metadata history viewing with user profile level (#7450)

Allow metadata history viewing with user profile level

Co-authored-by: Jose García <[email protected]>

core/src/main/java/org/fao/geonet/kernel/setting/Settings.java

@@ -71,7 +71,6 @@ public class Settings {
     public static final String SYSTEM_ENABLE_ALL_THESAURUS = "system/metadata/allThesaurus";
     public static final String SYSTEM_METADATA_THESAURUS_NAMESPACE = "system/metadata/thesaurusNamespace";
     public static final String SYSTEM_METADATA_VALIDATION_REMOVESCHEMALOCATION = "system/metadata/validation/removeSchemaLocation";
-    public static final String SYSTEM_METADATA_HISTORY_ENABLED = "system/metadata/history/enabled";
     public static final GNSetting SYSTEM_SITE_SVNUUID = new GNSetting("system/site/svnUuid", true);
     public static final String SYSTEM_INTRANET_NETWORK = "system/intranet/network";
     public static final String SYSTEM_INTRANET_NETMASK = "system/intranet/netmask";
@@ -139,6 +138,8 @@ public class Settings {
     public static final String METADATA_IMPORT_RESTRICT = "metadata/import/restrict";
     public static final String METADATA_IMPORT_USERPROFILE = "metadata/import/userprofile";
     public static final String METADATA_BATCH_EDITING_ACCESS_LEVEL = "metadata/batchediting/accesslevel";
+    public static final String METADATA_HISTORY_ENABLED = "metadata/history/enabled";
+    public static final String METADATA_HISTORY_ACCESS_LEVEL = "metadata/history/accesslevel";
     public static final String METADATA_PUBLISHED_DELETE_USERPROFILE = "metadata/delete/profilePublishedMetadata";
     public static final String METADATA_PUBLISH_USERPROFILE = "metadata/publication/profilePublishMetadata";
     public static final String METADATA_UNPUBLISH_USERPROFILE = "metadata/publication/profileUnpublishMetadata";

docs/manual/docs/administrator-guide/configuring-the-catalog/system-configuration.md

@@ -230,6 +230,19 @@ Allows to configure the user profile allowed to publish and un-publish metadata.
 
 ![](img/metadata-publication.png)
 
+## Metadata History
+
+Allows to view metadata history
+
+![](img/metadata_history.png)
+
+-   **Minimum user profile allowed to view metadata history** Minimum user profile allowed to delete metadata (`Registered User`, `Editor` or `Administrator`). The default value is `Editor`.
+![](img/metadata_history_config.png)
+
+-   **Registered User Configuration** The user who has granted view permission to the metadata record can view the history.
+-   **Editor Configuration** The user who has granted editing permission to the metadata record can view the history.
+-   **Administrator Configuration** The user who has granted system administrator permission can view the history.
+
 ## Harvesting
 
 *Allow editing on harvested records*: Enables/Disables editing of harvested records in the catalogue. By default, harvested records cannot be edited.

listeners/src/main/java/org/fao/geonet/listener/history/GenericMetadataEventListener.java

@@ -70,7 +70,7 @@ public final void handleEvent(AbstractHistoryEvent event) {
      */
     public final void storeContentHistoryEvent(AbstractHistoryEvent event) {
 
-        if(settingManager.getValueAsBool(Settings.SYSTEM_METADATA_HISTORY_ENABLED)) {
+        if(settingManager.getValueAsBool(Settings.METADATA_HISTORY_ENABLED)) {
 
             Integer metadataid = Math.toIntExact(event.getMdId());
 

services/src/main/java/org/fao/geonet/api/records/MetadataWorkflowApi.java

@@ -60,6 +60,7 @@
 import org.fao.geonet.kernel.setting.Settings;
 import org.fao.geonet.repository.*;
 import org.fao.geonet.util.MetadataPublicationMailNotifier;
+import org.fao.geonet.util.UserUtil;
 import org.fao.geonet.utils.Log;
 import org.fao.geonet.utils.Xml;
 import org.jdom.Element;
@@ -71,6 +72,7 @@
 import org.springframework.data.domain.Sort;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
+import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.*;
@@ -149,6 +151,9 @@ public class MetadataWorkflowApi {
     @Autowired
     MetadataPublicationMailNotifier metadataPublicationMailNotifier;
 
