bearerToken = extractBearerTokenFromHeaderParam(httpRequest.getHeader(HttpHeaders.AUTHORIZATION));
+ if (bearerToken.isEmpty()) {
+ return error(Response.Status.BAD_REQUEST, BundleUtil.getStringFromBundle("users.api.errors.bearerTokenRequired"));
+ }
+ try {
+ JsonObject userJson = JsonUtil.getJsonObject(body);
+ execCommand(new RegisterOIDCUserCommand(createDataverseRequest(GuestUser.get()), bearerToken.get(), jsonParser().parseUserDTO(userJson)));
+ } catch (JsonParseException | JsonParsingException e) {
+ return error(Response.Status.BAD_REQUEST, MessageFormat.format(BundleUtil.getStringFromBundle("users.api.errors.jsonParseToUserDTO"), e.getMessage()));
+ } catch (WrappedResponse e) {
+ return e.getResponse();
+ }
+ return ok(BundleUtil.getStringFromBundle("users.api.userRegistered"));
+ }
}
diff --git a/src/main/java/edu/harvard/iq/dataverse/api/auth/ApiKeyAuthMechanism.java b/src/main/java/edu/harvard/iq/dataverse/api/auth/ApiKeyAuthMechanism.java
index 0dd8a28baca..fbb0b484b58 100644
--- a/src/main/java/edu/harvard/iq/dataverse/api/auth/ApiKeyAuthMechanism.java
+++ b/src/main/java/edu/harvard/iq/dataverse/api/auth/ApiKeyAuthMechanism.java
@@ -9,6 +9,7 @@
import jakarta.inject.Inject;
import jakarta.ws.rs.container.ContainerRequestContext;
+
import java.util.logging.Logger;
/**
@@ -49,7 +50,7 @@ public User findUserFromRequest(ContainerRequestContext containerRequestContext)
authUser = userSvc.updateLastApiUseTime(authUser);
return authUser;
}
- throw new WrappedAuthErrorResponse(RESPONSE_MESSAGE_BAD_API_KEY);
+ throw new WrappedUnauthorizedAuthErrorResponse(RESPONSE_MESSAGE_BAD_API_KEY);
}
private String getRequestApiKey(ContainerRequestContext containerRequestContext) {
@@ -59,7 +60,7 @@ private String getRequestApiKey(ContainerRequestContext containerRequestContext)
return headerParamApiKey != null ? headerParamApiKey : queryParamApiKey;
}
- private void checkAnonymizedAccessToRequestPath(String requestPath, PrivateUrlUser privateUrlUser) throws WrappedAuthErrorResponse {
+ private void checkAnonymizedAccessToRequestPath(String requestPath, PrivateUrlUser privateUrlUser) throws WrappedUnauthorizedAuthErrorResponse {
if (!privateUrlUser.hasAnonymizedAccess()) {
return;
}
@@ -67,7 +68,7 @@ private void checkAnonymizedAccessToRequestPath(String requestPath, PrivateUrlUs
// to download the file or image thumbs
if (!(requestPath.startsWith(ACCESS_DATAFILE_PATH_PREFIX) && !requestPath.substring(ACCESS_DATAFILE_PATH_PREFIX.length()).contains("/"))) {
logger.info("Anonymized access request for " + requestPath);
- throw new WrappedAuthErrorResponse(RESPONSE_MESSAGE_BAD_API_KEY);
+ throw new WrappedUnauthorizedAuthErrorResponse(RESPONSE_MESSAGE_BAD_API_KEY);
}
}
}
diff --git a/src/main/java/edu/harvard/iq/dataverse/api/auth/AuthUtil.java b/src/main/java/edu/harvard/iq/dataverse/api/auth/AuthUtil.java
new file mode 100644
index 00000000000..36cd7c7f1df
--- /dev/null
+++ b/src/main/java/edu/harvard/iq/dataverse/api/auth/AuthUtil.java
@@ -0,0 +1,24 @@
+package edu.harvard.iq.dataverse.api.auth;
+
+import java.util.Optional;
+
+public class AuthUtil {
+
+ private static final String BEARER_AUTH_SCHEME = "Bearer";
+
+ /**
+ * Extracts the Bearer token from the provided HTTP Authorization header value.
+ *
+ * Validates that the header value starts with the "Bearer" scheme as defined in RFC 6750.
+ * If the header is null, empty, or does not start with "Bearer ", an empty {@link Optional} is returned.
+ *
+ * @param headerParamBearerToken the raw HTTP Authorization header value containing the Bearer token
+ * @return An {@link Optional} containing the raw Bearer token if present and valid; otherwise, an empty {@link Optional}
+ */
+ public static Optional extractBearerTokenFromHeaderParam(String headerParamBearerToken) {
+ if (headerParamBearerToken != null && headerParamBearerToken.toLowerCase().startsWith(BEARER_AUTH_SCHEME.toLowerCase() + " ")) {
+ return Optional.of(headerParamBearerToken);
+ }
+ return Optional.empty();
+ }
+}
diff --git a/src/main/java/edu/harvard/iq/dataverse/api/auth/BearerTokenAuthMechanism.java b/src/main/java/edu/harvard/iq/dataverse/api/auth/BearerTokenAuthMechanism.java
index 31f524af3f0..3ee9bb909f2 100644
--- a/src/main/java/edu/harvard/iq/dataverse/api/auth/BearerTokenAuthMechanism.java
+++ b/src/main/java/edu/harvard/iq/dataverse/api/auth/BearerTokenAuthMechanism.java
@@ -1,124 +1,65 @@
package edu.harvard.iq.dataverse.api.auth;
-import com.nimbusds.oauth2.sdk.ParseException;
-import com.nimbusds.oauth2.sdk.token.BearerAccessToken;
import edu.harvard.iq.dataverse.UserServiceBean;
import edu.harvard.iq.dataverse.authorization.AuthenticationServiceBean;
-import edu.harvard.iq.dataverse.authorization.UserRecordIdentifier;
-import edu.harvard.iq.dataverse.authorization.providers.oauth2.oidc.OIDCAuthProvider;
+import edu.harvard.iq.dataverse.authorization.exceptions.AuthorizationException;
import edu.harvard.iq.dataverse.authorization.users.AuthenticatedUser;
import edu.harvard.iq.dataverse.authorization.users.User;
import edu.harvard.iq.dataverse.settings.FeatureFlags;
+import edu.harvard.iq.dataverse.util.BundleUtil;
import jakarta.inject.Inject;
import jakarta.ws.rs.container.ContainerRequestContext;
import jakarta.ws.rs.core.HttpHeaders;
-import java.io.IOException;
-import java.util.List;
+
import java.util.Optional;
import java.util.logging.Level;
import java.util.logging.Logger;
-import java.util.stream.Collectors;
+
+import static edu.harvard.iq.dataverse.api.auth.AuthUtil.extractBearerTokenFromHeaderParam;
public class BearerTokenAuthMechanism implements AuthMechanism {
- private static final String BEARER_AUTH_SCHEME = "Bearer";
private static final Logger logger = Logger.getLogger(BearerTokenAuthMechanism.class.getCanonicalName());
-
- public static final String UNAUTHORIZED_BEARER_TOKEN = "Unauthorized bearer token";
- public static final String INVALID_BEARER_TOKEN = "Could not parse bearer token";
- public static final String BEARER_TOKEN_DETECTED_NO_OIDC_PROVIDER_CONFIGURED = "Bearer token detected, no OIDC provider configured";
@Inject
protected AuthenticationServiceBean authSvc;
@Inject
protected UserServiceBean userSvc;
-
+
@Override
public User findUserFromRequest(ContainerRequestContext containerRequestContext) throws WrappedAuthErrorResponse {
- if (FeatureFlags.API_BEARER_AUTH.enabled()) {
- Optional bearerToken = getRequestApiKey(containerRequestContext);
- // No Bearer Token present, hence no user can be authenticated
- if (bearerToken.isEmpty()) {
- return null;
- }
-
- // Validate and verify provided Bearer Token, and retrieve UserRecordIdentifier
- // TODO: Get the identifier from an invalidating cache to avoid lookup bursts of the same token. Tokens in the cache should be removed after some (configurable) time.
- UserRecordIdentifier userInfo = verifyOidcBearerTokenAndGetUserIdentifier(bearerToken.get());
+ if (!FeatureFlags.API_BEARER_AUTH.enabled()) {
+ return null;
+ }
- // retrieve Authenticated User from AuthService
- AuthenticatedUser authUser = authSvc.lookupUser(userInfo);
- if (authUser != null) {
- // track the API usage
- authUser = userSvc.updateLastApiUseTime(authUser);
- return authUser;
- } else {
- // a valid Token was presented, but we have no associated user account.
- logger.log(Level.WARNING, "Bearer token detected, OIDC provider {0} validated Token but no linked UserAccount", userInfo.getUserRepoId());
- // TODO: Instead of returning null, we should throw a meaningful error to the client.
- // Probably this will be a wrapped auth error response with an error code and a string describing the problem.
- return null;
- }
+ Optional bearerToken = getRequestBearerToken(containerRequestContext);
+ if (bearerToken.isEmpty()) {
+ return null;
}
- return null;
- }
- /**
- * Verifies the given Bearer token and obtain information about the corresponding user within respective AuthProvider.
- *
- * @param token The string containing the encoded JWT
- * @return
- */
- private UserRecordIdentifier verifyOidcBearerTokenAndGetUserIdentifier(String token) throws WrappedAuthErrorResponse {
+ AuthenticatedUser authUser;
try {
- BearerAccessToken accessToken = BearerAccessToken.parse(token);
- // Get list of all authentication providers using Open ID Connect
- // @TASK: Limited to OIDCAuthProviders, could be widened to OAuth2Providers.
- List providers = authSvc.getAuthenticationProviderIdsOfType(OIDCAuthProvider.class).stream()
- .map(providerId -> (OIDCAuthProvider) authSvc.getAuthenticationProvider(providerId))
- .collect(Collectors.toUnmodifiableList());
- // If not OIDC Provider are configured we cannot validate a Token
- if(providers.isEmpty()){
- logger.log(Level.WARNING, "Bearer token detected, no OIDC provider configured");
- throw new WrappedAuthErrorResponse(BEARER_TOKEN_DETECTED_NO_OIDC_PROVIDER_CONFIGURED);
- }
+ authUser = authSvc.lookupUserByOIDCBearerToken(bearerToken.get());
+ } catch (AuthorizationException e) {
+ logger.log(Level.WARNING, "Authorization failed: {0}", e.getMessage());
+ throw new WrappedUnauthorizedAuthErrorResponse(e.getMessage());
+ }
- // Iterate over all OIDC providers if multiple. Sadly needed as do not know which provided the Token.
- for (OIDCAuthProvider provider : providers) {
- try {
- // The OIDCAuthProvider need to verify a Bearer Token and equip the client means to identify the corresponding AuthenticatedUser.
- Optional userInfo = provider.getUserIdentifier(accessToken);
- if(userInfo.isPresent()) {
- logger.log(Level.FINE, "Bearer token detected, provider {0} confirmed validity and provided identifier", provider.getId());
- return userInfo.get();
- }
- } catch (IOException e) {
- // TODO: Just logging this is not sufficient - if there is an IO error with the one provider
- // which would have validated successfully, this is not the users fault. We need to
- // take note and refer to that later when occurred.
- logger.log(Level.FINE, "Bearer token detected, provider " + provider.getId() + " indicates an invalid Token, skipping", e);
- }
- }
- } catch (ParseException e) {
- logger.log(Level.FINE, "Bearer token detected, unable to parse bearer token (invalid Token)", e);
- throw new WrappedAuthErrorResponse(INVALID_BEARER_TOKEN);
+ if (authUser == null) {
+ logger.log(Level.WARNING, "Bearer token detected, OIDC provider validated the token but no linked UserAccount");
+ throw new WrappedForbiddenAuthErrorResponse(BundleUtil.getStringFromBundle("bearerTokenAuthMechanism.errors.tokenValidatedButNoRegisteredUser"));
}
- // No UserInfo returned means we have an invalid access token.
- logger.log(Level.FINE, "Bearer token detected, yet no configured OIDC provider validated it.");
- throw new WrappedAuthErrorResponse(UNAUTHORIZED_BEARER_TOKEN);
+ return userSvc.updateLastApiUseTime(authUser);
}
/**
* Retrieve the raw, encoded token value from the Authorization Bearer HTTP header as defined in RFC 6750
+ *
* @return An {@link Optional} either empty if not present or the raw token from the header
*/
- private Optional getRequestApiKey(ContainerRequestContext containerRequestContext) {
- String headerParamApiKey = containerRequestContext.getHeaderString(HttpHeaders.AUTHORIZATION);
- if (headerParamApiKey != null && headerParamApiKey.toLowerCase().startsWith(BEARER_AUTH_SCHEME.toLowerCase() + " ")) {
- return Optional.of(headerParamApiKey);
- } else {
- return Optional.empty();
- }
+ public static Optional getRequestBearerToken(ContainerRequestContext containerRequestContext) {
+ String headerParamBearerToken = containerRequestContext.getHeaderString(HttpHeaders.AUTHORIZATION);
+ return extractBearerTokenFromHeaderParam(headerParamBearerToken);
}
-}
\ No newline at end of file
+}
diff --git a/src/main/java/edu/harvard/iq/dataverse/api/auth/CompoundAuthMechanism.java b/src/main/java/edu/harvard/iq/dataverse/api/auth/CompoundAuthMechanism.java
index 801e2752b9e..e5be5144897 100644
--- a/src/main/java/edu/harvard/iq/dataverse/api/auth/CompoundAuthMechanism.java
+++ b/src/main/java/edu/harvard/iq/dataverse/api/auth/CompoundAuthMechanism.java
@@ -5,6 +5,7 @@
import jakarta.inject.Inject;
import jakarta.ws.rs.container.ContainerRequestContext;
+
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
@@ -19,9 +20,9 @@ public class CompoundAuthMechanism implements AuthMechanism {
private final List authMechanisms = new ArrayList<>();
@Inject
- public CompoundAuthMechanism(ApiKeyAuthMechanism apiKeyAuthMechanism, WorkflowKeyAuthMechanism workflowKeyAuthMechanism, SignedUrlAuthMechanism signedUrlAuthMechanism, SessionCookieAuthMechanism sessionCookieAuthMechanism, BearerTokenAuthMechanism bearerTokenAuthMechanism) {
+ public CompoundAuthMechanism(ApiKeyAuthMechanism apiKeyAuthMechanism, WorkflowKeyAuthMechanism workflowKeyAuthMechanism, SignedUrlAuthMechanism signedUrlAuthMechanism, BearerTokenAuthMechanism bearerTokenAuthMechanism, SessionCookieAuthMechanism sessionCookieAuthMechanism) {
// Auth mechanisms should be ordered by priority here
- add(apiKeyAuthMechanism, workflowKeyAuthMechanism, signedUrlAuthMechanism, sessionCookieAuthMechanism,bearerTokenAuthMechanism);
+ add(apiKeyAuthMechanism, workflowKeyAuthMechanism, signedUrlAuthMechanism, bearerTokenAuthMechanism, sessionCookieAuthMechanism);
}
public CompoundAuthMechanism(AuthMechanism... authMechanisms) {
diff --git a/src/main/java/edu/harvard/iq/dataverse/api/auth/SignedUrlAuthMechanism.java b/src/main/java/edu/harvard/iq/dataverse/api/auth/SignedUrlAuthMechanism.java
index 258661f6495..30e8a3b9ca4 100644
--- a/src/main/java/edu/harvard/iq/dataverse/api/auth/SignedUrlAuthMechanism.java
+++ b/src/main/java/edu/harvard/iq/dataverse/api/auth/SignedUrlAuthMechanism.java
@@ -43,7 +43,7 @@ public User findUserFromRequest(ContainerRequestContext containerRequestContext)
if (user != null) {
return user;
}
- throw new WrappedAuthErrorResponse(RESPONSE_MESSAGE_BAD_SIGNED_URL);
+ throw new WrappedUnauthorizedAuthErrorResponse(RESPONSE_MESSAGE_BAD_SIGNED_URL);
}
private String getSignedUrlRequestParameter(ContainerRequestContext containerRequestContext) {
diff --git a/src/main/java/edu/harvard/iq/dataverse/api/auth/WorkflowKeyAuthMechanism.java b/src/main/java/edu/harvard/iq/dataverse/api/auth/WorkflowKeyAuthMechanism.java
index bbd67713e85..df54b69af96 100644
--- a/src/main/java/edu/harvard/iq/dataverse/api/auth/WorkflowKeyAuthMechanism.java
+++ b/src/main/java/edu/harvard/iq/dataverse/api/auth/WorkflowKeyAuthMechanism.java
@@ -30,7 +30,7 @@ public User findUserFromRequest(ContainerRequestContext containerRequestContext)
if (authUser != null) {
return authUser;
}
- throw new WrappedAuthErrorResponse(RESPONSE_MESSAGE_BAD_WORKFLOW_KEY);
+ throw new WrappedUnauthorizedAuthErrorResponse(RESPONSE_MESSAGE_BAD_WORKFLOW_KEY);
}
private String getRequestWorkflowKey(ContainerRequestContext containerRequestContext) {
diff --git a/src/main/java/edu/harvard/iq/dataverse/api/auth/WrappedAuthErrorResponse.java b/src/main/java/edu/harvard/iq/dataverse/api/auth/WrappedAuthErrorResponse.java
index 40431557261..da92d882197 100644
--- a/src/main/java/edu/harvard/iq/dataverse/api/auth/WrappedAuthErrorResponse.java
+++ b/src/main/java/edu/harvard/iq/dataverse/api/auth/WrappedAuthErrorResponse.java
@@ -6,18 +6,24 @@
import jakarta.ws.rs.core.MediaType;
import jakarta.ws.rs.core.Response;
-public class WrappedAuthErrorResponse extends Exception {
+public abstract class WrappedAuthErrorResponse extends Exception {
private final String message;
private final Response response;
- public WrappedAuthErrorResponse(String message) {
+ public WrappedAuthErrorResponse(Response.Status status, String message) {
this.message = message;
- this.response = Response.status(Response.Status.UNAUTHORIZED)
+ this.response = createErrorResponse(status, message);
+ }
+
+ protected Response createErrorResponse(Response.Status status, String message) {
+ return Response.status(status)
.entity(NullSafeJsonBuilder.jsonObjectBuilder()
.add("status", ApiConstants.STATUS_ERROR)
.add("message", message).build()
- ).type(MediaType.APPLICATION_JSON_TYPE).build();
+ )
+ .type(MediaType.APPLICATION_JSON_TYPE)
+ .build();
}
public String getMessage() {
diff --git a/src/main/java/edu/harvard/iq/dataverse/api/auth/WrappedForbiddenAuthErrorResponse.java b/src/main/java/edu/harvard/iq/dataverse/api/auth/WrappedForbiddenAuthErrorResponse.java
new file mode 100644
index 00000000000..082ed3ca8d8
--- /dev/null
+++ b/src/main/java/edu/harvard/iq/dataverse/api/auth/WrappedForbiddenAuthErrorResponse.java
@@ -0,0 +1,10 @@
+package edu.harvard.iq.dataverse.api.auth;
+
+import jakarta.ws.rs.core.Response;
+
+public class WrappedForbiddenAuthErrorResponse extends WrappedAuthErrorResponse {
+
+ public WrappedForbiddenAuthErrorResponse(String message) {
+ super(Response.Status.FORBIDDEN, message);
+ }
+}
diff --git a/src/main/java/edu/harvard/iq/dataverse/api/auth/WrappedUnauthorizedAuthErrorResponse.java b/src/main/java/edu/harvard/iq/dataverse/api/auth/WrappedUnauthorizedAuthErrorResponse.java
new file mode 100644
index 00000000000..1d2eb8f8bd8
--- /dev/null
+++ b/src/main/java/edu/harvard/iq/dataverse/api/auth/WrappedUnauthorizedAuthErrorResponse.java
@@ -0,0 +1,10 @@
+package edu.harvard.iq.dataverse.api.auth;
+
+import jakarta.ws.rs.core.Response;
+
+public class WrappedUnauthorizedAuthErrorResponse extends WrappedAuthErrorResponse {
+
+ public WrappedUnauthorizedAuthErrorResponse(String message) {
+ super(Response.Status.UNAUTHORIZED, message);
+ }
+}
diff --git a/src/main/java/edu/harvard/iq/dataverse/api/dto/UserDTO.java b/src/main/java/edu/harvard/iq/dataverse/api/dto/UserDTO.java
new file mode 100644
index 00000000000..df1920c4d25
--- /dev/null
+++ b/src/main/java/edu/harvard/iq/dataverse/api/dto/UserDTO.java
@@ -0,0 +1,67 @@
+package edu.harvard.iq.dataverse.api.dto;
+
+public class UserDTO {
+ private String username;
+ private String firstName;
+ private String lastName;
+ private String emailAddress;
+ private String affiliation;
+ private String position;
+ private boolean termsAccepted;
+
+ public String getUsername() {
+ return username;
+ }
+
+ public void setUsername(String username) {
+ this.username = username;
+ }
+
+ public String getFirstName() {
+ return firstName;
+ }
+
+ public void setFirstName(String firstName) {
+ this.firstName = firstName;
+ }
+
+ public String getLastName() {
+ return lastName;
+ }
+
+ public void setLastName(String lastName) {
+ this.lastName = lastName;
+ }
+
+ public String getEmailAddress() {
+ return emailAddress;
+ }
+
+ public void setEmailAddress(String emailAddress) {
+ this.emailAddress = emailAddress;
+ }
+
+ public String getAffiliation() {
+ return affiliation;
+ }
+
+ public void setAffiliation(String affiliation) {
+ this.affiliation = affiliation;
+ }
+
+ public String getPosition() {
+ return position;
+ }
+
+ public void setPosition(String position) {
+ this.position = position;
+ }
+
+ public boolean isTermsAccepted() {
+ return termsAccepted;
+ }
+
+ public void setTermsAccepted(boolean termsAccepted) {
+ this.termsAccepted = termsAccepted;
+ }
+}
diff --git a/src/main/java/edu/harvard/iq/dataverse/api/imports/ImportDDIServiceBean.java b/src/main/java/edu/harvard/iq/dataverse/api/imports/ImportDDIServiceBean.java
index 35d35316f73..31941d3c8c0 100644
--- a/src/main/java/edu/harvard/iq/dataverse/api/imports/ImportDDIServiceBean.java
+++ b/src/main/java/edu/harvard/iq/dataverse/api/imports/ImportDDIServiceBean.java
@@ -5,13 +5,21 @@
import edu.harvard.iq.dataverse.DatasetFieldType;
import edu.harvard.iq.dataverse.DatasetVersion;
import edu.harvard.iq.dataverse.DatasetVersion.VersionState;
-import edu.harvard.iq.dataverse.api.dto.*;
+import edu.harvard.iq.dataverse.api.dto.LicenseDTO;
import edu.harvard.iq.dataverse.api.dto.FieldDTO;
import edu.harvard.iq.dataverse.api.dto.MetadataBlockDTO;
+import edu.harvard.iq.dataverse.api.dto.DatasetDTO;
+import edu.harvard.iq.dataverse.api.dto.DatasetVersionDTO;
+import edu.harvard.iq.dataverse.api.dto.FileMetadataDTO;
+import edu.harvard.iq.dataverse.api.dto.DataFileDTO;
+import edu.harvard.iq.dataverse.api.dto.DataTableDTO;
+
import edu.harvard.iq.dataverse.api.imports.ImportUtil.ImportType;
import static edu.harvard.iq.dataverse.export.ddi.DdiExportUtil.NOTE_TYPE_CONTENTTYPE;
import static edu.harvard.iq.dataverse.export.ddi.DdiExportUtil.NOTE_TYPE_TERMS_OF_ACCESS;
+import edu.harvard.iq.dataverse.license.License;
+import edu.harvard.iq.dataverse.license.LicenseServiceBean;
import edu.harvard.iq.dataverse.util.StringUtil;
import java.io.File;
import java.io.FileInputStream;
@@ -32,6 +40,9 @@
import org.apache.commons.lang3.StringUtils;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
/**
*
* @author ellenk
@@ -103,6 +114,8 @@ public class ImportDDIServiceBean {
@EJB DatasetFieldServiceBean datasetFieldService;
@EJB ImportGenericServiceBean importGenericService;
+
+ @EJB LicenseServiceBean licenseService;
// TODO: stop passing the xml source as a string; (it could be huge!) -- L.A. 4.5
@@ -1180,7 +1193,24 @@ private void processDataAccs(XMLStreamReader xmlr, DatasetVersionDTO dvDTO) thro
String noteType = xmlr.getAttributeValue(null, "type");
if (NOTE_TYPE_TERMS_OF_USE.equalsIgnoreCase(noteType) ) {
if ( LEVEL_DV.equalsIgnoreCase(xmlr.getAttributeValue(null, "level"))) {
- dvDTO.setTermsOfUse(parseText(xmlr, "notes"));
+ String termsOfUseStr = parseText(xmlr, "notes").trim();
+ Pattern pattern = Pattern.compile("(.*)", Pattern.CASE_INSENSITIVE);
+ Matcher matcher = pattern.matcher(termsOfUseStr);
+ boolean matchFound = matcher.find();
+ if (matchFound) {
+ String uri = matcher.group(1);
+ String license = matcher.group(2);
+ License lic = licenseService.getByNameOrUri(license);
+ if (lic != null) {
+ LicenseDTO licenseDTO = new LicenseDTO();
+ licenseDTO.setName(license);
+ licenseDTO.setUri(uri);
+ dvDTO.setLicense(licenseDTO);
+ }
+
+ } else {
+ dvDTO.setTermsOfUse(termsOfUseStr);
+ }
}
} else if (NOTE_TYPE_TERMS_OF_ACCESS.equalsIgnoreCase(noteType) ) {
if (LEVEL_DV.equalsIgnoreCase(xmlr.getAttributeValue(null, "level"))) {
diff --git a/src/main/java/edu/harvard/iq/dataverse/authorization/AuthenticationServiceBean.java b/src/main/java/edu/harvard/iq/dataverse/authorization/AuthenticationServiceBean.java
index 4a8fb123fd4..032c1dd5164 100644
--- a/src/main/java/edu/harvard/iq/dataverse/authorization/AuthenticationServiceBean.java
+++ b/src/main/java/edu/harvard/iq/dataverse/authorization/AuthenticationServiceBean.java
@@ -1,11 +1,18 @@
package edu.harvard.iq.dataverse.authorization;
+import com.nimbusds.oauth2.sdk.ParseException;
+import com.nimbusds.oauth2.sdk.token.BearerAccessToken;
+import com.nimbusds.openid.connect.sdk.claims.UserInfo;
import edu.harvard.iq.dataverse.DatasetVersionServiceBean;
import edu.harvard.iq.dataverse.DvObjectServiceBean;
import edu.harvard.iq.dataverse.GuestbookResponseServiceBean;
import edu.harvard.iq.dataverse.RoleAssigneeServiceBean;
import edu.harvard.iq.dataverse.UserNotificationServiceBean;
import edu.harvard.iq.dataverse.UserServiceBean;
+import edu.harvard.iq.dataverse.authorization.exceptions.AuthorizationException;
+import edu.harvard.iq.dataverse.authorization.providers.oauth2.OAuth2Exception;
+import edu.harvard.iq.dataverse.authorization.providers.oauth2.OAuth2UserRecord;
+import edu.harvard.iq.dataverse.authorization.providers.oauth2.oidc.OIDCAuthProvider;
import edu.harvard.iq.dataverse.search.IndexServiceBean;
import edu.harvard.iq.dataverse.actionlogging.ActionLogRecord;
import edu.harvard.iq.dataverse.actionlogging.ActionLogServiceBean;
@@ -34,21 +41,14 @@
import edu.harvard.iq.dataverse.validation.PasswordValidatorServiceBean;
import edu.harvard.iq.dataverse.workflow.PendingWorkflowInvocation;
import edu.harvard.iq.dataverse.workflows.WorkflowComment;
+
+import java.io.IOException;
import java.sql.Timestamp;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Calendar;
-import java.util.Collection;
-import java.util.Date;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.TreeSet;
+import java.util.*;
import java.util.logging.Level;
import java.util.logging.Logger;
import java.util.stream.Collectors;
-import jakarta.annotation.PostConstruct;
+
import jakarta.ejb.EJB;
import jakarta.ejb.EJBException;
import jakarta.ejb.Stateless;
@@ -126,9 +126,8 @@ public class AuthenticationServiceBean {
PrivateUrlServiceBean privateUrlService;
@PersistenceContext(unitName = "VDCNet-ejbPU")
- private EntityManager em;
-
-
+ EntityManager em;
+
public AbstractOAuth2AuthenticationProvider getOAuth2Provider( String id ) {
return authProvidersRegistrationService.getOAuth2AuthProvidersMap().get(id);
}
@@ -978,4 +977,70 @@ public ApiToken getValidApiTokenForUser(User user) {
}
return apiToken;
}
+
+ /**
+ * Looks up an authenticated user based on the provided OIDC bearer token.
