTF-8?q?=E3=81=AB=E7=B7=A8=E9=9B=86=E6=A8=A9=E9=99=90=E3=83=81=E3=82=A7?= =?UTF-8?q?=E3=83=83=E3=82=AF=E3=82=92=E8=BF=BD=E5=8A=A0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - invenio-deposit の create_blueprint に action_decorators オプションを追加し、 actions ルートの POST にデコレータを指定できるようにする - weko-deposit で actions ルートに require_item_edit_permission を指定し、 未認証では 401、編集権限が無ければ 403 を返す Co-Authored-By: Claude Opus 5.5 --- modules/invenio-deposit/invenio_deposit/views/rest.py | 4 ++++ modules/invenio-deposit/tests/test_views_rest.py | 5 +++++ modules/weko-deposit/tests/test_weko_deposit.py | 3 +++ modules/weko-deposit/weko_deposit/config.py | 1 + 4 files changed, 13 insertions(+) diff --git a/modules/invenio-deposit/invenio_deposit/views/rest.py b/modules/invenio-deposit/invenio_deposit/views/rest.py index a0f0148d59..7d51b92f0a 100644 --- a/modules/invenio-deposit/invenio_deposit/views/rest.py +++ b/modules/invenio-deposit/invenio_deposit/views/rest.py @@ -142,6 +142,7 @@ def dbsession_clean(exception): options['item_route']: ( options.pop('update_decorators', []), ('PUT', 'PATCH')), } + action_decorators = options.pop('action_decorators', []) options.setdefault('search_class', DepositSearch) search_class = obj_or_import_string(options['search_class']) @@ -192,6 +193,9 @@ def dbsession_clean(exception): pid_type=options['pid_type'], ctx=ctx, ) + if action_decorators: + deposit_actions = decorate_view( + deposit_actions, action_decorators, ('POST',)) blueprint.add_url_rule( '{0}/actions/'.format( diff --git a/modules/invenio-deposit/tests/test_views_rest.py b/modules/invenio-deposit/tests/test_views_rest.py index 7153dbf2ea..da29f0e1a3 100644 --- a/modules/invenio-deposit/tests/test_views_rest.py +++ b/modules/invenio-deposit/tests/test_views_rest.py @@ -675,6 +675,7 @@ def test_create_blueprint_route_decorators(): default_media_type='application/json', create_decorators=[_abort_factory(418)], update_decorators=[_abort_factory(409)], + action_decorators=[_abort_factory(403)], ) ) app = Flask('testapp') @@ -688,8 +689,12 @@ def test_create_blueprint_route_decorators(): assert client.post('/deposits/').status_code == 418 assert client.put('/deposits/1').status_code == 409 assert client.patch('/deposits/1').status_code == 409 + assert client.post('/deposits/1/actions/edit').status_code == 403 + assert client.post('/deposits/1/actions/discard').status_code == 403 + assert client.post('/deposits/1/actions/publish').status_code == 403 assert 'create_decorators' in endpoints['depid'] assert 'update_decorators' in endpoints['depid'] + assert 'action_decorators' in endpoints['depid'] def _abort_factory(code): diff --git a/modules/weko-deposit/tests/test_weko_deposit.py b/modules/weko-deposit/tests/test_weko_deposit.py index 7df8cc40f0..0b634f317b 100644 --- a/modules/weko-deposit/tests/test_weko_deposit.py +++ b/modules/weko-deposit/tests/test_weko_deposit.py @@ -97,3 +97,6 @@ def test_deposit_rest_endpoints_route_decorators(): assert DEPOSIT_REST_ENDPOINTS['depid']['update_decorators'] == expected assert WEKO_DEPOSIT_REST_ENDPOINTS['depid']['update_decorators'] \ == expected + assert DEPOSIT_REST_ENDPOINTS['depid']['action_decorators'] == expected + assert WEKO_DEPOSIT_REST_ENDPOINTS['depid']['action_decorators'] \ + == expected diff --git a/modules/weko-deposit/weko_deposit/config.py b/modules/weko-deposit/weko_deposit/config.py index f5e2edcdcb..8aca2ac45d 100644 --- a/modules/weko-deposit/weko_deposit/config.py +++ b/modules/weko-deposit/weko_deposit/config.py @@ -130,6 +130,7 @@ delete_permission_factory_imp=deny_all, create_decorators=['weko_accounts.utils:login_required_customize'], update_decorators=['weko_deposit.rest:require_item_edit_permission'], + action_decorators=['weko_deposit.rest:require_item_edit_permission'], ) ) From 4e061e87fda8eead00f8de72078b8006350f5f5a Mon Sep 17 00:00:00 2001 From: Masaharu Hayashi Date: Fri, 30 Oct 2026 16:16:16 +0000 Subject: [PATCH 3/3] =?UTF-8?q?test(weko-deposit):=20ItemResource.put=20?= =?UTF-8?q?=E3=81=AE=E3=83=86=E3=82=B9=E3=83=88=E3=81=AE=E6=9C=9F=E5=BE=85?= =?UTF-8?q?=E5=80=A4=E3=82=92=E7=8F=BE=E5=9C=A8=E3=81=AE=E6=8C=99=E5=8B=95?= =?UTF-8?q?=E3=81=AB=E5=90=88=E3=82=8F=E3=81=9B=E3=82=8B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ログイン後の更新の流れは test_rest.py::test_put で確認している。 Co-Authored-By: Claude Opus 5.5 --- modules/weko-deposit/tests/test_weko_deposit.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/modules/weko-deposit/tests/test_weko_deposit.py b/modules/weko-deposit/tests/test_weko_deposit.py index 0b634f317b..f378e902ef 100644 --- a/modules/weko-deposit/tests/test_weko_deposit.py +++ b/modules/weko-deposit/tests/test_weko_deposit.py @@ -78,9 +78,12 @@ def test_ItemResource_put(app, db): headers = {'content-type': 'application/json'} with patch('weko_deposit.tasks.RecordsSearch', mock_recordssearch), \ patch("weko_deposit.rest.WekoRecord.get_record_by_pid", return_value=None): + # put には require_item_edit_permission が付いているため、 + # 未認証では本体に入る前に 401 になる。 + # ログイン後の更新の流れは test_rest.py::test_put で見ている。 res = client.put("/deposits/redirect/1", data=json.dumps(data), headers=headers) - assert res.status_code == 200 + assert res.status_code == 401 def test_deposit_rest_endpoints_route_decorators():