+    @Autowired
+    RoleHierarchy roleHierarchy;
+
     // The restore function currently supports these states
     static final Integer[] supportedRestoreStatuses = {
         Integer.parseInt(StatusValue.Events.RECORDUPDATED),
@@ -635,7 +640,7 @@ public void deleteAllRecordStatus(
     @io.swagger.v3.oas.annotations.Operation(summary = "Search status", description = "")
     @RequestMapping(produces = MediaType.APPLICATION_JSON_VALUE, method = RequestMethod.GET, path = "/status/search")
     @ResponseStatus(value = HttpStatus.OK)
-    @PreAuthorize("hasAuthority('Editor')")
+    @PreAuthorize("hasAuthority('RegisteredUser')")
     @ResponseBody
     public List<MetadataStatusResponse> getWorkflowStatusByType(
         @Parameter(description = "One or more types to retrieve (ie. worflow, event, task). Default is all.",
@@ -694,6 +699,9 @@ public List<MetadataStatusResponse> getWorkflowStatusByType(
         ServiceContext context = ApiUtils.createServiceContext(request);
 
         Profile profile = context.getUserSession().getProfile();
+        String allowedProfileLevel = org.apache.commons.lang.StringUtils.defaultIfBlank(settingManager.getValue(Settings.METADATA_HISTORY_ACCESS_LEVEL), Profile.Editor.toString());
+        Profile allowedAccessLevelProfile = Profile.valueOf(allowedProfileLevel);
+
         if (profile != Profile.Administrator) {
             if (CollectionUtils.isEmpty(recordIdentifier) &&
                 CollectionUtils.isEmpty(uuid)) {
@@ -704,7 +712,12 @@ public List<MetadataStatusResponse> getWorkflowStatusByType(
             if (!CollectionUtils.isEmpty(recordIdentifier)) {
                 for (Integer recordId : recordIdentifier) {
                     try {
-                        ApiUtils.canEditRecord(String.valueOf(recordId), request);
+                        if (allowedAccessLevelProfile == Profile.RegisteredUser) {
+                            ApiUtils.canViewRecord(String.valueOf(recordId), request);
+                        } else {
+                            ApiUtils.canEditRecord(String.valueOf(recordId), request);
+                        }
+
                     } catch (SecurityException e) {
                         throw new NotAllowedException(ApiParams.API_RESPONSE_NOT_ALLOWED_CAN_EDIT);
                     }
@@ -713,7 +726,12 @@ public List<MetadataStatusResponse> getWorkflowStatusByType(
             if (!CollectionUtils.isEmpty(uuid)) {
                 for (String recordId : uuid) {
                     try {
-                        ApiUtils.canEditRecord(recordId, request);
+                        if (allowedAccessLevelProfile == Profile.RegisteredUser) {
+                            ApiUtils.canViewRecord(recordId, request);
+                        } else {
+                            ApiUtils.canEditRecord(recordId, request);
+                        }
+
                     } catch (SecurityException e) {
                         throw new NotAllowedException(ApiParams.API_RESPONSE_NOT_ALLOWED_CAN_EDIT);
                     }
@@ -1310,4 +1328,5 @@ private void changeMetadataStatus(ServiceContext context, AbstractMetadata metad
         listOfStatusChange.add(metadataStatusValue);
         sa.onStatusChange(listOfStatusChange, true);
     }
+
 }

services/src/main/java/org/fao/geonet/api/records/editing/BatchEditsApi.java

@@ -307,21 +307,4 @@ private Pair<SimpleMetadataProcessingReport, Element> applyBatchEdits(
         return Pair.write(report, preview);
     }
 
-    /**
-     * Checks if the user profile is allowed to batch edit metadata.
-     *
-     * @param userSession
-     */
-    private void checkUserProfileToBatchEditMetadata(UserSession userSession) {
-        if (userSession.getProfile() != Profile.Administrator) {
-            String allowedUserProfileToImportMetadata =
-                StringUtils.defaultIfBlank(settingManager.getValue(Settings.METADATA_BATCH_EDITING_ACCESS_LEVEL), Profile.Editor.toString());
-
-            // Is the user profile is higher than the profile allowed to import metadata?
-            if (!UserUtil.hasHierarchyRole(allowedUserProfileToImportMetadata, this.roleHierarchy)) {
-                throw new NotAllowedException("The user has no permissions to batch edit metadata.");
-            }
-        }
-
-    }
 }

