From 3984c4edcacadeeb9f881e59b555d23dbd1867a3 Mon Sep 17 00:00:00 2001
From: Ben Pennell <bbpennel@email.unc.edu>
Date: Wed, 27 Nov 2024 12:36:34 -0500
Subject: [PATCH] BXC-4796 - Limit bulk download access (#1838)

* Disentangling bulk download from file list to make it easier to get access to needed data

* Styling updates to button

* Limit zip download to authenticated or oncampus users. Server returns a property if the user has permission

* Fix test

* Fixing up style issues and getting more parts working with bulma 1.0

* Fix test and update readme

* Convert search clearing links to buttons
---
 README.md                                     |  2 +-
 .../auth/api/AccessPrincipalConstants.java    |  1 +
 static/css/sass/cdr_ui_styles.scss            | 36 +++------
 .../src/assets/common-styles.css              |  8 +-
 .../src/components/clearFacetsButton.vue      | 17 +----
 .../src/components/clearFilters.vue           | 18 ++---
 .../src/components/filterTags.vue             | 64 ++++++----------
 .../src/components/full_record/adminUnit.vue  |  4 +-
 .../full_record/aggregateRecord.vue           | 27 ++++---
 .../components/full_record/bulkDownload.vue   | 10 +--
 .../full_record/collectionRecord.vue          |  4 +-
 .../src/components/full_record/fileList.vue   | 29 +------
 .../components/full_record/folderRecord.vue   |  4 +-
 .../full_record/restrictedContent.vue         | 36 ++++-----
 .../components/full_record/singleUseLink.vue  |  4 +-
 .../src/mixins/fileDownloadUtils.js           | 10 +--
 .../tests/unit/aggregateRecord.spec.js        |  4 +
 .../tests/unit/bulkDownload.spec.js           |  8 +-
 .../tests/unit/clearFilters.spec.js           |  4 +-
 .../tests/unit/fileList.spec.js               |  6 +-
 .../controllers/FullRecordController.java     |  9 ++-
 .../auth/PatronActionPermissionsUtil.java     | 34 +++++++++
 .../auth/PatronActionPermissionsUtilTest.java | 75 +++++++++++++++++++
 .../services/rest/DownloadBulkController.java | 18 +++--
 .../rest/DownloadBulkControllerIT.java        | 25 +++++--
 25 files changed, 264 insertions(+), 193 deletions(-)
 create mode 100644 web-common/src/main/java/edu/unc/lib/boxc/web/common/auth/PatronActionPermissionsUtil.java
 create mode 100644 web-common/src/test/java/edu/unc/lib/boxc/web/common/auth/PatronActionPermissionsUtilTest.java

diff --git a/README.md b/README.md
index 8968f1c3a3..5397b5837f 100644
--- a/README.md
+++ b/README.md
@@ -85,7 +85,7 @@ mvn -pl '!clamav-java' verify
 ### Running JavaScript tests
 ```
 # JavaScript Tests
-npm --prefix static/js/admin/vue-permissions-editor run test
+npm --prefix static/js/admin/vue-cdr-admin run test
 npm --prefix static/js/vue-cdr-access run test
 ```
 
diff --git a/auth-api/src/main/java/edu/unc/lib/boxc/auth/api/AccessPrincipalConstants.java b/auth-api/src/main/java/edu/unc/lib/boxc/auth/api/AccessPrincipalConstants.java
index 285d9714be..f73ccc9728 100644
--- a/auth-api/src/main/java/edu/unc/lib/boxc/auth/api/AccessPrincipalConstants.java
+++ b/auth-api/src/main/java/edu/unc/lib/boxc/auth/api/AccessPrincipalConstants.java
@@ -23,6 +23,7 @@ public class AccessPrincipalConstants {
     public final static String PATRON_NAMESPACE = "unc:patron:";
     public final static String IP_PRINC_NAMESPACE = PATRON_NAMESPACE + "ipp:";
     public final static String ADMIN_ACCESS_PRINC = "admin_access";
+    public final static String ON_CAMPUS_PRINC = "unc:patron:ipp:on_campus";
 
     public final static Pattern PATRON_PRINC_PATTERN =
             Pattern.compile("(" + PUBLIC_PRINC
diff --git a/static/css/sass/cdr_ui_styles.scss b/static/css/sass/cdr_ui_styles.scss
index db723669a0..05cb52e4e8 100644
--- a/static/css/sass/cdr_ui_styles.scss
+++ b/static/css/sass/cdr_ui_styles.scss
@@ -125,7 +125,7 @@ $box-shadow: inset 3px 3px 10px -1px $box-shadow-color, 0px 16px 22px -15px $box
 *
 **/
 .search-query-text {
-  margin: 40px 20px 40px 25px;
+  margin: 40px 20px 20px 25px;
   font-size: 24px;
 
   h2 {
@@ -147,13 +147,6 @@ form.search {
   }
 }
 
-.browse-search {
-  .button.is-focused,
-  .button:focus {
-    color: #363636;
-  }
-}
-
 a.search-result-num {
   background-color: $container-blue;
   color: white !important;
@@ -435,14 +428,18 @@ img.data-thumb {
   max-width: 60px;
 }
 
-.child-records {
-  font-size: 16px;
-  margin: 30px 50px 25px 50px;
+.file-list-header {
+  margin: 30px 0 5px;
 
   h3 {
     font-size: 16px;
-    margin-bottom: 30px;
+    margin: 0;
+    padding: 0;
   }
+}
+
+.child-records {
+  font-size: 16px;
 
   .fa.default-img-icon {
     font-size: 32px;
@@ -455,14 +452,6 @@ img.data-thumb {
     }
   }
 
-  .is-icon {
-    background-color: $container-blue;
-    border: 1px solid $container-blue;
-    border-radius: 5px;
-    color: white;
-    padding: 7px;
-  }
-
   .no-download {
     background-color: #B8B8B8;
     border-color: #B8B8B8;
@@ -822,11 +811,6 @@ table.dataTable {
   margin-bottom: 10px;
 }
 
-.button.is-focused,
-.button:focus {
-  color: white;
-}
-
 /* MODs display for work and file pages, plus modalMetadata.vue component */
 #mods_data_display {
   margin: auto;
@@ -1156,7 +1140,7 @@ iframe {
 
