pkp/pkp-lib#i9963 API Endpoint to download review files

[Vitaliy-1]

No description provided.

[taslangraham]

The implemented endpoint seems to support the use-case described in #9964. Assigned files can be retrieved by sending the appropriate fileStage(4) in the fileStages param.

pkp-lib/api/v1/submissions/PKPSubmissionFileController.php

Lines 644 to 654 in fe3fe79

	// Get review files reviewer has access to
	$files = collect();
	if (in_array(SubmissionFile::SUBMISSION_FILE_REVIEW_FILE, $fileStages)) {
	$files = $files->merge(
	Repo::submissionFile()->getCollector()
	->filterByReviewIds([$reviewAssignment->getId()])
	->filterByFileStages([SubmissionFile::SUBMISSION_FILE_REVIEW_FILE, SubmissionFile::SUBMISSION_FILE_INTERNAL_REVIEW_FILE])
	->getMany()
	);
	}

@Vitaliy-1 @ewhanson @jardakotesovec

[ewhanson]

This make sense in theory but doesn't allow for admin access (site admin, journal manager, etc.) or other elevated roles like editors. As a site admin, I would expect all routes to be accessible via the site admin API key. I saw you said you based this on the ReviewAssignmentAccessPolicy. I think it makes sense to keep this as part of the ReviewAssignmentFileAccessPolicy as-is but to conditionally apply the policy check like ReviewAssignmentAccessPolicy is here:

pkp-lib/classes/security/authorization/SubmissionAccessPolicy.php

Lines 74 to 85 in 0434331

	//
	// Reviewer role
	//
	if (isset($roleAssignments[Role::ROLE_ID_REVIEWER])) {
	// 1) Reviewers can access whitelisted operations ...
	$reviewerSubmissionAccessPolicy = new PolicySet(PolicySet::COMBINING_DENY_OVERRIDES);
	$reviewerSubmissionAccessPolicy->addPolicy(new RoleBasedHandlerOperationPolicy($request, Role::ROLE_ID_REVIEWER, $roleAssignments[Role::ROLE_ID_REVIEWER]));
	// 2) ... but only if they have been assigned to the submission as reviewers.
	$reviewerSubmissionAccessPolicy->addPolicy(new ReviewAssignmentAccessPolicy($request, $permitDeclined));
	$submissionAccessPolicy->addPolicy($reviewerSubmissionAccessPolicy);
	}