invenio.cfg

"""
InvenioRDM settings for CaltechDATA project.

This file was automatically generated by 'invenio-cli init'.

For the full list of settings and their values, see
https://inveniordm.docs.cern.ch/reference/configuration/.
"""

import idutils
from invenio_rdm_records.services.pids import providers


def _(x):  # needed to avoid start time failure with lazy strings
    return x


from invenio_saml.handlers import acs_handler_factory

# NOTE: Per Tom's conversation with community the following
# end point do not need to be changed, they are internal to Invenio RDM
SSO_SAML_DEFAULT_BLUEPRINT_PREFIX = "/saml"
"""Base URL for the extensions endpoint."""

SSO_SAML_DEFAULT_METADATA_ROUTE = "/metadata/<idp>"
"""URL route for the metadata request."""

SSO_SAML_DEFAULT_SSO_ROUTE = "/login/<idp>"
"""URL route for the SP login."""

SSO_SAML_DEFAULT_ACS_ROUTE = "/authorized/<idp>"
"""URL route to handle the IdP login request."""

SSO_SAML_DEFAULT_SLO_ROUTE = "/slo/<idp>"
"""URL route for the SP logout."""

SSO_SAML_DEFAULT_SLS_ROUTE = "/sls/<idp>"
"""URL route to handle the IdP logout request."""

