Merge pull request #12250 from vera/feat/non-superuser-dataverse-linking

Dataverse collection linking/unlinking without superuser status

Author: sekmiller

doc/release-notes/12076-non-superuser-dataverse-linking.md

@@ -0,0 +1 @@
+Dataverse collection linking and unlinking no longer requires superuser status. Users with the "Link Dataverse" permission on a collection can now perform these actions through the UI and API.

doc/sphinx-guides/source/admin/dataverses-datasets.rst

@@ -22,14 +22,14 @@ Moves a Dataverse collection whose id is passed to an existing Dataverse collect
 Link a Dataverse Collection
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-Creates a link between a Dataverse collection and another Dataverse collection (see the :ref:`dataverse-linking` section of the User Guide for more information). Only accessible to superusers. ::
+Creates a link between a Dataverse collection and another Dataverse collection (see the :ref:`dataverse-linking` section of the User Guide for more information). ::
 
     curl -H "X-Dataverse-key: $API_TOKEN" -X PUT http://$SERVER/api/dataverses/$linked-dataverse-alias/link/$linking-dataverse-alias
 
 Unlink a Dataverse Collection
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-Removes a link between a Dataverse collection and another Dataverse collection. Only accessible to superusers. ::
+Removes a link between a Dataverse collection and another Dataverse collection. Accessible to users with Link Dataverse permission on the linking Dataverse collection.  ::
 
     curl -H "X-Dataverse-key: $API_TOKEN" -X DELETE http://$SERVER/api/dataverses/$linked-dataverse-alias/deleteLink/$linking-dataverse-alias
 

doc/sphinx-guides/source/api/native-api.rst

@@ -3746,6 +3746,66 @@ The fully expanded example above (without environment variables) looks like this
 
   curl -H "X-Dataverse-key: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" -X PUT "https://demo.dataverse.org/api/datasets/24/link/test"
 
