Allow Authors to download restricted bitstreams

When a bitstream is embargoed or restricted in DSpace, standard ACL-based authorization denies download access to everyone without explicit READ permission. But authors who contributed to a publication reasonably expect to access their own work's files — even during embargo periods.

When the standard READ check fails, the system falls back to CRIS security policies configured in bitstream-access-modes.xml. These policies only grant additional access — they never restrict access that users already have through standard ACLs.

With the default configuration, if a Researcher Page/Profile is linked as a dc.contributor.author on a publication, the author can download any restricted files on that item. 

Configuration

To enable the feature you should set the following property in dspace/config/dspace.cfg:

core.authorization.bitstream.author.bypass-restrictions = true

In the bitstream-access-modes.xml you should configure:

1.  bitstreamAccessModesMap — Who gets access, per entity type

   1. <!--Maps entity type names to lists of access mode beans:-->
      <entry key="Publication">
          <list>
              <ref bean="submitterEditItemMode" />   <!-- item submitter -->
              <ref bean="customEditItemMode" />       <!-- authors/editors via metadata -->
          </list>
      </entry>

   2. Only items with entity type "Publication" are evaluated. Other entity types (Person, Dataset, etc.) can be added with their own entries.
2.  allowedBundlesForBitstreamAccess — Which bundles are accessible

   1. <entry key-ref="submitterEditItemMode">
          <list><value>ORIGINAL</value></list>
      </entry>
      <entry key-ref="customEditItemMode">
          <list><value>ORIGINAL</value></list>
      </entry>

   2. Both modes are restricted to the ORIGINAL bundle only — so authors can download the actual files but not LICENSE, THUMBNAIL, or TEXT bundles via this bypass.
3. The Access Mode Beans

<bean id="submitterEditItemMode" class="org.dspace.content.edit.EditItemMode">
    <property name="security">
        <value type="...CrisSecurity">SUBMITTER</value>
    </property>
</bean>

<bean id="customEditItemMode" class="org.dspace.content.edit.EditItemMode">
    <property name="security">
        <value type="...CrisSecurity">CUSTOM</value>
    </property>
    <property name="items">
        <list>
            <value>dc.contributor.author</value>
            <value>dc.contributor.editor</value>
        </list>
    </property>
</bean>