# NOTE: This section needs to be updated to
# replace site settings.
SSO_SAML_IDPS = {
    # name your authentication provider
    "caltechdata_sso": {
        # Basic info
        "title": "access.caltech",
        "description": "SAML Authentication Service",
        "icon": "",
        # path to the file i.e. "./saml/sp.crt"
        "sp_cert_file": "./saml/sp.crt",
        # path to the file i.e. "./saml/sp.key"
        "sp_key_file": "./saml/sp.key",
        "settings": {
            # If strict is True, then the Python Toolkit will reject unsigned
            # or unencrypted messages if it expects them to be signed or encrypted.
            # Also it will reject the messages if the SAML standard is not strictly
            # followed. Destination, NameId, Conditions ... are validated too.
            "strict": True,
            # Enable debug mode (outputs errors).
            "debug": True,
            # Service Provider Data that we are deploying.
            "sp": {
                # Specifies the constraints on the name identifier to be used to
                # represent the requested subject.
                # Take a look on https://github.com/onelogin/python-saml/blob/master/src/onelogin/saml2/constants.py
                # to see the NameIdFormat that are supported.
                "NameIDFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified",
                #'NameIDFormat': 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
                #'NameIDFormat': 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
            },
            # Identity Provider Data that we want connected with our SP.
            "idp": {
                # Identifier of the IdP entity  (must be a URI)
                "entityId": "https://idp.caltech.edu/idp/shibboleth",
                # SSO endpoint info of the IdP. (Authentication Request protocol)
                "singleSignOnService": {
                    # URL Target of the IdP where the Authentication Request Message
                    # will be sent.
                    "url": "https://idp.caltech.edu/idp/profile/SAML2/Redirect/SSO",
                    # SAML protocol binding to be used when returning the <Response>
                    # message. OneLogin Toolkit supports the HTTP-Redirect binding
                    # only for this endpoint.
                    "binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
                },
                # SLO endpoint info of the IdP.
                "singleLogoutService": {
                    # URL Location where the <LogoutRequest> from the IdP will be sent (IdP-initiated logout)
                    "url": "https://idp.caltech.edu/idp/profile/Logout",
                    # SAML protocol binding to be used when returning the <Response>
                    # message. OneLogin Toolkit supports the HTTP-Redirect binding
                    # only for this endpoint.
                    "binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
                },
                # Public X.509 certificate of the IdP
                "x509cert": """-----BEGIN CERTIFICATE-----
MIIDJzCCAg+gAwIBAgIUC0Z5A7Hz0aGgHdvfgWBw/TW939IwDQYJKoZIhvcNAQEF
BQAwGjEYMBYGA1UEAxMPaWRwLmNhbHRlY2guZWR1MB4XDTEwMDIwNDAwMzgxNFoX
DTMwMDIwNDAwMzgxNFowGjEYMBYGA1UEAxMPaWRwLmNhbHRlY2guZWR1MIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAjUfvISEj5BkXO8k4dKr7C1NdlDIs
osNxbjP39/8oVwgGaMSnkfMhY6xct9gnxTzCRXe49MU+UyVRlljTqTeIJf8VG0K2
aPSRk9xpzWje/fEkUHgpOjLDM0TNB2tWIQbHQwHz7HsuB/Au870PBMv4EfVz4us8
yTmYvY2ZJPe192BnIbNyLub138HXjr7TrLBxMg7KulnanGnN75UrVjueRzAvFZlE
lAZ+shDsjVYAoceEaFn7TF37ehVdjbXwOegtu+vU0kjjCS3cQUXXOs1Ojz6Vood/
oP1SOisW3bEhboKMUCWEcDckUXHVd/qCekbUsJEt5KAK6Gmf5Ygha748kQIDAQAB
o2UwYzBCBgNVHREEOzA5gg9pZHAuY2FsdGVjaC5lZHWGJmh0dHBzOi8vaWRwLmNh
bHRlY2guZWR1L2lkcC9zaGliYm9sZXRoMB0GA1UdDgQWBBRlqKQBRnVFASGfdigd
a/ihuq365zANBgkqhkiG9w0BAQUFAAOCAQEAck8P9JfpOWTpgc4LCyaY3WiJFIGe
WT25D+6Gj7ADxj7+o2UZCcB2sI5LvyFJaetQSB/7p0F+hmU8/csunwoWARnbOcJt
SmbyiJQ6eKUXOklOEqxEpGZRa2MbRwukfVx+v6U3N75JxoyuNfqC/G3tKzOIo4qz
uxiE+1ntesuGTmWuLx9dIKILJ6XuD/rmGSkeKWljLC1jNQEjHioskqIFhcF1JxDv
qnn8IBfnaoc4GX6AV3fEHifdQEOu7GdicUeA8o+cKqddCZf1PoUTSPby1NcFeDO6
PPYq4pWYGD1Sc8SOXB+99YOD8hJObGIcskF0VRwv1Kg7rrTBqPLic7kcRA==
-----END CERTIFICATE-----""",
            },
            # Security settings
            # more on https://github.com/onelogin/python-saml
            "security": {
                "authnRequestsSigned": False,
                "failOnAuthnContextMismatch": False,
                "logoutRequestSigned": False,
                "logoutResponseSigned": False,
                "metadataCacheDuration": None,
                "metadataValidUntil": None,
                "nameIdEncrypted": False,
                "requestedAuthnContext": False,
                "requestedAuthnContextComparison": "exact",
                "signMetadata": False,
                "signatureAlgorithm": "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
                "wantAssertionsEncrypted": False,
                "wantAssertionsSigned": False,
                "wantAttributeStatement": False,
                "wantMessagesSigned": False,
                "wantNameId": True,
                "wantNameIdEncrypted": False,
                "digestAlgorithm": "http://www.w3.org/2001/04/xmlenc#sha256",
            },
        },
        # Account Mapping
        # Based on URN to OID mapping found at UCLA
        # https://spaces.ais.ucla.edu/display/iamucladocs/Mapping+of+URN+Attributes+and+OID+Attributes
        # And U. Bamberg's kind help.
        "mappings": {
            # EMail maps to mail in our attribute list.
            "email": "urn:oid:0.9.2342.19200300.100.1.3",
            # Name is "givenName" value?
            "name": "urn:oid:2.5.4.42",
            # In Bamberg example this maps to "sn", which I think is surname
            # in our attributes.
            "surname": "urn:oid:2.5.4.4",
            # In Bamberg example this looks like LDAP "cn" or commonName?
            # Trying eduPersonPrincipleName (e.g. rsdoiel@caltech.edu)
            # "external_id": "urn:oid:2.5.4.3",
            "external_id": "urn:oid:1.3.6.1.4.1.5923.1.1.1.6",
        },
        # Inject your remote_app to handler
        # Note: keep in mind the string should match
        # given name for authentication provider
        "acs_handler": acs_handler_factory("caltechdata_sso"),
        "auto_confirm": True,
    }
}

