WIP: feat: file modification

missing image, will force push

Author: carlinmack

docs/operate/customize/file_modification.md

@@ -0,0 +1,76 @@
+# File modification
+
+_Introduced in vNext_
+
+Admins can now modify the files of all records on their instance by default and, with configuration, you can also allow users to edit their own published records within a certain time period.
+
+## Disable
+
+If you would like to disable file modification for all users including admins, add the following to your `invenio.cfg`.
+
+```
+RDM_IMMEDIATE_FILE_MODIFICATION_ENABLED = False
+```
+
+## User file modification
+
+To enable user file modification, there is a default time-based policy which allows users to edit their records within a certain period. To enable this, add the following to your config:
+
+```python
+from invenio_rdm_records.services.request_policies import (
+    FileModificationGracePeriodPolicy,
+    FileModificationAdminPolicy,
+)
+RDM_IMMEDIATE_FILE_MODIFICATION_POLICIES = [
+    FileModificationGracePeriodPolicy(),
+    FileModificationAdminPolicy(),
+]
+```
+
+### Configure policies
+
+The time periods of the grace period policy are configured in two places, both in `invenio.cfg`:
+
+First, the time to unlock the files is configured via passing a custom timedelta to the policy, e.g. `FileModificationGracePeriodPolicy(timedelta(days=30))`
+
+Second, the time to publish the changes, which should be greater than the grace period, is configured in your config via `RDM_FILE_MODIFICATION_PERIOD = timedelta(days=30 + 15)`
+
+!!! info
+
+    Short time periods are recommended for the file modification period as there is a risk of users treating records as file storage, and not respecting that a DOI has been minted for this digital object.
+
+## Configure out of policy messages
+
+Unlike record deletion in which users outside of policy can "request" deletion, users are **not** similarly allowed to request file modification when they are outside of policy. Instead this request should be made via established channels relevant for your instance (whether by email, in person communication, official support ticket, etc) or you should communicate that no concessions will be made (and if they have an unpublishable draft it should be discarded). If you would like to satisfy the users request, you can unlock the bucket for them (in the same way they would) and then publish for them once they have made the changes.
+
+There are two messages which should be customised based upon how your instance handles support.
+
+First, the user facing message when they try to unlock the files outside of policy is a React compontent that should be overriden using your `mapping.js`. For example,
+
+```js
+import { ModalContent } from "semantic-ui-react";
+const ModificationMessage = () => {
+  return (
+    <ModalContent>
+      <p>
+        {i18next.t(
+          "Please contact us to request file modification, including the" +
+            " record URL and a detailed justification in your message."
+        )}
+      </p>
+    </ModalContent>
+  );
+};
+
+export const overriddenComponents = {
+  "InvenioAppRdm.Deposit.ModificationModal.message": UpgradeLegacyRecordButton,
+};
+```
+
+Second, the message which is returned to the user when they have run out of time is defined via your config:
+
+```
+RDM_FILE_MODIFICATION_VALIDATION_ERROR_MESSAGE = _(
+    "File modification grace period has passed. Please discard this draft to make any changes."
+)
+```

docs/releases/vNext/version-vNext.md

@@ -19,12 +19,28 @@ and digital assets management! Version Next will be maintained until at least 6
 
 ### Record deletion
 
-You can now allow users to delete, or request deletion of, their own records in accordance with any required criteria you may have. When enabled the default behaviour is that records can be deleted by their owners within 30 days of publication and record owners can request deletion outside this period. Deletion requests are visible within the admin panel and the user's request dashboard.
+You can now allow users to delete, or request deletion of, their own records in accordance with any required criteria you may have. When enabled, the default behaviour is that records can be deleted by their owners within 30 days of publication and record owners can request deletion outside this period. Deletion requests are visible within the admin panel and the user's request dashboard.
 
 ![Modal to immediately delete a record](imgs/deletion-modal.png)
 
 This feature is also [highly customisable](../../operate/customize/record_deletion.md)! You can introduce deletion policies based on the resource type, community role, file type or any other criteria you require. Additionally, you can prevent extraneous record deletion by adding a deletion checklist. This allows you to suggest how the user can fix the problem in the correct way instead of deleting the record.
 
+### File modification
+
+Admins can now edit the files of all records by default. To do so, simply edit the record and then unlock the files by completing the "Edit published files" modal. The files are then unlocked for you (or anyone with manage permissions) to upload files and then the draft can be published by an admin.
+
+![]()
+
+If you would like to disable file modification for all users including admins, add the following to your `invenio.cfg`.
+
+``
+RDM_IMMEDIATE_FILE_MODIFICATION_ENABLED = False
+```
+
+#### User file modification
+
+Additionally in a similar way to the new record deletion feature, you can also allow users to modify the files of published records in line with your defined policies. By adding the relevant policy, the files can be unlocked by the owner of the record within 30 days and the edits published within 45 days (giving them at least 15 days to upload and publish their changes). See the [relevant documentation](../../operate/customize/file_modification.md) to see how to enable this behaviour.
+
 #### New Web Archive previewer
 
 https://github.com/inveniosoftware/invenio-previewer/pull/224