 .clover-viewer {
   margin: auto;
-  width: 90%;
+  width: 95%;
 }
 
 #information-toggle {
diff --git a/static/js/vue-cdr-access/src/assets/common-styles.css b/static/js/vue-cdr-access/src/assets/common-styles.css
index ddc2c1bf99..5906cf1c01 100644
--- a/static/js/vue-cdr-access/src/assets/common-styles.css
+++ b/static/js/vue-cdr-access/src/assets/common-styles.css
@@ -35,17 +35,13 @@ a.button.is-link span {
     background-color: white;
 }
 
-.image-download-options button {
+.button.is-primary {
     background-color: #1A698C;
     color: white;
-    font-family: 'Open Sans', sans-serif;
-    height: 48px;
 }
 
-.image-download-options button:hover,
-.image-download-options button:focus {
+.button.is-primary:hover {
     background-color: #084b6b;
-    color: white;
 }
 
 .image-download-options a {
diff --git a/static/js/vue-cdr-access/src/components/clearFacetsButton.vue b/static/js/vue-cdr-access/src/components/clearFacetsButton.vue
index da3a775cfb..7f527f1d77 100644
--- a/static/js/vue-cdr-access/src/components/clearFacetsButton.vue
+++ b/static/js/vue-cdr-access/src/components/clearFacetsButton.vue
@@ -2,9 +2,9 @@
 Button for clearing all currently active facets limiting the search.
 -->
 <template>
-    <a v-if="showButton" class="clear-all-facets button is-link is-small" @click.prevent="clearAllFacets()">{{ $t('facets.clear')}}
-        <i class="fas fa-times"></i>
-    </a>
+    <button v-if="showButton" class="clear-all-facets button is-primary" @click.prevent="clearAllFacets()"><span>{{ $t('facets.clear')}}</span>
+        <span class="icon"><i class="fas fa-times"></i></span>
+    </button>
 </template>
 <script>
 import routeUtils from '../mixins/routeUtils';
@@ -27,13 +27,4 @@ export default {
         }
     }
 };
-</script>
-
-<style scoped  lang="scss">
-    a {
-        margin-left: 5px;
-    }
-    i {
-        padding-left: 10px;
-    }
-</style>
\ No newline at end of file
+</script>
\ No newline at end of file
diff --git a/static/js/vue-cdr-access/src/components/clearFilters.vue b/static/js/vue-cdr-access/src/components/clearFilters.vue
index b999d161f3..d9cd1f1535 100644
--- a/static/js/vue-cdr-access/src/components/clearFilters.vue
+++ b/static/js/vue-cdr-access/src/components/clearFilters.vue
@@ -1,8 +1,10 @@
 <template>
-    <div class="clear-options">
-        <a id="clear-results" class="button is-link is-small" v-bind:class="{ 'disabled' : !this.enableStartOverButton}"
-           href="#" @click.prevent="clearSearch">
-                {{ $t('search.clear_search')}} <i class="fas fa-times"></i></a>
+    <div class="clear-options field is-grouped">
+        <button id="clear-results" class="button is-primary"
+                v-bind:class="{ 'disabled' : !this.enableStartOverButton}"
+                @click.prevent="clearSearch">
+            <span>{{ $t('search.clear_search')}}</span><span class="icon"><i class="fas fa-times"></i></span>
+        </button>
         <clear-facets-button></clear-facets-button>
         <filter-tags :filter-parameters="filterParameters"></filter-tags>
     </div>
@@ -56,14 +58,10 @@ export default {
 </script>
 
 <style scoped  lang="scss">
-    i {
-        padding-left: 10px;
-    }
     .clear-options {
         display: inline-flex;
         flex-wrap: wrap;
-        margin-bottom: 10px;
-        margin-left: 35px;
-        margin-top: -20px
+        margin-bottom: 30px;
+        margin-left: 25px;
     }
 </style>
\ No newline at end of file
diff --git a/static/js/vue-cdr-access/src/components/filterTags.vue b/static/js/vue-cdr-access/src/components/filterTags.vue
index 6136ba118e..7cb7ec0031 100644
--- a/static/js/vue-cdr-access/src/components/filterTags.vue
+++ b/static/js/vue-cdr-access/src/components/filterTags.vue
@@ -2,18 +2,18 @@
 Displays tags for currently active filters in a search result, with the option to remove them
 -->
 <template>
-    <div>
-        <ul @click="updateQueryUrl">
-            <li data-type="anywhere" class="search-text" v-if="$route.query.anywhere">{{ $route.query.anywhere }}
-                <i class="fas fa-times" data-type="anywhere"></i></li>
-            <template v-for="searchText in searchQueryDisplay">
-                <li :data-type="searchText.type" :data-value="searchText.original_value" class="search-text" :title="searchText.value_text">
+    <div @click="updateQueryUrl" class="field is-grouped">
+        <button data-type="anywhere" class="button search-text" v-if="$route.query.anywhere"><span>{{ $route.query.anywhere }}</span>
+            <span class="icon"><i class="fas fa-times"></i></span></button>
+        <template v-for="searchText in searchQueryDisplay">
+            <button :data-type="searchText.type" :data-value="searchText.original_value" class="search-text button" :title="searchText.value_text">
+                <span>
                     {{ searchText.type_text }} <i class="fas fa-greater-than"></i>
                     {{ truncateText(searchText.value_text) }}
-                    <i class="fas fa-times" :data-type="searchText.type" :data-value="searchText.original_value"></i>
-                </li>
-            </template>
-        </ul>
+                </span>
+                <span class="icon"><i class="fas fa-times"></i></span>
+            </button>
+        </template>
     </div>
 </template>
 
@@ -66,7 +66,13 @@ export default {
         },
 
         _updateParams(event) {
-            const query_param = event.target.getAttribute('data-type');
+            // Find the button that was clicked, to deal with the button containing child elements
+            const button = event.target.closest('button');
+            if (!button) {
+                return;
+            }
+
+            const query_param = button.getAttribute('data-type');
             const params = Object.assign({}, this.$route.query);
             const tag = decodeURIComponent(params[query_param]).split('||');
 