from datetime import datetime
from invenio_i18n import lazy_gettext as _

# Setup for migration
RATELIMIT_AUTHENTICATED_USER = "25000 per hour;500 per minute"

# Setup deposit form quota
APP_RDM_DEPOSIT_FORM_QUOTA = {
    "maxFiles": 550,
    "maxStorage": 1000 * (10**9),
}
RDM_FILES_DEFAULT_QUOTA_SIZE = 1000 * 10**9
FILES_REST_DEFAULT_QUOTA_SIZE = 1000 * 10**9
RDM_FILES_DEFAULT_MAX_FILE_SIZE = 50 * 10**9
FILES_REST_DEFAULT_MAX_FILE_SIZE = 50 * 10**9
RDM_RECORDS_MAX_FILES_COUNT = 550

APP_RDM_DEPOSIT_NG_FILES_UI_ENABLED = False

# Flask
# =====
# See https://flask.palletsprojects.com/en/1.1.x/config/

# Since HAProxy and Nginx route all requests no matter the host header
# provided, the allowed hosts variable is set to localhost. In production it
# should be set to the correct host and it is strongly recommended to only
# route correct hosts to the application.
TRUSTED_HOSTS = ["data.caltech.edu"]


# Flask-SQLAlchemy
# ================
# See https://flask-sqlalchemy.palletsprojects.com/en/2.x/config/

# TODO: Set
SQLALCHEMY_DATABASE_URI = (
    "postgresql+psycopg2://caltechdata:caltechdata@localhost/caltechdata"
)


# Invenio-App
# ===========
# See https://invenio-app.readthedocs.io/en/latest/configuration.html

APP_DEFAULT_SECURE_HEADERS = {
    "content_security_policy": {
        "default-src": [
            "'self'",
            "data:",  # for fonts
            "'unsafe-inline'",  # for inline scripts and styles
            "blob:",  # for pdf preview
            "maxcdn.bootstrapcdn.com",  # mathjax
            "cdnjs.cloudflare.com",  # mathjax
            # Add your own policies here (e.g. analytics)
            "media.library.caltech.edu",
        ],
        "script-src": [
            "'self'",
            "blob:",
            "'wasm-unsafe-eval'",  # for WASM-based workers
            # Multipart file uploads use a Web Worker running `hash-wasm` to compute content checksums
            # (e.g., MD5) of uploaded parts. This requires both 'blob:' and 'wasm-unsafe-eval' enabled in `script-src`.
            "'unsafe-inline'",
            "cdn.matomo.cloud",
            "media.library.caltech.edu",
        ],
    },
    "content_security_policy_report_only": False,
    "content_security_policy_report_uri": None,
    "force_file_save": False,
    "force_https": True,
    "force_https_permanent": False,
    "frame_options": "sameorigin",
    "frame_options_allow_from": None,
    "session_cookie_http_only": True,
    "session_cookie_secure": True,
    "strict_transport_security": True,
    "strict_transport_security_include_subdomains": True,
    "strict_transport_security_max_age": 31556926,  # One year in seconds
    "strict_transport_security_preload": False,
}


# Flask-Babel
# ===========
# See https://flask-babel.tkte.ch/#configuration

# Default locale (language)
BABEL_DEFAULT_LOCALE = "en"
# Default time zone
BABEL_DEFAULT_TIMEZONE = "UTC"


# Invenio-I18N
# ============
# See https://invenio-i18n.readthedocs.io/en/latest/configuration.html

# Other supported languages (do not include BABEL_DEFAULT_LOCALE in list).
I18N_LANGUAGES = [
    # ('de', _('German')),
    # ('tr', _('Turkish')),
]


