Allow Preview User to download files without requiring a Guestbook Re…

doc/release-notes/12535-download-without-guestbook-response-for-preview-user.md

@@ -0,0 +1,2 @@
+## Bug ##
+Preview URL users could not download files from the dataset being previewed if a guestbook was assigned to that dataset. This is now fixed.

src/main/java/edu/harvard/iq/dataverse/FileDownloadServiceBean.java

@@ -4,6 +4,7 @@
 import edu.harvard.iq.dataverse.authorization.Permission;
 import edu.harvard.iq.dataverse.authorization.users.ApiToken;
 import edu.harvard.iq.dataverse.authorization.users.AuthenticatedUser;
+import edu.harvard.iq.dataverse.authorization.users.PrivateUrlUser;
 import edu.harvard.iq.dataverse.authorization.users.User;
 import edu.harvard.iq.dataverse.dataaccess.DataAccess;
 import edu.harvard.iq.dataverse.dataaccess.StorageIO;
@@ -31,7 +32,6 @@
 import java.sql.Timestamp;
 import java.util.*;
 import java.util.logging.Logger;
-//import org.primefaces.context.RequestContext;
 
 /**
  *
@@ -314,6 +314,10 @@ private void redirectToDownloadAPI(String downloadType, Long fileId, boolean gue
         } else {
             logger.fine("Redirecting to file download url: " + fileDownloadUrl);
             try {
+                User user = session.getUser();
+                if (user != null &&  (user instanceof PrivateUrlUser)) {
+                    fileDownloadUrl = fileDownloadUrl + ((fileDownloadUrl.contains("?")) ? "&" : "?") + "key=" + ((PrivateUrlUser) user).getToken();
+                }
                 FacesContext.getCurrentInstance().getExternalContext().redirect(fileDownloadUrl);
             } catch (IOException ex) {
                 logger.info("Failed to issue a redirect to file download url (" + fileDownloadUrl + "): " + ex);
@@ -337,7 +341,7 @@ public void redirectToAuxFileDownloadAPI(Long fileId, String formatTag, String f
             logger.info("Failed to issue a redirect to aux file download url (" + fileDownloadUrl + "): " + ex);
         }
     }
-    
+
     /**
      * Launch an "explore" tool which is a type of ExternalTool such as
      * Data Explorer. This method may be invoked directly from the

src/main/java/edu/harvard/iq/dataverse/api/Access.java

@@ -12,10 +12,7 @@
 import edu.harvard.iq.dataverse.authorization.DataverseRole;
 import edu.harvard.iq.dataverse.authorization.Permission;
 import edu.harvard.iq.dataverse.authorization.RoleAssignee;
-import edu.harvard.iq.dataverse.authorization.users.ApiToken;
-import edu.harvard.iq.dataverse.authorization.users.AuthenticatedUser;
-import edu.harvard.iq.dataverse.authorization.users.GuestUser;
-import edu.harvard.iq.dataverse.authorization.users.User;
+import edu.harvard.iq.dataverse.authorization.users.*;
 import edu.harvard.iq.dataverse.dataaccess.*;
 import edu.harvard.iq.dataverse.datavariable.DataVariable;
 import edu.harvard.iq.dataverse.datavariable.VariableServiceBean;
@@ -2237,7 +2234,12 @@ public Response getUserPermissionsOnFile(@Context ContainerRequestContext crc,
     private boolean checkGuestbookRequiredResponse(User user, UriInfo uriInfo, DataFile df, String gbrids) throws WebApplicationException {
         // Check if guestbook response is required
         Dataset d = df.getOwner();
-        boolean required = df.getOwner().hasEnabledGuestbook() && !d.getEffectiveGuestbookEntryAtRequest();
+        boolean exempt = false;
+        // PrivateUrlUser access to draft files is exempt from guestbook responses in JSF https://github.com/IQSS/dataverse/issues/12535
+        if (user instanceof PrivateUrlUser) {
+            exempt = (df.getOwner().getId() == ((PrivateUrlUser) user).getDatasetId());
+        }
+        boolean required = !exempt && df.getOwner().hasEnabledGuestbook() && !d.getEffectiveGuestbookEntryAtRequest();
         boolean wasWrittenInPost = false;
         if (required) {
             User requestor = getRequestor(user);

src/main/java/edu/harvard/iq/dataverse/authorization/users/PrivateUrlUser.java

@@ -20,7 +20,8 @@ public class PrivateUrlUser implements User {
      * is a DvObject.
      */
     private final long datasetId;
-    private final boolean anonymizedAccess; 
+    private final boolean anonymizedAccess;
+    private String token = null;
 
     public PrivateUrlUser(long datasetId) {
         this(datasetId, false);
@@ -38,7 +39,14 @@ public long getDatasetId() {
     public boolean hasAnonymizedAccess() {
         return anonymizedAccess;
     }
-
+
+    public String getToken() {
+        return token;
+    }
+    public void setToken(String token) {
+        this.token = token;
+    }
+
     /**
      * By always returning false for isAuthenticated(), we prevent a
      * name from appearing in the corner as well as preventing an account page

src/main/java/edu/harvard/iq/dataverse/privateurl/PrivateUrlServiceBean.java

@@ -51,15 +51,23 @@ public PrivateUrl getPrivateUrlFromDatasetId(long datasetId) {
      * @return A PrivateUrlUser if one can be found using the token or null.
      */
     public PrivateUrlUser getPrivateUrlUserFromToken(String token) {
-        return PrivateUrlUtil.getPrivateUrlUserFromRoleAssignment(getRoleAssignmentFromPrivateUrlToken(token));
+        PrivateUrlUser user = PrivateUrlUtil.getPrivateUrlUserFromRoleAssignment(getRoleAssignmentFromPrivateUrlToken(token));
+        if (user != null) {
+            user.setToken(token);
+        }
+        return user;
     }
 
     /**
      * @return PrivateUrlRedirectData if it can be found using the token or
      * null.
      */
     public PrivateUrlRedirectData getPrivateUrlRedirectDataFromToken(String token) {
-        return PrivateUrlUtil.getPrivateUrlRedirectData(getRoleAssignmentFromPrivateUrlToken(token));
+        PrivateUrlRedirectData privateUrlRedirectData = PrivateUrlUtil.getPrivateUrlRedirectData(getRoleAssignmentFromPrivateUrlToken(token));
+        if (privateUrlRedirectData != null && privateUrlRedirectData.getPrivateUrlUser() != null) {
+            privateUrlRedirectData.getPrivateUrlUser().setToken(token);
+        }
+        return privateUrlRedirectData;
     }
 
     /**