@@ -147,38 +153,12 @@ export default {
 </script>
 
 <style scoped lang="scss">
-    ul {
-        display: flex;
-        flex-wrap: wrap;
-        margin-top: 10px;
-
-        &:hover {
-            cursor: pointer;
-        }
-
-        .search-text {
-            border: 1px solid lightgray;
-            border-radius: 5px;
-            font-size: .85rem;
-            margin-left: 5px;
-            padding-left: 7px;
-            text-indent: 0;
-            text-transform: capitalize;
-        }
-    }
-
-    i.fa-times {
-        background-color: #1A698C;
-        border: 1px solid #1A698C;
-        border-bottom-right-radius: 5px;
-        border-top-right-radius: 5px;
-        color: white;
-        margin-left: 5px;
-        padding: 7px;
-    }
-
     i.fa-greater-than {
-        color: #B0B0B0;
         font-size: .6rem;
     }
+
+    .delete.is-small {
+        margin-left: 6px;
+        margin-right: -5px;
+    }
 </style>
\ No newline at end of file
diff --git a/static/js/vue-cdr-access/src/components/full_record/adminUnit.vue b/static/js/vue-cdr-access/src/components/full_record/adminUnit.vue
index 318659579e..265a65b5e0 100644
--- a/static/js/vue-cdr-access/src/components/full_record/adminUnit.vue
+++ b/static/js/vue-cdr-access/src/components/full_record/adminUnit.vue
@@ -1,8 +1,10 @@
 <template>
     <div>
         <div class="columns browse-top">
-            <div class="column">
+            <div class="column is-narrow">
                 <thumbnail :thumbnail-data="recordData"></thumbnail>
+            </div>
+            <div class="column">
                 <h2 :class="isDeleted">
                     {{ recordData.briefObject.title }}
                 </h2>
diff --git a/static/js/vue-cdr-access/src/components/full_record/aggregateRecord.vue b/static/js/vue-cdr-access/src/components/full_record/aggregateRecord.vue
index e6b9eab9c9..0f6efdfb38 100644
--- a/static/js/vue-cdr-access/src/components/full_record/aggregateRecord.vue
+++ b/static/js/vue-cdr-access/src/components/full_record/aggregateRecord.vue
@@ -62,16 +62,22 @@
                 </div>
             </div>
         </div>
-        <div class="full_record_bottom">
+        <div class="full_record_bottom container is-fluid">
             <player :record-data="recordData"></player>
-            <file-list v-if="childCount > 0" id="file-display"
-                       :child-count="childCount"
-                       :work-id="recordData.briefObject.id"
-                       :total-download-size="recordData.totalDownloadSize"
-                       :download-access="hasDownloadAccess(recordData)"
-                       :view-original-access="hasPermission(recordData, 'viewOriginal')"
-                       :edit-access="hasPermission(recordData,'editDescription')">
-            </file-list>
+            <template v-if="childCount > 0">
+                <div class="file-list-header columns is-vcentered">
+                    <h3 class="column">{{ $t('full_record.item_list') }} ({{ childCount }})</h3>
+                    <bulk-download :has-bulk-download-access="recordData.canBulkDownload"
+                                   :total-download-size="recordData.totalDownloadSize"
+                                   :work-id="recordData.briefObject.id">
+                    </bulk-download>
+                </div>
+                <file-list id="file-display"
+                           :work-id="recordData.briefObject.id"
+                           :download-access="hasDownloadAccess(recordData)"
+                           :edit-access="hasPermission(recordData,'editDescription')">
+                </file-list>
+            </template>
             <metadata-display :uuid="recordData.briefObject.id"
                               :can-view-metadata="hasPermission(recordData, 'viewMetadata')">
             </metadata-display>
@@ -91,11 +97,12 @@ import metadataDisplay from '@/components/full_record/metadataDisplay.vue';
 import neighborList from '@/components/full_record/neighborList.vue';
 import player from '@/components/full_record/player.vue';
 import restrictedContent from '@/components/full_record/restrictedContent.vue';
+import bulkDownload from "@/components/full_record/bulkDownload.vue";
 
 export default {
     name: 'aggregateRecord',
 
-    components: {abstract, fileList, neighborList, metadataDisplay, player, restrictedContent},
+    components: {bulkDownload, abstract, fileList, neighborList, metadataDisplay, player, restrictedContent},
 
     mixins: [fileUtils, fullRecordUtils],
 
diff --git a/static/js/vue-cdr-access/src/components/full_record/bulkDownload.vue b/static/js/vue-cdr-access/src/components/full_record/bulkDownload.vue
index 125c9e4c7a..8d4b932c3d 100644
--- a/static/js/vue-cdr-access/src/components/full_record/bulkDownload.vue
+++ b/static/js/vue-cdr-access/src/components/full_record/bulkDownload.vue
@@ -1,6 +1,6 @@
 <template>
-    <div v-if="hasDownloadableContent" class="actionlink column pr-0 is-justify-content-flex-end">
-        <a v-if="showTotalFilesize" class="bulk-download bulk-download-link button action" :href="downloadBulkUrl(workId)">
+    <div v-if="hasDownloadableContent" class="column pr-0 has-text-right">
+        <a v-if="showTotalFilesize" class="bulk-download bulk-download-link button action is-primary" :href="downloadBulkUrl(workId)">
                     <span class="icon">
                         <i class="fa fa-archive"></i>
                     </span>
@@ -31,7 +31,7 @@ export default {
             default: null,
             type: Number
         },
-        viewOriginalAccess: {
+        hasBulkDownloadAccess: {
             default: false,
             type: Boolean
         },
@@ -40,11 +40,11 @@ export default {
 
     computed: {
         hasDownloadableContent() {
-            return this.viewOriginalAccess && this.totalDownloadSize !== null;
+            return this.hasBulkDownloadAccess && this.totalDownloadSize !== null;
         },
 
