[ENG-8740] Ability to delete a file from a registration via admin (CenterForOpenScience#11285)

* [ENG-8514] Remove CSRF protection from reset password api v2 POST (CenterForOpenScience#11246)

* remove csrf protection from reset password endpoint

* update test

* add background color prop to Brand (CenterForOpenScience#11254)

* fix flaky test_serialized_metadata

* fix throttle test

* reset throttle cache

* don't ignore components when create a view-only link

* fixed updating subscribe_osf_general_email subscription

* [ENG-7277] Update doc to include version as relationship (CenterForOpenScience#11262)

* added tests

* [ENG-8691] Wrong server on reset password email (CenterForOpenScience#11271)

* use same logic for admin and web password reset

* fix tests

* enable filtering for linked-nodes endpoint (CenterForOpenScience#11273)

* remove deleted users from institutional dashboard (CenterForOpenScience#11261)

* fixed tests

* [ENG-7803] Update text on VOL modal for registration (CenterForOpenScience#11279)

* add a file removal feature for a node (registration) using admin panel

* delete file only for archived registration when it is not possible from user side to avoid inconsistency

* remove file from scheme response blocks

* delete file from registration and metadata and keep it for original project

---------

Co-authored-by: antkryt <ant.krytskyi@gmail.com>
Co-authored-by: John Tordoff <Johnetordoff@users.noreply.github.com>
Co-authored-by: Ihor Sokhan <isokhan@exoft.net>
Co-authored-by: Vlad0n20 <137097005+Vlad0n20@users.noreply.github.com>

Author: 5 people

admin/nodes/urls.py

@@ -50,4 +50,5 @@
     re_path(r'^(?P<guid>[a-z0-9]+)/system_tags/add/$', views.NodeAddSystemTag.as_view(), name='add-system-tag'),
     re_path(r'^(?P<guid>[a-z0-9]+)/system_tags/(?P<tag_id>[a-z0-9]+)/remove/$', views.NodeRemoveSystemTag.as_view(), name='remove-system-tag'),
     re_path(r'^(?P<guid>[a-z0-9]+)/update_permissions/$', views.NodeUpdatePermissionsView.as_view(), name='update-permissions'),
+    re_path(r'^(?P<guid>[a-z0-9]+)/remove_file/$', views.NodeRemoveFileView.as_view(), name='remove-file'),
 ]

admin/nodes/views.py

@@ -6,6 +6,7 @@
 from django.utils import timezone
 from django.core.exceptions import PermissionDenied, ValidationError
 from django.urls import NoReverseMatch
+from django.db import transaction
 from django.db.models import F, Case, When, IntegerField
 from django.contrib import messages
 from django.contrib.auth.mixins import PermissionRequiredMixin
@@ -28,14 +29,17 @@
 from api.caching.tasks import update_storage_usage_cache
 
 from osf.exceptions import NodeStateError, RegistrationStuckError
+from osf.management.commands.change_node_region import _update_schema_meta
 from osf.models import (
+    Guid,
     OSFUser,
     NodeLog,
     AbstractNode,
     Registration,
     RegistrationProvider,
     RegistrationApproval,
-    SpamStatus
+    SpamStatus,
+    TrashedFile
 )
 from osf.models.admin_log_entry import (
     update_admin_log,
@@ -813,6 +817,36 @@ def post(self, request, *args, **kwargs):
         return redirect(self.get_success_url())
 
