From e9ca2d96ada5ed68dfa5cade236bc30278aa8fa9 Mon Sep 17 00:00:00 2001
From: Eric O <eric@ejdigitalmedia.com>
Date: Tue, 15 Aug 2023 14:39:53 -0400
Subject: [PATCH] Add poster resource for Hyacinth Assets; Webdriver updates to
 support modern versions of Google Chrome

---
 Gemfile                                       |  4 +-
 Gemfile.lock                                  | 21 +++----
 .../models/digital_object/asset.js            | 60 +++++++++++--------
 .../widgets/digital_object_editor/_header.ejs | 21 +++++++
 .../hyacinth/digital_objects/downloads.rb     |  8 +++
 app/controllers/digital_objects_controller.rb | 39 +++++++++++-
 .../digital_object/assets/file_import.rb      | 42 ++++++++++++-
 app/models/digital_object/asset.rb            | 32 +++++++++-
 config/routes.rb                              |  2 +
 lib/tasks/hyacinth/asset_zip.rake             |  3 +-
 spec/requests/digital_objects_spec.rb         | 56 ++++++++++++++++-
 11 files changed, 243 insertions(+), 45 deletions(-)

diff --git a/Gemfile b/Gemfile
index 6b46a3049..66fb6d668 100644
--- a/Gemfile
+++ b/Gemfile
@@ -148,9 +148,9 @@ group :development, :test do
   gem 'rspec-rails', '~> 3.3'
   gem 'capybara', '~> 3.32'
   # For testing with chromedriver
-  gem 'selenium-webdriver', '~> 3.142'
+  gem 'selenium-webdriver', '~> 4.0'
   # For automatically updating chromedriver
-  gem 'webdrivers', '~> 4.0', require: false
+  gem 'webdrivers', '~> 5.3.0', require: false
   gem 'factory_girl_rails', '>= 4.4.1'
   gem 'rubocop', '~> 0.58.2', require: false
   gem 'rubocop-rspec', '>= 1.20.1', require: false
diff --git a/Gemfile.lock b/Gemfile.lock
index 0b7c97aaa..926501bee 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -142,8 +142,7 @@ GEM
       regexp_parser (~> 1.5)
       xpath (~> 3.2)
     charlock_holmes (0.7.6)
-    childprocess (2.0.0)
-      rake (< 13.0)
+    childprocess (4.1.0)
     chosen-rails (1.5.2)
       coffee-rails (>= 3.2)
       railties (>= 3.0)
@@ -433,6 +432,7 @@ GEM
       mime-types (>= 1.16, < 4.0)
       netrc (~> 0.8)
     retriable (2.1.0)
+    rexml (3.2.6)
     rsolr (1.1.2)
       builder (>= 2.1.2)
     rspec-core (3.3.2)
@@ -470,7 +470,7 @@ GEM
     rubyXL (3.3.15)
       nokogiri (>= 1.4.4)
       rubyzip (>= 1.1.6)
-    rubyzip (1.2.3)
+    rubyzip (1.3.0)
     sass (3.5.6)
       sass-listen (~> 4.0.0)
     sass-listen (4.0.0)
@@ -485,8 +485,9 @@ GEM
     sdoc (0.4.1)
       json (~> 1.7, >= 1.7.7)
       rdoc (~> 4.0)
-    selenium-webdriver (3.142.7)
-      childprocess (>= 0.5, < 4.0)
+    selenium-webdriver (4.1.0)
+      childprocess (>= 0.5, < 5.0)
+      rexml (~> 3.2, >= 3.2.5)
       rubyzip (>= 1.2.2)
     sequel (5.8.0)
     sinatra (1.4.8)
@@ -557,10 +558,10 @@ GEM
       binding_of_caller (>= 0.7.2)
       railties (>= 4.0)
       sprockets-rails (>= 2.0, < 4.0)
-    webdrivers (4.1.2)
+    webdrivers (5.3.1)
       nokogiri (~> 1.6)
-      rubyzip (~> 1.0)
-      selenium-webdriver (>= 3.0, < 4.0)
+      rubyzip (>= 1.3.0)
+      selenium-webdriver (~> 4.0, < 4.11)
     wowza-secure_token (0.0.1)
     xml-simple (1.1.5)
     xpath (3.2.0)
@@ -628,7 +629,7 @@ DEPENDENCIES
   sass
   sass-rails
   sdoc
-  selenium-webdriver (~> 3.142)
+  selenium-webdriver (~> 4.0)
   solrizer (>= 3.4.1)
   spreadsheet
   sqlite3 (~> 1.3.10)
@@ -637,7 +638,7 @@ DEPENDENCIES
   underscore-rails
   uri_service (= 0.5.5)
   web-console (~> 2.0)
-  webdrivers (~> 4.0)
+  webdrivers (~> 5.3.0)
   wowza-secure_token (= 0.0.1)
 
