Skip to content

fix(config): disallow versioning for external DOIs #973

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
TahaKhan998 wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix(config): disallow versioning for external DOIs #973

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions invenio.cfg
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -701,6 +701,12 @@ RDM_CUSTOM_FIELDS_UI = CUSTOM_FIELDS_UI
# Require files for user upload
RDM_ALLOW_METADATA_ONLY_RECORDS = False

# Zenodo-style: block new versions for records with an external DOI
# (provider=external). Only the system process can create a new version.
# Owners and community curators can still change files on those records via
# can_modify_locked_files (unlock on edit), without versioning.
RDM_ALLOW_EXTERNAL_DOI_VERSIONING = False

THEME_MATHJAX_CDN = (
"//cdnjs.cloudflare.com/ajax/libs/mathjax/3.2.2/es5/tex-mml-chtml.js"
"?config=TeX-AMS-MML_HTMLorMML"
Expand Down
9 changes: 9 additions & 0 deletions site/cds_rdm/permissions.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,10 @@
DefaultPreservationInfoPermissionPolicy,
)
from invenio_rdm_records.services.generators import (
IfExternalDOIRecord,
IfRecordDeleted,
RecordCommunitiesAction,
RecordOwners,
)
from invenio_rdm_records.services.permissions import (
RDMRecordPermissionPolicy,
Expand Down Expand Up @@ -119,10 +121,17 @@ class CDSRDMRecordPermissionPolicy(RDMRecordPermissionPolicy):

can_manage_clc_sync = [Librarian(), Administration(), SystemProcess()]

# External DOI records cannot be versioned when
# RDM_ALLOW_EXTERNAL_DOI_VERSIONING is False. Allow owners and community
# curators to unlock/edit files on those records without a new version.
can_modify_locked_files = [
Administration(),
InspireHarvester(),
SystemProcess(),
IfExternalDOIRecord(

@zzacharo zzacharo Oct 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it might be more complex than this, see the file modification grace period

@kpsherva kpsherva Oct 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

in the scope of this PR I think it will not be?

@zzacharo zzacharo Oct 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

depends what this line mean.... anyway my point is, we need to document and know in the case of external DOIs what is the file modification policy:

  • do we always allow file modifications?
  • is there a file modification grace period and then it is blocked?

this is more essential now that we have blocked newer versions for the external DOIs.

@TahaKhan998 TahaKhan998 Oct 2, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So what i discovered is that both paths go through RDMDraftFilesComponent on publish. Admins unlock files first, so they don't have modify_locked_files and they hit the 30-day grace period in that component. Owners and curators on external DOI records do get modify_locked_files, so on this line:

or can_modify_locked_files

that is True for them, which makes not (can_manage_files or can_modify_locked_files) false, so the whole grace-period if is skipped and they can edit files as much as they want on that version.
image

then_=[RecordOwners(), RecordCommunitiesAction("curate")],
else_=[],
),
]

can_manage_files = RDMRecordPermissionPolicy.can_manage_files + [
Expand Down
Loading