+Unlink a Dataset
+~~~~~~~~~~~~~~~~
+
+Removes a link between a dataset and a Dataverse collection (see :ref:`dataset-linking` section of Dataverse Collection Management in the User Guide for more information):
+
+.. code-block:: bash
+
+  export API_TOKEN=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+  export SERVER_URL=https://demo.dataverse.org
+  export DATASET_ID=24
+  export DATAVERSE_ID=test
+
+  curl -H "X-Dataverse-key: $API_TOKEN" -X DELETE "$SERVER_URL/api/datasets/$DATASET_ID/deleteLink/$DATAVERSE_ID"
+
+The fully expanded example above (without environment variables) looks like this:
+
+.. code-block:: bash
+
+  curl -H "X-Dataverse-key: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" -X DELETE "https://demo.dataverse.org/api/datasets/24/deleteLink/test"
+
+Link a Dataverse collection
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Creates a link between one Dataverse collection and another Dataverse collection (see :ref:`dataverse-linking` section of Dataverse Collection Management in the User Guide for more information):
+
+.. code-block:: bash
+
+  export API_TOKEN=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+  export SERVER_URL=https://demo.dataverse.org
+  export LINKED_DATAVERSE_ID=linked-collection
+  export LINKING_DATAVERSE_ID=linking-collection
+
+  curl -H "X-Dataverse-key: $API_TOKEN" -X PUT "$SERVER_URL/api/dataverses/$LINKED_DATAVERSE_ID/link/$LINKING_DATAVERSE_ID"
+
+The fully expanded example above (without environment variables) looks like this:
+
+.. code-block:: bash
+
+  curl -H "X-Dataverse-key: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" -X PUT "https://demo.dataverse.org/api/dataverses/linked-collection/link/linking-collection"
+
+Unlink a Dataverse collection
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Removes a link between one Dataverse collection and another Dataverse collection (see :ref:`dataverse-linking` section of Dataverse Collection Management in the User Guide for more information):
+
+.. code-block:: bash
+
+  export API_TOKEN=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+  export SERVER_URL=https://demo.dataverse.org
+  export LINKED_DATAVERSE_ID=linked-collection
+  export LINKING_DATAVERSE_ID=linking-collection
+
+  curl -H "X-Dataverse-key: $API_TOKEN" -X DELETE "$SERVER_URL/api/dataverses/$LINKED_DATAVERSE_ID/deleteLink/$LINKING_DATAVERSE_ID"
+
+The fully expanded example above (without environment variables) looks like this:
+
+.. code-block:: bash
+
+  curl -H "X-Dataverse-key: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" -X DELETE "https://demo.dataverse.org/api/dataverses/linked-collection/deleteLink/linking-collection"
+
 Dataset Locks
 ~~~~~~~~~~~~~
 

doc/sphinx-guides/source/user/dataverse-management.rst

@@ -221,18 +221,18 @@ In order to link a dataset, you will need your account to have the "Link Dataset
 
 To link a dataset to your Dataverse collection, you must navigate to that dataset and click the white "Link" button in the upper-right corner of the dataset page. This will open up a window where you can type in the name of the Dataverse collection that you would like to link the dataset to. Select your Dataverse collection and click the save button. This will establish the link, and the dataset will now appear under your Dataverse collection.
 
-A draft dataset can be linked to other Dataverse collections. It will only become publicly visible in the linked collection(s) after it has been published. To publish the dataset, your account must have the "Publish Dataset" permission for the Dataverse collection in which the dataset was originally created. Permissions in the linked Dataverse collections do not apply.
+To remove an established link, navigate to the linked dataset's page and click the white "Unlink" button in the upper-right corner of the page.
 
-There is currently no way to remove established links in the UI. If you need to remove a link between a Dataverse collection and a dataset, please contact the support team for the Dataverse installation you are using (see the :ref:`unlink-a-dataset` section of the Admin Guide for more information).
+A draft dataset can be linked to other Dataverse collections. It will only become publicly visible in the linked collection(s) after it has been published. To publish the dataset, your account must have the "Publish Dataset" permission for the Dataverse collection in which the dataset was originally created. Permissions in the linked Dataverse collections do not apply.
 
 .. _dataverse-linking:
 
 Dataverse Collection Linking
 ============================
 
-Similarly to dataset linking, Dataverse collection linking allows a Dataverse collection owner to "link" their Dataverse collection to another Dataverse collection, so the Dataverse collection being linked will appear in the linking Dataverse collection's list of contents without actually *being* in that Dataverse collection. Currently, the ability to link a Dataverse collection to another Dataverse collection is a superuser only feature. 
+Similarly to dataset linking, Dataverse collection linking allows a Dataverse collection owner to "link" their Dataverse collection to another Dataverse collection, so the Dataverse collection being linked will appear in the linking Dataverse collection's list of contents without actually *being* in that Dataverse collection.
 
-If you need to have a Dataverse collection linked to your Dataverse collection, please contact the support team for the Dataverse installation you are using.
+In order to link a collection, you will need your account to have the "Link Dataverse" permission on the linking Dataverse collection.
 