web-ui/src/main/resources/catalog/components/search/mdview/mdviewModule.js

@@ -105,7 +105,7 @@
         gnGlobalSettings.gnCfg.mods.recordview.showStatusTopBarFor;
 
       gnConfigService.load().then(function (c) {
-        $scope.isRecordHistoryEnabled = gnConfig["system.metadata.history.enabled"];
+        $scope.isRecordHistoryEnabled = gnConfig["metadata.history.enabled"];
         $scope.isPreferGroupLogo = gnConfig["system.metadata.prefergrouplogo"];
 
         var statusSystemRating = gnConfig["system.localrating.enable"];

web-ui/src/main/resources/catalog/js/CatController.js

@@ -1866,6 +1866,17 @@
                   : "";
             return angular.isFunction(this[fnName]) ? this[fnName]() : false;
           },
+          canViewMetadataHistory: function () {
+            var profile = gnConfig["metadata.history.accesslevel"] || "Editor",
+              fnName =
+                profile !== ""
+                  ? "is" + profile[0].toUpperCase() + profile.substring(1) + "OrMore"
+                  : "";
+            if (profile === "RegisteredUser") {
+              return true;
+            }
+            return angular.isFunction(this[fnName]) ? this[fnName]() : false;
+          },
           canDeletePublishedMetadata: function () {
             var profile =
                 gnConfig["metadata.delete.profilePublishedMetadata"] || "Editor",

web-ui/src/main/resources/catalog/locales/ca-admin.json

@@ -733,8 +733,8 @@
     "system/metadata/thesaurusNamespace-help": "Based on this pattern, when creating a new thesaurus a namespace will be suggested. The pattern can contain \\{\\{type\\}\\} and \\{\\{filename\\}\\} placeholder for substitution.",
     "system/metadata/validation/removeSchemaLocation": "Eliminar la locatització de l'esquema per a la validació",
     "system/metadata/validation/removeSchemaLocation-help": "Si s'activa, amb el valor true, l'atribut schemaLocation en l'element arrel de la metadada s'elimina durant la validació i en desar la metadata. Això assegura que l'schemaLocation utilitzat per a la metadada és sempre l'esquema local.",
-    "system/metadata/history/enabled": "Habilitar la traçabilitat dels històrics de cada registre",
-    "system/metadata/history/enabled-help": "Quan s'activa, amb el valor 'true', cada esdeveniment que alteri un registre de metadades és registrat a la base de dades.",
+    "metadata/history/enabled": "Habilitar la traçabilitat dels històrics de cada registre",
+    "metadata/history/enabled-help": "Quan s'activa, amb el valor 'true', cada esdeveniment que alteri un registre de metadades és registrat a la base de dades.",
     "system/metadata/allThesaurus-help": "Si s'habilita, un tesaurus virtual es crearà contenint totes les paraules clau dels altres tesaurus. Això és útil quan el nom del tesaurus no és important i només la paraula clau importa. Per assegurar que els blocs de paraules clau es mantenen (amb el nom correcte del tesaurus), habilitar això també s'habilita una transformació en update-fixed-info que assignarà les paraules claus d'aquest tesaurus virtual a blocs amb el tesaurus correcte.",
     "system/metadataprivs": "Privilegis de la metadada",
     "system/metadataprivs/usergrouponly": "Només ajustar privilegis als grups de l'usuari",
@@ -1491,4 +1491,4 @@
     "fieldTooShort": "The value is too short",
     "fieldEmailNotValid": "A valid email address is required",
     "formConfirmExit": "The form has changes, if you exit the changes will be lost. Do you want to exit on the page?"
-}
+}