 BUNDLED WITH
diff --git a/app/assets/javascripts/digital_objects_app/models/digital_object/asset.js b/app/assets/javascripts/digital_objects_app/models/digital_object/asset.js
index 5fbbd937d..52734540e 100644
--- a/app/assets/javascripts/digital_objects_app/models/digital_object/asset.js
+++ b/app/assets/javascripts/digital_objects_app/models/digital_object/asset.js
@@ -1,87 +1,99 @@
 // Asset - Subclass
-Hyacinth.DigitalObjectsApp.DigitalObject.Asset = function(digital_object_data){
+Hyacinth.DigitalObjectsApp.DigitalObject.Asset = function (digital_object_data) {
   Hyacinth.DigitalObjectsApp.DigitalObject.Base.call(this, digital_object_data); // call parent constructor
   this.assetData = digital_object_data['asset_data'];
 };
 Hyacinth.extendClass(Hyacinth.DigitalObjectsApp.DigitalObject.Asset, Hyacinth.DigitalObjectsApp.DigitalObject.Base); //Extend
 
 
-Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getFilesystemLocation = function(){
+Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getFilesystemLocation = function () {
   return this.assetData['filesystem_location'];
 };
 
-Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getAccessCopyLocation = function(){
+Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getAccessCopyLocation = function () {
   return this.assetData['access_copy_location'];
 };
 
-Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getServiceCopyLocation = function(){
+Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getPosterLocation = function () {
+  return this.assetData['poster_location'];
+};
+
+Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getServiceCopyLocation = function () {
   return this.assetData['service_copy_location'];
 };
 
-Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getFileChecksum = function(){
+Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getFileChecksum = function () {
   return this.assetData['checksum'];
 };
 
-Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getFileSizeInBytes = function(){
+Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getFileSizeInBytes = function () {
   return this.assetData['file_size_in_bytes'];
 };
 
-Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getAccessCopyFileSizeInBytes = function(){
+Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getAccessCopyFileSizeInBytes = function () {
   return this.assetData['access_copy_file_size_in_bytes'];
 };
 
-Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getServiceCopyFileSizeInBytes = function(){
+Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getPosterFileSizeInBytes = function () {
+  return this.assetData['poster_file_size_in_bytes'];
+};
+
+Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getServiceCopyFileSizeInBytes = function () {
   return this.assetData['service_copy_file_size_in_bytes'];
 };
 
-Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getFileSizeString = function() {
+Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getFileSizeString = function () {
   return this.bytesToSizeString(this.getFileSizeInBytes());
 };
 
-Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getAccessCopyFileSizeString = function() {
+Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getAccessCopyFileSizeString = function () {
   return this.bytesToSizeString(this.getAccessCopyFileSizeInBytes());
 };
 
-Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getServiceCopyFileSizeString = function() {
+Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getPosterFileSizeString = function () {
+  return this.bytesToSizeString(this.getPosterFileSizeInBytes());
+};
+
+Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getServiceCopyFileSizeString = function () {
   return this.bytesToSizeString(this.getServiceCopyFileSizeInBytes());
 };
 
-Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.bytesToSizeString = function(bytes) {
+Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.bytesToSizeString = function (bytes) {
   var sizeInBytes = parseInt(bytes);
   var value = sizeInBytes;
   var unit = 'B';
-	if(sizeInBytes < 1000) {
-  	return value + ' ' + unit;
-  } else if(sizeInBytes < 1000000) {
-  	value = sizeInBytes/1000;
+  if (sizeInBytes < 1000) {
+    return value + ' ' + unit;
+  } else if (sizeInBytes < 1000000) {
+    value = sizeInBytes / 1000;
     unit = 'kB';
-  } else if(sizeInBytes < 1000000000) {
-  	value = sizeInBytes/1000000;
+  } else if (sizeInBytes < 1000000000) {
+    value = sizeInBytes / 1000000;
     unit = 'MB';
   } else {
-	  value = sizeInBytes/1000000000;
+    value = sizeInBytes / 1000000000;
     unit = ' GB';
   }
 
   return parseFloat(parseFloat(value).toFixed(2)) + ' ' + unit; // the outermost parseFloat call removes trailing ".00" if present, but leaves values like ".01"
 };
 
-Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getOriginalFilename = function(){
+Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getOriginalFilename = function () {
   return this.assetData['original_filename'];
 };
 
-Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getOriginalFilePath = function(){
+Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.getOriginalFilePath = function () {
   return this.assetData['original_file_path'];
 };
 
-Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.hasImage = function(){
+Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.hasImage = function () {
   return Hyacinth.imageServerUrl && this.getDcType() == 'StillImage';
 };
 
-Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.isRestrictedSizeImage = function(){
+Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.isRestrictedSizeImage = function () {
   return this.hasRestrictions() && this.restrictions.restricted_size_image;
 };
 
-Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.isRestrictedOnsite = function(){
+Hyacinth.DigitalObjectsApp.DigitalObject.Asset.prototype.isRestrictedOnsite = function () {
   return this.hasRestrictions() && this.restrictions.restricted_onsite;
 };
diff --git a/app/assets/templates/digital_objects_app/widgets/digital_object_editor/_header.ejs b/app/assets/templates/digital_objects_app/widgets/digital_object_editor/_header.ejs
index 5e85622b1..c03ca311b 100644
--- a/app/assets/templates/digital_objects_app/widgets/digital_object_editor/_header.ejs
+++ b/app/assets/templates/digital_objects_app/widgets/digital_object_editor/_header.ejs
@@ -232,6 +232,27 @@
                 <%= digitalObject.getAccessCopyLocation() == null ? 'N/A' : digitalObject.getAccessCopyLocation() %>
               </div>
             </div>
+            <div class="form-group">
+              <label class="col-sm-3">
+                Download Poster:
+              </label>
+              <div class="col-sm-9">
+                <% if(digitalObject.getPosterLocation() == null) { %>
+                  N/A
+                <% } else { %>
+                  <a href="<%= Hyacinth.getLocationOrigin() + '/digital_objects/' + digitalObject.getPid() + '/download_poster' %>" target="_blank"><span class="glyphicon glyphicon-download"></span> Download</a>
+                  (<%= digitalObject.getPosterFileSizeString() %>) [<%= digitalObject.getPosterFileSizeInBytes() %> bytes]
+                  <% } %>
+              </div>
+            </div>
+            <div class="form-group">
+              <label class="col-sm-3">
+                Poster Location:
+              </label>
+              <div class="col-sm-9">
+                <%= digitalObject.getPosterLocation() == null ? 'N/A' : digitalObject.getPosterLocation() %>
+              </div>
+            </div>
 
             <div class="form-group">
               <label class="col-sm-3">
diff --git a/app/controllers/concerns/hyacinth/digital_objects/downloads.rb b/app/controllers/concerns/hyacinth/digital_objects/downloads.rb
index c349a41ec..e96e1d8c6 100644
--- a/app/controllers/concerns/hyacinth/digital_objects/downloads.rb
+++ b/app/controllers/concerns/hyacinth/digital_objects/downloads.rb
@@ -26,6 +26,14 @@ def download_service_copy
     end
   end
 