# Invenio-Theme
# =============
# See https://invenio-theme.readthedocs.io/en/latest/configuration.html

#: Site name.
THEME_SITENAME = "CaltechDATA"
# Frontpage title
THEME_FRONTPAGE_TITLE = "CaltechDATA"
# Header logo
THEME_LOGO = "images/CaltechDATA-by-Caltech-Library-blue-with-padding.svg"
THEME_TRACKINGCODE_TEMPLATE = "./invenio_theme/trackingcode.html"
# Allow matomo endpoint in the CSP rules
APP_DEFAULT_SECURE_HEADERS["content_security_policy"]["default-src"].append(
    "https://cdn.matomo.cloud"
)
APP_DEFAULT_SECURE_HEADERS["content_security_policy"]["default-src"].append(
    "https://caltechlibrary.matomo.cloud"
)
THEME_GOOGLE_SITE_VERIFICATION = ["S9ahhSTJNJrGXH8CLzN9O29lYE5sbaFyCLkdCXHU24U"]

# Invenio-App-RDM
# ===============
# See https://invenio-app-rdm.readthedocs.io/en/latest/configuration.html

APP_RDM_DETAIL_SIDE_BAR_TEMPLATES = [
    "invenio_app_rdm/records/details/side_bar/manage_menu.html",
    "invenio_app_rdm/records/details/side_bar/metrics.html",
    "invenio_app_rdm/records/details/side_bar/versions.html",
    "invenio_app_rdm/records/details/side_bar/external_resources.html",
    "invenio_app_rdm/records/details/side_bar/keywords_subjects.html",
    "invenio_app_rdm/records/details/side_bar/details.html",
    "invenio_app_rdm/records/details/side_bar/locations.html",
    "invenio_app_rdm/records/details/side_bar/licenses.html",
    "invenio_app_rdm/records/details/side_bar/communities.html",
    "invenio_app_rdm/records/details/side_bar/export.html",
    "invenio_app_rdm/records/details/side_bar/technical_metadata.html",
]

# Instance's theme entrypoint file. Path relative to the ``assets/`` folder.
INSTANCE_THEME_FILE = "./less/theme.less"

# Invenio-Files-Rest
# ==================
FILES_REST_STORAGE_FACTORY = "invenio_s3.s3fs_storage_factory"

# Invenio-S3
# ==========
S3_ENDPOINT_URL = "https://caltech2.osn.mghpcc.org"

S3_CONFIG_EXTRA = {
    "request_checksum_calculation": "WHEN_REQUIRED",
    "response_checksum_validation": "WHEN_REQUIRED",
}

# Allow S3 endpoint in the CSP rules
APP_DEFAULT_SECURE_HEADERS["content_security_policy"]["default-src"].append(
    S3_ENDPOINT_URL
)


# Invenio-Records-Resources
# =========================
# See https://github.com/inveniosoftware/invenio-records-resources/blob/master/invenio_records_resources/config.py

SITE_UI_URL = "https://data.caltech.edu"

SITE_API_URL = "https://data.caltech.edu/api"

APP_RDM_DEPOSIT_FORM_DEFAULTS = {
    "publication_date": lambda: datetime.now().strftime("%Y-%m-%d"),
    "rights": [
        {
            "id": "cc0-1.0",
            "title": "Creative Commons Zero v1.0 Universal",
            "description": (
                "CC0 waives copyright interest in a work you've "
                " created and dedicates it to the world-wide public domain. CC0 "
                " is recommended for datasets to ensure your work has the "
                " widest reach."
            ),
            "link": "https://creativecommons.org/publicdomain/zero/1.0/legalcode",
        }
    ],
    "publisher": "CaltechDATA",
}

# See https://github.com/inveniosoftware/invenio-app-rdm/blob/master/invenio_app_rdm/config.py
APP_RDM_DEPOSIT_FORM_AUTOCOMPLETE_NAMES = "search"  # "search_only" or "off"