         showTotalFilesize() {
-            return this.hasDownloadableContent && this.totalDownloadSize <= ONE_GIGABYTE;
+            return this.hasBulkDownloadAccess && this.totalDownloadSize <= ONE_GIGABYTE;
         }
     }
 }
diff --git a/static/js/vue-cdr-access/src/components/full_record/collectionRecord.vue b/static/js/vue-cdr-access/src/components/full_record/collectionRecord.vue
index 716212bce6..c052d0a3ec 100644
--- a/static/js/vue-cdr-access/src/components/full_record/collectionRecord.vue
+++ b/static/js/vue-cdr-access/src/components/full_record/collectionRecord.vue
@@ -1,8 +1,10 @@
 <template>
     <div class="content-wrap full_record">
         <div class="columns browse-top">
-            <div class="column" :class="{restrictedContent: 'is-8'}">
+            <div class="column is-narrow" :class="{restrictedContent: 'is-8'}">
                 <thumbnail :thumbnail-data="recordData"></thumbnail>
+            </div>
+            <div class="column">
                 <h2 :class="isDeleted">
                     {{ recordData.briefObject.title }}
                     <span class="item_container_count">{{ displayChildCount }}</span>
diff --git a/static/js/vue-cdr-access/src/components/full_record/fileList.vue b/static/js/vue-cdr-access/src/components/full_record/fileList.vue
index 1edeeeee46..fd515fe682 100644
--- a/static/js/vue-cdr-access/src/components/full_record/fileList.vue
+++ b/static/js/vue-cdr-access/src/components/full_record/fileList.vue
@@ -7,14 +7,6 @@ force it to reload
 -->
 <template>
     <div class="child-records table-container" id="data-display">
-        <div class="columns">
-            <h3 class="column">{{ $t('full_record.item_list') }} ({{ childCount }})</h3>
-            <bulk-download :view-original-access="viewOriginalAccess"
-                           :total-download-size="totalDownloadSize"
-                           :work-id="workId">
-            </bulk-download>
-        </div>
-
         <data-table :key="workId" id="child-files" class="table is-striped is-bordered is-fullwidth"
                     :ajax="ajaxOptions"
                     :columns="columns"
@@ -35,7 +27,6 @@ force it to reload
 </template>
 
 <script>
-import bulkDownload from '@/components/full_record/bulkDownload.vue';
 import fileDownloadUtils from '../../mixins/fileDownloadUtils';
 import fullRecordUtils from '../../mixins/fullRecordUtils';
 import fileUtils from '../../mixins/fileUtils';
@@ -51,10 +42,9 @@ export default {
 
     mixins: [fileDownloadUtils, fileUtils, fullRecordUtils],
 
-    components: {bulkDownload, DataTable},
+    components: {DataTable},
 
     props: {
-        childCount: Number,
         downloadAccess: {
             default: false,
             type: Boolean
@@ -67,14 +57,6 @@ export default {
             default: 'Work',
             type: String
         },
-        totalDownloadSize: {
-            default: null,
-            type: String
-        },
-        viewOriginalAccess: {
-            default: false,
-            type: Boolean
-        },
         workId: String
     },
 
@@ -91,10 +73,6 @@ export default {
     },
 
     computed: {
-        showTotalFilesize() {
-            return this.viewOriginalAccess && this.totalDownloadSize !== null
-        },
-
         // Datatables expects dataSrc to return an array
         // File objects don't have any child metadata, so wrap the file object in an array
         ajaxOptions() {
@@ -242,8 +220,8 @@ export default {
                 column_defs.push(
                     {
                         render: (data, type, row) => {
-                            return `<a href="/admin/describe/${row.id}" aria-label="${this.ariaLabelText(row)}">` +
-                                '<i class="fa fa-edit is-icon" title="Edit"></i></a>'
+                            return `<a href="/admin/describe/${row.id}" class="button action is-primary" aria-label="${this.ariaLabelText(row)}">` +
+                                '<span class="icon"><i class="fa fa-edit" title="Edit"></span></i></a>'
                         },
                         targets: column_number
                     }
@@ -367,7 +345,6 @@ export default {
 
     @media screen and (max-width: 576px) {
         #data-display {
-            h3,
             .actionlink.column {
                 margin-bottom: 0;
             }
diff --git a/static/js/vue-cdr-access/src/components/full_record/folderRecord.vue b/static/js/vue-cdr-access/src/components/full_record/folderRecord.vue
index 6ea83a5c0a..5e88fe28a1 100644
--- a/static/js/vue-cdr-access/src/components/full_record/folderRecord.vue
+++ b/static/js/vue-cdr-access/src/components/full_record/folderRecord.vue
@@ -1,8 +1,10 @@
 <template>
     <div class="content-wrap full_record">
         <div class="columns browse-top">
-            <div class="column" :class="{restrictedContent: 'is-8'}">
+            <div class="column is-narrow">
                 <thumbnail :thumbnail-data="recordData"></thumbnail>
+            </div>
+            <div class="column">
                 <h2 :class="isDeleted">
                     {{ recordData.briefObject.title }}
                     <span class="item_container_count">{{ displayChildCount }}</span>
diff --git a/static/js/vue-cdr-access/src/components/full_record/restrictedContent.vue b/static/js/vue-cdr-access/src/components/full_record/restrictedContent.vue
index 111c39d590..a00d87cd7a 100644
--- a/static/js/vue-cdr-access/src/components/full_record/restrictedContent.vue
+++ b/static/js/vue-cdr-access/src/components/full_record/restrictedContent.vue
@@ -1,29 +1,23 @@
 <template>
     <div class="column is-narrow action-btn item-actions">
-        <div v-if="restrictedContent && !isLoggedIn" class="column is-narrow item-actions">
+        <div v-if="restrictedContent && !isLoggedIn" class="column is-narrow item-actions has-text-centered">
             <div class="restricted-access">
                 <h2>{{ $t('full_record.restricted_content', { resource_type: recordData.briefObject.type.toLowerCase() }) }}</h2>
-                <div v-if="hasGroupRole(recordData, 'canViewOriginals', 'authenticated')" class="actionlink"><a class="button login-link action" :href="loginUrl"><i class="fa fa-id-card"></i> {{ $t('access.login') }}</a></div>
-                <div class="actionlink">
-                    <a class="button contact action" href="https://library.unc.edu/contact-us/?destination=wilson"><i class="fa fa-envelope"></i> {{ $t('access.contact') }}</a>
-                </div>
+                <a v-if="hasGroupRole(recordData, 'canViewOriginals', 'authenticated')" class="button login-link action is-primary" :href="loginUrl"><span class="icon"><i class="fa fa-id-card"></i></span><span>{{ $t('access.login') }}</span></a>
+                <a class="button contact action is-primary" href="https://library.unc.edu/contact-us/?destination=wilson"><span class="icon"><i class="fa fa-envelope"></i></span><span>{{ $t('access.contact') }}</span></a>
             </div>
         </div>
-        <div v-if="hasPermission(recordData, 'editDescription')" class="actionlink">
-            <a class="edit button action" :href="editDescriptionUrl(recordData.briefObject.id)"><i class="fa fa-edit"></i> {{ $t('full_record.edit') }}</a>
+        <div v-if="recordData.resourceType === 'File' && hasDownloadAccess(recordData)" class="field is-grouped is-justify-content-right">
+            <div class="header-button" v-html="downloadButtonHtml(recordData.briefObject)"></div>
+            <a v-if="hasPermission(recordData, 'viewOriginal')" class="button view action is-primary" :href="recordData.dataFileUrl">
+                <span class="icon"><i class="fa fa-search" aria-hidden="true"></i></span><span>View</span></a>
+        </div>
+        <div v-if="hasPermission(recordData, 'editDescription')" class="field is-grouped is-justify-content-right">
+            <a class="edit button action is-primary" :href="editDescriptionUrl(recordData.briefObject.id)"><span class="icon"><i class="fa fa-edit"></i></span><span>{{ $t('full_record.edit') }}</span></a>
+        </div>
+        <div v-if="recordData.resourceType === 'File' && hasPermission(recordData, 'viewHidden')" class="is-justify-content-right">
+            <single-use-link :uuid="recordData.briefObject.id"></single-use-link>
         </div>
-        <template v-if="recordData.resourceType === 'File'">
-            <template v-if="hasDownloadAccess(recordData)">
-                <div class="header-button" v-html="downloadButtonHtml(recordData.briefObject)"></div>
-                <div class="actionlink" v-if="hasPermission(recordData, 'viewOriginal')">
-                    <a class="button view action" :href="recordData.dataFileUrl">
-                        <i class="fa fa-search" aria-hidden="true"></i> View</a>
-                </div>
-            </template>
-            <template v-if="hasPermission(recordData, 'viewHidden')">
-                <single-use-link :uuid="recordData.briefObject.id"></single-use-link>
-            </template>
-        </template>
     </div>
 </template>
 