+ *
+ * @param bearerToken The OIDC bearer token.
+ * @return An instance of {@link AuthenticatedUser} representing the authenticated user.
+ * @throws AuthorizationException If the token is invalid or no OIDC provider is configured.
+ */
+ public AuthenticatedUser lookupUserByOIDCBearerToken(String bearerToken) throws AuthorizationException {
+ // TODO: Get the identifier from an invalidating cache to avoid lookup bursts of the same token.
+ // Tokens in the cache should be removed after some (configurable) time.
+ OAuth2UserRecord oAuth2UserRecord = verifyOIDCBearerTokenAndGetOAuth2UserRecord(bearerToken);
+ return lookupUser(oAuth2UserRecord.getUserRecordIdentifier());
+ }
+
+ /**
+ * Verifies the given OIDC bearer token and retrieves the corresponding OAuth2UserRecord.
+ *
+ * @param bearerToken The OIDC bearer token.
+ * @return An {@link OAuth2UserRecord} containing the user's info.
+ * @throws AuthorizationException If the token is invalid or if no OIDC providers are available.
+ */
+ public OAuth2UserRecord verifyOIDCBearerTokenAndGetOAuth2UserRecord(String bearerToken) throws AuthorizationException {
+ try {
+ BearerAccessToken accessToken = BearerAccessToken.parse(bearerToken);
+ List providers = getAvailableOidcProviders();
+
+ // Ensure at least one OIDC provider is configured to validate the token.
+ if (providers.isEmpty()) {
+ logger.log(Level.WARNING, "Bearer token detected, no OIDC provider configured");
+ throw new AuthorizationException(BundleUtil.getStringFromBundle("authenticationServiceBean.errors.bearerTokenDetectedNoOIDCProviderConfigured"));
+ }
+
+ // Attempt to validate the token with each configured OIDC provider.
+ for (OIDCAuthProvider provider : providers) {
+ try {
+ // Retrieve OAuth2UserRecord if UserInfo is present
+ Optional userInfo = provider.getUserInfo(accessToken);
+ if (userInfo.isPresent()) {
+ logger.log(Level.FINE, "Bearer token detected, provider {0} confirmed validity and provided user info", provider.getId());
+ return provider.getUserRecord(userInfo.get());
+ }
+ } catch (IOException | OAuth2Exception e) {
+ logger.log(Level.FINE, "Bearer token detected, provider " + provider.getId() + " indicates an invalid Token, skipping", e);
+ }
+ }
+ } catch (ParseException e) {
+ logger.log(Level.FINE, "Bearer token detected, unable to parse bearer token (invalid Token)", e);
+ throw new AuthorizationException(BundleUtil.getStringFromBundle("authenticationServiceBean.errors.invalidBearerToken"));
+ }
+
+ // If no provider validated the token, throw an authorization exception.
+ logger.log(Level.FINE, "Bearer token detected, yet no configured OIDC provider validated it.");
+ throw new AuthorizationException(BundleUtil.getStringFromBundle("authenticationServiceBean.errors.unauthorizedBearerToken"));
+ }
+
+ /**
+ * Retrieves a list of configured OIDC authentication providers.
+ *
+ * @return A list of available OIDCAuthProviders.
+ */
+ private List getAvailableOidcProviders() {
+ return getAuthenticationProviderIdsOfType(OIDCAuthProvider.class).stream()
+ .map(providerId -> (OIDCAuthProvider) getAuthenticationProvider(providerId))
+ .toList();
+ }
}
diff --git a/src/main/java/edu/harvard/iq/dataverse/authorization/providers/oauth2/oidc/OIDCAuthProvider.java b/src/main/java/edu/harvard/iq/dataverse/authorization/providers/oauth2/oidc/OIDCAuthProvider.java
index 5eb2b391eb7..f396ebf6487 100644
--- a/src/main/java/edu/harvard/iq/dataverse/authorization/providers/oauth2/oidc/OIDCAuthProvider.java
+++ b/src/main/java/edu/harvard/iq/dataverse/authorization/providers/oauth2/oidc/OIDCAuthProvider.java
@@ -242,7 +242,7 @@ public OAuth2UserRecord getUserRecord(String code, String state, String redirect
* @param userInfo
* @return the usable user record for processing ing {@link edu.harvard.iq.dataverse.authorization.providers.oauth2.OAuth2LoginBackingBean}
*/
- OAuth2UserRecord getUserRecord(UserInfo userInfo) {
+ public OAuth2UserRecord getUserRecord(UserInfo userInfo) {
return new OAuth2UserRecord(
this.getId(),
userInfo.getSubject().getValue(),
@@ -291,7 +291,7 @@ Optional getAccessToken(AuthorizationGrant grant) throws IOEx
* Retrieve User Info from provider. Encapsulate for testing.
* @param accessToken The access token to enable reading data from userinfo endpoint
*/
- Optional getUserInfo(BearerAccessToken accessToken) throws IOException, OAuth2Exception {
+ public Optional getUserInfo(BearerAccessToken accessToken) throws IOException, OAuth2Exception {
// Retrieve data
HTTPResponse response = new UserInfoRequest(this.idpMetadata.getUserInfoEndpointURI(), accessToken)
.toHTTPRequest()
@@ -316,44 +316,4 @@ Optional getUserInfo(BearerAccessToken accessToken) throws IOException
throw new OAuth2Exception(-1, ex.getMessage(), BundleUtil.getStringFromBundle("auth.providers.exception.userinfo", Arrays.asList(this.getTitle())));
}
}
-
- /**
- * Trades an access token for an {@link UserRecordIdentifier} (if valid).
- *
- * @apiNote The resulting {@link UserRecordIdentifier} may be used with
- * {@link edu.harvard.iq.dataverse.authorization.AuthenticationServiceBean#lookupUser(UserRecordIdentifier)}
- * to look up an {@link edu.harvard.iq.dataverse.authorization.users.AuthenticatedUser} from the database.
- * @see edu.harvard.iq.dataverse.api.auth.BearerTokenAuthMechanism
- *
- * @param accessToken The token to use when requesting user information from the provider
- * @return Returns an {@link UserRecordIdentifier} for a valid access token or an empty {@link Optional}.
- * @throws IOException In case communication with the endpoint fails to succeed for an I/O reason
- */
- public Optional getUserIdentifier(BearerAccessToken accessToken) throws IOException {
- OAuth2UserRecord userRecord;
- try {
- // Try to retrieve with given token (throws if invalid token)
- Optional userInfo = getUserInfo(accessToken);
-
- if (userInfo.isPresent()) {
- // Take this detour to avoid code duplication and potentially hard to track conversion errors.
- userRecord = getUserRecord(userInfo.get());
- } else {
- // This should not happen - an error at the provider side will lead to an exception.
- logger.log(Level.WARNING,
- "User info retrieval from {0} returned empty optional but expected exception for token {1}.",
- List.of(getId(), accessToken).toArray()
- );
- return Optional.empty();
- }
- } catch (OAuth2Exception e) {
- logger.log(Level.FINE,
- "Could not retrieve user info with token {0} at provider {1}: {2}",
- List.of(accessToken, getId(), e.getMessage()).toArray());
- logger.log(Level.FINER, "Retrieval failed, details as follows: ", e);
- return Optional.empty();
- }
-
- return Optional.of(userRecord.getUserRecordIdentifier());
- }
}
diff --git a/src/main/java/edu/harvard/iq/dataverse/engine/command/exception/InvalidFieldsCommandException.java b/src/main/java/edu/harvard/iq/dataverse/engine/command/exception/InvalidFieldsCommandException.java
new file mode 100644
index 00000000000..9bd1869f8a9
--- /dev/null
+++ b/src/main/java/edu/harvard/iq/dataverse/engine/command/exception/InvalidFieldsCommandException.java
@@ -0,0 +1,42 @@
+package edu.harvard.iq.dataverse.engine.command.exception;
+
+import edu.harvard.iq.dataverse.engine.command.Command;
+import java.util.Map;
+
+public class InvalidFieldsCommandException extends CommandException {
+
+ private final Map fieldErrors;
+
+ /**
+ * Constructs a new InvalidFieldsCommandException with the specified detail message,
+ * command, and a map of field errors.
+ *
+ * @param message The detail message.
+ * @param aCommand The command where the exception was encountered.
+ * @param fieldErrors A map containing the fields as keys and the reasons for their errors as values.
+ */
+ public InvalidFieldsCommandException(String message, Command aCommand, Map fieldErrors) {
+ super(message, aCommand);
+ this.fieldErrors = fieldErrors;
+ }
+
+ /**
+ * Gets the map of fields and their corresponding error messages.
+ *
+ * @return The map of field errors.
+ */
+ public Map getFieldErrors() {
+ return fieldErrors;
+ }
+
+ /**
+ * Returns a string representation of this exception, including the
+ * message and details of the invalid fields and their errors.
+ *
+ * @return A string representation of this exception.
+ */
+ @Override
+ public String toString() {
+ return super.toString() + ", fieldErrors=" + fieldErrors;
+ }
+}
diff --git a/src/main/java/edu/harvard/iq/dataverse/engine/command/exception/PermissionException.java b/src/main/java/edu/harvard/iq/dataverse/engine/command/exception/PermissionException.java
index a7881fc7b6e..2ca63c9c4aa 100644
--- a/src/main/java/edu/harvard/iq/dataverse/engine/command/exception/PermissionException.java
+++ b/src/main/java/edu/harvard/iq/dataverse/engine/command/exception/PermissionException.java
@@ -3,6 +3,7 @@
import edu.harvard.iq.dataverse.DvObject;
import edu.harvard.iq.dataverse.authorization.Permission;
import edu.harvard.iq.dataverse.engine.command.Command;
+
import java.util.Set;
/**
@@ -12,22 +13,31 @@
* @author michael
*/
public class PermissionException extends CommandException {
-
- private final Set required;
- private final DvObject dvObject;
-
- public PermissionException(String message, Command failedCommand, Set required, DvObject aDvObject ) {
- super(message, failedCommand);
- this.required = required;
- dvObject = aDvObject;
- }
-
- public Set getRequiredPermissions() {
- return required;
- }
-
- public DvObject getDvObject() {
- return dvObject;
- }
-
+
+ private final Set required;
+ private final DvObject dvObject;
+ private final boolean isDetailedMessageRequired;
+
+ public PermissionException(String message, Command failedCommand, Set required, DvObject dvObject, boolean isDetailedMessageRequired) {
+ super(message, failedCommand);
+ this.required = required;
+ this.dvObject = dvObject;
+ this.isDetailedMessageRequired = isDetailedMessageRequired;
+ }
+
+ public PermissionException(String message, Command failedCommand, Set required, DvObject dvObject) {
+ this(message, failedCommand, required, dvObject, false);
+ }
+
+ public Set getRequiredPermissions() {
+ return required;
+ }
+
+ public DvObject getDvObject() {
+ return dvObject;
+ }
+
+ public boolean isDetailedMessageRequired() {
+ return isDetailedMessageRequired;
+ }
}
diff --git a/src/main/java/edu/harvard/iq/dataverse/engine/command/impl/RegisterOIDCUserCommand.java b/src/main/java/edu/harvard/iq/dataverse/engine/command/impl/RegisterOIDCUserCommand.java
new file mode 100644
index 00000000000..c7745c75aa9
--- /dev/null
+++ b/src/main/java/edu/harvard/iq/dataverse/engine/command/impl/RegisterOIDCUserCommand.java
@@ -0,0 +1,204 @@
+package edu.harvard.iq.dataverse.engine.command.impl;
+
+import edu.harvard.iq.dataverse.DvObject;
+import edu.harvard.iq.dataverse.api.dto.UserDTO;
+import edu.harvard.iq.dataverse.authorization.AuthenticatedUserDisplayInfo;
+import edu.harvard.iq.dataverse.authorization.UserRecordIdentifier;
+import edu.harvard.iq.dataverse.authorization.exceptions.AuthorizationException;
+import edu.harvard.iq.dataverse.authorization.providers.oauth2.OAuth2UserRecord;
+import edu.harvard.iq.dataverse.engine.command.*;
+import edu.harvard.iq.dataverse.engine.command.exception.CommandException;
+import edu.harvard.iq.dataverse.engine.command.exception.IllegalCommandException;
+import edu.harvard.iq.dataverse.engine.command.exception.PermissionException;
+import edu.harvard.iq.dataverse.engine.command.exception.InvalidFieldsCommandException;
+import edu.harvard.iq.dataverse.settings.FeatureFlags;
+import edu.harvard.iq.dataverse.util.BundleUtil;
+
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+@RequiredPermissions({})
+public class RegisterOIDCUserCommand extends AbstractVoidCommand {
+
+ private static final String FIELD_USERNAME = "username";
+ private static final String FIELD_FIRST_NAME = "firstName";
+ private static final String FIELD_LAST_NAME = "lastName";
+ private static final String FIELD_EMAIL_ADDRESS = "emailAddress";
+ private static final String FIELD_TERMS_ACCEPTED = "termsAccepted";
+
+ private final String bearerToken;
+ private final UserDTO userDTO;
+
+ public RegisterOIDCUserCommand(DataverseRequest aRequest, String bearerToken, UserDTO userDTO) {
+ super(aRequest, (DvObject) null);
+ this.bearerToken = bearerToken;
+ this.userDTO = userDTO;
+ }
+
+ @Override
+ protected void executeImpl(CommandContext ctxt) throws CommandException {
+ try {
+ OAuth2UserRecord oAuth2UserRecord = ctxt.authentication().verifyOIDCBearerTokenAndGetOAuth2UserRecord(bearerToken);
+ UserRecordIdentifier userRecordIdentifier = oAuth2UserRecord.getUserRecordIdentifier();
+
+ if (ctxt.authentication().lookupUser(userRecordIdentifier) != null) {
+ throw new IllegalCommandException(BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.userAlreadyRegisteredWithToken"), this);
+ }
+
+ boolean provideMissingClaimsEnabled = FeatureFlags.API_BEARER_AUTH_PROVIDE_MISSING_CLAIMS.enabled();
+
+ updateUserDTO(oAuth2UserRecord, provideMissingClaimsEnabled);
+
+ AuthenticatedUserDisplayInfo userDisplayInfo = new AuthenticatedUserDisplayInfo(
+ userDTO.getFirstName(),
+ userDTO.getLastName(),
+ userDTO.getEmailAddress(),
+ userDTO.getAffiliation() != null ? userDTO.getAffiliation() : "",
+ userDTO.getPosition() != null ? userDTO.getPosition() : ""
+ );
+
+ validateUserFields(ctxt, provideMissingClaimsEnabled);
+
+ ctxt.authentication().createAuthenticatedUser(userRecordIdentifier, userDTO.getUsername(), userDisplayInfo, true);
+
+ } catch (AuthorizationException ex) {
+ throw new PermissionException(ex.getMessage(), this, null, null, true);
+ }
+ }
+
+ private void updateUserDTO(OAuth2UserRecord oAuth2UserRecord, boolean provideMissingClaimsEnabled) throws InvalidFieldsCommandException {
+ if (provideMissingClaimsEnabled) {
+ Map fieldErrors = validateConflictingClaims(oAuth2UserRecord);
+ throwInvalidFieldsCommandExceptionIfErrorsExist(fieldErrors);
+ updateUserDTOWithClaims(oAuth2UserRecord);
+ } else {
+ Map fieldErrors = validateUserDTOHasNoClaims();
+ throwInvalidFieldsCommandExceptionIfErrorsExist(fieldErrors);
+ overwriteUserDTOWithClaims(oAuth2UserRecord);
+ }
+ }
+
+ private Map validateConflictingClaims(OAuth2UserRecord oAuth2UserRecord) {
+ Map fieldErrors = new HashMap<>();
+
+ addFieldErrorIfConflict(FIELD_USERNAME, oAuth2UserRecord.getUsername(), userDTO.getUsername(), fieldErrors);
+ addFieldErrorIfConflict(FIELD_FIRST_NAME, oAuth2UserRecord.getDisplayInfo().getFirstName(), userDTO.getFirstName(), fieldErrors);
+ addFieldErrorIfConflict(FIELD_LAST_NAME, oAuth2UserRecord.getDisplayInfo().getLastName(), userDTO.getLastName(), fieldErrors);
+ addFieldErrorIfConflict(FIELD_EMAIL_ADDRESS, oAuth2UserRecord.getDisplayInfo().getEmailAddress(), userDTO.getEmailAddress(), fieldErrors);
+
+ return fieldErrors;
+ }
+
+ private void addFieldErrorIfConflict(String fieldName, String claimValue, String existingValue, Map fieldErrors) {
+ if (claimValue != null && !claimValue.trim().isEmpty() && existingValue != null && !claimValue.equals(existingValue)) {
+ String errorMessage = BundleUtil.getStringFromBundle(
+ "registerOidcUserCommand.errors.provideMissingClaimsEnabled.fieldAlreadyPresentInProvider",
+ List.of(fieldName)
+ );
+ fieldErrors.put(fieldName, errorMessage);
+ }
+ }
+
+ private Map validateUserDTOHasNoClaims() {
+ Map fieldErrors = new HashMap<>();
+ if (userDTO.getUsername() != null) {
+ String errorMessage = BundleUtil.getStringFromBundle(
+ "registerOidcUserCommand.errors.provideMissingClaimsDisabled.unableToSetFieldViaJSON",
+ List.of(FIELD_USERNAME)
+ );
+ fieldErrors.put(FIELD_USERNAME, errorMessage);
+ }
+ if (userDTO.getEmailAddress() != null) {
+ String errorMessage = BundleUtil.getStringFromBundle(
+ "registerOidcUserCommand.errors.provideMissingClaimsDisabled.unableToSetFieldViaJSON",
+ List.of(FIELD_EMAIL_ADDRESS)
+ );
+ fieldErrors.put(FIELD_EMAIL_ADDRESS, errorMessage);
+ }
+ if (userDTO.getFirstName() != null) {
+ String errorMessage = BundleUtil.getStringFromBundle(
+ "registerOidcUserCommand.errors.provideMissingClaimsDisabled.unableToSetFieldViaJSON",
+ List.of(FIELD_FIRST_NAME)
+ );
+ fieldErrors.put(FIELD_FIRST_NAME, errorMessage);
+ }
+ if (userDTO.getLastName() != null) {
+ String errorMessage = BundleUtil.getStringFromBundle(
+ "registerOidcUserCommand.errors.provideMissingClaimsDisabled.unableToSetFieldViaJSON",
+ List.of(FIELD_LAST_NAME)
+ );
+ fieldErrors.put(FIELD_LAST_NAME, errorMessage);
+ }
+ return fieldErrors;
+ }
+
+ private void updateUserDTOWithClaims(OAuth2UserRecord oAuth2UserRecord) {
+ userDTO.setUsername(getValueOrDefault(oAuth2UserRecord.getUsername(), userDTO.getUsername()));
+ userDTO.setFirstName(getValueOrDefault(oAuth2UserRecord.getDisplayInfo().getFirstName(), userDTO.getFirstName()));
+ userDTO.setLastName(getValueOrDefault(oAuth2UserRecord.getDisplayInfo().getLastName(), userDTO.getLastName()));
+ userDTO.setEmailAddress(getValueOrDefault(oAuth2UserRecord.getDisplayInfo().getEmailAddress(), userDTO.getEmailAddress()));
+ }
+
+ private void overwriteUserDTOWithClaims(OAuth2UserRecord oAuth2UserRecord) {
+ userDTO.setUsername(oAuth2UserRecord.getUsername());
+ userDTO.setFirstName(oAuth2UserRecord.getDisplayInfo().getFirstName());
+ userDTO.setLastName(oAuth2UserRecord.getDisplayInfo().getLastName());
+ userDTO.setEmailAddress(oAuth2UserRecord.getDisplayInfo().getEmailAddress());
+ }
+
+ private void throwInvalidFieldsCommandExceptionIfErrorsExist(Map fieldErrors) throws InvalidFieldsCommandException {
+ if (!fieldErrors.isEmpty()) {
+ throw new InvalidFieldsCommandException(
+ BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.invalidFields"),
+ this,
+ fieldErrors
+ );
+ }
+ }
+
+ private String getValueOrDefault(String oidcValue, String dtoValue) {
+ return (oidcValue == null || oidcValue.trim().isEmpty()) ? dtoValue : oidcValue;
+ }
+
+ private void validateUserFields(CommandContext ctxt, boolean provideMissingClaimsEnabled) throws InvalidFieldsCommandException {
+ Map fieldErrors = new HashMap<>();
+
+ if (!FeatureFlags.API_BEARER_AUTH_HANDLE_TOS_ACCEPTANCE_IN_IDP.enabled()) {
+ validateTermsAccepted(fieldErrors);
+ }
+
+ validateField(fieldErrors, FIELD_EMAIL_ADDRESS, userDTO.getEmailAddress(), ctxt, provideMissingClaimsEnabled);
+ validateField(fieldErrors, FIELD_USERNAME, userDTO.getUsername(), ctxt, provideMissingClaimsEnabled);
+ validateField(fieldErrors, FIELD_FIRST_NAME, userDTO.getFirstName(), ctxt, provideMissingClaimsEnabled);
+ validateField(fieldErrors, FIELD_LAST_NAME, userDTO.getLastName(), ctxt, provideMissingClaimsEnabled);
+
+ throwInvalidFieldsCommandExceptionIfErrorsExist(fieldErrors);
+ }
+
+ private void validateTermsAccepted(Map fieldErrors) {
+ if (!userDTO.isTermsAccepted()) {
+ fieldErrors.put(FIELD_TERMS_ACCEPTED, BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.userShouldAcceptTerms"));
+ }
+ }
+
+ private void validateField(Map fieldErrors, String fieldName, String fieldValue, CommandContext ctxt, boolean provideMissingClaimsEnabled) {
+ if (fieldValue == null || fieldValue.isEmpty()) {
+ String errorKey = provideMissingClaimsEnabled ?