RDM_CITATION_STYLES = [
    ("apa", _("APA")),
    ("american-chemical-society", _("ACS")),
    ("ieee", _("IEEE")),
    ("chicago-author-date", _("Chicago")),
    ("science", _("Science")),
    ("bibtex", _("Bibtex")),
]

RDM_SEARCH = {
    "facets": ["resource_type", "subject", "access_status", "file_type"],
    "sort": [
        "bestmatch",
        "newest",
        "oldest",
        "version",
        "mostviewed",
        "mostdownloaded",
        "updated-desc",
        "updated-asc",
    ]
}

# Invenio-RDM-Records
# ===================
# See https://inveniordm.docs.cern.ch/customize/dois/
DATACITE_ENABLED = True
DATACITE_USERNAME = "CALTECH.DATA"
DATACITE_PREFIX = "10.22002"
DATACITE_TEST_MODE = False
DATACITE_DATACENTER_SYMBOL = ""


def should_have_parent_doi(rec):
    if rec.parent.communities != {}:
        # ETDB should not get parent DOIs since it's a closed collection with no versioning
        if "0497183f-f3b1-483d-b8bb-133c731c939a" in rec.parent.communities.ids:
            return False
        # GPS Theses records do not need versioning, so they should not get parent DOIs
        if "9b91e752-8db6-49e9-8311-6dd6bd4a3064" in rec.parent.communities.ids:
            return False
    if rec.pids.get("doi", {}).get("provider") == "datacite":
        return True
    else:
        return False


RDM_PERSISTENT_IDENTIFIERS = {
    # DOI automatically removed if DATACITE_ENABLED is False.
    "doi": {
        "providers": ["datacite", "external"],
        "required": True,
        "label": _("DOI"),
        "validator": idutils.is_doi,
        "normalizer": idutils.normalize_doi,
        "is_enabled": providers.DataCitePIDProvider.is_enabled,
        "ui": {"default_selected": "no"},
    },
    "oai": {
        "providers": ["oai"],
        "required": True,
        "label": _("OAI"),
        "is_enabled": providers.OAIPIDProvider.is_enabled,
    },
}

RDM_PARENT_PERSISTENT_IDENTIFIERS = {
    "doi": {
        "providers": ["datacite"],
        "required": True,
        "condition": should_have_parent_doi,
        "label": _("Concept DOI"),
        "validator": idutils.is_doi,
        "normalizer": idutils.normalize_doi,
        "is_enabled": providers.DataCitePIDProvider.is_enabled,
    },
}
"""Persistent identifiers for parent record."""

# Authentication - Invenio-Accounts and Invenio-OAuthclient
# =========================================================
# See: https://inveniordm.docs.cern.ch/customize/authentication/

# Invenio-Accounts
# ----------------
# See https://github.com/inveniosoftware/invenio-accounts/blob/master/invenio_accounts/config.py
ACCOUNTS_LOCAL_LOGIN_ENABLED = True  # enable local login
SECURITY_REGISTERABLE = False  # local login: allow users to register
SECURITY_RECOVERABLE = True  # local login: allow users to reset the password
SECURITY_CHANGEABLE = True  # local login: allow users to change psw
SECURITY_CONFIRMABLE = False  # local login: send confirmation e-mail
SECURITY_LOGIN_WITHOUT_CONFIRMATION = (
    True  # require users to confirm email before being able to login
)
ACCOUNTS_DEFAULT_EMAIL_VISIBILITY = "public"
ACCOUNTS_DEFAULT_USER_VISIBILITY = "public"

# Invenio-OAuthclient
# -------------------
# See https://github.com/inveniosoftware/invenio-oauthclient/blob/master/invenio_oauthclient/config.py

OAUTHCLIENT_REMOTE_APPS = {}  # configure external login providers

from invenio_oauthclient.views.client import auto_redirect_login

ACCOUNTS_LOGIN_VIEW_FUNCTION = (
    auto_redirect_login  # autoredirect to external login if enabled
)
OAUTHCLIENT_AUTO_REDIRECT_TO_EXTERNAL_LOGIN = True  # autoredirect to external login
OAUTHCLIENT_LOGIN_USER_TEMPLATE = "invenio_saml/login_user.html"

