fix(transform): Raise if restricted record file has no status

cds_migrator_kit/rdm/records/load/load.py

@@ -385,7 +385,7 @@ def _load(self, entry: MigrationEntry):
             self.migration_logger.add_log(exc, record=entry)
         except Exception as e:
             exc = ManualImportRequired(
-                message=str(e),
+                message=repr(e) + str(e.__dict__),
                 field="validation",
                 stage="load",
                 recid=recid,

cds_migrator_kit/rdm/records/transform/entities/record.py

@@ -89,7 +89,8 @@ def __init__(
         self.raw_dump_entry = dump.data
         self.dojson_entry = dojson_entry
         self.affiliations_mapping = affiliations_mapping
-        self.restricted = restricted
+        # streams.yaml has this as a string ("True"/"False")
+        self.restricted = str(restricted).strip().lower() == "true"
         self.migration_logger = migration_logger
         self.body = None
 

cds_migrator_kit/rdm/records/transform/entities/version.py

@@ -189,6 +189,22 @@ def compute_access(self):
         # only decide public-vs-restricted and carry the raw status as `meta`.
         status = distinct_statuses.pop()
         if not status:
+            if record_access == "restricted":
+                # If the record is restricted but the legacy files carry no restriction to
+                # derive grants from, files would end up restricted with no one able to access them.
+                raise ManualImportRequired(
+                    message=(
+                        f"Record is '{record_access}' but its files have no "
+                        "legacy restriction status - no grants can be derived. "
+                        "Manual review required."
+                    ),
+                    field="files",
+                    subfield="status",
+                    stage="transform",
+                    recid=recid,
+                    priority="critical",
+                    value=", ".join(f["full_name"] for f in self.raw_file_dumps),
+                )
             return {
                 "access_obj": {
                     "record": record_access,

tests/cds-rdm/data/lep_exp/dumps/test_records.json

@@ -3,7 +3,7 @@
     "files": [
       {
         "comment": null,
-        "status": "",
+        "status": "SSO",
         "version": 1,
         "encoding": null,
         "creation_date": "2017-11-23T16:06:45+00:00",