web-ui/src/main/resources/catalog/locales/cs-admin.json

@@ -733,8 +733,8 @@
     "system/metadata/thesaurusNamespace-help": "Na základě tohoto vzoru bude při vytváření nového tezauru navržen jmenný prostor. Vzor může obsahovat zástupný symbol \\{\\{type\\}\\} a \\{\\{filename\\}\\} pro nahrazení.",
     "system/metadata/validation/removeSchemaLocation": "Odebrat schéma umístění pro ověření",
     "system/metadata/validation/removeSchemaLocation-help": "Je-li pravda, atribut schemaLocation v kořenovém elementu metadat je během ověřování a ukládání metadat odstraněn. Zaručuje, že schemaLocation použité pro metadata je vždy lokální schéma",
-    "system/metadata/history/enabled": "Povolit záznam historie záznamů",
-    "system/metadata/history/enabled-help": "Pokud je to pravda, je v databázi registrována každá událost, která mění záznamy metadat.",
+    "metadata/history/enabled": "Povolit záznam historie záznamů",
+    "metadata/history/enabled-help": "Pokud je to pravda, je v databázi registrována každá událost, která mění záznamy metadat.",
     "system/metadata/allThesaurus-help": "Pokud to platí, bude vytvořen virtuální tezaurus obsahující všechna klíčová slova ve všech ostatních tezaurech. To je užitečné v editoru, kdy není důležitý název tezauru, ale pouze klíčové slovo. Aby bylo možné zajistit uchování správných skupin klíčových slov (se správným názvem tezauru) aktivace této funkce rovněž umožní transformaci do aktualizovat-stanovené-info (update-fixed-info), kterým se přiřadí klíčové slovo do tezauru 'všechny' ke skupinám klíčových slov s odpovídajícím tezaurem pro dané klíčové slovo",
     "system/metadataprivs": "Výhradní práva k metadatům",
     "system/metadataprivs/usergrouponly": "Pouze nastavit výhradní práva ke skupinám uživatele",
@@ -1491,4 +1491,4 @@
     "fieldTooShort": "Hodnota je příliš krátká",
     "fieldEmailNotValid": "Je vyžadována platná e-mailová adresa",
     "formConfirmExit": "Formulář obsahuje změny, pokud jej opustíte, změny budou ztraceny. Chcete stránku opustit?"
-}
+}

web-ui/src/main/resources/catalog/locales/da-admin.json

@@ -733,8 +733,8 @@
     "system/metadata/thesaurusNamespace-help": "Når en ny tesaurus skabes, bliver et namespace baseret på dette mønster foreslået. ",
     "system/metadata/validation/removeSchemaLocation": "Fjern skemaplacering for validering",
     "system/metadata/validation/removeSchemaLocation-help": "Hvis sandt, fjernes schemaLocation-attributten i metadataens rod-element under valideringsprocessen og ved lagring af metadata. Det sikrer, at skemaplaceringen, der bruges til metadataene, altid er det lokale skema",
-    "system/metadata/history/enabled": "Aktiver håndtering af historiske poster",
-    "system/metadata/history/enabled-help": "Hvis denne er sand, registreres ethvert event, som ændrer metadata-instanserne.",
+    "metadata/history/enabled": "Aktiver håndtering af historiske poster",
+    "metadata/history/enabled-help": "Hvis denne er sand, registreres ethvert event, som ændrer metadata-instanserne.",
     "system/metadata/allThesaurus-help": "Hvis slået til, oprettes der en virtuel thesaurus, der indeholder alle søgeord i alle andre thesauri. Dette er nyttigt i editoren, når navnet på thesaurusen er ubetydeligt, og kun nøgleordet er vigtigt. For at sikre, at de korrekte nøgleordsblokke vedligeholdes (med korrekt thesaurus navn) aktiverer denne indstilling også en transformation i update-fixed-info, der vil tildele søgeordet i 'alle' thesaurus til nøgleordsblokke med den korrekte thesaurus som nøgleord.",
     "system/metadataprivs": "Metadata privilegier",
     "system/metadataprivs/usergrouponly": "Indstil kun privilegier til brugerens grupper",
@@ -1491,4 +1491,4 @@
     "fieldTooShort": "Værdien er for kort",
     "fieldEmailNotValid": "En valid e-mail er nødvendig",
     "formConfirmExit": "The form has changes, if you exit the changes will be lost. Do you want to exit on the page?"
-}
+}

