Curation Feature: Approval from admin required after material || event registration by kennethrioja · Pull Request #1382 · ElixirTeSS/TeSS

kennethrioja · 2026-09-29T09:34:29Z

Summary of changes

Generally: When material_under_admin_approval or event_under_admin_approval is set to true, and if a user registers a material or an event, the resource must be approved by either an administrator, a curator or a space admin.
For Registered Users:
- When a user registers a resource, there is an info box in the form (see screenshot)
- Once registered, they can see an icon in the /{resources} page and an 'Approval status: requested' in the {resources}/{name} page (see screenshots)
- The resource is hidden from unlogged users (both UI and JSON-LD)
For Admins:
- To curate, they can go to the /{resources} page, where a Curate {resource} is found next to the Register button OR they can find this page in the user dropdown (see screenshots)
- Once in the /curate/resources page, they can see by default the list of Requested materials. You can filter by Type, User, Provider, Space and bulk_approve or reject the filtered list of resources to avoid doing it 1 by 1. A Reset filter button is also present. A list of recent curation activity is found on the right.
- Private resources can be shown in this dashboard for admin and for private space admins (a curator can thus see it only if they are the private space admin)
Ingested materials:
- When we ingest a resource for the first time, they are automatically set to :requested (see material.rb#set_approval_status, same for events)
- When updated, they come back to :requested
For Space admins:
- They can curate resources only from the space they are admin
- If a space is private, they can view them via the curation dashboard
For Curators:
- They have the same approval rights than admin in public spaces except that they cannot see/curate :requested private space resources unless they are space admins
Devs:
- app/policies/application_policy.rb#shown? is the place to manage if a resource can be shown to a user. Then all the other resource-specific policies can be found in the related {resource}_policy.rb file. I avoided having to put conditions such as is_admin? in the html.erb files, this is why I tried to have as much conditions with <% if policy(@event).{update|approve}? %> as possible, so that everything is managed in the policies rather that in the views.

Motivation and context

Curation is needed in HEP and EVERSE Training

Screenshots

Users view

Admin/Curator/Space admin curation buttons

Curation page

Not covered in this PR, but could be useful

Emails to the admins/curators/space admins to say, "there are n resources to be curated".
Say why a resource has been rejected -> and if too much spam after several refusals, incremental cooldown days to register a material
If a resource is not approved, its URL can still checked in the form (see check_exists)

Checklist

I have read and followed the CONTRIBUTING guide.
I confirm that I have the authority necessary to make this contribution on behalf of its copyright owner and agree to license it to the TeSS codebase under the BSD license.

… view

…han admin

…y are not space admins

… name

kennethrioja · 2026-09-30T12:19:39Z

User documentation to add!

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

🟡 Changes recommended

Approval-state migration, authorization, visibility, routing, and pagination defects must be resolved before release.

12 open findings

🧠 Review effort: Balanced

kennethrioja · 2026-10-15T12:32:28Z

+                  external_resources: %i[url title], material_ids: [],
+                  llm_interaction_attributes: %i[id scrape_or_process model prompt input output needs_processing _destroy],
+                  locked_fields: [], instructors: [:name, :orcid], contributors: [:name, :orcid]]
+    permitted << :approval_status if User.current_user&.can_approve_resources?


Added :approval_status parameter to both #create and #update methods by checking policy(record).approve?. We now pass record to event_params to be able to call policy(record).approve?

kennethrioja · 2026-10-15T12:32:47Z

+                  external_resources_attributes: %i[id url title _destroy],
+                  external_resources: %i[url title],
+                  event_ids: [], locked_fields: []]
+    permitted << :approval_status if User.current_user&.can_approve_resources?


Same than previous comment

kennethrioja · 2026-10-15T12:35:11Z

+        # Filters by approval_status for unauthenticated requests (regardless of whether the feature is enabled or disabled) 
+        if name == 'Material' && TeSS::Config.feature['material_under_admin_approval'] && !(user&.is_admin? || user&.is_curator?)
+          any_of do
+            with(:approval_status, I18n.t('materials.approval_status.approved'))
+            with(:user_id, user.id) if user.present?
+          end
+        end
+
+        # Filters by approval_status for unauthenticated requests (regardless of whether the feature is enabled or disabled) 
+        if name == 'Event' && TeSS::Config.feature['event_under_admin_approval'] && !(user&.is_admin? || user&.is_curator?)


