documents: improve files permissions

[sebdeleze]

This PR improves files permissions to match what is currently implemented in RERO DOC.

• Installs netaddr library to check if an IP is in a specific range.
• Adds a function to check if an IP is in a list of ranges.
• Refactors get_file_restriction function, to apply the right rules for adding restriction to file.
• Refactors command for importing permissions from RERO DOC.
• Adds a new property access in files metadata in order to specify the access type and modify restricted property to be more explicit.
• Adds a new property allowedIps to organisation JSON schema, to store allowed IPs for the organisation.
• Adds a new property allowedIps to organisation elasticsearch mapping.
• Serializes allowedIps to get this property in API calls.
• Displays embargo date only if file is not restricted.
• Closes Check files permissions #328.

Co-Authored-by: Sébastien Délèze sebastien.deleze@rero.ch

[pronguen]

• For the field "restricted" in the file management, I would put these two labels "Access only from the organisation's IP addresses", "No access". The code can be anything.
• The field "restricted" should not be displayed if I choose for "access=c_abf2" (open access). In general, the fields "access" and "restricted" are difficult to understand. Ideally we would have only one list with subfields that appear according to the chosen option. Suggestion (see if it is easily feasible):
  • open access
  • open access with embargo
    • embargo date
    • toggle "Access only from the organisation's IP addresses"
  • no access
    • toggle "Access only from the organisation's IP addresses"
• I put my RERO IP address in the organisation (153.109.157.100) and uploaded a file with "restricted=outside_organisation". But I cannot access the file. It is this document.

[sebdeleze]

• For the field "restricted" in the file management, I would put these two labels "Access only from the organisation's IP addresses", "No access". The code can be anything.

• The field "restricted" should not be displayed if I choose for "access=c_abf2" (open access). In general, the fields "access" and "restricted" are difficult to understand. Ideally we would have only one list with subfields that appear according to the chosen option. Suggestion (see if it is easily feasible):

  • open access

  • open access with embargo

    • embargo date
    • toggle "Access only from the organisation's IP addresses"

  • no access

    • toggle "Access only from the organisation's IP addresses"

Done
Nico: The new structure is good! The toggle should be rather "Access allowed from the organisation's IP addresses" (sorry for the wrong proposal 😬 )

• I put my RERO IP address in the organisation (153.109.157.100) and uploaded a file with "restricted=outside_organisation". But I cannot access the file. It is this document.

Done
Nico: I am still not able to test it. It does not seem to work. Check IP inserted here with this document. Probably due to VPN. Not prioritary.