# Invenio-UserProfiles
# --------------------
USERPROFILES_READ_ONLY = (
    False  # allow users to change profile info (name, email, etc...)
)

# OAI-PMH
# =======
# See https://github.com/inveniosoftware/invenio-oaiserver/blob/master/invenio_oaiserver/config.py

OAISERVER_ID_PREFIX = "data.caltech.edu"
"""The prefix that will be applied to the generated OAI-PMH ids."""

# Customize Vocabularies
# ---------
# Customize vocabularies that are system variables


def always_valid(identifier):
    """Gives every identifier as valid."""
    return True


RDM_RECORDS_IDENTIFIERS_SCHEMES = {
    "ark": {"label": _("ARK"), "validator": idutils.is_ark, "datacite": "ARK"},
    "arxiv": {"label": _("arXiv"), "validator": idutils.is_arxiv, "datacite": "arXiv"},
    "bibcode": {
        "label": _("Bibcode"),
        "validator": idutils.is_ads,
        "datacite": "bibcode",
    },
    "doi": {"label": _("DOI"), "validator": idutils.is_doi, "datacite": "DOI"},
    "ean13": {"label": _("EAN13"), "validator": idutils.is_ean13, "datacite": "EAN13"},
    "eissn": {"label": _("EISSN"), "validator": idutils.is_issn, "datacite": "EISSN"},
    "handle": {
        "label": _("Handle"),
        "validator": idutils.is_handle,
        "datacite": "Handle",
    },
    "igsn": {"label": _("IGSN"), "validator": always_valid, "datacite": "IGSN"},
    "isbn": {"label": _("ISBN"), "validator": idutils.is_isbn, "datacite": "ISBN"},
    "issn": {"label": _("ISSN"), "validator": idutils.is_issn, "datacite": "ISSN"},
    "istc": {"label": _("ISTC"), "validator": idutils.is_istc, "datacite": "ISTC"},
    "lissn": {"label": _("LISSN"), "validator": idutils.is_issn, "datacite": "LISSN"},
    "lsid": {"label": _("LSID"), "validator": idutils.is_lsid, "datacite": "LSID"},
    "pmid": {"label": _("PMID"), "validator": idutils.is_pmid, "datacite": "PMID"},
    "purl": {"label": _("PURL"), "validator": idutils.is_purl, "datacite": "PURL"},
    "upc": {"label": _("UPC"), "validator": always_valid, "datacite": "UPC"},
    "url": {"label": _("URL"), "validator": idutils.is_url, "datacite": "URL"},
    "urn": {"label": _("URN"), "validator": idutils.is_urn, "datacite": "URN"},
    "w3id": {"label": _("W3ID"), "validator": always_valid, "datacite": "w3id"},
    "cdid": {
        "label": _("CALTECHDATA_ID"),
        "validator": always_valid,
        "datacite": "cdid",
    },
    "dsa-110-id": {
        "label": _("DSA_110_ID"),
        "validator": always_valid,
        "datacite": "dsa-110-id",
    },
    "tiltid": {
        "label": _("TILT_SERIES_ID"),
        "validator": always_valid,
        "datacite": "tiltid",
    },
}
"""These are used for main, alternate and related identifiers."""

from invenio_vocabularies.services.custom_fields import VocabularyCF

RDM_NAMESPACES = {
    "caltech": "https://library.caltech.edu/",
}

# Combine custom fields
RDM_CUSTOM_FIELDS = [
    # caltech groups
    VocabularyCF(
        name="caltech:groups",
        dump_options=True,
        vocabulary_id="caltechgroups",
        multiple=True,
    ),
]

