From dfba7adf989452d3c9c5896ed748e817c7c764df Mon Sep 17 00:00:00 2001
From: Anton <anton@scinote.net>
Date: Thu, 14 Nov 2024 15:33:03 +0100
Subject: [PATCH] Fix pemrisison for acrived rows and download link
 [SCI-11284][SCI-11285]

---
 app/javascript/vue/shared/file_versions_modal.vue | 2 +-
 app/permissions/asset.rb                          | 1 +
 app/serializers/active_storage/blob_serializer.rb | 6 +++++-
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/app/javascript/vue/shared/file_versions_modal.vue b/app/javascript/vue/shared/file_versions_modal.vue
index 1cf084138..1a0553e97 100644
--- a/app/javascript/vue/shared/file_versions_modal.vue
+++ b/app/javascript/vue/shared/file_versions_modal.vue
@@ -40,7 +40,7 @@
                 <div class="basis-1/4 flex justify-end">
                   <a class="btn btn-icon p-0 px-2 hover:bg-sn-light-grey"
                     v-if="enabled || index === 0"
-                    :href="fileVersion.attributes.url"
+                    :href="fileVersion.attributes.download_url"
                     target="_blank"
                     data-render-tooltip="true"
                     :title="i18n.t('assets.file_versions_modal.download')"
diff --git a/app/permissions/asset.rb b/app/permissions/asset.rb
index 4349fdfe5..8f576ca09 100644
--- a/app/permissions/asset.rb
+++ b/app/permissions/asset.rb
@@ -27,6 +27,7 @@ Canaid::Permissions.register_for(Asset) do
       if object.repository_column.repository.is_a?(RepositorySnapshot)
         false
       else
+        object.repository_row.active? &&
         can_manage_repository_assets?(user, object.repository_column.repository)
       end
     end
diff --git a/app/serializers/active_storage/blob_serializer.rb b/app/serializers/active_storage/blob_serializer.rb
index a758badd7..ff3a1ed8d 100644
--- a/app/serializers/active_storage/blob_serializer.rb
+++ b/app/serializers/active_storage/blob_serializer.rb
@@ -4,7 +4,7 @@ module ActiveStorage
   class BlobSerializer < ActiveModel::Serializer
     include Rails.application.routes.url_helpers
 
-    attributes :filename, :extension, :basename, :url, :created_at, :byte_size, :version, :restored_from_version, :created_by
+    attributes :filename, :extension, :basename, :url, :created_at, :byte_size, :version, :restored_from_version, :created_by, :download_url
 
     def basename
       object.filename.base
@@ -14,6 +14,10 @@ module ActiveStorage
       object.filename.extension_without_delimiter
     end
 
+    def download_url
+      rails_blob_url(object, disposition: 'attachment')
+    end
+
     def version
       object.metadata['version'] || 1
     end