+ "registerOidcUserCommand.errors.provideMissingClaimsEnabled.fieldRequired" :
+ "registerOidcUserCommand.errors.provideMissingClaimsDisabled.fieldRequired";
+ fieldErrors.put(fieldName, BundleUtil.getStringFromBundle(errorKey, List.of(fieldName)));
+ } else if (isFieldInUse(ctxt, fieldName, fieldValue)) {
+ fieldErrors.put(fieldName, BundleUtil.getStringFromBundle("registerOidcUserCommand.errors." + fieldName + "InUse"));
+ }
+ }
+
+ private boolean isFieldInUse(CommandContext ctxt, String fieldName, String value) {
+ if (FIELD_EMAIL_ADDRESS.equals(fieldName)) {
+ return ctxt.authentication().getAuthenticatedUserByEmail(value) != null;
+ } else if (FIELD_USERNAME.equals(fieldName)) {
+ return ctxt.authentication().getAuthenticatedUser(value) != null;
+ }
+ return false;
+ }
+}
diff --git a/src/main/java/edu/harvard/iq/dataverse/export/ddi/DdiExportUtil.java b/src/main/java/edu/harvard/iq/dataverse/export/ddi/DdiExportUtil.java
index 05ddbe83e78..8fab6a6704d 100644
--- a/src/main/java/edu/harvard/iq/dataverse/export/ddi/DdiExportUtil.java
+++ b/src/main/java/edu/harvard/iq/dataverse/export/ddi/DdiExportUtil.java
@@ -5,11 +5,13 @@
import edu.harvard.iq.dataverse.ControlledVocabularyValue;
import edu.harvard.iq.dataverse.DatasetFieldConstant;
import edu.harvard.iq.dataverse.DvObjectContainer;
+import edu.harvard.iq.dataverse.api.dto.MetadataBlockDTO;
import edu.harvard.iq.dataverse.api.dto.DatasetDTO;
import edu.harvard.iq.dataverse.api.dto.DatasetVersionDTO;
-import edu.harvard.iq.dataverse.api.dto.FieldDTO;
import edu.harvard.iq.dataverse.api.dto.FileDTO;
-import edu.harvard.iq.dataverse.api.dto.MetadataBlockDTO;
+import edu.harvard.iq.dataverse.api.dto.FieldDTO;
+import edu.harvard.iq.dataverse.api.dto.LicenseDTO;
+
import static edu.harvard.iq.dataverse.export.DDIExportServiceBean.LEVEL_FILE;
import static edu.harvard.iq.dataverse.export.DDIExportServiceBean.NOTE_SUBJECT_TAG;
@@ -313,8 +315,16 @@ private static void writeDataAccess(XMLStreamWriter xmlw , DatasetVersionDTO ver
XmlWriterUtil.writeFullElement(xmlw, "conditions", version.getConditions());
XmlWriterUtil.writeFullElement(xmlw, "disclaimer", version.getDisclaimer());
xmlw.writeEndElement(); //useStmt
-
+
/* any s: */
+ if (version.getTermsOfUse() != null && !version.getTermsOfUse().trim().equals("")) {
+ xmlw.writeStartElement("notes");
+ xmlw.writeAttribute("type", NOTE_TYPE_TERMS_OF_USE);
+ xmlw.writeAttribute("level", LEVEL_DV);
+ xmlw.writeCharacters(version.getTermsOfUse());
+ xmlw.writeEndElement(); //notes
+ }
+
if (version.getTermsOfAccess() != null && !version.getTermsOfAccess().trim().equals("")) {
xmlw.writeStartElement("notes");
xmlw.writeAttribute("type", NOTE_TYPE_TERMS_OF_ACCESS);
@@ -322,6 +332,19 @@ private static void writeDataAccess(XMLStreamWriter xmlw , DatasetVersionDTO ver
xmlw.writeCharacters(version.getTermsOfAccess());
xmlw.writeEndElement(); //notes
}
+
+ LicenseDTO license = version.getLicense();
+ if (license != null) {
+ String name = license.getName();
+ String uri = license.getUri();
+ if ((name != null && !name.trim().equals("")) && (uri != null && !uri.trim().equals(""))) {
+ xmlw.writeStartElement("notes");
+ xmlw.writeAttribute("type", NOTE_TYPE_TERMS_OF_USE);
+ xmlw.writeAttribute("level", LEVEL_DV);
+ xmlw.writeCharacters("" + name + "");
+ xmlw.writeEndElement(); //notes
+ }
+ }
xmlw.writeEndElement(); //dataAccs
}
diff --git a/src/main/java/edu/harvard/iq/dataverse/search/IndexServiceBean.java b/src/main/java/edu/harvard/iq/dataverse/search/IndexServiceBean.java
index 4efd339ee46..9b7998b0a8e 100644
--- a/src/main/java/edu/harvard/iq/dataverse/search/IndexServiceBean.java
+++ b/src/main/java/edu/harvard/iq/dataverse/search/IndexServiceBean.java
@@ -1325,7 +1325,8 @@ public SolrInputDocuments toSolrDocs(IndexableDataset indexableDataset, Set variables = fileMetadata.getDataFile().getDataTable().getDataVariables();
+ Long observations = fileMetadata.getDataFile().getDataTable().getCaseQuantity();
+ datafileSolrInputDocument.addField(SearchFields.OBSERVATIONS, observations);
+ datafileSolrInputDocument.addField(SearchFields.VARIABLE_COUNT, variables.size());
Map variableMap = null;
List variablesByMetadata = variableService.findVarMetByFileMetaId(fileMetadata.getId());
diff --git a/src/main/java/edu/harvard/iq/dataverse/search/SearchFields.java b/src/main/java/edu/harvard/iq/dataverse/search/SearchFields.java
index 1f1137016f2..712f90186f5 100644
--- a/src/main/java/edu/harvard/iq/dataverse/search/SearchFields.java
+++ b/src/main/java/edu/harvard/iq/dataverse/search/SearchFields.java
@@ -171,6 +171,7 @@ public class SearchFields {
public static final String FILE_CHECKSUM_TYPE = "fileChecksumType";
public static final String FILE_CHECKSUM_VALUE = "fileChecksumValue";
public static final String FILENAME_WITHOUT_EXTENSION = "fileNameWithoutExtension";
+ public static final String FILE_RESTRICTED = "fileRestricted";
/**
* Indexed as a string so we can facet on it.
*/
@@ -270,6 +271,8 @@ more targeted results for just datasets. The format is YYYY (i.e.
*/
public static final String DATASET_TYPE = "datasetType";
+ public static final String OBSERVATIONS = "observations";
+ public static final String VARIABLE_COUNT = "variableCount";
public static final String VARIABLE_NAME = "variableName";
public static final String VARIABLE_LABEL = "variableLabel";
public static final String LITERAL_QUESTION = "literalQuestion";
diff --git a/src/main/java/edu/harvard/iq/dataverse/search/SearchServiceBean.java b/src/main/java/edu/harvard/iq/dataverse/search/SearchServiceBean.java
index 3fd97d418c0..60bcc9f846e 100644
--- a/src/main/java/edu/harvard/iq/dataverse/search/SearchServiceBean.java
+++ b/src/main/java/edu/harvard/iq/dataverse/search/SearchServiceBean.java
@@ -1,6 +1,7 @@
package edu.harvard.iq.dataverse.search;
import edu.harvard.iq.dataverse.*;
+import edu.harvard.iq.dataverse.authorization.Permission;
import edu.harvard.iq.dataverse.authorization.groups.Group;
import edu.harvard.iq.dataverse.authorization.groups.GroupServiceBean;
import edu.harvard.iq.dataverse.authorization.users.AuthenticatedUser;
@@ -18,6 +19,7 @@
import java.util.Calendar;
import java.util.Collections;
import java.util.Date;
+import java.util.EnumSet;
import java.util.HashMap;
import java.util.LinkedList;
import java.util.List;
@@ -75,6 +77,8 @@ public class SearchServiceBean {
SystemConfig systemConfig;
@EJB
SolrClientService solrClientService;
+ @EJB
+ PermissionServiceBean permissionService;
@Inject
ThumbnailServiceWrapper thumbnailServiceWrapper;
@@ -677,6 +681,15 @@ public SolrQueryResponse search(
logger.info("Exception setting setFileChecksumType: " + ex);
}
solrSearchResult.setFileChecksumValue((String) solrDocument.getFieldValue(SearchFields.FILE_CHECKSUM_VALUE));
+
+ if (solrDocument.getFieldValue(SearchFields.FILE_RESTRICTED) != null) {
+ solrSearchResult.setFileRestricted((Boolean) solrDocument.getFieldValue(SearchFields.FILE_RESTRICTED));
+ }
+
+ if (solrSearchResult.getEntity() != null) {
+ solrSearchResult.setCanDownloadFile(permissionService.hasPermissionsFor(dataverseRequest, solrSearchResult.getEntity(), EnumSet.of(Permission.DownloadFile)));
+ }
+
solrSearchResult.setUnf((String) solrDocument.getFieldValue(SearchFields.UNF));
solrSearchResult.setDatasetVersionId(datasetVersionId);
List fileCategories = (List) solrDocument.getFieldValues(SearchFields.FILE_TAG);
@@ -688,6 +701,10 @@ public SolrQueryResponse search(
Collections.sort(tabularDataTags);
solrSearchResult.setTabularDataTags(tabularDataTags);
}
+ Long observations = (Long) solrDocument.getFieldValue(SearchFields.OBSERVATIONS);
+ solrSearchResult.setObservations(observations);
+ Long tabCount = (Long) solrDocument.getFieldValue(SearchFields.VARIABLE_COUNT);
+ solrSearchResult.setTabularDataCount(tabCount);
String filePID = (String) solrDocument.getFieldValue(SearchFields.FILE_PERSISTENT_ID);
if(null != filePID && !"".equals(filePID) && !"".equals("null")) {
solrSearchResult.setFilePersistentId(filePID);
diff --git a/src/main/java/edu/harvard/iq/dataverse/search/SolrSearchResult.java b/src/main/java/edu/harvard/iq/dataverse/search/SolrSearchResult.java
index 8802555affd..2250a245dab 100644
--- a/src/main/java/edu/harvard/iq/dataverse/search/SolrSearchResult.java
+++ b/src/main/java/edu/harvard/iq/dataverse/search/SolrSearchResult.java
@@ -97,6 +97,8 @@ public class SolrSearchResult {
private String fileMd5;
private DataFile.ChecksumType fileChecksumType;
private String fileChecksumValue;
+ private Boolean fileRestricted;
+ private Boolean canDownloadFile;
private String dataverseAlias;
private String dataverseParentAlias;
private String dataverseParentName;
@@ -122,6 +124,8 @@ public class SolrSearchResult {
private String harvestingDescription = null;
private List fileCategories = null;
private List tabularDataTags = null;
+ private Long tabularDataCount;
+ private Long observations;
private String identifierOfDataverse = null;
private String nameOfDataverse = null;
@@ -565,7 +569,12 @@ public JsonObjectBuilder json(boolean showRelevance, boolean showEntityIds, bool
.add("citationHtml", this.citationHtml)
.add("identifier_of_dataverse", this.identifierOfDataverse)
.add("name_of_dataverse", this.nameOfDataverse)
- .add("citation", this.citation);
+ .add("citation", this.citation)
+ .add("restricted", this.fileRestricted)
+ .add("variables", this.tabularDataCount)
+ .add("observations", this.observations)
+ .add("canDownloadFile", this.canDownloadFile);
+
// Now that nullSafeJsonBuilder has been instatiated, check for null before adding to it!
if (showRelevance) {
nullSafeJsonBuilder.add("matches", getRelevance());
@@ -579,6 +588,12 @@ public JsonObjectBuilder json(boolean showRelevance, boolean showEntityIds, bool
if (!getPublicationStatuses().isEmpty()) {
nullSafeJsonBuilder.add("publicationStatuses", getPublicationStatusesAsJSON());
}
+ if (this.fileCategories != null && !this.fileCategories.isEmpty()) {
+ nullSafeJsonBuilder.add("categories", JsonPrinter.asJsonArray(this.fileCategories));
+ }
+ if (this.tabularDataTags != null && !this.tabularDataTags.isEmpty()) {
+ nullSafeJsonBuilder.add("tabularTags", JsonPrinter.asJsonArray(this.tabularDataTags));
+ }
if (this.entity == null) {
@@ -956,6 +971,18 @@ public List getTabularDataTags() {
public void setTabularDataTags(List tabularDataTags) {
this.tabularDataTags = tabularDataTags;
}
+ public void setTabularDataCount(Long tabularDataCount) {
+ this.tabularDataCount = tabularDataCount;
+ }
+ public Long getTabularDataCount() {
+ return tabularDataCount;
+ }
+ public Long getObservations() {
+ return observations;
+ }
+ public void setObservations(Long observations) {
+ this.observations = observations;
+ }
public Map getParent() {
return parent;
@@ -1078,6 +1105,21 @@ public void setFileChecksumValue(String fileChecksumValue) {
this.fileChecksumValue = fileChecksumValue;
}
+ public Boolean getFileRestricted() {
+ return fileRestricted;
+ }
+
+ public void setFileRestricted(Boolean fileRestricted) {
+ this.fileRestricted = fileRestricted;
+ }
+ public Boolean getCanDownloadFile() {
+ return canDownloadFile;
+ }
+
+ public void setCanDownloadFile(Boolean canDownloadFile) {
+ this.canDownloadFile = canDownloadFile;
+ }
+
public String getNameSort() {
return nameSort;
}
diff --git a/src/main/java/edu/harvard/iq/dataverse/settings/FeatureFlags.java b/src/main/java/edu/harvard/iq/dataverse/settings/FeatureFlags.java
index 20632c170e4..2242b0f51c6 100644
--- a/src/main/java/edu/harvard/iq/dataverse/settings/FeatureFlags.java
+++ b/src/main/java/edu/harvard/iq/dataverse/settings/FeatureFlags.java
@@ -33,9 +33,32 @@ public enum FeatureFlags {
/**
* Enables API authentication via Bearer Token.
* @apiNote Raise flag by setting "dataverse.feature.api-bearer-auth"
- * @since Dataverse @TODO:
+ * @since Dataverse 5.14:
*/
API_BEARER_AUTH("api-bearer-auth"),
+ /**
+ * Enables sending the missing user claims in the request JSON provided during OIDC user registration
+ * (see API endpoint /users/register) when these claims are not returned by the identity provider
+ * but are necessary for registering the user in Dataverse.
+ *
+ * The value of this feature flag is only considered when the feature flag
+ * {@link #API_BEARER_AUTH} is enabled.
+ *
+ * @apiNote Raise flag by setting "dataverse.feature.api-bearer-auth-provide-missing-claims"
+ * @since Dataverse @TODO:
+ */
+ API_BEARER_AUTH_PROVIDE_MISSING_CLAIMS("api-bearer-auth-provide-missing-claims"),
+ /**
+ * Specifies that Terms of Service acceptance is handled by the IdP, eliminating the need to include
+ * ToS acceptance boolean parameter (termsAccepted) in the OIDC user registration request body.
+ *
+ * The value of this feature flag is only considered when the feature flag
+ * {@link #API_BEARER_AUTH} is enabled.
+ *
+ * @apiNote Raise flag by setting "dataverse.feature.api-bearer-auth-handle-tos-acceptance-in-idp"
+ * @since Dataverse @TODO:
+ */
+ API_BEARER_AUTH_HANDLE_TOS_ACCEPTANCE_IN_IDP("api-bearer-auth-handle-tos-acceptance-in-idp"),
/**
* For published (public) objects, don't use a join when searching Solr.
