Allow Preview User to download files without requiring a Guestbook Re…

[stevenwinship]

The guestbook popup does not appear to collect a response before the download attempt is made. Disabling the guestbook on the dataset resolves the issue and files download normally through the Preview URL. This fix reinstates the behavior of the JSF UI from prior versions of Dataverse.

Which issue(s) this PR closes:#12535

• Closes When there is a guestbook, you cannot download files using a Preview URL #12535

Special notes for your reviewer:

Suggestions on how to test this: Create a dataset with a guestbook. Generate a Preview URL. Using the preview url try to download files and dataset zip file. This should work without requiring the guestbook response.

Does this PR introduce a user interface change? If mockups are available, please link/include them here:

Is there a release notes update needed for this change?: Included

Additional documentation:

[coveralls]

Coverage is 24.971% — 12535-download-without-guestbook-response-for-preview-user into develop. No base build found for develop.

[github-actions]

Test Results

403 tests  ±0   388 ✅ ±0   33m 54s ⏱️ -1s
 55 suites ±0    15 💤 ±0 
 55 files   ±0     0 ❌ ±0 

Results for commit 092ef3e. ± Comparison against base commit 72a5ad2.

♻️ This comment has been updated with latest results.

[qqmyers]

This looks like it would work, except for some minor URL tweaking, but it seems like the fixes are in one-off places rather than the way things are done for other types of users. I made some comments about moving things around and avoiding a new method using signing.

[qqmyers]

Now that you set the token in the PrivateUrlUser, is there any reason you can't generate the required signed URL in the same method, e.g.

dataverse/src/main/java/edu/harvard/iq/dataverse/api/Access.java

Lines 584 to 608 in 72a5ad2

	private Response returnSignedUrl(ContainerRequestContext crc, UriInfo uriInfo, User user, String id, String gbrids) {
	// Create the signed URL
	String userIdentifier = null;
	String key = null;
	if (user != null && user instanceof AuthenticatedUser) {
	AuthenticatedUser requestor = (AuthenticatedUser) user;
	userIdentifier = requestor.getUserIdentifier();
	// Find the latest token: Use for signing
	// Could be null if no token was generated: Generate one to be used for signing (expire in 1 minute to match timeout in signedUrl)
	// Could be expired: The user was already authenticated (possible by bearer token). Only used for signing so we don't care
	ApiToken apiToken = authSvc.findApiTokenByUser(requestor);
	if (apiToken == null) {
	logger.fine("Generating temporary API token for user " + userIdentifier);
	apiToken = authSvc.generateApiTokenForUser(requestor, AuthenticationServiceBean.INTERVAL.MINUTES, GUESTBOOK_RESPONSE_SIGNEDURL_TIMEOUT_MINUTES);
	}
	if (apiToken != null) {
	key = apiToken.getTokenString();
	}
	} else {
	// Guest
	userIdentifier = "guest";
	// Note: In order for the key to match we need to replace ":persistentId" with the actual file id since that is what will be sent in via the signed url.
	key = URLDecoder.decode(uriInfo.getAbsolutePath().toASCIIString())
	.replace(":persistentId", id); //TODO find a better one for here and in SignedUrlAuthMechanism.java
	}

? (If not the URL munging here has to change as localhost:8080 won't work.)

[qqmyers]

Preview URL users could not download files from the dataset being previewed if a guestbook was assigned to that dataset. This is now fixed.

[stevenwinship]

fixed

[qqmyers]

Would it be cleaner to set this in

dataverse/src/main/java/edu/harvard/iq/dataverse/privateurl/PrivateUrlServiceBean.java

Lines 53 to 55 in 72a5ad2

	public PrivateUrlUser getPrivateUrlUserFromToken(String token) {
	return PrivateUrlUtil.getPrivateUrlUserFromRoleAssignment(getRoleAssignmentFromPrivateUrlToken(token));
	}

- when the token lookup is done?

[stevenwinship]

moved

[github-actions]

📦 Pushed preview images as

ghcr.io/gdcc/dataverse:12535-download-without-guestbook-response-for-preview-user

ghcr.io/gdcc/configbaker:12535-download-without-guestbook-response-for-preview-user

🚢 See on GHCR. Use by referencing with full name as printed above, mind the registry name.