From a0200f7e6db8244cc615856a94a4065c76bf8cd9 Mon Sep 17 00:00:00 2001
From: Mohammed Taha Khan <mohammed.taha.khan@cern.ch>
Date: Thu, 1 Oct 2026 13:50:57 +0200
Subject: [PATCH] fix(config): block external DOI versioning, allow file edits

---
 invenio.cfg                 | 6 ++++++
 site/cds_rdm/permissions.py | 9 +++++++++
 2 files changed, 15 insertions(+)

diff --git a/invenio.cfg b/invenio.cfg
index b2afdef5..6c7d1eac 100644
--- a/invenio.cfg
+++ b/invenio.cfg
@@ -701,6 +701,12 @@ RDM_CUSTOM_FIELDS_UI = CUSTOM_FIELDS_UI
 # Require files for user upload
 RDM_ALLOW_METADATA_ONLY_RECORDS = False
 
+# Zenodo-style: block new versions for records with an external DOI
+# (provider=external). Only the system process can create a new version.
+# Owners and community curators can still change files on those records via
+# can_modify_locked_files (unlock on edit), without versioning.
+RDM_ALLOW_EXTERNAL_DOI_VERSIONING = False
+
 THEME_MATHJAX_CDN = (
     "//cdnjs.cloudflare.com/ajax/libs/mathjax/3.2.2/es5/tex-mml-chtml.js"
     "?config=TeX-AMS-MML_HTMLorMML"
diff --git a/site/cds_rdm/permissions.py b/site/cds_rdm/permissions.py
index 6e5cc67f..c537d929 100644
--- a/site/cds_rdm/permissions.py
+++ b/site/cds_rdm/permissions.py
@@ -17,8 +17,10 @@
     DefaultPreservationInfoPermissionPolicy,
 )
 from invenio_rdm_records.services.generators import (
+    IfExternalDOIRecord,
     IfRecordDeleted,
     RecordCommunitiesAction,
+    RecordOwners,
 )
 from invenio_rdm_records.services.permissions import (
     RDMRecordPermissionPolicy,
@@ -119,10 +121,17 @@ class CDSRDMRecordPermissionPolicy(RDMRecordPermissionPolicy):
 
     can_manage_clc_sync = [Librarian(), Administration(), SystemProcess()]
 
+    # External DOI records cannot be versioned when
+    # RDM_ALLOW_EXTERNAL_DOI_VERSIONING is False. Allow owners and community
+    # curators to unlock/edit files on those records without a new version.
     can_modify_locked_files = [
         Administration(),
         InspireHarvester(),
         SystemProcess(),
+        IfExternalDOIRecord(
+            then_=[RecordOwners(), RecordCommunitiesAction("curate")],
+            else_=[],
+        ),
     ]
 
     can_manage_files = RDMRecordPermissionPolicy.can_manage_files + [