+  def download_poster
+    if @digital_object.is_a?(DigitalObject::Asset)
+        send_file @digital_object.poster_location, filename: @digital_object.fedora_object.datastreams['poster'].dsLabel
+    else
+      render text: @digital_object.digital_object_type.display_label.pluralize + ' do not have download URLs.  Try downloading an Asset poster instead.'
+    end
+  end
+
   # download_access_copy offers the ability to stream files using range requests
   # because access copies are sometimes played in a video player
   def download_access_copy
diff --git a/app/controllers/digital_objects_controller.rb b/app/controllers/digital_objects_controller.rb
index 4d21abdf8..a0609051e 100644
--- a/app/controllers/digital_objects_controller.rb
+++ b/app/controllers/digital_objects_controller.rb
@@ -9,13 +9,14 @@ class DigitalObjectsController < ApplicationController
   include Hyacinth::DigitalObjects::IndexDocument
   include Hyacinth::DigitalObjects::Captions
 
-  before_action :set_digital_object, only: [:show, :edit, :update, :destroy, :undestroy, :data_for_ordered_child_editor, :download, :download_access_copy, :download_service_copy,
+  before_action :set_digital_object, only: [:show, :edit, :update, :destroy, :undestroy, :data_for_ordered_child_editor,
+    :download, :download_access_copy, :download_poster, :download_service_copy,
     :add_parent, :remove_parents, :mods, :xacml, :media_view, :rotate_image, :swap_order_of_first_two_child_assets,
     :download_transcript, :update_transcript,
     :download_index_document, :update_index_document,
     :download_captions, :update_captions,
     :download_synchronized_transcript, :update_synchronized_transcript, :clear_synchronized_transcript_and_reimport_transcript,
-    :upload_access_copy, :update_featured_region, :query_featured_region
+    :upload_access_copy, :upload_poster, :update_featured_region, :query_featured_region
   ]
   before_action :set_digital_object_for_data_for_editor_action, only: [:data_for_editor]
   before_action :set_contextual_nav_options
@@ -340,6 +341,38 @@ def upload_access_copy
     end
   end
 
+  def upload_poster
+    if @digital_object.is_a?(DigitalObject::Asset)
+      if params[:file].blank?
+        render status: :bad_request, json: { errors: ['Missing multipart/form-data file upload data with name: file'] }
+        return
+      end
+
+      @digital_object_data = {}
+      @digital_object_data['import_file'] = posted_file_data(DigitalObject::Asset::IMPORT_TYPE_POST_DATA)
+      @digital_object.set_digital_object_data({
+        'import_file' => {
+          'poster_import_path' => params[:file].tempfile.path
+        }
+      }, true)
+      @digital_object.updated_by = current_user
+
+      if @digital_object.save
+        RepublishAssetJob.perform_later(@digital_object.pid)
+        render json: { success: true, size: @digital_object.poster_file_size_in_bytes.to_i }
+      else
+        render json: { errors: ['An error occurred during poster upload.'] }
+      end
+    else
+      render json: { errors: ["This action is only allowed for Assets.  This object has type: #{@digital_object.digital_object_type.display_label}"] }
+    end
+  ensure
+    if params[:file].present?
+      params[:file].tempfile.close
+      params[:file].tempfile.unlink
+    end
+  end
+
   private
 
     # Use callbacks to share common setup or constraints between actions.
@@ -374,7 +407,7 @@ def require_appropriate_project_permissions!
       case params[:action]
       when 'index', 'search', 'upload_directory_listing', 'titles_for_pids', 'search_results_to_csv'
         # Do nothing.  These actions are open to all logged-in users.
-      when 'show', 'data_for_editor', 'mods', 'download', 'data_for_ordered_child_editor', 'media_view', 'download_transcript', 'download_index_document', 'download_captions', 'download_synchronized_transcript', 'download_access_copy', 'download_service_copy', 'download'
+      when 'show', 'data_for_editor', 'mods', 'download', 'data_for_ordered_child_editor', 'media_view', 'download_transcript', 'download_index_document', 'download_captions', 'download_synchronized_transcript', 'download_access_copy', 'download_poster', 'download_service_copy', 'download'
         require_project_permission!(@digital_object.project, :read)
       when 'create'
         # Access logic inside action method
diff --git a/app/models/concerns/digital_object/assets/file_import.rb b/app/models/concerns/digital_object/assets/file_import.rb
index b4459ca36..7f0a687cd 100644
--- a/app/models/concerns/digital_object/assets/file_import.rb
+++ b/app/models/concerns/digital_object/assets/file_import.rb
@@ -90,8 +90,8 @@ def do_access_copy_import
     end
 