@@ -50,8 +44,8 @@ export default {
      white-space: normal;
  }
 
- .restricted-access .actionlink {
-     display: block;
+ .restricted-access {
+     text-align: center;
  }
 
  .header-button {
diff --git a/static/js/vue-cdr-access/src/components/full_record/singleUseLink.vue b/static/js/vue-cdr-access/src/components/full_record/singleUseLink.vue
index 7385c987ee..7552419c41 100644
--- a/static/js/vue-cdr-access/src/components/full_record/singleUseLink.vue
+++ b/static/js/vue-cdr-access/src/components/full_record/singleUseLink.vue
@@ -1,10 +1,10 @@
 <template>
     <div class="header-button-single-download">
-        <div class="actionlink single-download">
+        <div class="single-download">
             <div class="single-use-msg-text" :class="{'display-msg': this.message !== ''}">
                 {{ this.message }}
             </div>
-            <a class="button action" id="single-use-link" href="#" @click.prevent="createLink()">{{ $t('full_record.download_single_use') }}</a>
+            <a class="button action is-primary" id="single-use-link" href="#" @click.prevent="createLink()">{{ $t('full_record.download_single_use') }}</a>
             <ul>
                 <li v-for="single_use_link in single_use_links">
                     <div class="download-link-wrapper">
diff --git a/static/js/vue-cdr-access/src/mixins/fileDownloadUtils.js b/static/js/vue-cdr-access/src/mixins/fileDownloadUtils.js
index a5fbb0d0ee..12dbeb89f3 100644
--- a/static/js/vue-cdr-access/src/mixins/fileDownloadUtils.js
+++ b/static/js/vue-cdr-access/src/mixins/fileDownloadUtils.js
@@ -63,14 +63,14 @@ export default {
 
         downloadButtonHtml(brief_object) {
             if (this.showNonImageDownload(brief_object)) {
-                return `<div class="actionlink download">
-                            <a class="download button action" href="/content/${brief_object.id}?dl=true"><i class="fa fa-download"></i> ${this.$t('full_record.download')}</a>
+                return `<div class="download">
+                            <a class="download button action is-primary" href="/content/${brief_object.id}?dl=true"><span class="icon"><i class="fa fa-download"></i></span><span>${this.$t('full_record.download')}</span></a>
                         </div>`;
             } else if (this.showImageDownload(brief_object)) {
-                let html = `<div class="dropdown actionlink download image-download-options">
+                let html = `<div class="dropdown download image-download-options">
                 <div class="dropdown-trigger">
-                    <button id="dcr-download-${brief_object.id}" class="button download-images" aria-haspopup="true" aria-controls="dropdown-menu">
-                    ${this.$t('full_record.download')} <i class="fas fa-angle-down" aria-hidden="true"></i>
+                    <button id="dcr-download-${brief_object.id}" class="button download-images is-primary" aria-haspopup="true" aria-controls="dropdown-menu">
+                    <span>${this.$t('full_record.download')}</span><span class="icon"><i class="fas fa-angle-down" aria-hidden="true"></i></span>
                     </button>
                 </div>
                 <div class="dropdown-menu table-downloads" id="dropdown-menu" role="menu" aria-hidden="true">
diff --git a/static/js/vue-cdr-access/tests/unit/aggregateRecord.spec.js b/static/js/vue-cdr-access/tests/unit/aggregateRecord.spec.js
index 1f38a3bc03..97d6075aeb 100644
--- a/static/js/vue-cdr-access/tests/unit/aggregateRecord.spec.js
+++ b/static/js/vue-cdr-access/tests/unit/aggregateRecord.spec.js
@@ -585,6 +585,10 @@ describe('aggregateRecord.vue', () => {
         expect(wrapper.find('.download-jump a').exists()).toBe(true);
     });
 
+    it("displays a header with file count", () => {
+        expect(wrapper.find('h3').text()).toEqual("List of Items in This Work (1)");
+    });
+
     it("does not display a finding aid link, if absent", () => {
         expect(wrapper.find('.finding-aid').exists()).toBe(false);
     });
diff --git a/static/js/vue-cdr-access/tests/unit/bulkDownload.spec.js b/static/js/vue-cdr-access/tests/unit/bulkDownload.spec.js
index 5c212b74f1..26323bdff5 100644
--- a/static/js/vue-cdr-access/tests/unit/bulkDownload.spec.js
+++ b/static/js/vue-cdr-access/tests/unit/bulkDownload.spec.js
@@ -6,7 +6,7 @@ import translations from '@/translations';
 const work_id = 'e2f0d544-4f36-482c-b0ca-ba11f1251c01'
 let wrapper;
 