* Experimental! Requires a reindex with the following feature flag enabled,
diff --git a/src/main/java/edu/harvard/iq/dataverse/util/json/JsonParser.java b/src/main/java/edu/harvard/iq/dataverse/util/json/JsonParser.java
index 232b7431a24..ce6a5920a39 100644
--- a/src/main/java/edu/harvard/iq/dataverse/util/json/JsonParser.java
+++ b/src/main/java/edu/harvard/iq/dataverse/util/json/JsonParser.java
@@ -21,6 +21,7 @@
import edu.harvard.iq.dataverse.api.Util;
import edu.harvard.iq.dataverse.api.dto.DataverseDTO;
import edu.harvard.iq.dataverse.api.dto.FieldDTO;
+import edu.harvard.iq.dataverse.api.dto.UserDTO;
import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.IpGroup;
import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip.IpAddress;
import edu.harvard.iq.dataverse.authorization.groups.impl.ipaddress.ip.IpAddressRange;
@@ -31,6 +32,7 @@
import edu.harvard.iq.dataverse.harvest.client.HarvestingClient;
import edu.harvard.iq.dataverse.license.License;
import edu.harvard.iq.dataverse.license.LicenseServiceBean;
+import edu.harvard.iq.dataverse.settings.FeatureFlags;
import edu.harvard.iq.dataverse.settings.SettingsServiceBean;
import edu.harvard.iq.dataverse.util.BundleUtil;
import edu.harvard.iq.dataverse.workflow.Workflow;
@@ -49,6 +51,7 @@
import java.util.Map;
import java.util.Optional;
import java.util.Set;
+import java.util.function.Function;
import java.util.function.Consumer;
import java.util.logging.Logger;
import java.util.stream.Collectors;
@@ -76,11 +79,11 @@ public class JsonParser {
DatasetTypeServiceBean datasetTypeService;
HarvestingClient harvestingClient = null;
boolean allowHarvestingMissingCVV = false;
-
+
/**
* if lenient, we will accept alternate spellings for controlled vocabulary values
*/
- boolean lenient = false;
+ boolean lenient = false;
@Deprecated
public JsonParser(DatasetFieldServiceBean datasetFieldSvc, MetadataBlockServiceBean blockService, SettingsServiceBean settingsService) {
@@ -92,7 +95,7 @@ public JsonParser(DatasetFieldServiceBean datasetFieldSvc, MetadataBlockServiceB
public JsonParser(DatasetFieldServiceBean datasetFieldSvc, MetadataBlockServiceBean blockService, SettingsServiceBean settingsService, LicenseServiceBean licenseService, DatasetTypeServiceBean datasetTypeService) {
this(datasetFieldSvc, blockService, settingsService, licenseService, datasetTypeService, null);
}
-
+
public JsonParser(DatasetFieldServiceBean datasetFieldSvc, MetadataBlockServiceBean blockService, SettingsServiceBean settingsService, LicenseServiceBean licenseService, DatasetTypeServiceBean datasetTypeService, HarvestingClient harvestingClient) {
this.datasetFieldSvc = datasetFieldSvc;
this.blockService = blockService;
@@ -106,7 +109,7 @@ public JsonParser(DatasetFieldServiceBean datasetFieldSvc, MetadataBlockServiceB
public JsonParser() {
this( null,null,null );
}
-
+
public boolean isLenient() {
return lenient;
}
@@ -282,11 +285,19 @@ public DataverseTheme parseDataverseTheme(JsonObject obj) {
return theme;
}
- private static String getMandatoryString(JsonObject jobj, String name) throws JsonParseException {
+ private static T getMandatoryField(JsonObject jobj, String name, Function getter) throws JsonParseException {
if (jobj.containsKey(name)) {
- return jobj.getString(name);
+ return getter.apply(name);
}
- throw new JsonParseException("Field " + name + " is mandatory");
+ throw new JsonParseException("Field '" + name + "' is mandatory");
+ }
+
+ private static String getMandatoryString(JsonObject jobj, String name) throws JsonParseException {
+ return getMandatoryField(jobj, name, jobj::getString);
+ }
+
+ private static Boolean getMandatoryBoolean(JsonObject jobj, String name) throws JsonParseException {
+ return getMandatoryField(jobj, name, jobj::getBoolean);
}
public IpGroup parseIpGroup(JsonObject obj) {
@@ -318,10 +329,10 @@ public IpGroup parseIpGroup(JsonObject obj) {
return retVal;
}
-
+
public MailDomainGroup parseMailDomainGroup(JsonObject obj) throws JsonParseException {
MailDomainGroup grp = new MailDomainGroup();
-
+
if (obj.containsKey("id")) {
grp.setId(obj.getJsonNumber("id").longValue());
}
@@ -345,7 +356,7 @@ public MailDomainGroup parseMailDomainGroup(JsonObject obj) throws JsonParseExce
} else {
throw new JsonParseException("Field domains is mandatory.");
}
-
+
return grp;
}
@@ -383,7 +394,7 @@ public Dataset parseDataset(JsonObject obj) throws JsonParseException {
throw new JsonParseException("Invalid dataset type: " + datasetTypeIn);
}
- DatasetVersion dsv = new DatasetVersion();
+ DatasetVersion dsv = new DatasetVersion();
dsv.setDataset(dataset);
dsv = parseDatasetVersion(obj.getJsonObject("datasetVersion"), dsv);
List versions = new ArrayList<>(1);
@@ -414,7 +425,7 @@ public DatasetVersion parseDatasetVersion(JsonObject obj, DatasetVersion dsv) th
if (dsv.getId()==null) {
dsv.setId(parseLong(obj.getString("id", null)));
}
-
+
String versionStateStr = obj.getString("versionState", null);
if (versionStateStr != null) {
dsv.setVersionState(DatasetVersion.VersionState.valueOf(versionStateStr));
@@ -427,8 +438,8 @@ public DatasetVersion parseDatasetVersion(JsonObject obj, DatasetVersion dsv) th
// Terms of Use related fields
TermsOfUseAndAccess terms = new TermsOfUseAndAccess();
- License license = null;
-
+ License license = null;
+
try {
// This method will attempt to parse the license in the format
// in which it appears in our json exports, as a compound
@@ -447,7 +458,7 @@ public DatasetVersion parseDatasetVersion(JsonObject obj, DatasetVersion dsv) th
// "license" : "CC0 1.0"
license = parseLicense(obj.getString("license", null));
}
-
+
if (license == null) {
terms.setLicense(license);
terms.setTermsOfUse(obj.getString("termsOfUse", null));
@@ -485,13 +496,13 @@ public DatasetVersion parseDatasetVersion(JsonObject obj, DatasetVersion dsv) th
dsv.setFileMetadatas(parseFiles(filesJson, dsv));
}
return dsv;
- } catch (ParseException ex) {
+ } catch (ParseException ex) {
throw new JsonParseException(BundleUtil.getStringFromBundle("jsonparser.error.parsing.date", Arrays.asList(ex.getMessage())) , ex);
} catch (NumberFormatException ex) {
throw new JsonParseException(BundleUtil.getStringFromBundle("jsonparser.error.parsing.number", Arrays.asList(ex.getMessage())), ex);
}
}
-
+
private edu.harvard.iq.dataverse.license.License parseLicense(String licenseNameOrUri) throws JsonParseException {
if (licenseNameOrUri == null){
boolean safeDefaultIfKeyNotFound = true;
@@ -505,7 +516,7 @@ private edu.harvard.iq.dataverse.license.License parseLicense(String licenseName
if (license == null) throw new JsonParseException("Invalid license: " + licenseNameOrUri);
return license;
}
-
+
private edu.harvard.iq.dataverse.license.License parseLicense(JsonObject licenseObj) throws JsonParseException {
if (licenseObj == null){
boolean safeDefaultIfKeyNotFound = true;
@@ -515,12 +526,12 @@ private edu.harvard.iq.dataverse.license.License parseLicense(JsonObject license
return licenseService.getDefault();
}
}
-
+
String licenseName = licenseObj.getString("name", null);
String licenseUri = licenseObj.getString("uri", null);
-
- License license = null;
-
+
+ License license = null;
+
// If uri is provided, we'll try that first. This is an easier lookup
// method; the uri is always the same. The name may have been customized
// (translated) on this instance, so we may be dealing with such translated
@@ -530,17 +541,17 @@ private edu.harvard.iq.dataverse.license.License parseLicense(JsonObject license
if (licenseUri != null) {
license = licenseService.getByNameOrUri(licenseUri);
}
-
+
if (license != null) {
return license;
}
-
+
if (licenseName == null) {
- String exMsg = "Invalid or unsupported license section submitted"
+ String exMsg = "Invalid or unsupported license section submitted"
+ (licenseUri != null ? ": " + licenseUri : ".");
- throw new JsonParseException("Invalid or unsupported license section submitted.");
+ throw new JsonParseException("Invalid or unsupported license section submitted.");
}
-
+
license = licenseService.getByPotentiallyLocalizedName(licenseName);
if (license == null) {
throw new JsonParseException("Invalid or unsupported license: " + licenseName);
@@ -559,13 +570,13 @@ public List parseMetadataBlocks(JsonObject json) throws JsonParseE
}
return fields;
}
-
+
public List parseMultipleFields(JsonObject json) throws JsonParseException {
JsonArray fieldsJson = json.getJsonArray("fields");
List fields = parseFieldsFromArray(fieldsJson, false);
return fields;
}
-
+
public List parseMultipleFieldsForDelete(JsonObject json) throws JsonParseException {
List fields = new LinkedList<>();
for (JsonObject fieldJson : json.getJsonArray("fields").getValuesAs(JsonObject.class)) {
@@ -573,7 +584,7 @@ public List parseMultipleFieldsForDelete(JsonObject json) throws J
}
return fields;
}
-
+
private List parseFieldsFromArray(JsonArray fieldsArray, Boolean testType) throws JsonParseException {
List fields = new LinkedList<>();
for (JsonObject fieldJson : fieldsArray.getValuesAs(JsonObject.class)) {
@@ -585,18 +596,18 @@ private List parseFieldsFromArray(JsonArray fieldsArray, Boolean t
} catch (CompoundVocabularyException ex) {
DatasetFieldType fieldType = datasetFieldSvc.findByNameOpt(fieldJson.getString("typeName", ""));
if (lenient && (DatasetFieldConstant.geographicCoverage).equals(fieldType.getName())) {
- fields.add(remapGeographicCoverage( ex));
+ fields.add(remapGeographicCoverage( ex));
} else {
// if not lenient mode, re-throw exception
throw ex;
}
- }
+ }
}
return fields;
-
+
}
-
+
public List parseFiles(JsonArray metadatasJson, DatasetVersion dsv) throws JsonParseException {
List fileMetadatas = new LinkedList<>();
if (metadatasJson != null) {
@@ -610,7 +621,7 @@ public List parseFiles(JsonArray metadatasJson, DatasetVersion dsv
fileMetadata.setDirectoryLabel(directoryLabel);
fileMetadata.setDescription(description);
fileMetadata.setDatasetVersion(dsv);
-
+
if ( filemetadataJson.containsKey("dataFile") ) {
DataFile dataFile = parseDataFile(filemetadataJson.getJsonObject("dataFile"));
dataFile.getFileMetadatas().add(fileMetadata);
@@ -623,7 +634,7 @@ public List parseFiles(JsonArray metadatasJson, DatasetVersion dsv
dsv.getDataset().getFiles().add(dataFile);
}
}
-
+
fileMetadatas.add(fileMetadata);
fileMetadata.setCategories(getCategories(filemetadataJson, dsv.getDataset()));
}
@@ -631,19 +642,19 @@ public List parseFiles(JsonArray metadatasJson, DatasetVersion dsv
return fileMetadatas;
}
-
+
public DataFile parseDataFile(JsonObject datafileJson) {
DataFile dataFile = new DataFile();
-
+
Timestamp timestamp = new Timestamp(new Date().getTime());
dataFile.setCreateDate(timestamp);
dataFile.setModificationTime(timestamp);
dataFile.setPermissionModificationTime(timestamp);
-
+
if ( datafileJson.containsKey("filesize") ) {
dataFile.setFilesize(datafileJson.getJsonNumber("filesize").longValueExact());
}
-
+
String contentType = datafileJson.getString("contentType", null);
if (contentType == null) {
contentType = "application/octet-stream";
@@ -706,21 +717,21 @@ public DataFile parseDataFile(JsonObject datafileJson) {
// TODO:
// unf (if available)... etc.?
-
+
dataFile.setContentType(contentType);
dataFile.setStorageIdentifier(storageIdentifier);
-
+
return dataFile;
}
/**
* Special processing for GeographicCoverage compound field:
* Handle parsing exceptions caused by invalid controlled vocabulary in the "country" field by
* putting the invalid data in "otherGeographicCoverage" in a new compound value.
- *
+ *
* @param ex - contains the invalid values to be processed
- * @return a compound DatasetField that contains the newly created values, in addition to
+ * @return a compound DatasetField that contains the newly created values, in addition to
* the original valid values.
- * @throws JsonParseException
+ * @throws JsonParseException
*/
private DatasetField remapGeographicCoverage(CompoundVocabularyException ex) throws JsonParseException{
List> geoCoverageList = new ArrayList<>();
@@ -747,23 +758,23 @@ private DatasetField remapGeographicCoverage(CompoundVocabularyException ex) thr
}
return geoCoverageField;
}
-
-
+
+
public DatasetField parseFieldForDelete(JsonObject json) throws JsonParseException{
DatasetField ret = new DatasetField();
- DatasetFieldType type = datasetFieldSvc.findByNameOpt(json.getString("typeName", ""));
+ DatasetFieldType type = datasetFieldSvc.findByNameOpt(json.getString("typeName", ""));
if (type == null) {
throw new JsonParseException("Can't find type '" + json.getString("typeName", "") + "'");
}
return ret;
}
-
-
+
+
public DatasetField parseField(JsonObject json) throws JsonParseException{
return parseField(json, true);
}
-
-
+
+
public DatasetField parseField(JsonObject json, Boolean testType) throws JsonParseException {
if (json == null) {
return null;
@@ -771,7 +782,7 @@ public DatasetField parseField(JsonObject json, Boolean testType) throws JsonPar
DatasetField ret = new DatasetField();
DatasetFieldType type = datasetFieldSvc.findByNameOpt(json.getString("typeName", ""));
-
+
if (type == null) {
logger.fine("Can't find type '" + json.getString("typeName", "") + "'");
@@ -789,8 +800,8 @@ public DatasetField parseField(JsonObject json, Boolean testType) throws JsonPar
if (testType && type.isControlledVocabulary() && !json.getString("typeClass").equals("controlledVocabulary")) {
throw new JsonParseException("incorrect typeClass for field " + json.getString("typeName", "") + ", should be controlledVocabulary");
}
-
-
+
+
ret.setDatasetFieldType(type);
if (type.isCompound()) {
@@ -803,11 +814,11 @@ public DatasetField parseField(JsonObject json, Boolean testType) throws JsonPar
return ret;
}
-
+
public void parseCompoundValue(DatasetField dsf, DatasetFieldType compoundType, JsonObject json) throws JsonParseException {
parseCompoundValue(dsf, compoundType, json, true);
}
-
+
public void parseCompoundValue(DatasetField dsf, DatasetFieldType compoundType, JsonObject json, Boolean testType) throws JsonParseException {
List vocabExceptions = new ArrayList<>();
List vals = new LinkedList<>();
@@ -829,7 +840,7 @@ public void parseCompoundValue(DatasetField dsf, DatasetFieldType compoundType,
} catch(ControlledVocabularyException ex) {
vocabExceptions.add(ex);
}
-
+
if (f!=null) {
if (!compoundType.getChildDatasetFieldTypes().contains(f.getDatasetFieldType())) {
throw new JsonParseException("field " + f.getDatasetFieldType().getName() + " is not a child of " + compoundType.getName());
@@ -846,10 +857,10 @@ public void parseCompoundValue(DatasetField dsf, DatasetFieldType compoundType,
order++;
}
-
+
} else {
-
+
DatasetFieldCompoundValue cv = new DatasetFieldCompoundValue();
List fields = new LinkedList<>();
JsonObject value = json.getJsonObject("value");
@@ -870,7 +881,7 @@ public void parseCompoundValue(DatasetField dsf, DatasetFieldType compoundType,
cv.setChildDatasetFields(fields);
vals.add(cv);
}
-
+
}
if (!vocabExceptions.isEmpty()) {
throw new CompoundVocabularyException( "Invalid controlled vocabulary in compound field ", vocabExceptions, vals);
@@ -909,7 +920,7 @@ public void parsePrimitiveValue(DatasetField dsf, DatasetFieldType dft , JsonObj
try {json.getString("value");}
catch (ClassCastException cce) {
throw new JsonParseException("Invalid value submitted for " + dft.getName() + ". It should be a single value.");
- }
+ }
DatasetFieldValue datasetFieldValue = new DatasetFieldValue();
datasetFieldValue.setValue(json.getString("value", "").trim());
datasetFieldValue.setDatasetField(dsf);
@@ -923,7 +934,7 @@ public void parsePrimitiveValue(DatasetField dsf, DatasetFieldType dft , JsonObj
dsf.setDatasetFieldValues(vals);
}
-
+
public Workflow parseWorkflow(JsonObject json) throws JsonParseException {
Workflow retVal = new Workflow();
validate("", json, "name", ValueType.STRING);
@@ -937,12 +948,12 @@ public Workflow parseWorkflow(JsonObject json) throws JsonParseException {
retVal.setSteps(steps);
return retVal;
}
-
+
public WorkflowStepData parseStepData( JsonObject json ) throws JsonParseException {
WorkflowStepData wsd = new WorkflowStepData();
validate("step", json, "provider", ValueType.STRING);
validate("step", json, "stepType", ValueType.STRING);
-
+
wsd.setProviderId(json.getString("provider"));
wsd.setStepType(json.getString("stepType"));
if ( json.containsKey("parameters") ) {
@@ -959,7 +970,7 @@ public WorkflowStepData parseStepData( JsonObject json ) throws JsonParseExcepti
}
return wsd;
}
-
+
private String jsonValueToString(JsonValue jv) {
switch ( jv.getValueType() ) {
case STRING: return ((JsonString)jv).getString();
@@ -1038,11 +1049,11 @@ Long parseLong(String str) throws NumberFormatException {
int parsePrimitiveInt(String str, int defaultValue) {
return str == null ? defaultValue : Integer.parseInt(str);
}
-
+
public String parseHarvestingClient(JsonObject obj, HarvestingClient harvestingClient) throws JsonParseException {
-
+
String dataverseAlias = obj.getString("dataverseAlias",null);
-
+
harvestingClient.setName(obj.getString("nickName",null));
harvestingClient.setHarvestStyle(obj.getString("style", "default"));
harvestingClient.setHarvestingUrl(obj.getString("harvestUrl",null));
@@ -1078,7 +1089,7 @@ private List getCategories(JsonObject filemetadataJson, Datase
}
return dataFileCategories;
}
-
+
/**
* Validate than a JSON object has a field of an expected type, or throw an
* inforamtive exception.
@@ -1086,12 +1097,29 @@ private List getCategories(JsonObject filemetadataJson, Datase
* @param jobject
* @param fieldName
* @param expectedValueType
- * @throws JsonParseException
+ * @throws JsonParseException
*/
private void validate(String objectName, JsonObject jobject, String fieldName, ValueType expectedValueType) throws JsonParseException {
- if ( (!jobject.containsKey(fieldName))
+ if ( (!jobject.containsKey(fieldName))
|| (jobject.get(fieldName).getValueType()!=expectedValueType) ) {
throw new JsonParseException( objectName + " missing a field named '"+fieldName+"' of type " + expectedValueType );
}
}
+
+ public UserDTO parseUserDTO(JsonObject jobj) throws JsonParseException {
+ UserDTO userDTO = new UserDTO();
+
+ userDTO.setUsername(jobj.getString("username", null));
+ userDTO.setEmailAddress(jobj.getString("emailAddress", null));
+ userDTO.setFirstName(jobj.getString("firstName", null));
+ userDTO.setLastName(jobj.getString("lastName", null));
+ userDTO.setAffiliation(jobj.getString("affiliation", null));
+ userDTO.setPosition(jobj.getString("position", null));
+
+ if (!FeatureFlags.API_BEARER_AUTH_HANDLE_TOS_ACCEPTANCE_IN_IDP.enabled()) {
+ userDTO.setTermsAccepted(getMandatoryBoolean(jobj, "termsAccepted"));
+ }
+
+ return userDTO;
+ }
}
diff --git a/src/main/java/edu/harvard/iq/dataverse/util/json/JsonPrinter.java b/src/main/java/edu/harvard/iq/dataverse/util/json/JsonPrinter.java
index 4f5b2898eff..426f738ac28 100644
--- a/src/main/java/edu/harvard/iq/dataverse/util/json/JsonPrinter.java
+++ b/src/main/java/edu/harvard/iq/dataverse/util/json/JsonPrinter.java
@@ -56,6 +56,7 @@
import jakarta.ejb.Singleton;
import jakarta.json.JsonArray;
import jakarta.json.JsonObject;
+import java.util.function.Predicate;
/**
* Convert objects to Json.
@@ -642,22 +643,31 @@ public static JsonObjectBuilder json(MetadataBlock metadataBlock, boolean printO
.add("displayName", metadataBlock.getDisplayName())
.add("displayOnCreate", metadataBlock.isDisplayOnCreate());
- Set datasetFieldTypes;
-
- if (ownerDataverse != null) {
- datasetFieldTypes = new TreeSet<>(datasetFieldService.findAllInMetadataBlockAndDataverse(
- metadataBlock, ownerDataverse, printOnlyDisplayedOnCreateDatasetFieldTypes));
- } else {
- datasetFieldTypes = printOnlyDisplayedOnCreateDatasetFieldTypes
- ? new TreeSet<>(datasetFieldService.findAllDisplayedOnCreateInMetadataBlock(metadataBlock))
- : new TreeSet<>(metadataBlock.getDatasetFieldTypes());
- }
-
JsonObjectBuilder fieldsBuilder = Json.createObjectBuilder();
- for (DatasetFieldType datasetFieldType : datasetFieldTypes) {
- fieldsBuilder.add(datasetFieldType.getName(), json(datasetFieldType, ownerDataverse));
+
+ Predicate isNoChild = element -> element.isChild() == false;
+ List childLessList = metadataBlock.getDatasetFieldTypes().stream().filter(isNoChild).toList();
+ Set datasetFieldTypesNoChildSorted = new TreeSet<>(childLessList);
+
+ for (DatasetFieldType datasetFieldType : datasetFieldTypesNoChildSorted) {
+
+ Long datasetFieldTypeId = datasetFieldType.getId();
+ boolean requiredAsInputLevelInOwnerDataverse = ownerDataverse != null && ownerDataverse.isDatasetFieldTypeRequiredAsInputLevel(datasetFieldTypeId);
+ boolean includedAsInputLevelInOwnerDataverse = ownerDataverse != null && ownerDataverse.isDatasetFieldTypeIncludedAsInputLevel(datasetFieldTypeId);
+ boolean isNotInputLevelInOwnerDataverse = ownerDataverse != null && !ownerDataverse.isDatasetFieldTypeInInputLevels(datasetFieldTypeId);
+
+ DatasetFieldType parentDatasetFieldType = datasetFieldType.getParentDatasetFieldType();
+ boolean isRequired = parentDatasetFieldType == null ? datasetFieldType.isRequired() : parentDatasetFieldType.isRequired();
+
+ boolean displayCondition = printOnlyDisplayedOnCreateDatasetFieldTypes
+ ? (datasetFieldType.isDisplayOnCreate() || isRequired || requiredAsInputLevelInOwnerDataverse)
+ : ownerDataverse == null || includedAsInputLevelInOwnerDataverse || isNotInputLevelInOwnerDataverse;
+
+ if (displayCondition) {
+ fieldsBuilder.add(datasetFieldType.getName(), json(datasetFieldType, ownerDataverse));
+ }
}
-
+
jsonObjectBuilder.add("fields", fieldsBuilder);
return jsonObjectBuilder;
}
diff --git a/src/main/java/edu/harvard/iq/dataverse/util/json/NullSafeJsonBuilder.java b/src/main/java/edu/harvard/iq/dataverse/util/json/NullSafeJsonBuilder.java
index ef8ab39122f..21360fcd708 100644
--- a/src/main/java/edu/harvard/iq/dataverse/util/json/NullSafeJsonBuilder.java
+++ b/src/main/java/edu/harvard/iq/dataverse/util/json/NullSafeJsonBuilder.java
@@ -85,7 +85,10 @@ public NullSafeJsonBuilder add(String name, boolean value) {
delegate.add(name, value);
return this;
}
-
+ public NullSafeJsonBuilder add(String name, Boolean value) {
+ return (value != null) ? add(name, value.booleanValue()) : this;
+ }
+
@Override
public NullSafeJsonBuilder addNull(String name) {
delegate.addNull(name);
diff --git a/src/main/java/propertyFiles/Bundle.properties b/src/main/java/propertyFiles/Bundle.properties
index 750b1b4f429..f01e17dceea 100644
--- a/src/main/java/propertyFiles/Bundle.properties
+++ b/src/main/java/propertyFiles/Bundle.properties
@@ -1744,15 +1744,13 @@ dataset.privateurl.general.title=General Preview
dataset.privateurl.anonymous.title=Anonymous Preview
dataset.privateurl.anonymous.button.label=Create Anonymous Preview URL
dataset.privateurl.anonymous.description=Create a URL that others can use to access an anonymized view of this unpublished dataset version. Metadata that could identify the dataset author will not be displayed. Non-identifying metadata will be visible.