     # Clear old rels_int values if present
-    fedora_object.rels_int.clear_relationship(access_ds, :extent)
-    fedora_object.rels_int.clear_relationship(access_ds, :rdf_type)
+    @fedora_object.rels_int.clear_relationship(access_ds, :extent)
+    @fedora_object.rels_int.clear_relationship(access_ds, :rdf_type)
 
     # Set rels_int values
     @fedora_object.rels_int.add_relationship(access_ds, :extent, File.size(@access_copy_import_path).to_s, true) # last param *true* means that this is a literal value rather than a relationship
@@ -133,6 +133,44 @@ def do_service_copy_import
     @fedora_object.add_datastream(service_ds)
   end
 
+  def do_poster_import
+    poster_filename = 'poster' + File.extname(@poster_import_path)
+    dest_dir = Hyacinth::Utils::PathUtils.access_directory_path_for_uuid!(self.uuid)
+    dest_file_path = File.join(dest_dir, poster_filename)
+    FileUtils.cp(@poster_import_path, dest_file_path)
+    # Make sure the new file's group permissions are set to rw (using 0660 permissions).
+    # When Derivativo 1.5 is released, this can change to 0640 permissions.
+    FileUtils.chmod(0660, dest_file_path)
+
+    poster_ds_location = filesystem_path_to_ds_location(dest_file_path)
+
+    # Create poster datastream if it doesn't already exist
+    poster_ds = @fedora_object.datastreams['poster']
+    if poster_ds.blank?
+      poster_ds = @fedora_object.create_datastream(
+        ActiveFedora::Datastream,
+        'poster',
+        controlGroup: 'E',
+        mimeType: BestType.mime_type.for_file_name(poster_filename),
+        dsLabel: poster_filename,
+        versionable: true
+      )
+      poster_ds.dsLocation = poster_ds_location
+      @fedora_object.add_datastream(poster_ds)
+    else
+      poster_ds.dsLocation = poster_ds_location
+      poster_ds.mimeType = BestType.mime_type.for_file_name(poster_filename)
+      poster_ds.dsLabel = poster_filename
+    end
+
+    # Clear old rels_int values if present
+    @fedora_object.rels_int.clear_relationship(poster_ds, :extent)
+    @fedora_object.rels_int.clear_relationship(poster_ds, :rdf_type)
+
+    # Set rels_int values
+    @fedora_object.rels_int.add_relationship(poster_ds, :extent, File.size(@poster_import_path).to_s, true) # last param *true* means that this is a literal value rather than a relationship
+  end
+
   def copy_and_verify_file(import_file)
     if [DigitalObject::Asset::IMPORT_TYPE_INTERNAL, DigitalObject::Asset::IMPORT_TYPE_POST_DATA].include? @import_file_import_type
       return copy_and_verify_internal_file(import_file)
diff --git a/app/models/digital_object/asset.rb b/app/models/digital_object/asset.rb
index 4a7a83f5c..dcd7e91ca 100644
--- a/app/models/digital_object/asset.rb
+++ b/app/models/digital_object/asset.rb
@@ -33,6 +33,7 @@ def initialize
     @import_file_import_path = nil
     @import_file_original_file_path = nil
     @access_copy_import_path = nil
+    @poster_import_path = nil
     @service_copy_import_type = nil
     @service_copy_import_path = nil
 
@@ -54,7 +55,8 @@ def run_post_validation_pre_save_logic
     super
     # For new DigitalObjects, we want to import a file as part of our save operation (assuming that this new object doesn't already have an associated Fedora object with a 'content' datastream)
     do_file_import if self.new_record? && @fedora_object.present? && @fedora_object.datastreams['content'].blank?
-    do_access_copy_import if @access_copy_import_path.present? # && self.access_copy_location.blank?
+    do_access_copy_import if @access_copy_import_path.present?
+    do_poster_import if @poster_import_path.present?
     do_service_copy_import if @service_copy_import_path.present? && self.service_copy_location.blank?
 