-describe('fileList.vue', () => {
+describe('bulkDownload.vue', () => {
     const i18n = createI18n({
         locale: 'en',
         fallbackLocale: 'en',
@@ -20,7 +20,7 @@ describe('fileList.vue', () => {
             },
             props: {
                 totalDownloadSize: 8193,
-                viewOriginalAccess: true,
+                hasBulkDownloadAccess: true,
                 workId: work_id,
             }
         });
@@ -51,9 +51,9 @@ describe('fileList.vue', () => {
         expect(download_email.text()).toEqual(expect.stringContaining('Contact Wilson Library for access'));
     });
 
-    it ("does not display a button if the user doesn't have viewOriginalAccess", async () => {
+    it ("does not display a button if the user doesn't have hasBulkDownloadAccess", async () => {
         await wrapper.setProps({
-            viewOriginalAccess: false
+            hasBulkDownloadAccess: false
         });
 
         let download_link = wrapper.find('.actionlink');
diff --git a/static/js/vue-cdr-access/tests/unit/clearFilters.spec.js b/static/js/vue-cdr-access/tests/unit/clearFilters.spec.js
index 72a7894e4e..abb657742e 100644
--- a/static/js/vue-cdr-access/tests/unit/clearFilters.spec.js
+++ b/static/js/vue-cdr-access/tests/unit/clearFilters.spec.js
@@ -56,7 +56,7 @@ describe('clearFilters.vue', () => {
         expect(wrapper.vm.$router.currentRoute.value.query.anywhere).toEqual("test");
         expect(wrapper.vm.$router.currentRoute.value.query.subject).toEqual("topic");
 
-        let clearLink = wrapper.find('a#clear-results');
+        let clearLink = wrapper.find('#clear-results');
         expect(clearLink.classes()).not.toContain('disabled');
 
         await clearLink.trigger('click');
@@ -70,7 +70,7 @@ describe('clearFilters.vue', () => {
         await flushPromises();
         expect(wrapper.vm.$router.currentRoute.value.query.anywhere).toEqual('TestCollection');
 
-        let clearLink = wrapper.find('a#clear-results');
+        let clearLink = wrapper.find('#clear-results');
         await clearLink.trigger('click');
         await flushPromises();
         expect(wrapper.vm.$router.currentRoute.value.query.anywhere).not.toBeDefined();
diff --git a/static/js/vue-cdr-access/tests/unit/fileList.spec.js b/static/js/vue-cdr-access/tests/unit/fileList.spec.js
index 468c0ab68e..57886e0660 100644
--- a/static/js/vue-cdr-access/tests/unit/fileList.spec.js
+++ b/static/js/vue-cdr-access/tests/unit/fileList.spec.js
@@ -82,10 +82,6 @@ describe('fileList.vue', () => {
         });
     });
 
-    it("displays a header with file count", () => {
-        expect(wrapper.find('h3').text()).toEqual("List of Items in This Work (3)");
-    });
-
     it("contains a table of files", () => {
         expect(wrapper.findComponent({ name: 'dataTable' }).exists()).toBe(true);
     });
@@ -173,7 +169,7 @@ describe('fileList.vue', () => {
 
         const download = wrapper.vm.downloadButtonHtml(updatedBriefObj);
         // Download button
-        expect(download).toEqual(expect.stringContaining('<a class="download button action"'));
+        expect(download).toEqual(expect.stringContaining('<a class="download button action is-primary"'));
     });
 
     it("does not show a button for non-image files without viewOriginal permission", () => {
diff --git a/web-access-app/src/main/java/edu/unc/lib/boxc/web/access/controllers/FullRecordController.java b/web-access-app/src/main/java/edu/unc/lib/boxc/web/access/controllers/FullRecordController.java
index a1ef8148f6..d7ea46d366 100644
--- a/web-access-app/src/main/java/edu/unc/lib/boxc/web/access/controllers/FullRecordController.java
+++ b/web-access-app/src/main/java/edu/unc/lib/boxc/web/access/controllers/FullRecordController.java
@@ -21,6 +21,7 @@
 import edu.unc.lib.boxc.search.solr.services.ChildrenCountService;
 import edu.unc.lib.boxc.search.solr.services.GetCollectionIdService;
 import edu.unc.lib.boxc.search.solr.services.NeighborQueryService;
+import edu.unc.lib.boxc.web.common.auth.PatronActionPermissionsUtil;
 import edu.unc.lib.boxc.web.common.controllers.AbstractErrorHandlingSearchController;
 import edu.unc.lib.boxc.web.common.exceptions.RenderViewException;
 import edu.unc.lib.boxc.web.common.services.AccessCopiesService;
@@ -30,6 +31,7 @@
 import edu.unc.lib.boxc.web.common.utils.ModsUtil;
 import edu.unc.lib.boxc.web.common.utils.SerializationUtil;
 import edu.unc.lib.boxc.web.common.view.XSLViewResolver;
+import org.apache.commons.lang3.StringUtils;
 import org.jdom2.Document;
 import org.jdom2.JDOMException;
 import org.jdom2.input.SAXBuilder;
@@ -55,6 +57,7 @@
 import java.util.TimeZone;
 import java.util.stream.Collectors;
 
+import static edu.unc.lib.boxc.auth.api.AccessPrincipalConstants.ON_CAMPUS_PRINC;
 import static edu.unc.lib.boxc.auth.fcrepo.services.GroupsThreadStore.getAgentPrincipals;
 import static edu.unc.lib.boxc.common.xml.SecureXMLFactory.createSAXBuilder;
 import static edu.unc.lib.boxc.search.api.FacetConstants.MARKED_FOR_DELETION;
@@ -166,7 +169,8 @@ public String getFullObjectView(String pidString) {
         PID pid = PIDs.get(pidString);
         LOG.debug("Getting full record for {}", pid);
 
-        AccessGroupSet principals = getAgentPrincipals().getPrincipals();
+        var agent = getAgentPrincipals();
+        AccessGroupSet principals = agent.getPrincipals();
         aclService.assertHasAccess("Insufficient permissions to access full record for " + pidString,
                 pid, principals, Permission.viewMetadata);
 
@@ -229,10 +233,13 @@ public String getFullObjectView(String pidString) {
         }
 