-dataset.privateurl.anonymous.description.paragraph.two=The dataset's files are not changed and will be accessible if they're not restricted. Users of the Anonymous Preview URL will not be able to see the name of the Dataverse that this dataset is in but will be able to see the name of the repository, which might expose the dataset authors' identities.
+dataset.privateurl.anonymous.description.paragraph.two=The dataset's files are not changed and users of the Anonymous Preview URL will be able to access them. Users of the Anonymous Preview URL will not be able to see the name of the Dataverse that this dataset is in but will be able to see the name of the repository, which might expose the dataset authors' identities.
dataset.privateurl.createPrivateUrl=Create Preview URL
dataset.privateurl.introduction=You can create a Preview URL to copy and share with others who will not need a repository account to review this unpublished dataset version. Once the dataset is published or if the URL is disabled, the URL will no longer work and will point to a "Page not found" page.
dataset.privateurl.createPrivateUrl.anonymized=Create URL for Anonymized Access
-dataset.privateurl.createPrivateUrl.anonymized.unavailable=Anonymized Access is not available once a version of the dataset has been published
-dataset.privateurl.disablePrivateUrl=Disable Preview URL
+dataset.privateurl.createPrivateUrl.anonymized.unavailable=You won't be able to create an Anonymous Preview URL once a version of this dataset has been published.
dataset.privateurl.disableGeneralPreviewUrl=Disable General Preview URL
dataset.privateurl.disableAnonPreviewUrl=Disable Anonymous Preview URL
-dataset.privateurl.disablePrivateUrlConfirm=Yes, Disable Preview URL
dataset.privateurl.disableGeneralPreviewUrlConfirm=Yes, Disable General Preview URL
dataset.privateurl.disableAnonPreviewUrlConfirm=Yes, Disable Anonymous Preview URL
dataset.privateurl.disableConfirmationText=Are you sure you want to disable the Preview URL? If you have shared the Preview URL with others they will no longer be able to use it to access your unpublished dataset.
@@ -3089,3 +3087,27 @@ openapi.exception.invalid.format=Invalid format {0}, currently supported formats
openapi.exception=Supported format definition not found.
openapi.exception.unaligned=Unaligned parameters on Headers [{0}] and Request [{1}]
+#Users.java
+users.api.errors.bearerAuthFeatureFlagDisabled=This endpoint is only available when bearer authentication feature flag is enabled.
+users.api.errors.bearerTokenRequired=Bearer token required.
+users.api.errors.jsonParseToUserDTO=Error parsing the POSTed User json: {0}
+users.api.userRegistered=User registered.
+
+#RegisterOidcUserCommand.java
+registerOidcUserCommand.errors.userAlreadyRegisteredWithToken=User is already registered with this token.
+registerOidcUserCommand.errors.invalidFields=The provided fields are invalid for registering a new user.
+registerOidcUserCommand.errors.userShouldAcceptTerms=Terms should be accepted.
+registerOidcUserCommand.errors.provideMissingClaimsEnabled.fieldAlreadyPresentInProvider=Unable to set {0} because it conflicts with an existing claim from the OIDC identity provider.
+registerOidcUserCommand.errors.provideMissingClaimsEnabled.fieldRequired=It is required to include the field {0} in the request JSON for registering the user.
+registerOidcUserCommand.errors.provideMissingClaimsDisabled.unableToSetFieldViaJSON=Unable to set field {0} via JSON because the api-bearer-auth-provide-missing-claims feature flag is disabled.
+registerOidcUserCommand.errors.provideMissingClaimsDisabled.fieldRequired=The OIDC identity provider does not provide the user claim {0}, which is required for user registration. Please contact an administrator.
+registerOidcUserCommand.errors.emailAddressInUse=Email already in use.
+registerOidcUserCommand.errors.usernameInUse=Username already in use.
+
+#BearerTokenAuthMechanism.java
+bearerTokenAuthMechanism.errors.tokenValidatedButNoRegisteredUser=Bearer token is validated, but there is no linked user account.
+
+#AuthenticationServiceBean.java
+authenticationServiceBean.errors.unauthorizedBearerToken=Unauthorized bearer token.
+authenticationServiceBean.errors.invalidBearerToken=Could not parse bearer token.
+authenticationServiceBean.errors.bearerTokenDetectedNoOIDCProviderConfigured=Bearer token detected, no OIDC provider configured.
diff --git a/src/main/resources/META-INF/services/edu.harvard.iq.dataverse.pidproviders.PidProviderFactory b/src/main/resources/META-INF/services/edu.harvard.iq.dataverse.pidproviders.PidProviderFactory
new file mode 100644
index 00000000000..acdfd927e45
--- /dev/null
+++ b/src/main/resources/META-INF/services/edu.harvard.iq.dataverse.pidproviders.PidProviderFactory
@@ -0,0 +1,6 @@
+edu.harvard.iq.dataverse.pidproviders.doi.crossref.CrossRefDOIProviderFactory
+edu.harvard.iq.dataverse.pidproviders.doi.datacite.DataCiteProviderFactory
+edu.harvard.iq.dataverse.pidproviders.doi.ezid.EZIdProviderFactory
+edu.harvard.iq.dataverse.pidproviders.doi.fake.FakeProviderFactory
+edu.harvard.iq.dataverse.pidproviders.handle.HandleProviderFactory
+edu.harvard.iq.dataverse.pidproviders.perma.PermaLinkProviderFactory
diff --git a/src/main/resources/META-INF/services/io.gdcc.spi.export.Exporter b/src/main/resources/META-INF/services/io.gdcc.spi.export.Exporter
new file mode 100644
index 00000000000..873cea58911
--- /dev/null
+++ b/src/main/resources/META-INF/services/io.gdcc.spi.export.Exporter
@@ -0,0 +1,10 @@
+edu.harvard.iq.dataverse.export.DCTermsExporter
+edu.harvard.iq.dataverse.export.DDIExporter
+edu.harvard.iq.dataverse.export.DataCiteExporter
+edu.harvard.iq.dataverse.export.DublinCoreExporter
+edu.harvard.iq.dataverse.export.HtmlCodeBookExporter
+edu.harvard.iq.dataverse.export.JSONExporter
+edu.harvard.iq.dataverse.export.OAI_DDIExporter
+edu.harvard.iq.dataverse.export.OAI_OREExporter
+edu.harvard.iq.dataverse.export.OpenAireExporter
+edu.harvard.iq.dataverse.export.SchemaDotOrgExporter
diff --git a/src/test/java/edu/harvard/iq/dataverse/api/DataversesIT.java b/src/test/java/edu/harvard/iq/dataverse/api/DataversesIT.java
index 72205022b8c..488e2d93120 100644
--- a/src/test/java/edu/harvard/iq/dataverse/api/DataversesIT.java
+++ b/src/test/java/edu/harvard/iq/dataverse/api/DataversesIT.java
@@ -927,7 +927,8 @@ public void testListMetadataBlocks() {
.body("data.size()", equalTo(1))
.body("data[0].name", is("citation"))
.body("data[0].fields.title.displayOnCreate", equalTo(true))
- .body("data[0].fields.size()", is(28));
+ .body("data[0].fields.size()", is(10))
+ .body("data[0].fields.author.childFields.size()", is(4));
Response setMetadataBlocksResponse = UtilIT.setMetadataBlocks(dataverseAlias, Json.createArrayBuilder().add("citation").add("astrophysics"), apiToken);
setMetadataBlocksResponse.then().assertThat().statusCode(OK.getStatusCode());
@@ -1007,17 +1008,23 @@ public void testListMetadataBlocks() {
// Since the included property of notesText is set to false, we should retrieve the total number of fields minus one
int citationMetadataBlockIndex = geospatialMetadataBlockIndex == 0 ? 1 : 0;
listMetadataBlocksResponse.then().assertThat()
- .body(String.format("data[%d].fields.size()", citationMetadataBlockIndex), equalTo(79));
+ .body(String.format("data[%d].fields.size()", citationMetadataBlockIndex), equalTo(34));
// Since the included property of geographicCoverage is set to false, we should retrieve the total number of fields minus one
listMetadataBlocksResponse.then().assertThat()
- .body(String.format("data[%d].fields.size()", geospatialMetadataBlockIndex), equalTo(10));
+ .body(String.format("data[%d].fields.size()", geospatialMetadataBlockIndex), equalTo(2));
+
+ listMetadataBlocksResponse = UtilIT.getMetadataBlock("geospatial");
- String actualGeospatialMetadataField1 = listMetadataBlocksResponse.then().extract().path(String.format("data[%d].fields.geographicCoverage.name", geospatialMetadataBlockIndex));
- String actualGeospatialMetadataField2 = listMetadataBlocksResponse.then().extract().path(String.format("data[%d].fields.country.name", geospatialMetadataBlockIndex));
- String actualGeospatialMetadataField3 = listMetadataBlocksResponse.then().extract().path(String.format("data[%d].fields.city.name", geospatialMetadataBlockIndex));
+ String actualGeospatialMetadataField1 = listMetadataBlocksResponse.then().extract().path(String.format("data.fields['geographicCoverage'].name"));
+ String actualGeospatialMetadataField2 = listMetadataBlocksResponse.then().extract().path(String.format("data.fields['geographicCoverage'].childFields['country'].name"));
+ String actualGeospatialMetadataField3 = listMetadataBlocksResponse.then().extract().path(String.format("data.fields['geographicCoverage'].childFields['city'].name"));
+
+ listMetadataBlocksResponse.then().assertThat().statusCode(OK.getStatusCode())
+ .body("data.fields['geographicCoverage'].childFields.size()", equalTo(4))
+ .body("data.fields['geographicBoundingBox'].childFields.size()", equalTo(4));
- assertNull(actualGeospatialMetadataField1);
+ assertNotNull(actualGeospatialMetadataField1);
assertNotNull(actualGeospatialMetadataField2);
assertNotNull(actualGeospatialMetadataField3);
@@ -1040,21 +1047,21 @@ public void testListMetadataBlocks() {
geospatialMetadataBlockIndex = actualMetadataBlockDisplayName2.equals("Geospatial Metadata") ? 1 : 0;
listMetadataBlocksResponse.then().assertThat()
- .body(String.format("data[%d].fields.size()", geospatialMetadataBlockIndex), equalTo(1));
+ .body(String.format("data[%d].fields.size()", geospatialMetadataBlockIndex), equalTo(0));
- actualGeospatialMetadataField1 = listMetadataBlocksResponse.then().extract().path(String.format("data[%d].fields.geographicCoverage.name", geospatialMetadataBlockIndex));
- actualGeospatialMetadataField2 = listMetadataBlocksResponse.then().extract().path(String.format("data[%d].fields.country.name", geospatialMetadataBlockIndex));
- actualGeospatialMetadataField3 = listMetadataBlocksResponse.then().extract().path(String.format("data[%d].fields.city.name", geospatialMetadataBlockIndex));
+// actualGeospatialMetadataField1 = listMetadataBlocksResponse.then().extract().path(String.format("data[%d].fields.geographicCoverage.name", geospatialMetadataBlockIndex));
+// actualGeospatialMetadataField2 = listMetadataBlocksResponse.then().extract().path(String.format("data[%d].fields.geographicCoverage.childFields['country'].name", geospatialMetadataBlockIndex));
+// actualGeospatialMetadataField3 = listMetadataBlocksResponse.then().extract().path(String.format("data[%d].fields.geographicCoverage.childFields['city'].name", geospatialMetadataBlockIndex));
- assertNull(actualGeospatialMetadataField1);
- assertNotNull(actualGeospatialMetadataField2);
- assertNull(actualGeospatialMetadataField3);
+// assertNull(actualGeospatialMetadataField1);
+// assertNotNull(actualGeospatialMetadataField2);
+// assertNull(actualGeospatialMetadataField3);
citationMetadataBlockIndex = geospatialMetadataBlockIndex == 0 ? 1 : 0;
// notesText has displayOnCreate=true but has include=false, so should not be retrieved
String notesTextCitationMetadataField = listMetadataBlocksResponse.then().extract().path(String.format("data[%d].fields.notesText.name", citationMetadataBlockIndex));
- assertNull(notesTextCitationMetadataField);
+ assertNotNull(notesTextCitationMetadataField);
// producerName is a conditionally required field, so should not be retrieved
String producerNameCitationMetadataField = listMetadataBlocksResponse.then().extract().path(String.format("data[%d].fields.producerName.name", citationMetadataBlockIndex));
@@ -1083,6 +1090,16 @@ public void testListMetadataBlocks() {
.body("data[0].displayName", equalTo("Citation Metadata"))
.body("data[0].fields", not(equalTo(null)))
.body("data.size()", equalTo(1));
+
+ // Checking child / parent logic
+ listMetadataBlocksResponse = UtilIT.getMetadataBlock("citation");
+ listMetadataBlocksResponse.then().assertThat().statusCode(OK.getStatusCode());
+ listMetadataBlocksResponse.then().assertThat()
+ .statusCode(OK.getStatusCode())
+ .body("data.displayName", equalTo("Citation Metadata"))
+ .body("data.fields", not(equalTo(null)))
+ .body("data.fields.otherIdAgency", equalTo(null))
+ .body("data.fields.otherId.childFields.size()", equalTo(2));
}
@Test
diff --git a/src/test/java/edu/harvard/iq/dataverse/api/MetadataBlocksIT.java b/src/test/java/edu/harvard/iq/dataverse/api/MetadataBlocksIT.java
index 6e7061961f0..3b0b56740eb 100644
--- a/src/test/java/edu/harvard/iq/dataverse/api/MetadataBlocksIT.java
+++ b/src/test/java/edu/harvard/iq/dataverse/api/MetadataBlocksIT.java
@@ -1,6 +1,7 @@
package edu.harvard.iq.dataverse.api;
import io.restassured.RestAssured;
+
import io.restassured.response.Response;
import org.hamcrest.CoreMatchers;
import org.junit.jupiter.api.BeforeAll;
@@ -9,6 +10,7 @@
import static jakarta.ws.rs.core.Response.Status.CREATED;
import static jakarta.ws.rs.core.Response.Status.OK;
import static org.hamcrest.CoreMatchers.equalTo;
+import static org.hamcrest.CoreMatchers.is;
import static org.hamcrest.CoreMatchers.not;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assumptions.assumeFalse;
@@ -42,22 +44,27 @@ void testListMetadataBlocks() {
// returnDatasetFieldTypes=true
listMetadataBlocksResponse = UtilIT.listMetadataBlocks(false, true);
- int expectedNumberOfMetadataFields = 80;
+ int expectedNumberOfMetadataFields = 35;
+ listMetadataBlocksResponse.prettyPrint();
listMetadataBlocksResponse.then().assertThat()
.statusCode(OK.getStatusCode())
.body("data[0].fields", not(equalTo(null)))
.body("data[0].fields.size()", equalTo(expectedNumberOfMetadataFields))
- .body("data.size()", equalTo(expectedDefaultNumberOfMetadataBlocks));
+ .body("data.size()", equalTo(expectedDefaultNumberOfMetadataBlocks))
+ .body("data[1].fields.geographicCoverage.childFields.size()", is(4))
+ .body("data[0].fields.publication.childFields.size()", is(5));
// onlyDisplayedOnCreate=true and returnDatasetFieldTypes=true
listMetadataBlocksResponse = UtilIT.listMetadataBlocks(true, true);
- expectedNumberOfMetadataFields = 28;
+ listMetadataBlocksResponse.prettyPrint();
+ expectedNumberOfMetadataFields = 10;
listMetadataBlocksResponse.then().assertThat()
.statusCode(OK.getStatusCode())
.body("data[0].fields", not(equalTo(null)))
.body("data[0].fields.size()", equalTo(expectedNumberOfMetadataFields))
.body("data[0].displayName", equalTo("Citation Metadata"))
- .body("data.size()", equalTo(expectedOnlyDisplayedOnCreateNumberOfMetadataBlocks));
+ .body("data.size()", equalTo(expectedOnlyDisplayedOnCreateNumberOfMetadataBlocks))
+ .body("data[0].fields.author.childFields.size()", is(4));
}
@Test
diff --git a/src/test/java/edu/harvard/iq/dataverse/api/SearchIT.java b/src/test/java/edu/harvard/iq/dataverse/api/SearchIT.java
index b03c23cd1e2..c97762526b0 100644
--- a/src/test/java/edu/harvard/iq/dataverse/api/SearchIT.java
+++ b/src/test/java/edu/harvard/iq/dataverse/api/SearchIT.java
@@ -4,6 +4,9 @@
import io.restassured.path.json.JsonPath;
import io.restassured.response.Response;
import edu.harvard.iq.dataverse.settings.SettingsServiceBean;
+
+import java.util.List;
+import java.util.UUID;
import java.util.logging.Level;
import java.util.logging.Logger;
import jakarta.json.Json;
@@ -29,6 +32,7 @@
import jakarta.json.JsonObjectBuilder;
import static jakarta.ws.rs.core.Response.Status.*;
+import static java.lang.Thread.sleep;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertNotEquals;
@@ -175,6 +179,7 @@ public void testSearchCitation() {
Response createDatasetResponse = UtilIT.createRandomDatasetViaNativeApi(dataverseAlias, apiToken);
createDatasetResponse.prettyPrint();
Integer datasetId = UtilIT.getDatasetIdFromResponse(createDatasetResponse);
+ String datasetPersistentId = UtilIT.getDatasetPersistentIdFromResponse(createDatasetResponse);
Response searchResponse = UtilIT.search("id:dataset_" + datasetId + "_draft", apiToken);
searchResponse.prettyPrint();
@@ -185,20 +190,49 @@ public void testSearchCitation() {
.body("data.items[0].citationHtml", Matchers.containsString("href"))
.statusCode(200);
- Response deleteDatasetResponse = UtilIT.deleteDatasetViaNativeApi(datasetId, apiToken);
- deleteDatasetResponse.prettyPrint();
- deleteDatasetResponse.then().assertThat()
+ String pathToFile = "src/main/webapp/resources/images/dataverseproject.png";
+ Response uploadImage = UtilIT.uploadFileViaNative(datasetId.toString(), pathToFile, apiToken);
+ uploadImage.prettyPrint();
+ uploadImage.then().assertThat()
+ .statusCode(200);
+
+ Response publishResponse = UtilIT.publishDataverseViaNativeApi(dataverseAlias, apiToken);
+ publishResponse.prettyPrint();
+ publishResponse.then().assertThat()
+ .statusCode(OK.getStatusCode());
+ publishResponse = UtilIT.publishDatasetViaNativeApi(datasetId, "major", apiToken);
+ publishResponse.prettyPrint();
+ publishResponse.then().assertThat()
.statusCode(OK.getStatusCode());
- Response deleteDataverseResponse = UtilIT.deleteDataverse(dataverseAlias, apiToken);
- deleteDataverseResponse.prettyPrint();
- deleteDataverseResponse.then().assertThat()
+ Response updateTitleResponseAuthor = UtilIT.updateDatasetTitleViaSword(datasetPersistentId, "New Title", apiToken);
+ updateTitleResponseAuthor.prettyPrint();
+ updateTitleResponseAuthor.then().assertThat()
.statusCode(OK.getStatusCode());
- Response deleteUserResponse = UtilIT.deleteUser(username);
- deleteUserResponse.prettyPrint();
- assertEquals(200, deleteUserResponse.getStatusCode());
+ // search descending will get the latest 100.
+ // This could fail if more than 100 get created between our update and the search. Highly unlikely
+ searchResponse = UtilIT.search("*&type=file&sort=date&order=desc&per_page=100&start=0&subtree=root" , apiToken);
+ searchResponse.prettyPrint();
+ int i=0;
+ String parentCitation = "";
+ String datasetName = "";
+ // most likely ours is in index 0, but it's not a guaranty.