RDM_CUSTOM_FIELDS_UI = [
    {
        "section": _("Caltech Custom Metadata"),
        "fields": [
            dict(
                field="caltech:groups",
                ui_widget="Dropdown",
                props=dict(
                    label="Caltech groups",
                    placeholder="Search for a Caltech group by name or identifier...",
                    icon="users",
                    description="The group or groups associated with record.",
                    autocompleteFrom="/api/vocabularies/caltechgroups",
                    search=True,
                    multiple=True,
                    clearable=True,
                ),
            ),
        ],
    },
]



SECURITY_EMAIL_SENDER = "repositories@library.caltech.edu"
MAIL_SERVER = "smtp.gmail.com"
MAIL_USERNAME = "repositories@library.caltech.edu"
MAIL_USE_SSL = True
MAIL_PORT = 465

MAIL_SUPPRESS_SEND = False

APP_RDM_ADMIN_EMAIL_RECIPIENT = "tmorrell@caltech.edu"

import sentry_sdk
from flask import Flask
from sentry_sdk.integrations.flask import FlaskIntegration

sentry_sdk.init(
    dsn="https://81545f7568417c8ebb7f2dc160c4f4e7@o4505830343245824.ingest.sentry.io/4505834416177152",
    integrations=[FlaskIntegration()],
    # Set traces_sample_rate to 1.0 to capture 100%
    # of transactions for performance monitoring.
    # We recommend adjusting this value in production.
    traces_sample_rate=0.01,
)

app = Flask(__name__)

SEARCH_INDEX_PREFIX = "caltechdata-"

# Allow administrators to edit files
from invenio_rdm_records.services.permissions import RDMRecordPermissionPolicy
from invenio_administration.generators import Administration
from invenio_records_permissions.generators import SystemProcess
from invenio_records_resources.services.files.generators import IfTransferType
from invenio_records_resources.services.files.transfer import (
    LOCAL_TRANSFER_TYPE,
    REMOTE_TRANSFER_TYPE,
)

from invenio_administration.generators import Administration
from invenio_communities.generators import CommunityCurators
from invenio_records_permissions.generators import (
    AnyUser,
    AuthenticatedUser,
    Disable,
    IfConfig,
    SystemProcess,
)
from invenio_records_permissions.policies.records import RecordPermissionPolicy
from invenio_records_resources.services.files.generators import IfTransferType
from invenio_records_resources.services.files.transfer import (
    LOCAL_TRANSFER_TYPE,
    MULTIPART_TRANSFER_TYPE,
)
from invenio_users_resources.services.permissions import UserManager

from invenio_rdm_records.services.generators import (
    AccessGrant,
    CommunityInclusionReviewers,
    GuestAccessRequestToken,
    IfAtLeastOneCommunity,
    IfCreate,
    IfDeleted,
    IfExternalDOIRecord,
    IfNewRecord,
    IfOneCommunity,
    IfRecordDeleted,
    IfRequestType,
    IfRestricted,
    RecordCommunitiesAction,
    RecordOwners,
    RequestReviewers,
    ResourceAccessToken,
    SecretLinks,
    SubmissionReviewer,
)

def lock_edit_record_published_files(service, identity, record=None, draft=None):
    """Custom conditions for file bucket lock."""
    can_modify = service.check_permission(
        identity, "modify_locked_files", record=record
    )
    if can_modify:
        return False
    return True


class CustomRDMRecordPermissionPolicy(RDMRecordPermissionPolicy):
    can_manage = [
        RecordOwners(),
        RecordCommunitiesAction("curate"),
        AccessGrant("manage"),
        SystemProcess(),
    ]
    can_curate = can_manage + [AccessGrant("edit"), SecretLinks("edit")]
    can_review = can_curate + [SubmissionReviewer()]
    can_preview = can_curate + [
        AccessGrant("preview"),
        SecretLinks("preview"),
        SubmissionReviewer(),
        RequestReviewers(),
        UserManager,
    ]
    can_view = can_preview + [
        AccessGrant("view"),
        SecretLinks("view"),
        SubmissionReviewer(),
        CommunityInclusionReviewers(),
        RecordCommunitiesAction("view"),
    ]