Added Scope#resolved in both material and event policies (and includes owner/admin/curator/space admin exceptions)

kennethrioja · 2026-10-15T12:35:29Z

+    add_column :materials, :approval_status, :string, default: 'approved'
+    add_column :events, :approval_status, :string, default: 'approved'
+
+    reversible do |dir|
+      dir.up do
+        # Backfill existing records (will be NULL on existing rows when adding a column)
+        Material.unscoped.where(approval_status: nil).update_all(approval_status: 'approved')
+        Event.unscoped.where(approval_status: nil).update_all(approval_status: 'approved')


Accepted the suggestion

kennethrioja · 2026-10-15T12:35:49Z

+    @status = params[:status].presence || 'requested'
+    @type = params[:type].presence || 'all'
+
+    target_classes = @type == 'all' ? CURATABLE_TYPES.values : [CURATABLE_TYPES[@type]].compact


Tailored target_classes to filter on the enabled_curatable_classes

kennethrioja · 2026-10-15T12:29:07Z

+                <%= resource_approval_badge(@event.approval_status) %>
+              </p>
+
+              <% if !@event.not_approved? && !@event.approval_requested? && !@event.approved? && !policy(@event).approve? %>


I deleted it, users never ask for request approval, it is automatically done – this is a remnant from my previous design

kennethrioja · 2026-10-15T12:29:13Z

+                  <%= resource_approval_badge(@material.approval_status) %>
+                </p>
+
+                <% if !@material.not_approved? && !@material.approval_requested? && !@material.approved? && !policy(@material).approve? %>


I deleted it, users never ask for request approval, it is automatically done – this is a remnant from my previous design

kennethrioja · 2026-10-15T12:40:27Z

+  get 'curate/materials' => 'curator#materials', as: :curate_materials
+  get 'curate/events' => 'curator#events', as: :curate_events


Suggestion accepted

kennethrioja · 2026-10-15T12:45:25Z

+  # test '.approved scope returns only approved event' do
+  #   approved = Event.approved
+  #   assert_includes approved, @approved_event
+  #   refute_includes approved, @not_approved_event
+  #   refute_includes approved, @requested_event


kennethrioja · 2026-10-15T12:49:44Z

+      context = Struct.new(:user).new(@private_space_owner)
+      scope = ApplicationPolicy::Scope.new(context, Material).resolve_curatable
+
+      scope.each do |material|
+        assert_equal @space.id, material.space_id
+      end


Suggestion accepted

… space but cannot see and curate requested private resources Using Copilot, GPT-6 Luna, 6.65 AIC used

kennethrioja added 20 commits September 28, 2026 13:01

feat(approval): added approval status for materials

4e69714

fix(approval): loop non-approved/request/approved is UI ok

80366f0

chore(approval): set default and show requested icon

4906cdb

feat(approval): filter approval in curation section

c0ad4dc

fix(approval): show only approved material in lists

226ca7e

fix(approval): sort by approval, also in latest

9aeaab8

fix(approval): rendering and controller

0cf0291

chore(approval): change sunspot searchable for only approved materials

b6d3854

chore(approval): make it work with material_under_admin_approval==false

5d50d9d

test(approval): passing base tests

b518e30

test(approval): adding tests

586fe5f

feat(approval): adding /curate/materials view

c32e5b6

feat(approval): added events approval status, and a resource curation…

27f2e36

… view

feat(approval): curators can have the same approval power and views t…

c7209f3

…han admin

fix(approval): curators can not see private space materials where the…

6f993b7

…y are not space admins

refactor(approval): more readable code

6c2385c

test(approval): adding tests for application_policy and curation

5afb4c0

chore(approval): few bits before doing the PR

e1a6a30

chore(approval): scss and before_update small tweaks

aafb344

fix(approval): renaming migration file title which didn't match class…

f86d0e9

… name

fbacall requested a balanced review from Copilot September 30, 2026 12:12

Copilot started reviewing on behalf of fbacall September 30, 2026 12:13

View session

Copilot AI reviewed Sep 30, 2026

This was referenced Oct 5, 2026

Adding content curation documentation ElixirTeSS/docs#36

Closed

space admins do not have edit rights in their own space? hep-training/TeSS#7

Open

fbacall requested a balanced review from Copilot October 13, 2026 12:00

Copilot started reviewing on behalf of fbacall October 13, 2026 12:01

View session

Copilot AI reviewed Oct 13, 2026

View reviewed changes

review(approval): addressing copilot's review from ElixirTeSS#1382

a2957c1

fix(approval): curators not private space admins can access a private…

caf1167

… space but cannot see and curate requested private resources Using Copilot, GPT-6 Luna, 6.65 AIC used

		get 'curate/materials' => 'curator#materials', as: :curate_materials
		get 'curate/events' => 'curator#events', as: :curate_events

Conversation

kennethrioja commented Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Users view

Admin/Curator/Space admin curation buttons

Curation page

Uh oh!

kennethrioja commented Sep 30, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kennethrioja Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

kennethrioja commented Sep 29, 2026 •

edited

Loading

kennethrioja Oct 15, 2026 •

edited

Loading