+ while (i < 100) {
+ String dataset_persistent_id = searchResponse.body().jsonPath().getString("data.items[" + i + "].dataset_persistent_id");
+ if (datasetPersistentId.equalsIgnoreCase(dataset_persistent_id)) {
+ parentCitation = searchResponse.body().jsonPath().getString("data.items[" + i + "].dataset_citation");
+ datasetName = searchResponse.body().jsonPath().getString("data.items[" + i + "].dataset_name");
+ break;
+ }
+ i++;
+ }
+ // see https://github.com/IQSS/dataverse/issues/10735
+ // was showing the citation of the draft version and not the released parent
+ assertFalse(parentCitation.contains("New Title"));
+ assertTrue(parentCitation.contains(datasetName));
+ assertFalse(parentCitation.contains("DRAFT"));
}
@Test
@@ -1284,7 +1318,7 @@ public static void cleanup() {
}
@Test
- public void testSearchFilesAndUrlImages() {
+ public void testSearchFilesAndUrlImages() throws InterruptedException {
Response createUser = UtilIT.createRandomUser();
createUser.prettyPrint();
String username = UtilIT.getUsernameFromResponse(createUser);
@@ -1300,8 +1334,12 @@ public void testSearchFilesAndUrlImages() {
System.out.println("id: " + datasetId);
String datasetPid = JsonPath.from(createDatasetResponse.getBody().asString()).getString("data.persistentId");
System.out.println("datasetPid: " + datasetPid);
-
String pathToFile = "src/main/webapp/resources/images/dataverseproject.png";
+ Response logoResponse = UtilIT.uploadDatasetLogo(datasetPid, pathToFile, apiToken);
+ logoResponse.prettyPrint();
+ logoResponse.then().assertThat()
+ .statusCode(200);
+
Response uploadImage = UtilIT.uploadFileViaNative(datasetId.toString(), pathToFile, apiToken);
uploadImage.prettyPrint();
uploadImage.then().assertThat()
@@ -1311,6 +1349,23 @@ public void testSearchFilesAndUrlImages() {
uploadFile.prettyPrint();
uploadFile.then().assertThat()
.statusCode(200);
+ pathToFile = "src/test/resources/tab/test.tab";
+ String searchableUniqueId = "testtab"+ UUID.randomUUID().toString().substring(0, 8); // so the search only returns 1 file
+ JsonObjectBuilder json = Json.createObjectBuilder()
+ .add("description", searchableUniqueId)
+ .add("restrict", "true")
+ .add("categories", Json.createArrayBuilder().add("Data"));
+ Response uploadTabFile = UtilIT.uploadFileViaNative(datasetId.toString(), pathToFile, json.build(), apiToken);
+ uploadTabFile.prettyPrint();
+ uploadTabFile.then().assertThat()
+ .statusCode(200);
+ // Ensure tabular file is ingested
+ sleep(2000);
+ // Set tabular tags
+ String tabularFileId = uploadTabFile.getBody().jsonPath().getString("data.files[0].dataFile.id");
+ List testTabularTags = List.of("Survey", "Genomics");
+ Response setFileTabularTagsResponse = UtilIT.setFileTabularTags(tabularFileId, apiToken, testTabularTags);
+ setFileTabularTagsResponse.then().assertThat().statusCode(OK.getStatusCode());
Response publishDataverse = UtilIT.publishDataverseViaSword(dataverseAlias, apiToken);
publishDataverse.prettyPrint();
@@ -1339,6 +1394,13 @@ public void testSearchFilesAndUrlImages() {
.body("data.items[0].url", CoreMatchers.containsString("/dataverse/"))
.body("data.items[0]", CoreMatchers.not(CoreMatchers.hasItem("image_url")));
+ searchResp = UtilIT.search(datasetPid, apiToken);
+ searchResp.prettyPrint();
+ searchResp.then().assertThat()
+ .statusCode(OK.getStatusCode())
+ .body("data.items[0].type", CoreMatchers.is("dataset"))
+ .body("data.items[0].image_url", CoreMatchers.containsString("/logo"));
+
searchResp = UtilIT.search("mydata", apiToken);
searchResp.prettyPrint();
searchResp.then().assertThat()
@@ -1346,5 +1408,78 @@ public void testSearchFilesAndUrlImages() {
.body("data.items[0].type", CoreMatchers.is("file"))
.body("data.items[0].url", CoreMatchers.containsString("/datafile/"))
.body("data.items[0]", CoreMatchers.not(CoreMatchers.hasItem("image_url")));
+ searchResp = UtilIT.search(searchableUniqueId, apiToken);
+ searchResp.prettyPrint();
+ searchResp.then().assertThat()
+ .statusCode(OK.getStatusCode())
+ .body("data.items[0].type", CoreMatchers.is("file"))
+ .body("data.items[0].url", CoreMatchers.containsString("/datafile/"))
+ .body("data.items[0].variables", CoreMatchers.is(3))
+ .body("data.items[0].observations", CoreMatchers.is(10))
+ .body("data.items[0].restricted", CoreMatchers.is(true))
+ .body("data.items[0].canDownloadFile", CoreMatchers.is(true))
+ .body("data.items[0].tabularTags", CoreMatchers.hasItem("Genomics"))
+ .body("data.items[0]", CoreMatchers.not(CoreMatchers.hasItem("image_url")));
+ }
+
+ @Test
+ public void testShowTypeCounts() {
+ //Create 1 user and 1 Dataverse/Collection
+ Response createUser = UtilIT.createRandomUser();
+ String username = UtilIT.getUsernameFromResponse(createUser);
+ String apiToken = UtilIT.getApiTokenFromResponse(createUser);
+ String affiliation = "testAffiliation";
+
+ // test total_count_per_object_type is not included because the results are empty
+ Response searchResp = UtilIT.search(username, apiToken, "&show_type_counts=true");
+ searchResp.then().assertThat()
+ .statusCode(OK.getStatusCode())
+ .body("data.total_count_per_object_type", CoreMatchers.equalTo(null));
+
+ Response createDataverseResponse = UtilIT.createRandomDataverse(apiToken, affiliation);
+ assertEquals(201, createDataverseResponse.getStatusCode());
+ String dataverseAlias = UtilIT.getAliasFromResponse(createDataverseResponse);
+
+ // create 3 Datasets, each with 2 Datafiles
+ for (int i = 0; i < 3; i++) {
+ Response createDatasetResponse = UtilIT.createRandomDatasetViaNativeApi(dataverseAlias, apiToken);
+ createDatasetResponse.then().assertThat()
+ .statusCode(CREATED.getStatusCode());
+ String datasetId = UtilIT.getDatasetIdFromResponse(createDatasetResponse).toString();
+
+ // putting the dataverseAlias in the description of each file so the search q={dataverseAlias} will return dataverse, dataset, and files for this test only
+ String jsonAsString = "{\"description\":\"" + dataverseAlias + "\",\"directoryLabel\":\"data/subdir1\",\"categories\":[\"Data\"], \"restrict\":\"false\" }";
+
+ String pathToFile = "src/main/webapp/resources/images/dataverseproject.png";
+ Response uploadImage = UtilIT.uploadFileViaNative(datasetId, pathToFile, jsonAsString, apiToken);
+ uploadImage.then().assertThat()
+ .statusCode(200);
+ pathToFile = "src/main/webapp/resources/js/mydata.js";
+ Response uploadFile = UtilIT.uploadFileViaNative(datasetId, pathToFile, jsonAsString, apiToken);
+ uploadFile.then().assertThat()
+ .statusCode(200);
+
+ // This call forces a wait for dataset indexing to finish and gives time for file uploads to complete
+ UtilIT.search("id:dataset_" + datasetId, apiToken);
+ }
+
+ // Test Search without show_type_counts
+ searchResp = UtilIT.search(dataverseAlias, apiToken);
+ searchResp.then().assertThat()
+ .statusCode(OK.getStatusCode())
+ .body("data.total_count_per_object_type", CoreMatchers.equalTo(null));
+ // Test Search with show_type_counts = FALSE
+ searchResp = UtilIT.search(dataverseAlias, apiToken, "&show_type_counts=false");
+ searchResp.then().assertThat()
+ .statusCode(OK.getStatusCode())
+ .body("data.total_count_per_object_type", CoreMatchers.equalTo(null));
+ // Test Search with show_type_counts = TRUE
+ searchResp = UtilIT.search(dataverseAlias, apiToken, "&show_type_counts=true");
+ searchResp.prettyPrint();
+ searchResp.then().assertThat()
+ .statusCode(OK.getStatusCode())
+ .body("data.total_count_per_object_type.Dataverses", CoreMatchers.is(1))
+ .body("data.total_count_per_object_type.Datasets", CoreMatchers.is(3))
+ .body("data.total_count_per_object_type.Files", CoreMatchers.is(6));
}
}
diff --git a/src/test/java/edu/harvard/iq/dataverse/api/UsersIT.java b/src/test/java/edu/harvard/iq/dataverse/api/UsersIT.java
index ce3b8bf75ff..eb78a216626 100644
--- a/src/test/java/edu/harvard/iq/dataverse/api/UsersIT.java
+++ b/src/test/java/edu/harvard/iq/dataverse/api/UsersIT.java
@@ -1,31 +1,33 @@
package edu.harvard.iq.dataverse.api;
+import edu.harvard.iq.dataverse.util.BundleUtil;
import io.restassured.RestAssured;
+
import static io.restassured.RestAssured.given;
+
import io.restassured.http.ContentType;
import io.restassured.path.json.JsonPath;
import io.restassured.response.Response;
import edu.harvard.iq.dataverse.authorization.DataverseRole;
import edu.harvard.iq.dataverse.settings.SettingsServiceBean;
-import java.util.ArrayList;
+
import java.util.Arrays;
import java.util.List;
import java.util.UUID;
+
import jakarta.json.Json;
import jakarta.json.JsonObjectBuilder;
-import static jakarta.ws.rs.core.Response.Status.BAD_REQUEST;
-import static jakarta.ws.rs.core.Response.Status.CREATED;
-import static jakarta.ws.rs.core.Response.Status.NOT_FOUND;
-import static jakarta.ws.rs.core.Response.Status.OK;
-import static jakarta.ws.rs.core.Response.Status.UNAUTHORIZED;
+
+import static jakarta.ws.rs.core.Response.Status.*;
+import static org.hamcrest.Matchers.notNullValue;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.hamcrest.CoreMatchers.containsString;
import static org.hamcrest.CoreMatchers.equalTo;
-import static org.hamcrest.Matchers.contains;
import static org.junit.jupiter.api.Assertions.assertTrue;
import org.hamcrest.CoreMatchers;
import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Disabled;
import org.junit.jupiter.api.Test;
public class UsersIT {
@@ -515,6 +517,177 @@ public void testDeleteAuthenticatedUser() {
}
+ @Test
+ // This test is disabled because it is only compatible with the containerized development environment and would cause the Jenkins job to fail.
+ @Disabled
+ public void testRegisterOIDCUser() {
+ // Set Up - Get the admin access token from the OIDC provider
+ Response adminOidcLoginResponse = UtilIT.performKeycloakROPCLogin("admin", "admin");
+ adminOidcLoginResponse.then().assertThat()
+ .statusCode(OK.getStatusCode())
+ .body("access_token", notNullValue());
+ String adminOidcAccessToken = adminOidcLoginResponse.jsonPath().getString("access_token");
+
+ // Set Up - Create random user in the OIDC provider without some necessary claims (email, firstName and lastName)
+ String randomUsername = UUID.randomUUID().toString().substring(0, 8);
+
+ String newKeycloakUserWithoutClaimsJson = "{"
+ + "\"username\":\"" + randomUsername + "\","
+ + "\"enabled\":true,"
+ + "\"credentials\":["
+ + " {"
+ + " \"type\":\"password\","
+ + " \"value\":\"password\","
+ + " \"temporary\":false"
+ + " }"
+ + "]"
+ + "}";
+
+ Response createKeycloakOidcUserResponse = UtilIT.createKeycloakUser(adminOidcAccessToken, newKeycloakUserWithoutClaimsJson);
+ createKeycloakOidcUserResponse.then().assertThat().statusCode(CREATED.getStatusCode());
+
+ Response newUserOidcLoginResponse = UtilIT.performKeycloakROPCLogin(randomUsername, "password");
+ String userWithoutClaimsAccessToken = newUserOidcLoginResponse.jsonPath().getString("access_token");
+
+ // Set Up - Create a second random user in the OIDC provider with all necessary claims (including email, firstName and lastName)
+ randomUsername = UUID.randomUUID().toString().substring(0, 8);
+ String email = randomUsername + "@dataverse.org";
+ String firstName = "John";
+ String lastName = "Doe";
+
+ String newKeycloakUserWithClaimsJson = "{"
+ + "\"username\":\"" + randomUsername + "\","
+ + "\"enabled\":true,"
+ + "\"email\":\"" + email + "\","
+ + "\"firstName\":\"" + firstName + "\","
+ + "\"lastName\":\"" + lastName + "\","
+ + "\"credentials\":["
+ + " {"
+ + " \"type\":\"password\","
+ + " \"value\":\"password\","
+ + " \"temporary\":false"
+ + " }"
+ + "]"
+ + "}";
+
+ Response createKeycloakOidcUserWithClaimsResponse = UtilIT.createKeycloakUser(adminOidcAccessToken, newKeycloakUserWithClaimsJson);
+ createKeycloakOidcUserWithClaimsResponse.then().assertThat().statusCode(CREATED.getStatusCode());
+
+ Response newUserWithClaimsOidcLoginResponse = UtilIT.performKeycloakROPCLogin(randomUsername, "password");
+ String userWithClaimsAccessToken = newUserWithClaimsOidcLoginResponse.jsonPath().getString("access_token");
+
+ // Should return error when empty token is passed
+ Response registerOidcUserResponse = UtilIT.registerOidcUser(
+ "{}",
+ ""
+ );
+ registerOidcUserResponse.then().assertThat()
+ .statusCode(BAD_REQUEST.getStatusCode())
+ .body("message", equalTo(BundleUtil.getStringFromBundle("users.api.errors.bearerTokenRequired")));
+
+ // Should return error when a malformed User JSON is sent
+ registerOidcUserResponse = UtilIT.registerOidcUser(
+ "{{{user:abcde}",
+ "Bearer testBearerToken"
+ );
+ registerOidcUserResponse.then().assertThat()
+ .statusCode(BAD_REQUEST.getStatusCode())
+ .body("message", equalTo("Error parsing the POSTed User json: Invalid token=CURLYOPEN at (line no=1, column no=2, offset=1). Expected tokens are: [STRING]"));
+
+ // Should return error when the provided User JSON is valid but the provided Bearer token is invalid
+ registerOidcUserResponse = UtilIT.registerOidcUser(
+ "{"
+ + "\"termsAccepted\":true"
+ + "}",
+ "Bearer testBearerToken"
+ );
+ registerOidcUserResponse.then().assertThat()
+ .statusCode(UNAUTHORIZED.getStatusCode())
+ .body("message", equalTo("Unauthorized bearer token."));
+
+ // Should return an error when the termsAccepted field is missing in the User JSON
+ registerOidcUserResponse = UtilIT.registerOidcUser(
+ "{"
+ + "\"affiliation\":\"YourAffiliation\","
+ + "\"position\":\"YourPosition\""
+ + "}",
+ "Bearer testBearerToken"
+ );
+ registerOidcUserResponse.then().assertThat()
+ .statusCode(BAD_REQUEST.getStatusCode())
+ .body("message", equalTo("Error parsing the POSTed User json: Field 'termsAccepted' is mandatory"));
+
+ // Should return an error when the Bearer token is valid but required claims are missing in the IdP, needing completion from the request JSON
+ registerOidcUserResponse = UtilIT.registerOidcUser(
+ "{"
+ + "\"termsAccepted\":true"
+ + "}",
+ "Bearer " + userWithoutClaimsAccessToken
+ );
+ registerOidcUserResponse.then().assertThat()
+ .statusCode(BAD_REQUEST.getStatusCode())
+ .body("message", equalTo(BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.invalidFields")))
+ .body("fieldErrors.firstName", equalTo(BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.provideMissingClaimsEnabled.fieldRequired", List.of("firstName"))))
+ .body("fieldErrors.lastName", equalTo(BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.provideMissingClaimsEnabled.fieldRequired", List.of("lastName"))))
+ .body("fieldErrors.emailAddress", equalTo(BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.provideMissingClaimsEnabled.fieldRequired", List.of("emailAddress"))));
+
+ // Should register user when the Bearer token is valid and the provided User JSON contains the missing claims in the IdP
+ registerOidcUserResponse = UtilIT.registerOidcUser(
+ "{"
+ + "\"firstName\":\"testFirstName\","
+ + "\"lastName\":\"testLastName\","
+ + "\"emailAddress\":\"" + UUID.randomUUID().toString().substring(0, 8) + "@dataverse.org\","
+ + "\"termsAccepted\":true"
+ + "}",
+ "Bearer " + userWithoutClaimsAccessToken
+ );
+ registerOidcUserResponse.then().assertThat()
+ .statusCode(OK.getStatusCode())
+ .body("data.message", equalTo("User registered."));
+
+ // Should return error when attempting to re-register with the same Bearer token but different User data
+ String newUserJson = "{"
+ + "\"firstName\":\"newFirstName\","
+ + "\"lastName\":\"newLastName\","
+ + "\"emailAddress\":\"newEmail@dataverse.com\","
+ + "\"termsAccepted\":true"
+ + "}";
+ registerOidcUserResponse = UtilIT.registerOidcUser(
+ newUserJson,
+ "Bearer " + userWithoutClaimsAccessToken
+ );
+ registerOidcUserResponse.then().assertThat()
+ .statusCode(FORBIDDEN.getStatusCode())
+ .body("message", equalTo("User is already registered with this token."));
+
+ // Should return an error when the Bearer token is valid and attempting to set JSON properties that conflict with existing claims in the IdP
+ registerOidcUserResponse = UtilIT.registerOidcUser(
+ "{"
+ + "\"firstName\":\"testFirstName\","
+ + "\"lastName\":\"testLastName\","
+ + "\"emailAddress\":\"" + UUID.randomUUID().toString().substring(0, 8) + "@dataverse.org\","
+ + "\"termsAccepted\":true"
+ + "}",
+ "Bearer " + userWithClaimsAccessToken
+ );
+ registerOidcUserResponse.then().assertThat()
+ .statusCode(BAD_REQUEST.getStatusCode())
+ .body("fieldErrors.firstName", equalTo(BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.provideMissingClaimsEnabled.fieldAlreadyPresentInProvider", List.of("firstName"))))
+ .body("fieldErrors.lastName", equalTo(BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.provideMissingClaimsEnabled.fieldAlreadyPresentInProvider", List.of("lastName"))))
+ .body("fieldErrors.emailAddress", equalTo(BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.provideMissingClaimsEnabled.fieldAlreadyPresentInProvider", List.of("emailAddress"))));
+
+ // Should register user when the Bearer token is valid and all required claims are present in the IdP, requiring only minimal data in the User JSON
+ registerOidcUserResponse = UtilIT.registerOidcUser(
+ "{"
+ + "\"termsAccepted\":true"
+ + "}",
+ "Bearer " + userWithClaimsAccessToken
+ );
+ registerOidcUserResponse.then().assertThat()
+ .statusCode(OK.getStatusCode())
+ .body("data.message", equalTo("User registered."));
+ }
+
private Response convertUserFromBcryptToSha1(long idOfBcryptUserToConvert, String password) {
JsonObjectBuilder data = Json.createObjectBuilder();
data.add("builtinUserId", idOfBcryptUserToConvert);
diff --git a/src/test/java/edu/harvard/iq/dataverse/api/UtilIT.java b/src/test/java/edu/harvard/iq/dataverse/api/UtilIT.java
index b9947e2e870..6c4eae0d06f 100644
--- a/src/test/java/edu/harvard/iq/dataverse/api/UtilIT.java
+++ b/src/test/java/edu/harvard/iq/dataverse/api/UtilIT.java
@@ -24,6 +24,7 @@
import edu.harvard.iq.dataverse.api.datadeposit.SwordConfigurationImpl;
import io.restassured.path.xml.XmlPath;
import edu.harvard.iq.dataverse.mydata.MyDataFilterParams;
+import jakarta.ws.rs.core.HttpHeaders;
import org.apache.commons.lang3.StringUtils;
import org.junit.jupiter.api.Test;
import edu.harvard.iq.dataverse.settings.SettingsServiceBean;
@@ -4305,6 +4306,60 @@ static Response deleteDatasetTypes(long doomed, String apiToken) {
.delete("/api/datasets/datasetTypes/" + doomed);
}
+ static Response registerOidcUser(String jsonIn, String bearerToken) {
+ return given()
+ .header(HttpHeaders.AUTHORIZATION, bearerToken)
+ .body(jsonIn)
+ .contentType(ContentType.JSON)
+ .post("/api/users/register");
+ }
+
+ /**
+ * Creates a new user in the development Keycloak instance.
+ * This method is specifically designed for use in the containerized Keycloak development
+ * environment. The configured Keycloak instance must be accessible at the specified URL.
+ * The method sends a request to the Keycloak Admin API to create a new user in the given realm.
+ *
+ *
Refer to the {@code testRegisterOidc()} method in the {@code UsersIT} class for an example
+ * of this method in action.
+ *
+ * @param bearerToken The Bearer token used for authenticating the request to the Keycloak Admin API.
+ * @param userJson The JSON representation of the user to be created.
+ * @return A {@link Response} containing the result of the user creation request.
+ */
+ static Response createKeycloakUser(String bearerToken, String userJson) {
+ return given()
+ .contentType(ContentType.JSON)
+ .header(HttpHeaders.AUTHORIZATION, "Bearer " + bearerToken)
+ .body(userJson)
+ .post("http://keycloak.mydomain.com:8090/admin/realms/test/users");
+ }
+
+ /**
+ * Performs an OIDC login in the development Keycloak instance using the Resource Owner Password Credentials (ROPC)
+ * grant type to retrieve authentication tokens from a Keycloak instance.
+ *
+ *
This method is specifically designed for use in the containerized Keycloak development
+ * environment. The configured Keycloak instance must be accessible at the specified URL.
+ *
+ *
Refer to the {@code testRegisterOidc()} method in the {@code UsersIT} class for an example
+ * of this method in action.
+ *
+ * @return A {@link Response} containing authentication tokens, including access and refresh tokens,
+ * if the login is successful.
