From 1763b1c9602e42613b9d187416ece5445dee62c1 Mon Sep 17 00:00:00 2001
From: Pal Kerecsenyi <pal@p.kerecs.com>
Date: Wed, 22 Jul 2026 10:02:22 +0200
Subject: [PATCH 1/2] config: allow file modification for instance admins

---
 invenio.cfg | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/invenio.cfg b/invenio.cfg
index 15ca380c..45a2ce05 100644
--- a/invenio.cfg
+++ b/invenio.cfg
@@ -65,6 +65,9 @@ from invenio_rdm_records.notifications.vcs import (
     RepositoryReleaseCommunitySubmittedNotificationBuilder,
     RepositoryReleaseFailureNotificationBuilder,
     RepositoryReleaseSuccessNotificationBuilder)
+from invenio_rdm_records.services.request_policies import (
+    FileModificationAdminPolicy,
+)
 from invenio_preservation_sync.utils import preservation_info_render
 from invenio_cern_sync.users.profile import CERNUserProfileSchema
 from invenio_oauthclient.views.client import auto_redirect_login
@@ -499,6 +502,23 @@ RDM_COMMUNITY_REQUIRED_TO_PUBLISH = True
 RDM_NEW_RECORD_VERSION_REVIEW_POLICY = CDSRecordVersionReviewPolicy
 CDS_COMMUNITIES_REQUIRING_NEW_RECORD_VERSION_REVIEW = []
 
+RDM_IMMEDIATE_FILE_MODIFICATION_POLICIES = [
+    FileModificationAdminPolicy(),
+]
+"""Allow only instance-wide admins to modify files of records without creating a new version."""
+
+RDM_FILE_MODIFICATION_PERIOD = timedelta(days=30)
+"""
+Instance-wide admins should only be able to modify files for up to 30 days after the publishing of a record
+version.
+
+The file "bucket" can be unlocked at any point in this period, and then the admin, the owner of the record,
+or the curators of the community can modify the files. The record must be definitively published by the end
+of 30 days after first publication.
+
+E.g. if the bucket is unlocked 29 days after initial publication, files can only be modified for 1 day.
+"""
+
 RDM_SEARCH = {
     **deepcopy(RDM_SEARCH),
     "query_parser_cls": QueryParser.factory(

From d84c61ce4b3e240fe0b51821880f4e5cfd41baf2 Mon Sep 17 00:00:00 2001
From: Karolina <38131488+kpsherva@users.noreply.github.com>
Date: Wed, 22 Jul 2026 10:30:22 +0200
Subject: [PATCH 2/2] Update invenio.cfg

Co-authored-by: Saksham Arora <50872172+sakshamarora1@users.noreply.github.com>
---
 invenio.cfg | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/invenio.cfg b/invenio.cfg
index 45a2ce05..52d6dc20 100644
--- a/invenio.cfg
+++ b/invenio.cfg
@@ -512,7 +512,7 @@ RDM_FILE_MODIFICATION_PERIOD = timedelta(days=30)
 Instance-wide admins should only be able to modify files for up to 30 days after the publishing of a record
 version.
 
-The file "bucket" can be unlocked at any point in this period, and then the admin, the owner of the record,
+The file "bucket" can be unlocked (only by the admin) at any point in this period, and then the admin, the owner of the record,
 or the curators of the community can modify the files. The record must be definitively published by the end
 of 30 days after first publication.