 Publish Your Dataverse Collection
 =================================

src/main/java/edu/harvard/iq/dataverse/DataverseLinkingServiceBean.java

@@ -89,19 +89,19 @@ public void save(DataverseLinkingDataverse dataverseLinkingDataverse) {
         }
     }
 
-    public DataverseLinkingDataverse findDataverseLinkingDataverse(Long dataverseId, Long linkingDataverseId) {
+    public DataverseLinkingDataverse findDataverseLinkingDataverse(Long linkingDataverseId, Long linkedDataverseId) {
         try {
             return em.createNamedQuery("DataverseLinkingDataverse.findByDataverseIdAndLinkingDataverseId", DataverseLinkingDataverse.class)
-                .setParameter("dataverseId", dataverseId)
+                .setParameter("dataverseId", linkedDataverseId)
                 .setParameter("linkingDataverseId", linkingDataverseId)
                 .getSingleResult();
         } catch (jakarta.persistence.NoResultException e) {
-            logger.fine("No DataverseLinkingDataverse found for dataverseId " + dataverseId + " and linkedDataverseId " + linkingDataverseId);        
+            logger.fine("No DataverseLinkingDataverse found for linkingDataverseId " + linkingDataverseId + " and linkedDataverseId " + linkedDataverseId);
             return null;
         }
     }
 
-    public boolean alreadyLinked(Dataverse definitionPoint, Dataverse dataverseToLinkTo) {
-        return findDataverseLinkingDataverse(dataverseToLinkTo.getId(), definitionPoint.getId()) != null;
+    public boolean alreadyLinked(Dataverse linkingDataverse, Dataverse linkedDataverse) {
+        return findDataverseLinkingDataverse(linkingDataverse.getId(), linkedDataverse.getId()) != null;
     }
 }

src/main/java/edu/harvard/iq/dataverse/DataversePage.java

@@ -215,18 +215,31 @@ public void setLinkMode(LinkMode linkMode) {
     }
 
     public boolean showLinkingPopup() {
-        String testquery = "";
-        if (session.getUser() == null) {
+        // Must be logged in
+        AuthenticatedUser au = getAuthenticatedUser();
+        if (au == null) {
             return false;
         }
         if (dataverse == null) {
             return false;
         }
-        if (query != null) {
-            testquery = query;
+
+        // If there is an active search query, that's all that matters (plus having permission on ANY collection)
+        if (query != null && !query.isEmpty()) {
+            List<Dataverse> permitted = permissionService.findPermittedCollections(dvRequestService.getDataverseRequest(), au, Permission.LinkDataverse);
+            return permitted != null && !permitted.isEmpty();
+        }
+
+        // Otherwise (no active search), check if there is at least one OTHER eligible collection
+        // Eligible means: not the current collection and not in the parent tree
+        // Technically, eligible also means "not already linked", but in that case, we show the Link button anyway and have the Link dialog display a message about all eligible collections already being linked
+        List<Dataverse> dvsWithLinkPermission = permissionService.findPermittedCollections(dvRequestService.getDataverseRequest(), au, Permission.LinkDataverse);
+        if (dvsWithLinkPermission != null && !dvsWithLinkPermission.isEmpty()) {
+            List<Dataverse> eligibleDataverses = dataverseService.removeUnlinkableDataverses(dvsWithLinkPermission, dataverse, false);
+            return !eligibleDataverses.isEmpty();
         }
 
-        return (session.getUser().isSuperuser() && (dataverse.getOwner() != null || !testquery.isEmpty()));
+        return false;
     }
 
     public void setupLinkingPopup (String popupSetting){
@@ -241,35 +254,18 @@ public void setupLinkingPopup (String popupSetting){
     public void updateLinkableDataverses() {
         dataversesForLinking = new ArrayList<>();
         linkingDVSelectItems = new ArrayList<>();
-        
-        //Since only a super user function add all dvs
-        dataversesForLinking = dataverseService.findAll();// permissionService.getDataversesUserHasPermissionOn(session.getUser(), Permission.PublishDataverse);
-        
-        /*
-        List<DataverseRole> roles = dataverseRoleServiceBean.getDataverseRolesByPermission(Permission.PublishDataverse, dataverse.getId());
-        List<String> types = new ArrayList();
-        types.add("Dataverse");
-        for (Long dvIdAsInt : permissionService.getDvObjectIdsUserHasRoleOn(session.getUser(), roles, types, false)) {
-            dataversesForLinking.add(dataverseService.find(dvIdAsInt));
-        }*/
-        
-        //for linking - make sure the link hasn't occurred and its not int the tree
-        if (this.linkMode.equals(LinkMode.LINKDATAVERSE)) {
-        
-            // remove this and it's parent tree
-            dataversesForLinking.remove(dataverse);
-            Dataverse testDV = dataverse;
-            while(testDV.getOwner() != null){
-                dataversesForLinking.remove(testDV.getOwner());
-                testDV = testDV.getOwner();
-            }                
-            
-            for (Dataverse removeLinked : linkingService.findLinkingDataverses(dataverse.getId())) {
-                dataversesForLinking.remove(removeLinked);
-            }
-        } else{
-            //for saved search add all
 
+
+        List<Dataverse> dvsWithLinkPermission = permissionService.findPermittedCollections(dvRequestService.getDataverseRequest(), getAuthenticatedUser(), Permission.LinkDataverse, "");
+
+        if (dvsWithLinkPermission != null && !dvsWithLinkPermission.isEmpty()) {
+            // for linking - make sure the link hasn't occurred and it's not in the tree