         Long totalDownloadSize = null;
+        boolean canBulkDownload = false;
         if (ResourceType.Work.nameEquals(resourceType)) {
+            canBulkDownload = PatronActionPermissionsUtil.hasBulkDownloadPermission(aclService, pid, agent);
             totalDownloadSize = workFilesizeService.getTotalFilesize(briefObject, principals);
         }
         recordProperties.put("totalDownloadSize", totalDownloadSize);
+        recordProperties.put("canBulkDownload", canBulkDownload);
 
         accessCopiesService.populateThumbnailId(briefObject, principals, true);
 
diff --git a/web-common/src/main/java/edu/unc/lib/boxc/web/common/auth/PatronActionPermissionsUtil.java b/web-common/src/main/java/edu/unc/lib/boxc/web/common/auth/PatronActionPermissionsUtil.java
new file mode 100644
index 0000000000..fe697eb34b
--- /dev/null
+++ b/web-common/src/main/java/edu/unc/lib/boxc/web/common/auth/PatronActionPermissionsUtil.java
@@ -0,0 +1,34 @@
+package edu.unc.lib.boxc.web.common.auth;
+
+import edu.unc.lib.boxc.auth.api.Permission;
+import edu.unc.lib.boxc.auth.api.models.AccessGroupSet;
+import edu.unc.lib.boxc.auth.api.models.AgentPrincipals;
+import edu.unc.lib.boxc.auth.api.services.AccessControlService;
+import edu.unc.lib.boxc.model.api.ids.PID;
+import org.apache.commons.lang3.StringUtils;
+
+import static edu.unc.lib.boxc.auth.api.AccessPrincipalConstants.ON_CAMPUS_PRINC;
+
+/**
+ * Utility class for determining permissions for patron actions
+ * @author bbpennel
+ */
+public class PatronActionPermissionsUtil {
+    private PatronActionPermissionsUtil() {
+    }
+
+    /**
+     * Determine if the provided agent has permission to download a bulk export zip of the provided object
+     * @param aclService
+     * @param pid
+     * @param agent
+     * @return
+     */
+    public static boolean hasBulkDownloadPermission(AccessControlService aclService, PID pid, AgentPrincipals agent) {
+        AccessGroupSet principals = agent.getPrincipals();
+        if (StringUtils.isBlank(agent.getUsername()) && !principals.contains(ON_CAMPUS_PRINC)) {
+            return false;
+        }
+        return aclService.hasAccess(pid, principals, Permission.viewOriginal);
+    }
+}
diff --git a/web-common/src/test/java/edu/unc/lib/boxc/web/common/auth/PatronActionPermissionsUtilTest.java b/web-common/src/test/java/edu/unc/lib/boxc/web/common/auth/PatronActionPermissionsUtilTest.java
new file mode 100644
index 0000000000..f70d13b1b0
--- /dev/null
+++ b/web-common/src/test/java/edu/unc/lib/boxc/web/common/auth/PatronActionPermissionsUtilTest.java
@@ -0,0 +1,75 @@
+package edu.unc.lib.boxc.web.common.auth;
+
+import edu.unc.lib.boxc.auth.api.AccessPrincipalConstants;
+import edu.unc.lib.boxc.auth.api.models.AccessGroupSet;
+import edu.unc.lib.boxc.auth.api.models.AgentPrincipals;
+import edu.unc.lib.boxc.auth.api.services.AccessControlService;
+import edu.unc.lib.boxc.auth.fcrepo.models.AccessGroupSetImpl;
+import edu.unc.lib.boxc.auth.fcrepo.models.AgentPrincipalsImpl;
+import edu.unc.lib.boxc.model.api.ids.PID;
+import edu.unc.lib.boxc.model.fcrepo.ids.PIDs;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.Mock;
+
+import static edu.unc.lib.boxc.auth.api.Permission.viewOriginal;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.when;
+import static org.mockito.MockitoAnnotations.openMocks;
+
+/**
+ * @author bbpennel
+ */
+public class PatronActionPermissionsUtilTest {
+    private static final String WORK_ID = "f277bb38-272c-471c-a28a-9887a1328a1f";
+    @Mock
+    private AccessControlService aclService;
+    private PID pid;
+    private final static String USERNAME = "test_user";
+    private AccessGroupSet groups = new AccessGroupSetImpl("adminGroup");
+    private AgentPrincipals agent;
+
+    private AutoCloseable autoCloseable;
+
+    @BeforeEach
+    public void setup() {
+        autoCloseable = openMocks(this);
+        pid = PIDs.get(WORK_ID);
+        agent = new AgentPrincipalsImpl(USERNAME, groups);
+    }
+
+    @AfterEach
+    public void tearDown() throws Exception {
+        autoCloseable.close();
+    }
+
+    @Test
+    public void testHasBulkDownloadPermissionPermit() {
+        when(aclService.hasAccess(eq(pid), any(), eq(viewOriginal))).thenReturn(true);
+        assertTrue(PatronActionPermissionsUtil.hasBulkDownloadPermission(aclService, pid, agent));
+    }
+
+    @Test
+    public void testHasBulkDownloadPermissionNotAuthenticatedOrOnCampusReject() {
+        when(aclService.hasAccess(eq(pid), any(), eq(viewOriginal))).thenReturn(true);
+        var unauthAgent = new AgentPrincipalsImpl(null, null);
+        assertFalse(PatronActionPermissionsUtil.hasBulkDownloadPermission(aclService, pid, unauthAgent));
+    }
+
+    @Test
+    public void testHasBulkDownloadPermissionOnCampusPermit() {
+        when(aclService.hasAccess(eq(pid), any(), eq(viewOriginal))).thenReturn(true);
+        var unauthAgent = new AgentPrincipalsImpl(null, new AccessGroupSetImpl(AccessPrincipalConstants.ON_CAMPUS_PRINC));
+        assertTrue(PatronActionPermissionsUtil.hasBulkDownloadPermission(aclService, pid, unauthAgent));
+    }
+
+    @Test
+    public void testHasBulkDownloadPermissionNoPermissionReject() {
+        when(aclService.hasAccess(eq(pid), any(), eq(viewOriginal))).thenReturn(false);
+        assertFalse(PatronActionPermissionsUtil.hasBulkDownloadPermission(aclService, pid, agent));
+    }
+}
diff --git a/web-services-app/src/main/java/edu/unc/lib/boxc/web/services/rest/DownloadBulkController.java b/web-services-app/src/main/java/edu/unc/lib/boxc/web/services/rest/DownloadBulkController.java
index 27ec7d2fe9..483fd96dc4 100644
--- a/web-services-app/src/main/java/edu/unc/lib/boxc/web/services/rest/DownloadBulkController.java
+++ b/web-services-app/src/main/java/edu/unc/lib/boxc/web/services/rest/DownloadBulkController.java
@@ -1,12 +1,13 @@
 package edu.unc.lib.boxc.web.services.rest;
 
