[DSpace-CRIS] Download button & Allow authors to download restricted files by FrancescoMolinaro · Pull Request #5132 · DSpace/dspace-angular

FrancescoMolinaro · 2026-02-20T13:45:43Z

References

Fixes [DSpace-CRIS] Download button & Allow authors to download restricted files DSpace#12169
Relates to: Feature differences #12 and Feature differences #13

Description

Add new way of rendering download link in item page, the new UI component can be activated via the config:

showDownloadLinkAsAttachment

inside the layout config in default.app.config.ts.

The metadata to be visualized in the attachment box are handled with a separated config param:

advancedAttachmentRendering

Which allows granural control on which information to show in the template.

In addition a new route guard has been added for the bitstream download path, so that we can check the authorization before loading the page and handle in advance eventual authorizations needed.

On the rest side the canDownload authorization feature will be enhanced to allow authors the download of restricted items.

Instructions for Reviewers

The new config has been set as true for the time being so that every link in item page will be displayed with the new component.
The positioning was also adapted from the left side of the page to the right one, so to use the wider space for the additional informations.

List of changes in this PR:

Add new UI component and related configs
Add new guard for bitsream download path

Checklist

This checklist provides a reminder of what we are going to look for when reviewing your PR. You do not need to complete this checklist prior creating your PR (draft PRs are always welcome).
However, reviewers may request that you complete any actions in this list if you have not done so. If you are unsure about an item in the checklist, don't hesitate to ask. We're here to help!

tdonohue · 2026-02-20T16:28:38Z

@FrancescoMolinaro : Same here, please specify in the PR description which DSpace-CRIS differences this PR implements/relates to.

github-actions · 2026-03-13T17:36:29Z

Hi @FrancescoMolinaro,
Conflicts have been detected against the base branch.
Please resolve these conflicts as soon as you can. Thanks!

tdonohue · 2026-03-13T19:21:19Z

@FrancescoMolinaro : Just to verify, does this PR require any backend PR? Or is it standalone? It's unclear to me whether this requires specific backend changes to work.

FrancescoMolinaro · 2026-03-16T11:06:25Z

Hi @tdonohue , sorry for missing to specify it, this PR is mainly a UI variant of the normal link and it is indeed standalone.

lgeggleston · 2026-03-19T16:11:59Z

@aprilherron General reminder for all new feature PRs currently under review: there is still a possibility of getting this into 10.0, in case you have the capacity to complete the review at the moment. Feature merge deadline will be Friday 3/27. Thank you!

aprilherron · 2026-03-19T19:31:43Z

Review notes:

Config syntax

Feature is enabled by default.
To turn it off, use config:

layout:
  showDownloadLinkAsAttachment: false

Tests

If it is enabled the new bitstream view shows on the item-page.
If it is disabled the new bitstream view doesn't show on the item-page
=> But the normal download links DO NOT appear (marked spot in code for fix in code-review)
Make sure every field in the bitstream-view is correct:
- Name = dc.title
- Size = the same in edit > bitstream
- Format = the same in edit > bitstream
- Checksum = the same as in the DB
Multiple bitstream:
- Both bitsteams still have the correct field values
- The each download button downloads the correct bitstream
Unexpected values:
- Creating a bitstream with a huge filename doesn't overflow the bitstream-view
Authorization:
- Anon users can see and use the bitstream-view -> if the bitstream is openAccess
- Normal users can see and use the bitstream-view -> if the bitstream is openAccess
- Admin users can see and user the bitstream-view -> if the bitstream is openAccess
- Anon users can see and use the bitstream-view, but are unable to download the bitstream. They can request a copy instead -> if the bitstream is not openAccess
- Normal users can see and use the bitstream-view, but are unable to download the bitstream. They can request a copy instead -> if the bitstream is not openAccess
- Admin users can see and use the bitstream-view, and are able to download the bitstream -> if the bitstream is not openAccess
Security:
- Valid html in the filename <b>test.pdf</b> does not render as HTML

…nk, add tests

FrancescoMolinaro · 2026-03-20T09:41:24Z

Hi @aprilherron , thanks for the feedback, I have set the property as false by default so that the new layout will be optional. In addition I have also fixed the issue with the missing default download link and implemented some test to enforce the behavior, now it should work as expected, thanks again for the review.

tdonohue · 2026-03-24T22:07:29Z

@aprilherron : If you can find time to rereview this (based on the updates), I'd appreciate it. Please also remember to explicitly give the PR a "+1" if you feel it's working well and ready to be merged.

