{"action":"closed","issue":{"url":"https://api.github.com/repos/uclibs/scholar_uc/issues/250","labels_url":"https://api.github.com/repos/uclibs/scholar_uc/issues/250/labels{/name}","comments_url":"https://api.github.com/repos/uclibs/scholar_uc/issues/250/comments","events_url":"https://api.github.com/repos/uclibs/scholar_uc/issues/250/events","html_url":"https://github.com/uclibs/scholar_uc/issues/250","id":56609568,"number":250,"title":"Embargo plus delegate: inconsistencies","user":{"login":"newmanld","id":3521707,"avatar_url":"https://avatars.githubusercontent.com/u/3521707?v=3","gravatar_id":"","url":"https://api.github.com/users/newmanld","html_url":"https://github.com/newmanld","followers_url":"https://api.github.com/users/newmanld/followers","following_url":"https://api.github.com/users/newmanld/following{/other_user}","gists_url":"https://api.github.com/users/newmanld/gists{/gist_id}","starred_url":"https://api.github.com/users/newmanld/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/newmanld/subscriptions","organizations_url":"https://api.github.com/users/newmanld/orgs","repos_url":"https://api.github.com/users/newmanld/repos","events_url":"https://api.github.com/users/newmanld/events{/privacy}","received_events_url":"https://api.github.com/users/newmanld/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/uclibs/scholar_uc/labels/3%20-%20Done","name":"3 - Done","color":"CCCCCC"},{"url":"https://api.github.com/repos/uclibs/scholar_uc/labels/bug","name":"bug","color":"fc2929"}],"state":"closed","locked":false,"assignee":{"login":"scherztc","id":5084562,"avatar_url":"https://avatars.githubusercontent.com/u/5084562?v=3","gravatar_id":"","url":"https://api.github.com/users/scherztc","html_url":"https://github.com/scherztc","followers_url":"https://api.github.com/users/scherztc/followers","following_url":"https://api.github.com/users/scherztc/following{/other_user}","gists_url":"https://api.github.com/users/scherztc/gists{/gist_id}","starred_url":"https://api.github.com/users/scherztc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/scherztc/subscriptions","organizations_url":"https://api.github.com/users/scherztc/orgs","repos_url":"https://api.github.com/users/scherztc/repos","events_url":"https://api.github.com/users/scherztc/events{/privacy}","received_events_url":"https://api.github.com/users/scherztc/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/uclibs/scholar_uc/milestones/20","html_url":"https://github.com/uclibs/scholar_uc/milestones/Sprint%20Ending%204/17/2015","labels_url":"https://api.github.com/repos/uclibs/scholar_uc/milestones/20/labels","id":1047517,"number":20,"title":"Sprint Ending 4/17/2015","description":"","creator":{"login":"scherztc","id":5084562,"avatar_url":"https://avatars.githubusercontent.com/u/5084562?v=3","gravatar_id":"","url":"https://api.github.com/users/scherztc","html_url":"https://github.com/scherztc","followers_url":"https://api.github.com/users/scherztc/followers","following_url":"https://api.github.com/users/scherztc/following{/other_user}","gists_url":"https://api.github.com/users/scherztc/gists{/gist_id}","starred_url":"https://api.github.com/users/scherztc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/scherztc/subscriptions","organizations_url":"https://api.github.com/users/scherztc/orgs","repos_url":"https://api.github.com/users/scherztc/repos","events_url":"https://api.github.com/users/scherztc/events{/privacy}","received_events_url":"https://api.github.com/users/scherztc/received_events","type":"User","site_admin":false},"open_issues":9,"closed_issues":5,"state":"open","created_at":"2015-03-31T18:23:31Z","updated_at":"2015-04-17T17:56:46Z","due_on":"2015-04-17T04:00:00Z","closed_at":null},"comments":7,"created_at":"2015-02-05T00:24:34Z","updated_at":"2015-04-17T17:56:46Z","closed_at":"2015-04-17T17:56:46Z","body":"Testing on our sandbox yielded these inconsistencies, worth confirming with further tests:\r\n \r\nA submitter (let's call them the owner) assigns someone to be their delegate.\r\n  \r\nScenario 1:  As the delegate, I submit a work on behalf of the owner, and embargo that work.  While the work is embargoed:\r\n \r\n* Someone who is not logged in does not find the work.  If they happened to know the url for the work, they would see an unauthorized message if they tried to go to it directly.\r\n* The delegate can find the work from a search or browse, can edit the work, and can display an attached file.\r\n* The owner however cannot find the work from a search or browse.  (And this is despite the fact that our app automatically assigned the owner to be an editor as well as the work owner.) \r\n* If the owner knows the url for the work, they can display the work show page.  But from the work show page they cannot display the attached file.\r\n* From the work show page, the owner can edit the work (and presumably remove the embargo).   Assumption: The owner should be able to do the things they cannot do, because they are the work owner.\r\n \r\nScenario 2:  The owner submits a work and embargoes that work.  While the work is embargoed:\r\n \r\n* Someone who is not logged in does not find the work.  If they happened to know the url for the work, they would see an unauthorized message if they tried to go to it directly.\r\n* The owner can find the work from a search or browse, can edit the work, and can display an attached file.\r\n* The delegate however cannot find the work from a search or browse.  \r\n* If the delegate knows the url for the work, they can display the work show page.  From the work show page they cannot display the attached file.\r\n* From the work show page, the delegate can edit the work (and presumably remove the embargo).  Assumption: The delegate should be able to do the things they cannot do, because as a delegate they should have access to all the owners works, consistent with non-embargoed private works.\r\n \r\nVariation: As the owner, I returned to the work, edited it, and assigned my delegate to also be an editor of my work.  This did not allow the delegate to find the work, but it did allow them to display the attached file.\r\n \r\nI have not tested how embargoes affect the rights of editors or members of editor groups (with delegates out of the mix).\r\n\r\nScenario 3:\r\nAfter creating both of the works above, I created two new users, not connected to the owner or delegate as editors.  The first new user had similarities in the email address, both the delegate and new user had the same characters before the @ sign -- one being xxxxxx@ucmail.uc.edu and the other being xxxxxx@gmail.com.  Logged in as the new user with similar email address, I can see in the search results the embargoed work created by the delegate.  When I try to display the work, I see an 'Unauthorized' message.  \r\n\r\nI created a second new user (nobody@nobody.com) without any similarity in email address, and logged in as that user I did not find either of the two embargoed works.  This too requires further testing, and confirmation as to whether the similarities in email address are key or coincidental.\r\n\r\n<!---\r\n@huboard:{\"order\":125.5,\"milestone_order\":250,\"custom_state\":\"\"}\n-->\r\n"}}