-import edu.unc.lib.boxc.auth.api.Permission;
-import edu.unc.lib.boxc.auth.api.models.AccessGroupSet;
+import edu.unc.lib.boxc.auth.api.exceptions.AccessRestrictionException;
+import edu.unc.lib.boxc.auth.api.models.AgentPrincipals;
 import edu.unc.lib.boxc.auth.api.services.AccessControlService;
 import edu.unc.lib.boxc.model.api.ids.PID;
 import edu.unc.lib.boxc.model.fcrepo.ids.PIDs;
 import edu.unc.lib.boxc.operations.impl.download.DownloadBulkRequest;
 import edu.unc.lib.boxc.operations.impl.download.DownloadBulkService;
+import edu.unc.lib.boxc.web.common.auth.PatronActionPermissionsUtil;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.core.io.FileSystemResource;
 import org.springframework.http.MediaType;
@@ -34,10 +35,9 @@ public class DownloadBulkController {
     public ResponseEntity<FileSystemResource> getZip(@PathVariable("id") String pidString) {
         PID pid = PIDs.get(pidString);
 
-        AccessGroupSet principals = getAgentPrincipals().getPrincipals();
-        aclService.assertHasAccess("Insufficient permissions to bulk download for " + pidString,
-                pid, principals, Permission.viewOriginal);
-        var request = new DownloadBulkRequest(pidString, principals);
+        var agentPrincipal = getAgentPrincipals();
+        assertHasPermission(pid, agentPrincipal);
+        var request = new DownloadBulkRequest(pidString, agentPrincipal.getPrincipals());
         var path = downloadBulkService.downloadBulk(request);
         var filename = DownloadBulkService.getZipFilename(pidString);
 
@@ -47,6 +47,12 @@ public ResponseEntity<FileSystemResource> getZip(@PathVariable("id") String pidS
                 .body(new FileSystemResource(path));
     }
 
+    public void assertHasPermission(PID pid, AgentPrincipals agent) {
+        if (!PatronActionPermissionsUtil.hasBulkDownloadPermission(aclService, pid, agent)) {
+            throw new AccessRestrictionException("User has insufficient permissions to download bulk export");
+        }
+    }
+
     public void setDownloadBulkService(DownloadBulkService downloadBulkService) {
         this.downloadBulkService = downloadBulkService;
     }
diff --git a/web-services-app/src/test/java/edu/unc/lib/boxc/web/services/rest/DownloadBulkControllerIT.java b/web-services-app/src/test/java/edu/unc/lib/boxc/web/services/rest/DownloadBulkControllerIT.java
index 2ae9383c49..24490b497f 100644
--- a/web-services-app/src/test/java/edu/unc/lib/boxc/web/services/rest/DownloadBulkControllerIT.java
+++ b/web-services-app/src/test/java/edu/unc/lib/boxc/web/services/rest/DownloadBulkControllerIT.java
@@ -51,7 +51,6 @@
 public class DownloadBulkControllerIT {
     private static final String WORK_ID = "f277bb38-272c-471c-a28a-9887a1328a1f";
     private static final String FILE_ID = "83c2d7f8-2e6b-4f0b-ab7e-7397969c0682";
-    private static final PID FILE_PID = PIDs.get(FILE_ID);
     private final static String USERNAME = "test_user";
     private final static AccessGroupSet GROUPS = new AccessGroupSetImpl("adminGroup");
     @Mock
@@ -62,6 +61,8 @@ public class DownloadBulkControllerIT {
     private WorkObject workObject;
     @Mock
     private FileObject fileObject;
+    private PID filePid;
+    private PID workPid;
     @TempDir
     public Path tmpFolder;
     @InjectMocks
@@ -84,6 +85,8 @@ public void init() throws FileNotFoundException {
                 .setControllerAdvice(new RestResponseEntityExceptionHandler())
                 .build();
         TestHelper.setContentBase("http://localhost:48085/rest");
+        workPid = PIDs.get(WORK_ID);
+        filePid = PIDs.get(FILE_ID);
         GroupsThreadStore.storeUsername(USERNAME);
         GroupsThreadStore.storeGroups(GROUPS);
     }
@@ -95,8 +98,18 @@ void closeService() throws Exception {
 
     @Test
     public void noAccessTest() throws Exception {
-        doThrow(new AccessRestrictionException()).when(aclService).assertHasAccess(
-                anyString(), any(), any(AccessGroupSetImpl.class), eq(viewOriginal));
+        when(aclService.hasAccess(eq(workPid), any(), eq(viewOriginal))).thenReturn(false);
+
+        mvc.perform(get("/bulkDownload/" + WORK_ID))
+                .andExpect(status().isForbidden())
+                .andReturn();
+    }
+
+    @Test
+    public void userNotLoggedInTest() throws Exception {
+        GroupsThreadStore.clearStore();
+        when(aclService.hasAccess(eq(workPid), any(), eq(viewOriginal))).thenReturn(true);
+
 
         mvc.perform(get("/bulkDownload/" + WORK_ID))
                 .andExpect(status().isForbidden())
@@ -107,12 +120,14 @@ public void noAccessTest() throws Exception {
     public void successTest() throws Exception {
         when(repositoryObjectLoader.getWorkObject(any())).thenReturn(workObject);
         when(workObject.getMembers()).thenReturn(List.of(fileObject));
-        when(fileObject.getPid()).thenReturn(FILE_PID);
+        when(fileObject.getPid()).thenReturn(filePid);
         var binObj = mock(BinaryObject.class);
         when(fileObject.getOriginalFile()).thenReturn(binObj);
         when(binObj.getBinaryStream()).thenReturn(fileInputStream);
         when(binObj.getFilename()).thenReturn("bunny.jpg");
-        when(aclService.hasAccess(eq(FILE_PID), any(),
+
+        when(aclService.hasAccess(eq(workPid), any(), eq(viewOriginal))).thenReturn(true);
+        when(aclService.hasAccess(eq(filePid), any(),
                 eq(Permission.viewOriginal))).thenReturn(true);
 
         var result = mvc.perform(get("/bulkDownload/" + WORK_ID))