web-ui/src/main/resources/catalog/locales/de-admin.json

@@ -733,8 +733,8 @@
     "system/metadata/thesaurusNamespace-help": "Basierend auf diesem Muster wird beim Erstellen eines neuen Thesaurus ein Namensraum vorgeschlagen. Das Muster kann die Platzhalter \\{\\{type\\}\\} und \\{\\{filename\\}\\} für die Ersetzung enthalten.",
     "system/metadata/validation/removeSchemaLocation": "Entfernen Sie den Schemapfad zur Validierung",
     "system/metadata/validation/removeSchemaLocation-help": "Wenn zutreffend (true), wird das schemaLocation-Attribut im Stammelement der Metadaten während der Validierung und beim Speichern der Metadaten entfernt. Dadurch wird sichergestellt, dass die für die Metadaten verwendete schemaLocation immer das lokale Schema ist",
-    "system/metadata/history/enabled": "Aktivieren der Aufzeichnung der History",
-    "system/metadata/history/enabled-help": "Wenn zutreffend (true), wird jedes Ereignis, das Metadatensätze ändert, in der Datenbank registriert.",
+    "metadata/history/enabled": "Aktivieren der Aufzeichnung der History",
+    "metadata/history/enabled-help": "Wenn zutreffend (true), wird jedes Ereignis, das Metadatensätze ändert, in der Datenbank registriert.",
     "system/metadata/allThesaurus-help": "Wenn das Feld ausgewählt ist, wird ein virtueller Thesaurus generiert, der alle Schlagwörter aller anderen Thesauri enthält. Dies ist nützlich im Editor, wenn der Name des Thesaurus unwichtig ist und nur die Schlagwörter von Bedeutung sind. Um sicherzustellen, dass die richtigen Schlagwort-Blöcke (des korrekten Thesaurus-Namens) bearbeitet werden, wird gleichzeitig eine Transformation in update-fixed-info.xsl durchgeführt.",
     "system/metadataprivs": "Metadaten Berechtigungen",
     "system/metadataprivs/usergrouponly": "Nur Berechtigungen an die Gruppen der Nutzer vergeben",

web-ui/src/main/resources/catalog/locales/en-admin.json

@@ -733,8 +733,8 @@
     "system/metadata/thesaurusNamespace-help": "Based on this pattern, when creating a new thesaurus a namespace will be suggested. The pattern can contain \\{\\{type\\}\\} and \\{\\{filename\\}\\} placeholder for substitution.",
     "system/metadata/validation/removeSchemaLocation": "Remove schema location for validation",
     "system/metadata/validation/removeSchemaLocation-help": "If true, the schemaLocation attribute in root element of the metadata is removed during validation and on metadata save. It ensures that the schemaLocation used for the metadata is always the local schema one",
-    "system/metadata/history/enabled": "Enable record history recording",
-    "system/metadata/history/enabled-help": "When true, every event that alters metadata records is registered in the database.",
+    "metadata/history/enabled": "Enable record history recording",
+    "metadata/history/enabled-help": "When true, every event that alters metadata records is registered in the database.",
     "system/metadata/allThesaurus-help": "If true then a virtual thesaurus will be created that contains all keywords in all other thesauri.  This is useful in editor when the name of the thesaurus is unimportant and only the keyword is important.  In order to ensure that the correct keyword blocks are maintained (with correct thesaurus name) enabling this will also enable a transform in update-fixed-info that will assign the keyword in the 'all' thesaurus to keyword blocks with the correct thesaurus for the keyword",
     "system/metadataprivs": "Metadata privileges",
     "system/metadataprivs/usergrouponly": "Only set privileges to user's groups",
@@ -883,6 +883,9 @@
     "metadata/publication/profilePublishMetadata-help": "Minimum user profile allowed to publish metadata (Reviewer or Administrator). The default value is Reviewer.",
     "metadata/publication/profileUnpublishMetadata": "Minimum user profile allowed to un-publish metadata",
     "metadata/publication/profileUnpublishMetadata-help": "Minimum user profile allowed to un-publish metadata (Reviewer or Administrator). The default value is Reviewer.",
+    "metadata/history": "Metadata History",
+    "metadata/history/accesslevel": "Select the minimum user profile allowed to view metadata history",
+    "metadata/history/accesslevel-help": "Select the user profile allowed to view metadata history (Registered User, Editor or Administrator). The Registered User configuration can view the history with view permission granted to the metadata record. The Editor configuration can view the history with editing permission granted to the metadata record. The default value is Editor.",
     "filterStatusByAuthor":"Status author",
     "filterStatusByOwner":"Status owner",
     "filterStatusByRecordId":"Record identifier",