@FrancescoMolinaro : I've yet to review/test this, but we may want to consider enabling this by default if it accurately fixes #3384 (as that's a long standing accessibility/usability issue). That said, I'll try to give this a test tomorrow to see if this should be enabled by default.

aprilherron

Bug in untyped-item view has been addressed. This PR looks good to be merged 👍

src/app/item-page/simple/item-types/untyped-item/untyped-item.component.html

tinsch · 2026-03-25T12:41:55Z

@FrancescoMolinaro I ran some response time performance tests on your branch, because I recently worked on a similar area of the code (#5028). I found out that your new code runs much faster on larger page sizes with showDownloadLinkAsAttachment enabled than the 'old' code for the bitstream download links. Congrats 👏🎉

Could you maybe explain a bit what you are doing with this bitstream route guard, and if we could also use it for the 'normal' bitstream download links?

Here is a diagram from my performance tests, so that you can see how much better the new feature performs:

github-actions · 2026-03-25T15:21:33Z

Hi @FrancescoMolinaro,
Conflicts have been detected against the base branch.
Please resolve these conflicts as soon as you can. Thanks!

tdonohue · 2026-03-25T15:24:59Z

@FrancescoMolinaro : Could you quickly rebase this PR? It appears to have gained merge conflicts after the merger of #5112

FrancescoMolinaro · 2026-03-25T16:13:43Z

Hi @tinsch , thanks for the feedback much appreciated, the bitstream route guard is currently already active for all the downloads as it runs on the download page indipendently from the property showDownloadLinkAsAttachment.
It's purpose is to check if the user is authorized to access the download path, the main point is to check authorizations on direct link, e.g. accessing a link like https://demo.dspace.org/bitstreams/55113c70-2f96-4f66-acbc-692987fcedcc/download from a shared link.

I believe that what makes the file-download-link.component.html slow to render on pages, is the template of the component itself, which creates many unnecessary subscriptions, creating the risk of memory leaks.

I have made a commit to change this as I think is a good improvment in any case, you can check the last commit of this PR for confirmation on your tests, hopefully performaces will be better also with the property set to false.

tinsch · 2026-03-25T16:16:01Z

Thanks a lot! I will look into it and retest it 👍

tdonohue

@FrancescoMolinaro : I gave this a review and test today. Overall, it works, but I've found some issues in the code which I think need cleanup/correction (see inline below).

I also have a few basic questions here:

I don't understand how to configure advancedAttachmentRendering > metadata fields, as the examples provided in config.example.yml seem to be invalid.
I also don't see how this PR is providing authors with the ability to download restricted files. Is that provided via a backend PR? If so, which backend PR does this feature require?

I have been able to verify that the basics of rendering bitstreams in a list with a download button works properly.

tdonohue · 2026-03-25T16:30:37Z

config/config.example.yml

+  showDownloadLinkAsAttachment: true
+  # Configuration for advanced attachment rendering in item pages. This controls how files are displayed when showDownloadLinkAsAttachment is enabled.
+  # Each configuration maps a bundle name to specific metadata fields that should be displayed alongside the file.
+  advancedAttachmentRendering:


The pagination setting appears to be missing from the examples here.

Also, I'd recommend the configuration in config.example.yml match the default configuration that you've set in default-app-config.ts. That makes it much easier for users to understand what the default configs are.

tdonohue · 2026-03-25T16:32:17Z

config/config.example.yml

+        - dc.title
+    - bundle: LICENSE
+      metadata:
+        - dc.rights


Why is the structure of these bundle and metadata configs so much different here then in default-app-config.ts? Are these settings correct?

src/config/default-app-config.ts

tdonohue · 2026-03-25T16:38:53Z

src/app/bitstream-page/bitstream-download-redirect.guard.ts

+} from '../utils/empty.util';
+
+
+export const bitstreamDownloadRedirectGuard: CanActivateFn = (


Please add code comments to describe the behavior of this new guard.

tdonohue · 2026-03-25T16:43:04Z

src/app/core/services/server-hard-redirect.service.ts

+   * The actual security header will be set by the rest
+   */
+  setCorsHeader() {
+    this.responseService.setHeader('Access-Control-Allow-Origin', '*');


I want to understand why this is being set to a wildcard/asterisk. This can be a potential security flaw as it allows resources to be accessed by any domain (even untrusted ones).

Why do we need this to be set to an asterisk? Is there a way to instead set it to the UI's URL? As of #5276 it should now be possible to access the URL of the User Interface via the environment.ui.baseUrl setting. So, that might be a better value here, assuming it works as well.

tdonohue · 2026-03-25T16:48:46Z

src/assets/i18n/en.json5


  "cookies.consent.purpose.sharing": "Sharing",

+  "cris-layout.advanced-attachment.dc.title": "Name",


Could we consider changing all these new keys to start with layout instead of cris-layout? That way they'd match with the new layout configuration section where they are used.

tdonohue · 2026-03-25T17:10:50Z

config/config.example.yml

          icon: fas fa-project-diagram
          style: text-success
+  # If true the download link in item page will be rendered as an advanced attachment, the view can be then configured with the layout.advancedAttachmentRendering config
+  showDownloadLinkAsAttachment: true


@FrancescoMolinaro : One last note, this setting should match the default value in default-app-config.ts.

