Open the create form on the ACL the Collection would inherit

Atlas copies the destination's read AND edit lists onto a new child
wholesale, group grants included - a Collection made under a public
Community is born public, and one made under a container granting
'editors' is born granting 'editors'.

The form defaulted to Private with no grant rows, which would have
narrowed every child of a public container and dropped the inherited
grants along with it. Open it holding what the child would inherit
instead: the reader sees the audience the Collection is about to be born
with, and submitting untouched lands exactly where a bare create would.

Author: dgcliff

app/controllers/concerns/transformable.rb

@@ -106,26 +106,32 @@ def assign_visibility_ceiling(resource)
     @public_allowed = true
   end
 
-  # Everything the permissions section of a *create* form needs. The resource
-  # does not exist yet, so it has no grants to show and nothing beneath it to
-  # cascade to: the rows start empty and @narrowing_allowed stays unset, which
-  # is what puts shared/_visibility_control on its ordinary offered branch (see
-  # the `== false` test there).
+  # Everything the permissions section of a *create* form needs.
   #
-  # Order is load-bearing. The ceiling is read off the destination container's
-  # envelope, which @permissions holds from the create gate until the last line
-  # replaces it with the form's (empty) row list.
+  # Atlas copies the destination's read ACL onto a new child wholesale — group
+  # grants included — so the form opens holding exactly what the resource would
+  # be born with, rather than a blank slate or a fixed default. That is what
+  # lets it add a choice without moving the outcome: submit it untouched and the
+  # ACL is the one inheritance would have produced anyway. A form that defaulted
+  # to Private instead would quietly narrow every child of a public container,
+  # and drop the inherited group grants with it.
+  #
+  # @narrowing_allowed stays unset, which is what puts _visibility_control on
+  # its ordinary offered branch (see the `== false` test there) — there is
+  # nothing inside a resource that does not exist to cascade to.
+  #
+  # Order is load-bearing twice. The ceiling reads the destination's envelope,
+  # and pretty_resource_permissions then MUTATES that same envelope (stripping
+  # the public sentinel) before returning the form's rows, so the ceiling has to
+  # be settled first.
   #
   # @param destination_id [String] the container this resource will be made in.
   def new_form_permissions!(destination_id)
+    inherited = @permissions
     assign_destination_ceiling(destination_id)
-    # Private, matching the ACL Atlas mints a container with (read: []). The
-    # control adds a choice here; it must not also move the outcome for someone
-    # who leaves it alone, and of the two directions to be wrong in silently,
-    # publishing is the one that cannot be taken back.
-    @public = false
+    @public = @public_allowed
     @groups = groups_for_permissions_picker
-    @permissions = []
+    @permissions = pretty_resource_permissions(inherited)
   end
 
   # The create-form counterpart to {#assign_visibility_ceiling}. That one walks

app/views/collections/new.html.haml

@@ -12,11 +12,12 @@
       = c.text_field :title, required: true
       = c.text_area :description, rows: 10
 
-    -# The two controls the Permissions tab offers, so a Collection is born with
-    -# the audience its creator chose instead of inheriting one silently and
-    -# needing a second visit to correct it. No embargo field — that is a
-    -# Work-level affordance — and no narrowing confirmation, because a
-    -# Collection this new has nothing inside it to cascade to.
+    -# The two controls the Permissions tab offers. They open holding the ACL
+    -# this Collection would inherit from its destination, so the audience it is
+    -# about to be born with is visible and editable here rather than only
+    -# discoverable afterwards. No embargo field — that is a Work-level
+    -# affordance — and no narrowing confirmation, because a Collection this new
+    -# has nothing inside it to cascade to.
     %h4.pt-4.pb-2 Permissions
     .row
       .col-sm

spec/controllers/collections_controller_spec.rb

@@ -270,14 +270,26 @@
     context 'permissions section' do
       render_views
 
-      it 'renders the group grant editor with no committed rows' do
+      it 'renders the group grant editor' do
         get :new, params: { community_id: community.id }
 
-        expect(assigns(:permissions)).to eq([])
         expect(response.body).to include('Group Permissions')
         expect(response.body).to include('collection[permissions][new][group_id]')
       end
 
+      # Atlas copies the destination's read ACL onto a new child, so the form has
+      # to open holding it. Showing a blank slate would invite a curator to
+      # submit one and silently drop grants they never saw.
+      it 'prefills the grants the new collection would inherit' do
+        AtlasRb::Community.metadata(community.id,
+                                    { 'permissions' => { 'read' => ['editors'] } }, nuid: '000000004')
+
+        get :new, params: { community_id: community.id }
+
+        expect(assigns(:permissions).map(&:group_id)).to include('editors')
+        expect(response.body).to include('collection[permissions][1][group_id]')
+      end
+
       # A brand-new Collection has nothing inside it, so the cascade warning the
       # edit tab carries must not appear — and leaving @narrowing_allowed unset
       # is what keeps _visibility_control off its locked branch.
@@ -298,18 +310,20 @@
         expect(CGI.unescapeHTML(response.body)).to include("#{community.title}” is private")
       end
 
-      # Private matches the ACL Atlas mints a Collection with, so the control
-      # adds a choice without moving the outcome for a reader who ignores it.
-      it 'offers the choice under a public destination and preselects Private' do
+      # Public is what the Collection would inherit, so preselecting it is what
+      # lets the control add a choice without moving the outcome for a reader
+      # who ignores it. Preselecting Private would narrow every child of a
+      # public container instead.
+      it 'offers the choice under a public destination and preselects the inherited Public' do
         publicize_ancestry!(community: community)
 
         get :new, params: { community_id: community.id }
 
         control = response.parsed_body.at_css('[name="mass"]')
         expect(assigns(:public_allowed)).to be(true)
-        expect(assigns(:public)).to be(false)
+        expect(assigns(:public)).to be(true)
         expect(control.name).to eq('select')
-        expect(control.at_css('option[selected]')['value']).to eq('private')
+        expect(control.at_css('option[selected]')['value']).to eq('public')
       end
     end
   end
@@ -372,6 +386,24 @@
       expect(response).to redirect_to(new_community_collection_path(community.id))
     end
 
+    # Atlas copies the destination's ACL onto a new child, and the form opens
+    # holding that copy — so submitting it untouched has to land where a bare
+    # create would. Otherwise adding the control would itself change what
+    # creating a Collection does.
+    it 'lands on the inherited ACL when the prefilled controls are submitted untouched' do
+      publicize_ancestry!(community: community)
+      reference = AtlasRb::Collection.create(community.id, nuid: '000000004')
+      inherited = Array(AtlasRb::Resource.permissions(reference.id)&.read)
+
+      post :create, params: { community_id: community.id, mass: 'public',
+                              collection: { title: 'InheritedCollection', description: 'D' } }
+
+      created_id = response.location.split('/').last
+      expect(Array(AtlasRb::Resource.permissions(created_id)&.read)).to match_array(inherited)
+    ensure
+      [reference&.id, created_id].compact.each { |id| AtlasRb::Collection.tombstone(id) }
+    end
+
     it 'applies the submitted visibility and group grants to the new collection' do
       publicize_ancestry!(community: community)