    can_authenticated = [AuthenticatedUser(), SystemProcess()]
    can_all = [AnyUser(), SystemProcess()] 
    can_modify_locked_files = [Administration(), SystemProcess()]
    can_read_files = [
        IfRestricted("files", then_=can_view, else_=can_all),
        ResourceAccessToken("read"),
    ]
    can_get_content_files= [
        IfTransferType(LOCAL_TRANSFER_TYPE, can_read_files),
        IfTransferType(REMOTE_TRANSFER_TYPE, can_read_files),
	SystemProcess(),
    ]

RDM_PERMISSION_POLICY = CustomRDMRecordPermissionPolicy
RDM_LOCK_EDIT_PUBLISHED_FILES = lock_edit_record_published_files

from datetime import datetime, timedelta
from celery.schedules import crontab
from invenio_stats.tasks import StatsAggregationTask, StatsEventTask
from invenio_rdm_records.services.tasks import StatsRDMReindexTask

CELERY_BEAT_SCHEDULE = {
    "indexer": {
        "task": "invenio_records_resources.tasks.manage_indexer_queues",
        "schedule": timedelta(seconds=10),
    },
    "accounts_sessions": {
        "task": "invenio_accounts.tasks.clean_session_table",
        "schedule": timedelta(minutes=60),
    },
    "accounts_ips": {
        "task": "invenio_accounts.tasks.delete_ips",
        "schedule": timedelta(hours=6),
    },
    "update_domain_status": {
        "task": "invenio_accounts.tasks.update_domain_status",
        "schedule": timedelta(hours=4),
    },
    "draft_resources": {
        "task": ("invenio_drafts_resources.services.records.tasks.cleanup_drafts"),
        "schedule": timedelta(minutes=60),
    },
    "rdm_records": {
        "task": "invenio_rdm_records.services.tasks.update_expired_embargos",
        "schedule": crontab(minute=2, hour=0),
    },
    "expire_requests": {
        "task": "invenio_requests.tasks.check_expired_requests",
        "schedule": crontab(minute=3, hour=0),
    },
    # indexing of statistics events & aggregations
    "stats-process-events": {
        **StatsEventTask,
        "schedule": crontab(minute="25,55"),  # Every hour at minute 25 and 55
    },
    "stats-aggregate-events": {
        **StatsAggregationTask,
        "schedule": crontab(minute=0),  # Every hour at minute 0
    },
    "reindex-stats": StatsRDMReindexTask,  # Every hour at minute 10
    # Invenio communities provides some caching that has the potential to be never removed,
    # therefore, we need a cronjob to ensure that at least once per day we clear the cache
    "clear-cache": {
        "task": "invenio_communities.tasks.clear_cache",
        "schedule": crontab(minute=0, hour=1),  # Every day at 01:00 UTC
    },
    "clean-access-request-tokens": {
        "task": "invenio_rdm_records.requests.access.tasks.clean_expired_request_access_tokens",
        "schedule": crontab(minute=4, hour=0),
    },
    "delete-job-logs": {
        "task": "invenio_jobs.logging.tasks.delete_logs",
        "schedule": crontab(minute=5, hour=0),
    },
    "update_sitemap": {
        "task": "invenio_sitemap.tasks.update_sitemap_cache",
        "schedule": crontab(minute=0, hour=2),
    },
}
"""Scheduled tasks configuration (aka cronjobs)."""

AUDIT_LOGS_ENABLED = True

RECORDS_RESOURCES_FILES_ALLOWED_REMOTE_DOMAINS = [
    "caltech2.osn.mghpcc.org", "sdsc.osn.xsede.org"
]

REQUESTS_REVIEWERS_ENABLED = True
USERS_RESOURCES_GROUPS_ENABLED = False

RDM_ARCHIVE_DOWNLOAD_ENABLED = False

APP_RDM_DEPOSIT_NG_FILES_UI_ENABLED = True