+            if (this.linkMode.equals(LinkMode.LINKDATAVERSE)) {
+                dataversesForLinking = dataverseService.removeUnlinkableDataverses(dvsWithLinkPermission, dataverse);
+            } else {
+                // for saved search, add all
+                dataversesForLinking = dvsWithLinkPermission;
+            }
         }
 
         for (Dataverse selectDV : dataversesForLinking) {

src/main/java/edu/harvard/iq/dataverse/DataverseServiceBean.java

@@ -551,28 +551,30 @@ public List<Dataverse> filterDataversesForLinking(String query, DataverseRequest
         return dataverseList;
     }
 
-    public List<Dataverse> removeUnlinkableDataverses(List<Dataverse> allWithPerms, DvObject dvo) {
+    public List<Dataverse> removeUnlinkableDataverses(List<Dataverse> allWithPerms, DvObject dvo, boolean removeAlreadyLinked) {
         List<Dataverse> dataverseList = new ArrayList<>();
         Dataset linkedDataset = null;
         Dataverse linkedDataverse = null;
-        List<Object> alreadyLinkeddv_ids;
-
-        if ((dvo instanceof Dataset)) {
-            linkedDataset = (Dataset) dvo;
-            alreadyLinkeddv_ids = em.createNativeQuery("SELECT linkingdataverse_id FROM datasetlinkingdataverse WHERE dataset_id = " + linkedDataset.getId()).getResultList();
-        } else {
-            linkedDataverse = (Dataverse) dvo;
-            alreadyLinkeddv_ids = em.createNativeQuery("SELECT linkingdataverse_id FROM dataverselinkingdataverse WHERE dataverse_id = " + linkedDataverse.getId()).getResultList();
-        }
 
         List<Dataverse> remove = new ArrayList<>();
 
-        if (alreadyLinkeddv_ids != null && !alreadyLinkeddv_ids.isEmpty()) {
-            alreadyLinkeddv_ids.stream().map((testDVId) -> this.find(testDVId)).forEachOrdered((removeIt) -> {
-                remove.add(removeIt);
-            });
+        if (removeAlreadyLinked) {
+            List<Object> alreadyLinkeddv_ids;
+
+            if ((dvo instanceof Dataset)) {
+                linkedDataset = (Dataset) dvo;
+                alreadyLinkeddv_ids = em.createNativeQuery("SELECT linkingdataverse_id FROM datasetlinkingdataverse WHERE dataset_id = " + linkedDataset.getId()).getResultList();
+            } else {
+                linkedDataverse = (Dataverse) dvo;
+                alreadyLinkeddv_ids = em.createNativeQuery("SELECT linkingdataverse_id FROM dataverselinkingdataverse WHERE dataverse_id = " + linkedDataverse.getId()).getResultList();
+            }
+
+            if (alreadyLinkeddv_ids != null && !alreadyLinkeddv_ids.isEmpty()) {
+                alreadyLinkeddv_ids.stream().map((testDVId) -> this.find(testDVId)).forEachOrdered((removeIt) -> {
+                    remove.add(removeIt);
+                });
+            }
         }
-        
 
         if (dvo instanceof Dataverse dataverse) {
             remove.add(dataverse);
@@ -596,8 +598,11 @@ public List<Dataverse> removeUnlinkableDataverses(List<Dataverse> allWithPerms,
 
         return dataverseList;
     }
-    
-  
+
+    public List<Dataverse> removeUnlinkableDataverses(List<Dataverse> allWithPerms, DvObject dvo) {
+        return removeUnlinkableDataverses(allWithPerms, dvo, true);
+    }
+
     public List<Dataverse> filterDataversesForUnLinking(String query, DataverseRequest req, Dataset dataset) {
         List<Object> alreadyLinkeddv_ids = em.createNativeQuery("SELECT linkingdataverse_id FROM datasetlinkingdataverse WHERE dataset_id = " + dataset.getId()).getResultList();
         List<Dataverse> dataverseList = new ArrayList<>();

src/main/java/edu/harvard/iq/dataverse/api/Dataverses.java

@@ -855,7 +855,7 @@ private List<DatasetFieldType> parseFacets(JsonArray facetsArray) throws Wrapped
 
     @DELETE
     @AuthRequired
-    @Path("{linkingDataverseId}/deleteLink/{linkedDataverseId}")
+    @Path("{linkedDataverseId}/deleteLink/{linkingDataverseId}")
     public Response deleteDataverseLinkingDataverse(@Context ContainerRequestContext crc, @PathParam("linkingDataverseId") String linkingDataverseId, @PathParam("linkedDataverseId") String linkedDataverseId) {
         boolean index = true;
         return response(req -> {

src/main/java/edu/harvard/iq/dataverse/engine/command/impl/CreateSavedSearchCommand.java

@@ -14,7 +14,7 @@
 import java.util.logging.Logger;
 import jakarta.json.JsonObjectBuilder;
 
-@RequiredPermissions(Permission.PublishDataverse)
+@RequiredPermissions(Permission.LinkDataverse)
 public class CreateSavedSearchCommand extends AbstractCommand<SavedSearch> {
 
     private static final Logger logger = Logger.getLogger(SavedSearchServiceBean.class.getCanonicalName());

src/main/java/edu/harvard/iq/dataverse/engine/command/impl/DeleteDataverseLinkingDataverseCommand.java

@@ -26,7 +26,7 @@
  * @author sarahferry
  */
 
-@RequiredPermissions( Permission.EditDataverse )
+@RequiredPermissions( Permission.LinkDataverse )
 public class DeleteDataverseLinkingDataverseCommand extends AbstractCommand<Dataverse> {
 
     private final DataverseLinkingDataverse doomed;
@@ -42,10 +42,6 @@ public DeleteDataverseLinkingDataverseCommand(DataverseRequest aRequest, Dataver
 
     @Override
     public Dataverse execute(CommandContext ctxt) throws CommandException {
-        if ((!(getUser() instanceof AuthenticatedUser) || !getUser().isSuperuser())) {
-            throw new PermissionException("Delete dataverse linking dataverse can only be called by superusers.",
-                    this, Collections.singleton(Permission.DeleteDataverse), editedDv);
-        }
         Dataverse merged = ctxt.em().merge(editedDv);
         DataverseLinkingDataverse doomedAndMerged = ctxt.em().merge(doomed);
         ctxt.em().remove(doomedAndMerged);