For now, I'd say maybe we should keep this disabled by default. However, if we receive positive feedback on the display, we can modify it at a later time.

Personally, I like the new look overall. But I do find displaying the same thumbnail twice on the Item page seems a bit odd. For example, with an Item with one bitstream, you see its thumbnail twice near the top of the page:

tinsch · 2026-03-25T19:57:12Z

Thanks a lot! I will look into it and retest it 👍

I ran the performance tests again, and the results are nearly the same now with and without the new showDownloadLinkAsAttachment feature enabled. Both better than on current main. Thanks a lot! 👏

FrancescoMolinaro added 4 commits February 17, 2026 17:20

[DURACOM-455] add bitstream download redirect guard

5bd912c

[DURACOM-455] add download button

64e866e

[DURACOM-455] add advanced attachment

4f72074

[DURACOM-455] add config example

6878cd6

github-actions bot assigned FrancescoMolinaro Feb 20, 2026

[DURACOM-455] fix tests

d361cc3

tdonohue added new feature DSpace-CRIS merger This ticket/PR relates to the merger of DSpace-CRIS into DSpace. labels Feb 20, 2026

tdonohue added this to DSpace 10.0 Release Feb 20, 2026

tdonohue moved this to 🙋 Needs Reviewers Assigned in DSpace 10.0 Release Feb 20, 2026

FrancescoMolinaro marked this pull request as ready for review March 4, 2026 17:11

artlowel requested a review from aprilherron March 12, 2026 17:02

github-actions bot added the merge conflict label Mar 13, 2026

tdonohue changed the title ~~[DSpace-CRIS] porting of advanced attachment and canDownload authorization features changes~~ [DSpace-CRIS] Download button & Allow authors to download restricted files Mar 13, 2026

FrancescoMolinaro added 2 commits March 16, 2026 11:42

Merge remote-tracking branch 'gitHub/main' into task/main/DURACOM-455

e738016

[DURACOM-455] refactor config property, add example

a77a7a4

github-actions bot removed the merge conflict label Mar 16, 2026

lgeggleston moved this from 🙋 Needs Reviewers Assigned to 👀 Under Review in DSpace 10.0 Release Mar 19, 2026

[DURACOM-455] set default as false, fix issue with missing default li…

7ad401d

…nk, add tests

abollini mentioned this pull request Mar 23, 2026

Accessibility or discoverability of bitstream download links #3384

Open

tdonohue mentioned this pull request Mar 23, 2026

added main link method on item component to use in thumbnails. #3951

Open

12 tasks

aprilherron approved these changes Mar 24, 2026

View reviewed changes

src/app/item-page/simple/item-types/untyped-item/untyped-item.component.html Outdated Show resolved Hide resolved

github-actions bot added the merge conflict label Mar 25, 2026

Merge remote-tracking branch 'gitHub/main' into task/main/DURACOM-455

de6955b

github-actions bot removed the merge conflict label Mar 25, 2026

[DURACOM-455] optimize file download link template

04a1e9f

tdonohue requested changes Mar 25, 2026

View reviewed changes

tdonohue reviewed Mar 25, 2026

View reviewed changes

		} from '../utils/empty.util';


		export const bitstreamDownloadRedirectGuard: CanActivateFn = (


		"cookies.consent.purpose.sharing": "Sharing",

		"cris-layout.advanced-attachment.dc.title": "Name",

Conversation

FrancescoMolinaro commented Feb 20, 2026 • edited by tdonohue Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

References

Description

Instructions for Reviewers

Checklist

Uh oh!

tdonohue commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 13, 2026

Uh oh!

tdonohue commented Mar 13, 2026

Uh oh!

FrancescoMolinaro commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lgeggleston commented Mar 19, 2026

Uh oh!

aprilherron commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Config syntax

Tests

Uh oh!

FrancescoMolinaro commented Mar 20, 2026

Uh oh!

tdonohue commented Mar 24, 2026

Uh oh!

aprilherron left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

tinsch commented Mar 25, 2026

Uh oh!

github-actions bot commented Mar 25, 2026

Uh oh!

tdonohue commented Mar 25, 2026

Uh oh!

FrancescoMolinaro commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tinsch commented Mar 25, 2026

Uh oh!

tdonohue left a comment

Choose a reason for hiding this comment

Uh oh!

tdonohue Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

tdonohue Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

tdonohue Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

tdonohue Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

tdonohue Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

tdonohue Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

tinsch commented Mar 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

FrancescoMolinaro commented Feb 20, 2026 •

edited by tdonohue

Loading

tdonohue commented Feb 20, 2026 •

edited

Loading

FrancescoMolinaro commented Mar 16, 2026 •

edited

Loading

aprilherron commented Mar 19, 2026 •

edited

Loading

FrancescoMolinaro commented Mar 25, 2026 •

edited

Loading