+ */
+ static Response performKeycloakROPCLogin(String username, String password) {
+ return given()
+ .contentType(ContentType.URLENC)
+ .formParam("client_id", "test")
+ .formParam("client_secret", "94XHrfNRwXsjqTqApRrwWmhDLDHpIYV8")
+ .formParam("username", username)
+ .formParam("password", password)
+ .formParam("grant_type", "password")
+ .formParam("scope", "openid")
+ .post("http://keycloak.mydomain.com:8090/realms/test/protocol/openid-connect/token");
+ }
+
static Response createFeaturedItem(String dataverseAlias, String apiToken, String title, String content, String pathToFile) {
return given()
.header(API_TOKEN_HTTP_HEADER, apiToken)
diff --git a/src/test/java/edu/harvard/iq/dataverse/api/auth/ApiKeyAuthMechanismTest.java b/src/test/java/edu/harvard/iq/dataverse/api/auth/ApiKeyAuthMechanismTest.java
index 486697664e6..12216819cf8 100644
--- a/src/test/java/edu/harvard/iq/dataverse/api/auth/ApiKeyAuthMechanismTest.java
+++ b/src/test/java/edu/harvard/iq/dataverse/api/auth/ApiKeyAuthMechanismTest.java
@@ -84,9 +84,9 @@ public void testFindUserFromRequest_ApiKeyProvided_AnonymizedPrivateUrlUserAuthe
sut.userSvc = Mockito.mock(UserServiceBean.class);
ContainerRequestContext testContainerRequest = new ApiKeyContainerRequestTestFake(TEST_API_KEY, TEST_PATH);
- WrappedAuthErrorResponse wrappedAuthErrorResponse = assertThrows(WrappedAuthErrorResponse.class, () -> sut.findUserFromRequest(testContainerRequest));
+ WrappedUnauthorizedAuthErrorResponse wrappedUnauthorizedAuthErrorResponse = assertThrows(WrappedUnauthorizedAuthErrorResponse.class, () -> sut.findUserFromRequest(testContainerRequest));
- assertEquals(RESPONSE_MESSAGE_BAD_API_KEY, wrappedAuthErrorResponse.getMessage());
+ assertEquals(RESPONSE_MESSAGE_BAD_API_KEY, wrappedUnauthorizedAuthErrorResponse.getMessage());
}
@Test
@@ -123,8 +123,8 @@ public void testFindUserFromRequest_ApiKeyProvided_CanNotAuthenticateUserWithAny
sut.userSvc = Mockito.mock(UserServiceBean.class);
ContainerRequestContext testContainerRequest = new ApiKeyContainerRequestTestFake(TEST_API_KEY, TEST_PATH);
- WrappedAuthErrorResponse wrappedAuthErrorResponse = assertThrows(WrappedAuthErrorResponse.class, () -> sut.findUserFromRequest(testContainerRequest));
+ WrappedUnauthorizedAuthErrorResponse wrappedUnauthorizedAuthErrorResponse = assertThrows(WrappedUnauthorizedAuthErrorResponse.class, () -> sut.findUserFromRequest(testContainerRequest));
- assertEquals(RESPONSE_MESSAGE_BAD_API_KEY, wrappedAuthErrorResponse.getMessage());
+ assertEquals(RESPONSE_MESSAGE_BAD_API_KEY, wrappedUnauthorizedAuthErrorResponse.getMessage());
}
}
diff --git a/src/test/java/edu/harvard/iq/dataverse/api/auth/BearerTokenAuthMechanismTest.java b/src/test/java/edu/harvard/iq/dataverse/api/auth/BearerTokenAuthMechanismTest.java
index 7e1c23d26f4..ab4090eb0a0 100644
--- a/src/test/java/edu/harvard/iq/dataverse/api/auth/BearerTokenAuthMechanismTest.java
+++ b/src/test/java/edu/harvard/iq/dataverse/api/auth/BearerTokenAuthMechanismTest.java
@@ -1,15 +1,13 @@
package edu.harvard.iq.dataverse.api.auth;
-import com.nimbusds.oauth2.sdk.ParseException;
-import com.nimbusds.oauth2.sdk.token.BearerAccessToken;
import edu.harvard.iq.dataverse.UserServiceBean;
import edu.harvard.iq.dataverse.api.auth.doubles.BearerTokenKeyContainerRequestTestFake;
import edu.harvard.iq.dataverse.authorization.AuthenticationServiceBean;
-import edu.harvard.iq.dataverse.authorization.UserRecordIdentifier;
-import edu.harvard.iq.dataverse.authorization.providers.oauth2.oidc.OIDCAuthProvider;
+import edu.harvard.iq.dataverse.authorization.exceptions.AuthorizationException;
import edu.harvard.iq.dataverse.authorization.users.AuthenticatedUser;
import edu.harvard.iq.dataverse.authorization.users.User;
import edu.harvard.iq.dataverse.settings.JvmSettings;
+import edu.harvard.iq.dataverse.util.BundleUtil;
import edu.harvard.iq.dataverse.util.testing.JvmSetting;
import edu.harvard.iq.dataverse.util.testing.LocalJvmSettings;
import org.junit.jupiter.api.BeforeEach;
@@ -18,18 +16,13 @@
import jakarta.ws.rs.container.ContainerRequestContext;
-import java.io.IOException;
-import java.util.Collections;
-import java.util.Optional;
-
-import static edu.harvard.iq.dataverse.api.auth.BearerTokenAuthMechanism.*;
import static org.junit.jupiter.api.Assertions.*;
@LocalJvmSettings
@JvmSetting(key = JvmSettings.FEATURE_FLAG, value = "true", varArgs = "api-bearer-auth")
class BearerTokenAuthMechanismTest {
- private static final String TEST_API_KEY = "test-api-key";
+ private static final String TEST_BEARER_TOKEN = "Bearer test";
private BearerTokenAuthMechanism sut;
@@ -49,119 +42,42 @@ void testFindUserFromRequest_no_token() throws WrappedAuthErrorResponse {
}
@Test
- void testFindUserFromRequest_invalid_token() {
- Mockito.when(sut.authSvc.getAuthenticationProviderIdsOfType(OIDCAuthProvider.class)).thenReturn(Collections.emptySet());
-
- ContainerRequestContext testContainerRequest = new BearerTokenKeyContainerRequestTestFake("Bearer ");
- WrappedAuthErrorResponse wrappedAuthErrorResponse = assertThrows(WrappedAuthErrorResponse.class, () -> sut.findUserFromRequest(testContainerRequest));
-
- //then
- assertEquals(INVALID_BEARER_TOKEN, wrappedAuthErrorResponse.getMessage());
- }
- @Test
- void testFindUserFromRequest_no_OidcProvider() {
- Mockito.when(sut.authSvc.getAuthenticationProviderIdsOfType(OIDCAuthProvider.class)).thenReturn(Collections.emptySet());
-
- ContainerRequestContext testContainerRequest = new BearerTokenKeyContainerRequestTestFake("Bearer " +TEST_API_KEY);
- WrappedAuthErrorResponse wrappedAuthErrorResponse = assertThrows(WrappedAuthErrorResponse.class, () -> sut.findUserFromRequest(testContainerRequest));
-
- //then
- assertEquals(BEARER_TOKEN_DETECTED_NO_OIDC_PROVIDER_CONFIGURED, wrappedAuthErrorResponse.getMessage());
- }
-
- @Test
- void testFindUserFromRequest_oneProvider_invalidToken_1() throws ParseException, IOException {
- OIDCAuthProvider oidcAuthProvider = Mockito.mock(OIDCAuthProvider.class);
- String providerID = "OIEDC";
- Mockito.when(oidcAuthProvider.getId()).thenReturn(providerID);
- // ensure that a valid OIDCAuthProvider is available within the AuthenticationServiceBean
- Mockito.when(sut.authSvc.getAuthenticationProviderIdsOfType(OIDCAuthProvider.class)).thenReturn(Collections.singleton(providerID));
- Mockito.when(sut.authSvc.getAuthenticationProvider(providerID)).thenReturn(oidcAuthProvider);
-
- // ensure that the OIDCAuthProvider returns a valid UserRecordIdentifier for a given Token
- BearerAccessToken token = BearerAccessToken.parse("Bearer " + TEST_API_KEY);
- Mockito.when(oidcAuthProvider.getUserIdentifier(token)).thenReturn(Optional.empty());
+ void testFindUserFromRequest_invalid_token() throws AuthorizationException {
+ String testErrorMessage = "test error";
+ Mockito.when(sut.authSvc.lookupUserByOIDCBearerToken(TEST_BEARER_TOKEN)).thenThrow(new AuthorizationException(testErrorMessage));
// when
- ContainerRequestContext testContainerRequest = new BearerTokenKeyContainerRequestTestFake("Bearer " + TEST_API_KEY);
- WrappedAuthErrorResponse wrappedAuthErrorResponse = assertThrows(WrappedAuthErrorResponse.class, () -> sut.findUserFromRequest(testContainerRequest));
+ ContainerRequestContext testContainerRequest = new BearerTokenKeyContainerRequestTestFake(TEST_BEARER_TOKEN);
+ WrappedUnauthorizedAuthErrorResponse wrappedUnauthorizedAuthErrorResponse = assertThrows(WrappedUnauthorizedAuthErrorResponse.class, () -> sut.findUserFromRequest(testContainerRequest));
//then
- assertEquals(UNAUTHORIZED_BEARER_TOKEN, wrappedAuthErrorResponse.getMessage());
+ assertEquals(testErrorMessage, wrappedUnauthorizedAuthErrorResponse.getMessage());
}
@Test
- void testFindUserFromRequest_oneProvider_invalidToken_2() throws ParseException, IOException {
- OIDCAuthProvider oidcAuthProvider = Mockito.mock(OIDCAuthProvider.class);
- String providerID = "OIEDC";
- Mockito.when(oidcAuthProvider.getId()).thenReturn(providerID);
- // ensure that a valid OIDCAuthProvider is available within the AuthenticationServiceBean
- Mockito.when(sut.authSvc.getAuthenticationProviderIdsOfType(OIDCAuthProvider.class)).thenReturn(Collections.singleton(providerID));
- Mockito.when(sut.authSvc.getAuthenticationProvider(providerID)).thenReturn(oidcAuthProvider);
-
- // ensure that the OIDCAuthProvider returns a valid UserRecordIdentifier for a given Token
- BearerAccessToken token = BearerAccessToken.parse("Bearer " + TEST_API_KEY);
- Mockito.when(oidcAuthProvider.getUserIdentifier(token)).thenThrow(IOException.class);
-
- // when
- ContainerRequestContext testContainerRequest = new BearerTokenKeyContainerRequestTestFake("Bearer " + TEST_API_KEY);
- WrappedAuthErrorResponse wrappedAuthErrorResponse = assertThrows(WrappedAuthErrorResponse.class, () -> sut.findUserFromRequest(testContainerRequest));
-
- //then
- assertEquals(UNAUTHORIZED_BEARER_TOKEN, wrappedAuthErrorResponse.getMessage());
- }
- @Test
- void testFindUserFromRequest_oneProvider_validToken() throws WrappedAuthErrorResponse, ParseException, IOException {
- OIDCAuthProvider oidcAuthProvider = Mockito.mock(OIDCAuthProvider.class);
- String providerID = "OIEDC";
- Mockito.when(oidcAuthProvider.getId()).thenReturn(providerID);
- // ensure that a valid OIDCAuthProvider is available within the AuthenticationServiceBean
- Mockito.when(sut.authSvc.getAuthenticationProviderIdsOfType(OIDCAuthProvider.class)).thenReturn(Collections.singleton(providerID));
- Mockito.when(sut.authSvc.getAuthenticationProvider(providerID)).thenReturn(oidcAuthProvider);
-
- // ensure that the OIDCAuthProvider returns a valid UserRecordIdentifier for a given Token
- UserRecordIdentifier userinfo = new UserRecordIdentifier(providerID, "KEY");
- BearerAccessToken token = BearerAccessToken.parse("Bearer " + TEST_API_KEY);
- Mockito.when(oidcAuthProvider.getUserIdentifier(token)).thenReturn(Optional.of(userinfo));
-
- // ensures that the AuthenticationServiceBean can retrieve an Authenticated user based on the UserRecordIdentifier
+ void testFindUserFromRequest_validToken_accountExists() throws WrappedAuthErrorResponse, AuthorizationException {
AuthenticatedUser testAuthenticatedUser = new AuthenticatedUser();
- Mockito.when(sut.authSvc.lookupUser(userinfo)).thenReturn(testAuthenticatedUser);
+ Mockito.when(sut.authSvc.lookupUserByOIDCBearerToken(TEST_BEARER_TOKEN)).thenReturn(testAuthenticatedUser);
Mockito.when(sut.userSvc.updateLastApiUseTime(testAuthenticatedUser)).thenReturn(testAuthenticatedUser);
// when
- ContainerRequestContext testContainerRequest = new BearerTokenKeyContainerRequestTestFake("Bearer " + TEST_API_KEY);
+ ContainerRequestContext testContainerRequest = new BearerTokenKeyContainerRequestTestFake(TEST_BEARER_TOKEN);
User actual = sut.findUserFromRequest(testContainerRequest);
//then
assertEquals(testAuthenticatedUser, actual);
Mockito.verify(sut.userSvc, Mockito.atLeastOnce()).updateLastApiUseTime(testAuthenticatedUser);
-
}
- @Test
- void testFindUserFromRequest_oneProvider_validToken_noAccount() throws WrappedAuthErrorResponse, ParseException, IOException {
- OIDCAuthProvider oidcAuthProvider = Mockito.mock(OIDCAuthProvider.class);
- String providerID = "OIEDC";
- Mockito.when(oidcAuthProvider.getId()).thenReturn(providerID);
- // ensure that a valid OIDCAuthProvider is available within the AuthenticationServiceBean
- Mockito.when(sut.authSvc.getAuthenticationProviderIdsOfType(OIDCAuthProvider.class)).thenReturn(Collections.singleton(providerID));
- Mockito.when(sut.authSvc.getAuthenticationProvider(providerID)).thenReturn(oidcAuthProvider);
-
- // ensure that the OIDCAuthProvider returns a valid UserRecordIdentifier for a given Token
- UserRecordIdentifier userinfo = new UserRecordIdentifier(providerID, "KEY");
- BearerAccessToken token = BearerAccessToken.parse("Bearer " + TEST_API_KEY);
- Mockito.when(oidcAuthProvider.getUserIdentifier(token)).thenReturn(Optional.of(userinfo));
-
- // ensures that the AuthenticationServiceBean can retrieve an Authenticated user based on the UserRecordIdentifier
- Mockito.when(sut.authSvc.lookupUser(userinfo)).thenReturn(null);
+ @Test
+ void testFindUserFromRequest_validToken_noAccount() throws AuthorizationException {
+ Mockito.when(sut.authSvc.lookupUserByOIDCBearerToken(TEST_BEARER_TOKEN)).thenReturn(null);
// when
- ContainerRequestContext testContainerRequest = new BearerTokenKeyContainerRequestTestFake("Bearer " + TEST_API_KEY);
- User actual = sut.findUserFromRequest(testContainerRequest);
+ ContainerRequestContext testContainerRequest = new BearerTokenKeyContainerRequestTestFake(TEST_BEARER_TOKEN);
+ WrappedForbiddenAuthErrorResponse wrappedForbiddenAuthErrorResponse = assertThrows(WrappedForbiddenAuthErrorResponse.class, () -> sut.findUserFromRequest(testContainerRequest));
//then
- assertNull(actual);
-
+ assertEquals(BundleUtil.getStringFromBundle("bearerTokenAuthMechanism.errors.tokenValidatedButNoRegisteredUser"), wrappedForbiddenAuthErrorResponse.getMessage());
}
}
diff --git a/src/test/java/edu/harvard/iq/dataverse/api/auth/SignedUrlAuthMechanismTest.java b/src/test/java/edu/harvard/iq/dataverse/api/auth/SignedUrlAuthMechanismTest.java
index 74db6e544da..6fd7d2e1d8e 100644
--- a/src/test/java/edu/harvard/iq/dataverse/api/auth/SignedUrlAuthMechanismTest.java
+++ b/src/test/java/edu/harvard/iq/dataverse/api/auth/SignedUrlAuthMechanismTest.java
@@ -65,9 +65,9 @@ public void testFindUserFromRequest_SignedUrlTokenProvided_UserExists_InvalidSig
sut.authSvc = authenticationServiceBeanStub;
ContainerRequestContext testContainerRequest = new SignedUrlContainerRequestTestFake(TEST_SIGNED_URL_TOKEN, TEST_SIGNED_URL_USER_ID);
- WrappedAuthErrorResponse wrappedAuthErrorResponse = assertThrows(WrappedAuthErrorResponse.class, () -> sut.findUserFromRequest(testContainerRequest));
+ WrappedUnauthorizedAuthErrorResponse wrappedUnauthorizedAuthErrorResponse = assertThrows(WrappedUnauthorizedAuthErrorResponse.class, () -> sut.findUserFromRequest(testContainerRequest));
- assertEquals(RESPONSE_MESSAGE_BAD_SIGNED_URL, wrappedAuthErrorResponse.getMessage());
+ assertEquals(RESPONSE_MESSAGE_BAD_SIGNED_URL, wrappedUnauthorizedAuthErrorResponse.getMessage());
}
@Test
@@ -79,9 +79,9 @@ public void testFindUserFromRequest_SignedUrlTokenProvided_UserExists_UserApiTok
sut.authSvc = authenticationServiceBeanStub;
ContainerRequestContext testContainerRequest = new SignedUrlContainerRequestTestFake(TEST_SIGNED_URL_TOKEN, TEST_SIGNED_URL_USER_ID);
- WrappedAuthErrorResponse wrappedAuthErrorResponse = assertThrows(WrappedAuthErrorResponse.class, () -> sut.findUserFromRequest(testContainerRequest));
+ WrappedUnauthorizedAuthErrorResponse wrappedUnauthorizedAuthErrorResponse = assertThrows(WrappedUnauthorizedAuthErrorResponse.class, () -> sut.findUserFromRequest(testContainerRequest));
- assertEquals(RESPONSE_MESSAGE_BAD_SIGNED_URL, wrappedAuthErrorResponse.getMessage());
+ assertEquals(RESPONSE_MESSAGE_BAD_SIGNED_URL, wrappedUnauthorizedAuthErrorResponse.getMessage());
}
@Test
@@ -92,8 +92,8 @@ public void testFindUserFromRequest_SignedUrlTokenProvided_UserDoesNotExistForTh
sut.authSvc = authenticationServiceBeanStub;
ContainerRequestContext testContainerRequest = new SignedUrlContainerRequestTestFake(TEST_SIGNED_URL_TOKEN, TEST_SIGNED_URL_USER_ID);
- WrappedAuthErrorResponse wrappedAuthErrorResponse = assertThrows(WrappedAuthErrorResponse.class, () -> sut.findUserFromRequest(testContainerRequest));
+ WrappedUnauthorizedAuthErrorResponse wrappedUnauthorizedAuthErrorResponse = assertThrows(WrappedUnauthorizedAuthErrorResponse.class, () -> sut.findUserFromRequest(testContainerRequest));
- assertEquals(RESPONSE_MESSAGE_BAD_SIGNED_URL, wrappedAuthErrorResponse.getMessage());
+ assertEquals(RESPONSE_MESSAGE_BAD_SIGNED_URL, wrappedUnauthorizedAuthErrorResponse.getMessage());
}
}
diff --git a/src/test/java/edu/harvard/iq/dataverse/api/auth/WorkflowKeyAuthMechanismTest.java b/src/test/java/edu/harvard/iq/dataverse/api/auth/WorkflowKeyAuthMechanismTest.java
index 3f90fa73fa9..22c3abffe2b 100644
--- a/src/test/java/edu/harvard/iq/dataverse/api/auth/WorkflowKeyAuthMechanismTest.java
+++ b/src/test/java/edu/harvard/iq/dataverse/api/auth/WorkflowKeyAuthMechanismTest.java
@@ -54,8 +54,8 @@ public void testFindUserFromRequest_WorkflowKeyProvided_UserNotAuthenticated() {
sut.authSvc = authenticationServiceBeanStub;
ContainerRequestContext testContainerRequest = new WorkflowKeyContainerRequestTestFake(TEST_WORKFLOW_KEY);
- WrappedAuthErrorResponse wrappedAuthErrorResponse = assertThrows(WrappedAuthErrorResponse.class, () -> sut.findUserFromRequest(testContainerRequest));
+ WrappedUnauthorizedAuthErrorResponse wrappedUnauthorizedAuthErrorResponse = assertThrows(WrappedUnauthorizedAuthErrorResponse.class, () -> sut.findUserFromRequest(testContainerRequest));
- assertEquals(RESPONSE_MESSAGE_BAD_WORKFLOW_KEY, wrappedAuthErrorResponse.getMessage());
+ assertEquals(RESPONSE_MESSAGE_BAD_WORKFLOW_KEY, wrappedUnauthorizedAuthErrorResponse.getMessage());
}
}
diff --git a/src/test/java/edu/harvard/iq/dataverse/authorization/AuthenticationServiceBeanTest.java b/src/test/java/edu/harvard/iq/dataverse/authorization/AuthenticationServiceBeanTest.java
new file mode 100644
index 00000000000..56ac4eefb3d
--- /dev/null
+++ b/src/test/java/edu/harvard/iq/dataverse/authorization/AuthenticationServiceBeanTest.java
@@ -0,0 +1,152 @@
+package edu.harvard.iq.dataverse.authorization;
+
+import com.nimbusds.oauth2.sdk.ParseException;
+import com.nimbusds.oauth2.sdk.token.BearerAccessToken;
+import com.nimbusds.openid.connect.sdk.claims.UserInfo;
+import edu.harvard.iq.dataverse.authorization.exceptions.AuthorizationException;
+import edu.harvard.iq.dataverse.authorization.providers.oauth2.OAuth2Exception;
+import edu.harvard.iq.dataverse.authorization.providers.oauth2.OAuth2UserRecord;
+import edu.harvard.iq.dataverse.authorization.providers.oauth2.oidc.OIDCAuthProvider;
+import edu.harvard.iq.dataverse.authorization.users.AuthenticatedUser;
+import edu.harvard.iq.dataverse.authorization.users.User;
+import edu.harvard.iq.dataverse.util.BundleUtil;
+import jakarta.persistence.EntityManager;
+import jakarta.persistence.NoResultException;
+import jakarta.persistence.TypedQuery;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.Mockito;
+
+import java.io.IOException;
+import java.util.Map;
+import java.util.Optional;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+public class AuthenticationServiceBeanTest {
+
+ private AuthenticationServiceBean sut;
+ private static final String TEST_BEARER_TOKEN = "Bearer test";
+
+ @BeforeEach
+ public void setUp() {
+ sut = new AuthenticationServiceBean();
+ sut.authProvidersRegistrationService = Mockito.mock(AuthenticationProvidersRegistrationServiceBean.class);
+ sut.em = Mockito.mock(EntityManager.class);
+ }
+
+ @Test
+ void testLookupUserByOIDCBearerToken_no_OIDCProvider() {
+ // Given no OIDC providers are configured
+ Mockito.when(sut.authProvidersRegistrationService.getAuthenticationProvidersMap()).thenReturn(Map.of());
+
+ // When invoking lookupUserByOIDCBearerToken
+ AuthorizationException exception = assertThrows(AuthorizationException.class,
+ () -> sut.lookupUserByOIDCBearerToken(TEST_BEARER_TOKEN));
+
+ // Then the exception message should indicate no OIDC provider is configured
+ assertEquals(BundleUtil.getStringFromBundle("authenticationServiceBean.errors.bearerTokenDetectedNoOIDCProviderConfigured"), exception.getMessage());
+ }
+
+ @Test
+ void testLookupUserByOIDCBearerToken_oneProvider_invalidToken_1() throws ParseException, OAuth2Exception, IOException {