 
+class NodeRemoveFileView(NodeMixin, View):
+    """ Allows an authorized user to remove file from node.
+    """
+    permission_required = 'osf.change_node'
+
+    def post(self, request, *args, **kwargs):
+        def _remove_file_from_schema_response_blocks(registration, removed_file_id):
+            file_input_keys = registration.registration_schema.schema_blocks.filter(
+                block_type='file-input'
+            ).values_list('registration_response_key', flat=True)
+            for schema_response in registration.schema_responses.all():
+                for block in schema_response.response_blocks.filter(schema_key__in=file_input_keys):
+                    if not block.response:
+                        continue
+                    block.response = [entry for entry in block.response if entry.get('file_id') not in removed_file_id]
+                    block.save()
+
+        node = self.get_object()
+        guid_id = request.POST.get('remove-file-guid', '').strip()
+        guid = Guid.load(guid_id)
+
+        # delete file from registration and metadata and keep it for original project
+        if guid and (file := guid.referent) and (file.target == node) and not isinstance(file, TrashedFile):
+            with transaction.atomic():
+                file.delete()
+                _update_schema_meta(file.target)
+                _remove_file_from_schema_response_blocks(node, [file._id, file.copied_from._id])
+        return redirect(self.get_success_url())
+
+
 class RemoveStuckRegistrationsView(NodeMixin, View):
     """ Allows an authorized user to remove a registrations if it's stuck in the archiving process.
     """

admin/templates/nodes/node.html

@@ -17,6 +17,7 @@
                     <a href="{% url 'nodes:search' %}" class="btn btn-primary"> <i class="fa fa-search"></i></a>
                     <a href="{% url 'nodes:node-logs' guid=node.guid %}" class="btn btn-primary">View Logs</a>
                     {% include "nodes/remove_node.html" with node=node %}
+                    {% include "nodes/remove_file.html" with node=node %}
                     {% include "nodes/registration_force_archive.html" with node=node %}
                     {% include "nodes/make_private.html" with node=node %}
                     {% include "nodes/make_public.html" with node=node %}

admin/templates/nodes/remove_file.html

@@ -0,0 +1,36 @@
+{% if node.is_registration and node.archived %}
+<a data-toggle="modal" data-target="#confirmDeleteFileModal" class="btn btn-danger">
+    Delete File
+</a>
+<div id="confirmDeleteFileModal" class="modal fade well" tabindex="-1" role="dialog">
+    <div class="modal-dialog" role="document">
+        <div class="modal-content">
+            <form class="well" method="post" action="{% url 'nodes:remove-file' guid=node.guid %}">
+                <div class="modal-header">
+                    <button type="button" class="close" data-dismiss="modal">x</button>
+                    <h3>Enter file to delete</h3>
+                </div>
+                 {% csrf_token %}
+
+                <div class="modal-body">
+                    <div style="display:flex; align-items:center; gap:12px;">
+                    <label for="file-guid" style="margin:0; white-space:nowrap;">File guid:</label>
+                    <input id="file-guid"
+                           type="text"
+                           name="remove-file-guid"
+                           class="form-control"
+                           required
+                           style="flex:1; min-width:0;">
+                  </div>
+                </div>
+                <div class="modal-footer">
+                    <button class="btn btn-danger"  name="action" value="ham" type="submit">Confirm</button>
+                    <button type="button" class="btn btn-default" data-dismiss="modal">
+                        Cancel
+                    </button>
+                </div>
+            </form>
+        </div>
+    </div>
+</div>
+{% endif %}

osf/management/commands/change_node_region.py

@@ -39,11 +39,14 @@ def _update_blocks(file_block_map, original_id, cloned_id):
         block.save()
 
 def _update_schema_meta(node):
-    logger.info('Updating legacy schema information...')
-    node.registration_responses = node.schema_responses.latest('-created').all_responses
-    node.registered_meta[node.registration_schema._id] = node.expand_registration_responses()
-    node.save()
-    logger.info('Updated legacy schema information.')
+    try:
+        logger.info('Updating legacy schema information...')
+        node.registration_responses = node.schema_responses.latest('-created').all_responses
+        node.registered_meta[node.registration_schema._id] = node.expand_registration_responses()
+        node.save()
+        logger.info('Updated legacy schema information.')
+    except Exception:
+        logger.error('There is no data in schema responses to update legacy schema information.')
 
 def _copy_and_clone_versions(original_file, cloned_file, src_bucket, dest_bucket, dest_bucket_name, dest_region):
     for v in original_file.versions.order_by('identifier').all():