     self.dc_type = BestType.dc_type.for_file_name(original_filename) if self.dc_type == 'Unknown' # Attempt to correct dc_type for 'Unknown' dc_type DigitalObjects
@@ -89,6 +91,12 @@ def access_copy_location
     Addressable::URI.unencode(access_ds.dsLocation).gsub(/^file:/, '')
   end
 
+  def poster_location
+    poster_ds = @fedora_object.datastreams['poster']
+    return nil unless poster_ds.present?
+    Addressable::URI.unencode(poster_ds.dsLocation).gsub(/^file:/, '')
+  end
+
   def service_copy_location
     service_ds = @fedora_object.datastreams['service']
     return nil unless service_ds.present?
@@ -120,6 +128,11 @@ def access_copy_file_size_in_bytes
     first_relationship_object_for_datastream(access_ds, :extent)
   end
 
+  def poster_file_size_in_bytes
+    poster_ds = @fedora_object.datastreams['poster']
+    first_relationship_object_for_datastream(poster_ds, :extent)
+  end
+
   def service_copy_file_size_in_bytes
     service_ds = @fedora_object.datastreams['service']
     first_relationship_object_for_datastream(service_ds, :extent)
@@ -165,9 +178,12 @@ def set_digital_object_data(digital_object_data, merge_dynamic_fields)
     # File upload (for NEW assets only, and only if this object's current data validates successfully)
     handle_new_file_upload(digital_object_data['import_file']) if self.new_record? && digital_object_data['import_file'].present?
 
-    # Access copy upload (only if an object doesn't already have an access copy)
+    # Access copy upload
     handle_access_copy_upload(digital_object_data['import_file']) if digital_object_data.fetch('import_file', {})['access_copy_import_path'].present?
 
+    # Poster upload
+    handle_poster_upload(digital_object_data['import_file']) if digital_object_data.fetch('import_file', {})['poster_import_path'].present?
+
     # Service copy upload (only if an object doesn't already have an service copy)
     handle_service_copy_upload(digital_object_data['import_file']) if digital_object_data.fetch('import_file', {})['service_copy_import_path'].present?
   end
@@ -222,6 +238,14 @@ def handle_access_copy_upload(import_file_data)
     end
   end
 
+  def handle_poster_upload(import_file_data)
+    if import_file_data['poster_import_path'].present?
+      # Get access copy import path
+      @poster_import_path = import_file_data['poster_import_path']
+      raise 'File paths cannot contain: "..". Please specify a full path.' if @poster_import_path.index('/..') || @poster_import_path.index('../')
+    end
+  end
+
   def handle_service_copy_upload(import_file_data)
     if import_file_data['service_copy_import_path'].present?
       # Get service copy import path
@@ -377,11 +401,13 @@ def to_solr
     doc['original_filename_sim'] = original_filename
     doc['original_file_path_sim'] = original_file_path
     doc['access_copy_location_sim'] = access_copy_location
+    doc['poster_location_sim'] = poster_location
     doc['service_copy_location_sim'] = service_copy_location
 
     doc['file_size_in_bytes_ltsi'] = file_size_in_bytes&.to_i
     doc['service_copy_file_size_in_bytes_ltsi'] = service_copy_file_size_in_bytes&.to_i
     doc['access_copy_file_size_in_bytes_ltsi'] = access_copy_file_size_in_bytes&.to_i
+    doc['poster_file_size_in_bytes_ltsi'] = poster_file_size_in_bytes&.to_i
     doc
   end
 
@@ -397,6 +423,8 @@ def as_json(options = {})
       original_file_path: original_file_path,
       access_copy_location: access_copy_location,
       access_copy_file_size_in_bytes: access_copy_file_size_in_bytes,
+      poster_location: poster_location,
+      poster_file_size_in_bytes: poster_file_size_in_bytes,
       service_copy_location: service_copy_location,
       service_copy_file_size_in_bytes: service_copy_file_size_in_bytes
     }
diff --git a/config/routes.rb b/config/routes.rb
index 49742725c..acaea85a0 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -59,6 +59,7 @@
       get 'data_for_ordered_child_editor'
       get 'download'
       get 'download_access_copy'
+      get 'download_poster'
       get 'download_service_copy'
       get 'transcript', action: 'download_transcript'
       put 'transcript', action: 'update_transcript'
@@ -80,6 +81,7 @@
       post 'featured_region', action: 'update_featured_region'
       post 'swap_order_of_first_two_child_assets', action: 'swap_order_of_first_two_child_assets'
       put 'upload_access_copy'
+      put 'upload_poster'
     end
   end
 
