Allow Preview User to download files without requiring a Guestbook Re…

[stevenwinship]

The guestbook popup does not appear to collect a response before the download attempt is made. Disabling the guestbook on the dataset resolves the issue and files download normally through the Preview URL. This fix reinstates the behavior of the JSF UI from prior versions of Dataverse.

Which issue(s) this PR closes:#12535

• Closes When there is a guestbook, you cannot download files using a Preview URL #12535

Special notes for your reviewer:

Suggestions on how to test this: Create a dataset with a guestbook. Generate a Preview URL. Using the preview url try to download files and dataset zip file. This should work without requiring the guestbook response.

Does this PR introduce a user interface change? If mockups are available, please link/include them here:

Is there a release notes update needed for this change?: Included

Additional documentation:

[coveralls]

Coverage is 24.968% — 12535-download-without-guestbook-response-for-preview-user into develop. No base build found for develop.

[github-actions]

Test Results

403 tests  ±0   388 ✅ ±0   25m 39s ⏱️ - 8m 40s
 55 suites ±0    15 💤 ±0 
 55 files   ±0     0 ❌ ±0 

Results for commit 4477597. ± Comparison against base commit b485249.

♻️ This comment has been updated with latest results.

[qqmyers]

This looks like it would work, except for some minor URL tweaking, but it seems like the fixes are in one-off places rather than the way things are done for other types of users. I made some comments about moving things around and avoiding a new method using signing.

[qqmyers]

Now that you set the token in the PrivateUrlUser, is there any reason you can't generate the required signed URL in the same method, e.g.

dataverse/src/main/java/edu/harvard/iq/dataverse/api/Access.java

Lines 584 to 608 in 72a5ad2

	private Response returnSignedUrl(ContainerRequestContext crc, UriInfo uriInfo, User user, String id, String gbrids) {
	// Create the signed URL
	String userIdentifier = null;
	String key = null;
	if (user != null && user instanceof AuthenticatedUser) {
	AuthenticatedUser requestor = (AuthenticatedUser) user;
	userIdentifier = requestor.getUserIdentifier();
	// Find the latest token: Use for signing
	// Could be null if no token was generated: Generate one to be used for signing (expire in 1 minute to match timeout in signedUrl)
	// Could be expired: The user was already authenticated (possible by bearer token). Only used for signing so we don't care
	ApiToken apiToken = authSvc.findApiTokenByUser(requestor);
	if (apiToken == null) {
	logger.fine("Generating temporary API token for user " + userIdentifier);
	apiToken = authSvc.generateApiTokenForUser(requestor, AuthenticationServiceBean.INTERVAL.MINUTES, GUESTBOOK_RESPONSE_SIGNEDURL_TIMEOUT_MINUTES);
	}
	if (apiToken != null) {
	key = apiToken.getTokenString();
	}
	} else {
	// Guest
	userIdentifier = "guest";
	// Note: In order for the key to match we need to replace ":persistentId" with the actual file id since that is what will be sent in via the signed url.
	key = URLDecoder.decode(uriInfo.getAbsolutePath().toASCIIString())
	.replace(":persistentId", id); //TODO find a better one for here and in SignedUrlAuthMechanism.java
	}

? (If not the URL munging here has to change as localhost:8080 won't work.)

[stevenwinship]

I'm not fully understanding your comment. The signing happens in 2 places.

1. in DatasetPage (FileDownloadServiceBean) when the preview user tries to download a file. The redirect is simply "/api/access/..." (no scheme, service, port)
2. In access when the api call comes in. the url is "http://localhost:8080/api/v1/access/..."
   When the access call compares the token hash of the signed url it doesn't match if the signed token was generated using "/api/access/..."

[qqmyers]

Perhaps I'm misunderstanding. My assumption is that this case is similar to the case of a dataset creator downloading from the draft - just a different type of user and different key. So I expected to see some code right where signing for an authenticated user happened to also sign for a privateUulUser - same url, same signing code, just a difference in getting the signing key for this case - versus a new method to generate and sign a URL for this case.

[stevenwinship]

The dataset creator downloading from draft includes the auth key in the header. The preview user has a token in the query params. in order to propagate the fact that it's a preview user and not a guest the url needs to be signed. This allows the SignedUrlAuthMechanism to authenticate a PrivateUrlUser based on the user=!{datasetId} and the token from the datasetId

[qqmyers]

Preview URL users could not download files from the dataset being previewed if a guestbook was assigned to that dataset. This is now fixed.

[stevenwinship]

fixed

[qqmyers]

Would it be cleaner to set this in

dataverse/src/main/java/edu/harvard/iq/dataverse/privateurl/PrivateUrlServiceBean.java

Lines 53 to 55 in 72a5ad2

	public PrivateUrlUser getPrivateUrlUserFromToken(String token) {
	return PrivateUrlUtil.getPrivateUrlUserFromRoleAssignment(getRoleAssignmentFromPrivateUrlToken(token));
	}

- when the token lookup is done?

[stevenwinship]

moved

[github-actions]

📦 Pushed preview images as

ghcr.io/gdcc/dataverse:12535-download-without-guestbook-response-for-preview-user

ghcr.io/gdcc/configbaker:12535-download-without-guestbook-response-for-preview-user

🚢 See on GHCR. Use by referencing with full name as printed above, mind the registry name.