services: Require record community

invenio_rdm_records/config.py

@@ -4,6 +4,7 @@
 # Copyright (C) 2019 Northwestern University.
 # Copyright (C) 2021-2023 Graz University of Technology.
 # Copyright (C) 2023 TU Wien.
+# Copyright (C) 2023 KTH Royal Institute of Technology.
 #
 # Invenio-RDM-Records is free software; you can redistribute it and/or modify
 # it under the terms of the MIT License; see LICENSE file for more details.
@@ -125,6 +126,12 @@ def always_valid(identifier):
 RDM_ALLOW_RESTRICTED_RECORDS = True
 """Allow users to set restricted/private records."""
 
+#
+# Record communities
+#
+RDM_ENSURE_RECORD_COMMUNITY_EXISTS = False
+"""Enforces at least one community per record on remove community function."""
+
 #
 # Search configuration
 #

invenio_rdm_records/services/communities/service.py

@@ -1,12 +1,13 @@
 # -*- coding: utf-8 -*-
 #
 # Copyright (C) 2023 CERN.
+# Copyright (C) 2023 KTH Royal Institute of Technology.
 #
 # Invenio-RDM-Records is free software; you can redistribute it and/or modify
 # it under the terms of the MIT License; see LICENSE file for more details.
 
 """RDM Record Communities Service."""
-
+from flask import current_app
 from invenio_communities.proxies import current_communities
 from invenio_i18n import lazy_gettext as _
 from invenio_pidstore.errors import PIDDoesNotExistError
@@ -34,6 +35,7 @@
     InvalidAccessRestrictions,
     OpenRequestAlreadyExists,
     RecordCommunityMissing,
+    RecordCommunityRequired,
 )
 
 
@@ -166,6 +168,10 @@ def _remove(self, identity, community_id, record):
         self.require_permission(
             identity, "remove_community", record=record, community_id=community_id
         )
+        if current_app.config.get("RDM_ENSURE_RECORD_COMMUNITY_EXISTS"):
+            rec_communities = record.parent.communities.ids
+            if len(rec_communities) <= 1:
+                raise RecordCommunityRequired()
 
         # Default community is deleted when the exact same community is removed from the record
         record.parent.communities.remove(community_id)
@@ -185,12 +191,17 @@ def remove(self, identity, id_, data, uow):
         )
         communities = valid_data["communities"]
         processed = []
+
         for community in communities:
             community_id = community["id"]
             try:
                 self._remove(identity, community_id, record)
                 processed.append({"community": community_id})
-            except (RecordCommunityMissing, PermissionDeniedError) as ex:
+            except (
+                RecordCommunityMissing,
+                PermissionDeniedError,
+                RecordCommunityRequired,
+            ) as ex:
                 errors.append(
                     {
                         "community": community_id,
@@ -213,7 +224,7 @@ def search(
         search_preference=None,
         expand=False,
         extra_filter=None,
-        **kwargs
+        **kwargs,
     ):
         """Search for record's communities."""
         record = self.record_cls.pid.resolve(id_)
@@ -230,7 +241,7 @@ def search(
             search_preference=search_preference,
             expand=expand,
             extra_filter=communities_filter,
-            **kwargs
+            **kwargs,
         )
 
     @staticmethod
@@ -274,7 +285,7 @@ def search_suggested_communities(
         expand=False,
         by_membership=False,
         extra_filter=None,
-        **kwargs
+        **kwargs,
     ):
         """Search for communities that can be added to a record."""
         record = self.record_cls.pid.resolve(id_)
@@ -294,7 +305,7 @@ def search_suggested_communities(
                 params=params,
                 search_preference=search_preference,
                 extra_filter=communities_filter,
-                **kwargs
+                **kwargs,
             )
 
         return current_communities.service.search(
@@ -303,5 +314,5 @@ def search_suggested_communities(
             search_preference=search_preference,
             expand=expand,
             extra_filter=communities_filter,
-            **kwargs
+            **kwargs,
         )

invenio_rdm_records/services/errors.py

@@ -2,6 +2,7 @@
 #
 # Copyright (C) 2021 CERN.
 # Copyright (C) 2023 Graz University of Technology.
+# Copyright (C) 2023 KTH Royal Institute of Technology.
 #
 # Invenio-RDM-Records is free software; you can redistribute it and/or modify
 # it under the terms of the MIT License; see LICENSE file for more details.
@@ -142,6 +143,15 @@ def description(self):
         )
 
 
+class RecordCommunityRequired(Exception):
+    """Record associated community required."""
+
+    @property
+    def description(self):
+        """Exception description."""
+        return _("Last community on record cannot be removed.")
+
+
 class InvalidCommunityVisibility(Exception):
     """Community visibility does not match the content."""
 

invenio_rdm_records/services/permissions.py

@@ -10,6 +10,7 @@
 """Permissions for Invenio RDM Records."""
 
 from invenio_communities.generators import CommunityCurators
+from invenio_communities.permissions import CommunityMembers
 from invenio_records import Record
 from invenio_records_permissions.generators import (
     AnyUser,
@@ -147,8 +148,20 @@ class RDMRecordPermissionPolicy(RecordPermissionPolicy):
     can_delete_draft = can_curate
     # Allow creating a new version of an existing published record.
     can_new_version = can_curate
+    can_publish_restricted = (
+        can_manage[1:]
+        + [CommunityMembers()]
+        + [SecretLinks("edit")]
+        + [SubmissionReviewer()]
+    )
     # Allow publishing a new record or changes to an existing record.
-    can_publish = can_review
+    can_publish = [
+        IfConfig(
+            "RDM_ENSURE_RECORD_COMMUNITY_EXISTS",
+            then_=can_publish_restricted,
+            else_=can_review,
+        ),
+    ]
     # Allow lifting a record or draft.
     can_lift_embargo = can_manage