From 1fa68cf5e337b2a49d2b47e7dbdb14115ca86f05 Mon Sep 17 00:00:00 2001
From: Saksham <sakshamarora1001@gmail.com>
Date: Tue, 20 Oct 2026 13:49:16 +0200
Subject: [PATCH] fix(transform): Raise if restricted record file has no status

* Fixes for the case when a stream is marked as restricted, the record will be migrated as restricted but it could be that the file has no status set, which would make the parent access grant have no permissions
* Fix check for restricted bool returning True if string was not empty
* Fix RDM errors not being propagated to the log
---
 cds_migrator_kit/rdm/records/load/load.py        |  2 +-
 .../rdm/records/transform/entities/record.py     |  3 ++-
 .../rdm/records/transform/entities/version.py    | 16 ++++++++++++++++
 .../cds-rdm/data/lep_exp/dumps/test_records.json |  2 +-
 4 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/cds_migrator_kit/rdm/records/load/load.py b/cds_migrator_kit/rdm/records/load/load.py
index 4bfcbe4e..62e1935d 100644
--- a/cds_migrator_kit/rdm/records/load/load.py
+++ b/cds_migrator_kit/rdm/records/load/load.py
@@ -385,7 +385,7 @@ def _load(self, entry: MigrationEntry):
             self.migration_logger.add_log(exc, record=entry)
         except Exception as e:
             exc = ManualImportRequired(
-                message=str(e),
+                message=repr(e) + str(e.__dict__),
                 field="validation",
                 stage="load",
                 recid=recid,
diff --git a/cds_migrator_kit/rdm/records/transform/entities/record.py b/cds_migrator_kit/rdm/records/transform/entities/record.py
index 9832a8f9..c12c1298 100644
--- a/cds_migrator_kit/rdm/records/transform/entities/record.py
+++ b/cds_migrator_kit/rdm/records/transform/entities/record.py
@@ -89,7 +89,8 @@ def __init__(
         self.raw_dump_entry = dump.data
         self.dojson_entry = dojson_entry
         self.affiliations_mapping = affiliations_mapping
-        self.restricted = restricted
+        # streams.yaml has this as a string ("True"/"False")
+        self.restricted = str(restricted).strip().lower() == "true"
         self.migration_logger = migration_logger
         self.body = None
 
diff --git a/cds_migrator_kit/rdm/records/transform/entities/version.py b/cds_migrator_kit/rdm/records/transform/entities/version.py
index a766c6f4..555be78d 100644
--- a/cds_migrator_kit/rdm/records/transform/entities/version.py
+++ b/cds_migrator_kit/rdm/records/transform/entities/version.py
@@ -189,6 +189,22 @@ def compute_access(self):
         # only decide public-vs-restricted and carry the raw status as `meta`.
         status = distinct_statuses.pop()
         if not status:
+            if record_access == "restricted":
+                # If the record is restricted but the legacy files carry no restriction to
+                # derive grants from, files would end up restricted with no one able to access them.
+                raise ManualImportRequired(
+                    message=(
+                        f"Record is '{record_access}' but its files have no "
+                        "legacy restriction status - no grants can be derived. "
+                        "Manual review required."
+                    ),
+                    field="files",
+                    subfield="status",
+                    stage="transform",
+                    recid=recid,
+                    priority="critical",
+                    value=", ".join(f["full_name"] for f in self.raw_file_dumps),
+                )
             return {
                 "access_obj": {
                     "record": record_access,
diff --git a/tests/cds-rdm/data/lep_exp/dumps/test_records.json b/tests/cds-rdm/data/lep_exp/dumps/test_records.json
index 9d5bcbb6..2013bfa7 100644
--- a/tests/cds-rdm/data/lep_exp/dumps/test_records.json
+++ b/tests/cds-rdm/data/lep_exp/dumps/test_records.json
@@ -3,7 +3,7 @@
     "files": [
       {
         "comment": null,
-        "status": "",
+        "status": "SSO",
         "version": 1,
         "encoding": null,
         "creation_date": "2017-11-23T16:06:45+00:00",