diff --git a/lib/tasks/hyacinth/asset_zip.rake b/lib/tasks/hyacinth/asset_zip.rake
index 9a2d57038..bd3cb8cf7 100644
--- a/lib/tasks/hyacinth/asset_zip.rake
+++ b/lib/tasks/hyacinth/asset_zip.rake
@@ -1,7 +1,8 @@
 datastreams_to_asset_file_location_heading_names = {
   'master' => '_asset_data.filesystem_location',
   'service' => '_asset_data.service_copy_location',
-  'access' => '_asset_data.access_copy_location'
+  'access' => '_asset_data.access_copy_location',
+  'poster' => '_asset_data.poster_location',
 }
 
 require 'csv'
diff --git a/spec/requests/digital_objects_spec.rb b/spec/requests/digital_objects_spec.rb
index 8820e7731..829070610 100644
--- a/spec/requests/digital_objects_spec.rb
+++ b/spec/requests/digital_objects_spec.rb
@@ -1,6 +1,6 @@
 require 'rails_helper'
 
-RSpec.describe "DigitalObjects", :type => :request do
+RSpec.describe "DigitalObjects", type: :request do
   describe "GET /digital_objects" do
     it "returns a 401 (unauthorized) status when a user is not logged in" do
       get digital_objects_path
@@ -291,5 +291,59 @@
           expect(response_json).to eq({'errors' => ['Missing multipart/form-data file upload data with name: file']})
       end
     end
+
+    describe "PUT /digital_objects/:id/upload_poster" do
+      let(:asset_digital_object_data) {
+        dod = JSON.parse( fixture('sample_digital_object_data/new_asset.json').read )
+        dod['import_file']['import_type'] = 'internal'
+        dod['import_file']['import_path'] = fixture('sample_assets/sample_text_file.txt').path
+        dod['publish_targets'] = []
+        dod
+      }
+
+      let(:asset) {
+        # Create a new asset
+        asset = DigitalObject::Asset.new
+        allow(asset).to receive(:update_index).and_return(nil)
+        asset.set_digital_object_data(asset_digital_object_data, false)
+        result = asset.save
+        asset
+      }
+
+      it "returns the expected response when the upload is successful" do
+        # Perform first-time upload
+        put upload_poster_digital_object_path(id: asset.pid),
+          file: Rack::Test::UploadedFile.new(fixture('sample_upload_files/lincoln.jpg').path, "image/jpeg")
+
+        expect(response.status).to be(200)
+        response_json = JSON.parse(response.body)
+        expect(response_json).to eq({'success' => true, 'size' => 37692})
+
+        # Perform access copy replacement upload
+        put upload_poster_digital_object_path(id: asset.pid),
+          file: Rack::Test::UploadedFile.new(fixture('sample_upload_files/cat.jpg').path, "image/jpeg")
+
+        expect(response.status).to be(200)
+        response_json = JSON.parse(response.body)
+        expect(response_json).to eq({'success' => true, 'size' => 228093})
+      end
+
+      it "returns the expected error response when a file is missing or sent with the wrong param name" do
+        # Case 1: Missing file
+        put upload_poster_digital_object_path(id: asset.pid)
+
+        expect(response.status).to be(400)
+        response_json = JSON.parse(response.body)
+        expect(response_json).to eq({'errors' => ['Missing multipart/form-data file upload data with name: file']})
+
+        # Case 2: Incorrect file param name
+        put upload_poster_digital_object_path(id: asset.pid),
+          filezzzzzzzzzzzzzzz: Rack::Test::UploadedFile.new(fixture('sample_upload_files/lincoln.jpg').path, "image/jpeg")
+
+          expect(response.status).to be(400)
+          response_json = JSON.parse(response.body)
+          expect(response_json).to eq({'errors' => ['Missing multipart/form-data file upload data with name: file']})
+      end
+    end
   end
 end