From 8b5257c2c2b7b4c99f0aba567e9e0195c53e5ac3 Mon Sep 17 00:00:00 2001
From: Martin Fenner <martin.fenner@datacite.org>
Date: Sat, 1 Jun 2019 08:02:33 +0200
Subject: [PATCH] unauthenticated users should only see findable dois. #284

---
 app/controllers/dois_controller.rb | 3 ++-
 app/models/concerns/indexable.rb   | 7 ++++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/app/controllers/dois_controller.rb b/app/controllers/dois_controller.rb
index b3de4a46d..f4fb80316 100644
--- a/app/controllers/dois_controller.rb
+++ b/app/controllers/dois_controller.rb
@@ -71,7 +71,8 @@ def index
                           source: params[:source],
                           page: page,
                           sort: sort,
-                          random: params[:random])
+                          random: params[:random],
+                          current_user: current_user)
     end
 
     begin
diff --git a/app/models/concerns/indexable.rb b/app/models/concerns/indexable.rb
index 4b56732dd..3e23b5a7e 100644
--- a/app/models/concerns/indexable.rb
+++ b/app/models/concerns/indexable.rb
@@ -135,7 +135,6 @@ def query(query, options={})
 
       must = []
       must << { query_string: { query: query, fields: query_fields }} if query.present?
-      must << { terms: { aasm_state: options[:state].to_s.split(",") }} if options[:state].present?
       must << { term: { "types.resourceTypeGeneral": options[:resource_type_id].underscore.camelize }} if options[:resource_type_id].present?
       must << { terms: { provider_id: options[:provider_id].split(",") }} if options[:provider_id].present?
       must << { terms: { client_id: options[:client_id].to_s.split(",") }} if options[:client_id].present?
@@ -172,6 +171,12 @@ def query(query, options={})
         must << { terms: { "software.raw" => options[:software].split(",") }} if options[:software].present?
         must_not << { exists: { field: "deleted_at" }} unless options[:include_deleted]
       elsif self.name == "Doi"
+        # anonymous users should only see findable DOIs
+        if options[:current_user]
+          must << { terms: { aasm_state: options[:state].to_s.split(",") }} if options[:state].present?
+        else
+          must << { terms: { aasm_state: ["findable"] }}
+        end
         must << { range: { registered: { gte: "#{options[:registered].split(",").min}||/y", lte: "#{options[:registered].split(",").max}||/y", format: "yyyy" }}} if options[:registered].present?
       end