+ // Given a single OIDC provider that cannot find a user
+ OIDCAuthProvider oidcAuthProviderStub = stubOIDCAuthProvider("OIEDC");
+ BearerAccessToken token = BearerAccessToken.parse(TEST_BEARER_TOKEN);
+ Mockito.when(oidcAuthProviderStub.getUserInfo(token)).thenReturn(Optional.empty());
+
+ // When invoking lookupUserByOIDCBearerToken
+ AuthorizationException exception = assertThrows(AuthorizationException.class,
+ () -> sut.lookupUserByOIDCBearerToken(TEST_BEARER_TOKEN));
+
+ // Then the exception message should indicate an unauthorized token
+ assertEquals(BundleUtil.getStringFromBundle("authenticationServiceBean.errors.unauthorizedBearerToken"), exception.getMessage());
+ }
+
+ @Test
+ void testLookupUserByOIDCBearerToken_oneProvider_invalidToken_2() throws ParseException, IOException, OAuth2Exception {
+ // Given a single OIDC provider that throws an IOException
+ OIDCAuthProvider oidcAuthProviderStub = stubOIDCAuthProvider("OIEDC");
+ BearerAccessToken token = BearerAccessToken.parse(TEST_BEARER_TOKEN);
+ Mockito.when(oidcAuthProviderStub.getUserInfo(token)).thenThrow(IOException.class);
+
+ // When invoking lookupUserByOIDCBearerToken
+ AuthorizationException exception = assertThrows(AuthorizationException.class,
+ () -> sut.lookupUserByOIDCBearerToken(TEST_BEARER_TOKEN));
+
+ // Then the exception message should indicate an unauthorized token
+ assertEquals(BundleUtil.getStringFromBundle("authenticationServiceBean.errors.unauthorizedBearerToken"), exception.getMessage());
+ }
+
+ @Test
+ void testLookupUserByOIDCBearerToken_oneProvider_validToken() throws ParseException, IOException, AuthorizationException, OAuth2Exception {
+ // Given a single OIDC provider that returns a valid user identifier
+ setUpOIDCProviderWhichValidatesToken();
+
+ // Setting up an authenticated user is found
+ AuthenticatedUser authenticatedUser = setupAuthenticatedUserQueryWithResult(new AuthenticatedUser());
+
+ // When invoking lookupUserByOIDCBearerToken
+ User actualUser = sut.lookupUserByOIDCBearerToken(TEST_BEARER_TOKEN);
+
+ // Then the actual user should match the expected authenticated user
+ assertEquals(authenticatedUser, actualUser);
+ }
+
+ @Test
+ void testLookupUserByOIDCBearerToken_oneProvider_validToken_noAccount() throws ParseException, IOException, AuthorizationException, OAuth2Exception {
+ // Given a single OIDC provider that returns a valid user identifier
+ setUpOIDCProviderWhichValidatesToken();
+
+ // Setting up an authenticated user is not found
+ setupAuthenticatedUserQueryWithNoResult();
+
+ // When invoking lookupUserByOIDCBearerToken
+ User actualUser = sut.lookupUserByOIDCBearerToken(TEST_BEARER_TOKEN);
+
+ // Then no user should be found, and result should be null
+ assertNull(actualUser);
+ }
+
+ private AuthenticatedUser setupAuthenticatedUserQueryWithResult(AuthenticatedUser authenticatedUser) {
+ TypedQuery queryStub = Mockito.mock(TypedQuery.class);
+ AuthenticatedUserLookup lookupStub = Mockito.mock(AuthenticatedUserLookup.class);
+ Mockito.when(lookupStub.getAuthenticatedUser()).thenReturn(authenticatedUser);
+ Mockito.when(queryStub.getSingleResult()).thenReturn(lookupStub);
+ Mockito.when(sut.em.createNamedQuery("AuthenticatedUserLookup.findByAuthPrvID_PersUserId", AuthenticatedUserLookup.class)).thenReturn(queryStub);
+ return authenticatedUser;
+ }
+
+ private void setupAuthenticatedUserQueryWithNoResult() {
+ TypedQuery queryStub = Mockito.mock(TypedQuery.class);
+ Mockito.when(queryStub.getSingleResult()).thenThrow(new NoResultException());
+ Mockito.when(sut.em.createNamedQuery("AuthenticatedUserLookup.findByAuthPrvID_PersUserId", AuthenticatedUserLookup.class)).thenReturn(queryStub);
+ }
+
+ private void setUpOIDCProviderWhichValidatesToken() throws ParseException, IOException, OAuth2Exception {
+ OIDCAuthProvider oidcAuthProviderStub = stubOIDCAuthProvider("OIDC");
+
+ BearerAccessToken token = BearerAccessToken.parse(TEST_BEARER_TOKEN);
+
+ // Stub the UserInfo returned by the provider
+ UserInfo userInfoStub = Mockito.mock(UserInfo.class);
+ Mockito.when(oidcAuthProviderStub.getUserInfo(token)).thenReturn(Optional.of(userInfoStub));
+
+ // Stub OAuth2UserRecord and its associated UserRecordIdentifier
+ OAuth2UserRecord oAuth2UserRecordStub = Mockito.mock(OAuth2UserRecord.class);
+ UserRecordIdentifier userRecordIdentifierStub = Mockito.mock(UserRecordIdentifier.class);
+ Mockito.when(userRecordIdentifierStub.getUserIdInRepo()).thenReturn("testUserId");
+ Mockito.when(userRecordIdentifierStub.getUserRepoId()).thenReturn("testRepoId");
+ Mockito.when(oAuth2UserRecordStub.getUserRecordIdentifier()).thenReturn(userRecordIdentifierStub);
+
+ // Stub the OIDCAuthProvider to return OAuth2UserRecord
+ Mockito.when(oidcAuthProviderStub.getUserRecord(userInfoStub)).thenReturn(oAuth2UserRecordStub);
+ }
+
+ private OIDCAuthProvider stubOIDCAuthProvider(String providerID) {
+ OIDCAuthProvider oidcAuthProviderStub = Mockito.mock(OIDCAuthProvider.class);
+ Mockito.when(oidcAuthProviderStub.getId()).thenReturn(providerID);
+ Mockito.when(sut.authProvidersRegistrationService.getAuthenticationProvidersMap()).thenReturn(Map.of(providerID, oidcAuthProviderStub));
+ return oidcAuthProviderStub;
+ }
+}
diff --git a/src/test/java/edu/harvard/iq/dataverse/authorization/providers/oauth2/oidc/OIDCAuthenticationProviderFactoryIT.java b/src/test/java/edu/harvard/iq/dataverse/authorization/providers/oauth2/oidc/OIDCAuthenticationProviderFactoryIT.java
index ee6823ef98a..58b792691b9 100644
--- a/src/test/java/edu/harvard/iq/dataverse/authorization/providers/oauth2/oidc/OIDCAuthenticationProviderFactoryIT.java
+++ b/src/test/java/edu/harvard/iq/dataverse/authorization/providers/oauth2/oidc/OIDCAuthenticationProviderFactoryIT.java
@@ -7,7 +7,6 @@
import edu.harvard.iq.dataverse.api.auth.BearerTokenAuthMechanism;
import edu.harvard.iq.dataverse.api.auth.doubles.BearerTokenKeyContainerRequestTestFake;
import edu.harvard.iq.dataverse.authorization.AuthenticationServiceBean;
-import edu.harvard.iq.dataverse.authorization.UserRecordIdentifier;
import edu.harvard.iq.dataverse.authorization.providers.oauth2.OAuth2Exception;
import edu.harvard.iq.dataverse.authorization.providers.oauth2.OAuth2UserRecord;
import edu.harvard.iq.dataverse.authorization.users.AuthenticatedUser;
@@ -38,16 +37,12 @@
import java.util.Map;
import java.util.Optional;
-import java.util.Set;
import java.util.regex.Pattern;
import java.util.stream.Collectors;
import static edu.harvard.iq.dataverse.authorization.providers.oauth2.oidc.OIDCAuthenticationProviderFactoryIT.clientId;
import static edu.harvard.iq.dataverse.authorization.providers.oauth2.oidc.OIDCAuthenticationProviderFactoryIT.clientSecret;
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.*;
import static org.junit.jupiter.api.Assumptions.assumeFalse;
import static org.junit.jupiter.api.Assumptions.assumeTrue;
import static org.mockito.Mockito.when;
@@ -143,7 +138,7 @@ void testCreateProvider() throws Exception {
/**
* This test covers using an OIDC provider as authorization party when accessing the Dataverse API with a
- * Bearer Token. See {@link BearerTokenAuthMechanism}. It needs to mock the auth services to avoid adding
+ * Bearer Token. See {@link BearerTokenAuthMechanism}. It needs to mock the auth service to avoid adding
* more dependencies.
*/
@Test
@@ -158,19 +153,15 @@ void testApiBearerAuth() throws Exception {
String accessToken = getBearerTokenViaKeycloakAdminClient();
assumeFalse(accessToken == null);
- OIDCAuthProvider oidcAuthProvider = getProvider();
// This will also receive the details from the remote Keycloak in the container
- UserRecordIdentifier identifier = oidcAuthProvider.getUserIdentifier(new BearerAccessToken(accessToken)).get();
String token = "Bearer " + accessToken;
BearerTokenKeyContainerRequestTestFake request = new BearerTokenKeyContainerRequestTestFake(token);
AuthenticatedUser user = new MockAuthenticatedUser();
// setup mocks (we don't want or need a database here)
- when(authService.getAuthenticationProviderIdsOfType(OIDCAuthProvider.class)).thenReturn(Set.of(oidcAuthProvider.getId()));
- when(authService.getAuthenticationProvider(oidcAuthProvider.getId())).thenReturn(oidcAuthProvider);
- when(authService.lookupUser(identifier)).thenReturn(user);
+ when(authService.lookupUserByOIDCBearerToken(token)).thenReturn(user);
when(userService.updateLastApiUseTime(user)).thenReturn(user);
-
+
// when (let's do this again, but now with the actual subject under test!)
User lookedUpUser = bearerTokenAuthMechanism.findUserFromRequest(request);
diff --git a/src/test/java/edu/harvard/iq/dataverse/engine/command/impl/RegisterOIDCUserCommandTest.java b/src/test/java/edu/harvard/iq/dataverse/engine/command/impl/RegisterOIDCUserCommandTest.java
new file mode 100644
index 00000000000..3f6b3b0f393
--- /dev/null
+++ b/src/test/java/edu/harvard/iq/dataverse/engine/command/impl/RegisterOIDCUserCommandTest.java
@@ -0,0 +1,371 @@
+package edu.harvard.iq.dataverse.engine.command.impl;
+
+import edu.harvard.iq.dataverse.api.dto.UserDTO;
+import edu.harvard.iq.dataverse.authorization.AuthenticatedUserDisplayInfo;
+import edu.harvard.iq.dataverse.authorization.AuthenticationServiceBean;
+import edu.harvard.iq.dataverse.authorization.UserRecordIdentifier;
+import edu.harvard.iq.dataverse.authorization.exceptions.AuthorizationException;
+import edu.harvard.iq.dataverse.authorization.providers.oauth2.OAuth2UserRecord;
+import edu.harvard.iq.dataverse.authorization.users.AuthenticatedUser;
+import edu.harvard.iq.dataverse.engine.command.CommandContext;
+import edu.harvard.iq.dataverse.engine.command.exception.CommandException;
+import edu.harvard.iq.dataverse.engine.command.exception.IllegalCommandException;
+import edu.harvard.iq.dataverse.engine.command.exception.InvalidFieldsCommandException;
+import edu.harvard.iq.dataverse.engine.command.exception.PermissionException;
+import edu.harvard.iq.dataverse.settings.JvmSettings;
+import edu.harvard.iq.dataverse.util.BundleUtil;
+import edu.harvard.iq.dataverse.util.testing.JvmSetting;
+import edu.harvard.iq.dataverse.util.testing.LocalJvmSettings;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import java.util.List;
+
+import static edu.harvard.iq.dataverse.mocks.MocksFactory.makeRequest;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
+import static org.mockito.Mockito.*;
+
+@LocalJvmSettings
+class RegisterOIDCUserCommandTest {
+
+ private static final String TEST_BEARER_TOKEN = "Bearer test";
+ private static final String TEST_USERNAME = "username";
+ private static final AuthenticatedUserDisplayInfo TEST_MISSING_CLAIMS_DISPLAY_INFO = new AuthenticatedUserDisplayInfo(
+ null,
+ null,
+ null,
+ "",
+ ""
+ );
+ private static final AuthenticatedUserDisplayInfo TEST_VALID_DISPLAY_INFO = new AuthenticatedUserDisplayInfo(
+ "FirstName",
+ "LastName",
+ "user@example.com",
+ "",
+ ""
+ );
+
+ private UserDTO testUserDTO;
+
+ @Mock
+ private CommandContext contextStub;
+
+ @Mock
+ private AuthenticationServiceBean authServiceStub;
+
+ @InjectMocks
+ private RegisterOIDCUserCommand sut;
+
+ private OAuth2UserRecord oAuth2UserRecordStub;
+ private UserRecordIdentifier userRecordIdentifierMock;
+ private AuthenticatedUser existingTestUser;
+
+ @BeforeEach
+ void setUp() {
+ MockitoAnnotations.openMocks(this);
+ setUpDefaultUserDTO();
+
+ userRecordIdentifierMock = mock(UserRecordIdentifier.class);
+ oAuth2UserRecordStub = mock(OAuth2UserRecord.class);
+ existingTestUser = new AuthenticatedUser();
+
+ when(oAuth2UserRecordStub.getUserRecordIdentifier()).thenReturn(userRecordIdentifierMock);
+ when(contextStub.authentication()).thenReturn(authServiceStub);
+
+ sut = new RegisterOIDCUserCommand(makeRequest(), TEST_BEARER_TOKEN, testUserDTO);
+ }
+
+ private void setUpDefaultUserDTO() {
+ testUserDTO = new UserDTO();
+ testUserDTO.setTermsAccepted(true);
+ testUserDTO.setFirstName("FirstName");
+ testUserDTO.setLastName("LastName");
+ testUserDTO.setUsername("username");
+ testUserDTO.setEmailAddress("user@example.com");
+ }
+
+ @Test
+ public void execute_completedUserDTOWithUnacceptedTerms_missingClaimsInProvider_provideMissingClaimsFeatureFlagDisabled() throws AuthorizationException {
+ testUserDTO.setTermsAccepted(false);
+ testUserDTO.setEmailAddress(null);
+ testUserDTO.setUsername(null);
+ testUserDTO.setFirstName(null);
+ testUserDTO.setLastName(null);
+
+ when(authServiceStub.getAuthenticatedUserByEmail(testUserDTO.getEmailAddress())).thenReturn(null);
+ when(authServiceStub.getAuthenticatedUser(testUserDTO.getUsername())).thenReturn(null);
+ when(authServiceStub.verifyOIDCBearerTokenAndGetOAuth2UserRecord(TEST_BEARER_TOKEN)).thenReturn(oAuth2UserRecordStub);
+
+ when(oAuth2UserRecordStub.getUsername()).thenReturn(null);
+ when(oAuth2UserRecordStub.getDisplayInfo()).thenReturn(TEST_MISSING_CLAIMS_DISPLAY_INFO);
+
+ assertThatThrownBy(() -> sut.execute(contextStub))
+ .isInstanceOf(InvalidFieldsCommandException.class)
+ .satisfies(exception -> {
+ InvalidFieldsCommandException ex = (InvalidFieldsCommandException) exception;
+ assertThat(ex.getFieldErrors())
+ .containsEntry("termsAccepted", BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.userShouldAcceptTerms"))
+ .containsEntry("emailAddress", BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.provideMissingClaimsDisabled.fieldRequired", List.of("emailAddress")))
+ .containsEntry("username", BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.provideMissingClaimsDisabled.fieldRequired", List.of("username")))
+ .containsEntry("firstName", BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.provideMissingClaimsDisabled.fieldRequired", List.of("firstName")))
+ .containsEntry("lastName", BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.provideMissingClaimsDisabled.fieldRequired", List.of("lastName")));
+ });
+ }
+
+ @Test
+ @JvmSetting(key = JvmSettings.FEATURE_FLAG, value = "true", varArgs = "api-bearer-auth-provide-missing-claims")
+ public void execute_uncompletedUserDTOWithUnacceptedTerms_missingClaimsInProvider_provideMissingClaimsFeatureFlagEnabled() throws AuthorizationException {
+ testUserDTO.setTermsAccepted(false);
+ testUserDTO.setEmailAddress(null);
+ testUserDTO.setUsername(null);
+ testUserDTO.setFirstName(null);
+ testUserDTO.setLastName(null);
+
+ when(oAuth2UserRecordStub.getUsername()).thenReturn(null);
+ when(oAuth2UserRecordStub.getDisplayInfo()).thenReturn(TEST_MISSING_CLAIMS_DISPLAY_INFO);
+
+ when(authServiceStub.getAuthenticatedUserByEmail(testUserDTO.getEmailAddress())).thenReturn(null);
+ when(authServiceStub.getAuthenticatedUser(testUserDTO.getUsername())).thenReturn(null);
+ when(authServiceStub.verifyOIDCBearerTokenAndGetOAuth2UserRecord(TEST_BEARER_TOKEN)).thenReturn(oAuth2UserRecordStub);
+
+ assertThatThrownBy(() -> sut.execute(contextStub))
+ .isInstanceOf(InvalidFieldsCommandException.class)
+ .satisfies(exception -> {
+ InvalidFieldsCommandException ex = (InvalidFieldsCommandException) exception;
+ assertThat(ex.getFieldErrors())
+ .containsEntry("termsAccepted", BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.userShouldAcceptTerms"))
+ .containsEntry("emailAddress", BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.provideMissingClaimsEnabled.fieldRequired", List.of("emailAddress")))
+ .containsEntry("username", BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.provideMissingClaimsEnabled.fieldRequired", List.of("username")))
+ .containsEntry("firstName", BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.provideMissingClaimsEnabled.fieldRequired", List.of("firstName")))
+ .containsEntry("lastName", BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.provideMissingClaimsEnabled.fieldRequired", List.of("lastName")));
+ });
+ }
+
+ @Test
+ @JvmSetting(key = JvmSettings.FEATURE_FLAG, value = "true", varArgs = "api-bearer-auth-provide-missing-claims")
+ public void execute_acceptedTerms_unavailableEmailAndUsername_missingClaimsInProvider_provideMissingClaimsFeatureFlagEnabled() throws AuthorizationException {
+ when(authServiceStub.getAuthenticatedUserByEmail(testUserDTO.getEmailAddress())).thenReturn(existingTestUser);
+ when(authServiceStub.getAuthenticatedUser(testUserDTO.getUsername())).thenReturn(existingTestUser);
+ when(authServiceStub.verifyOIDCBearerTokenAndGetOAuth2UserRecord(TEST_BEARER_TOKEN)).thenReturn(oAuth2UserRecordStub);
+
+ when(oAuth2UserRecordStub.getUsername()).thenReturn(null);
+ when(oAuth2UserRecordStub.getDisplayInfo()).thenReturn(TEST_MISSING_CLAIMS_DISPLAY_INFO);
+
+ assertThatThrownBy(() -> sut.execute(contextStub))
+ .isInstanceOf(InvalidFieldsCommandException.class)
+ .satisfies(exception -> {
+ InvalidFieldsCommandException ex = (InvalidFieldsCommandException) exception;
+ assertThat(ex.getFieldErrors())
+ .containsEntry("emailAddress", BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.emailAddressInUse"))
+ .containsEntry("username", BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.usernameInUse"))
+ .doesNotContainKey("termsAccepted");
+ });
+ }
+
+ @Test
+ void execute_throwsPermissionException_onAuthorizationException() throws AuthorizationException {
+ String testAuthorizationExceptionMessage = "Authorization failed";
+ when(contextStub.authentication().verifyOIDCBearerTokenAndGetOAuth2UserRecord(TEST_BEARER_TOKEN))
+ .thenThrow(new AuthorizationException(testAuthorizationExceptionMessage));
+
+ assertThatThrownBy(() -> sut.execute(contextStub))
+ .isInstanceOf(PermissionException.class)
+ .hasMessageContaining(testAuthorizationExceptionMessage);
+
+ verify(contextStub.authentication(), times(1)).verifyOIDCBearerTokenAndGetOAuth2UserRecord(TEST_BEARER_TOKEN);
+ }
+
+ @Test
+ void execute_throwsIllegalCommandException_ifUserAlreadyRegisteredWithToken() throws AuthorizationException {
+ when(contextStub.authentication().verifyOIDCBearerTokenAndGetOAuth2UserRecord(TEST_BEARER_TOKEN))
+ .thenReturn(oAuth2UserRecordStub);
+ when(contextStub.authentication().lookupUser(userRecordIdentifierMock)).thenReturn(new AuthenticatedUser());
+
+ assertThatThrownBy(() -> sut.execute(contextStub))
+ .isInstanceOf(IllegalCommandException.class)
+ .hasMessageContaining(BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.userAlreadyRegisteredWithToken"));
+
+ verify(contextStub.authentication(), times(1)).lookupUser(userRecordIdentifierMock);
+ }
+
+ @Test
+ void execute_throwsInvalidFieldsCommandException_ifUserDTOHasClaimsAndProvideMissingClaimsFeatureFlagIsDisabled() throws AuthorizationException {
+ when(contextStub.authentication().verifyOIDCBearerTokenAndGetOAuth2UserRecord(TEST_BEARER_TOKEN))
+ .thenReturn(oAuth2UserRecordStub);
+
+ assertThatThrownBy(() -> sut.execute(contextStub))
+ .isInstanceOf(InvalidFieldsCommandException.class)
+ .satisfies(exception -> {
+ InvalidFieldsCommandException ex = (InvalidFieldsCommandException) exception;
+ assertThat(ex.getFieldErrors())
+ .containsEntry("username", BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.provideMissingClaimsDisabled.unableToSetFieldViaJSON", List.of("username")))
+ .containsEntry("emailAddress", BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.provideMissingClaimsDisabled.unableToSetFieldViaJSON", List.of("emailAddress")))
+ .containsEntry("firstName", BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.provideMissingClaimsDisabled.unableToSetFieldViaJSON", List.of("firstName")))
+ .containsEntry("lastName", BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.provideMissingClaimsDisabled.unableToSetFieldViaJSON", List.of("lastName")))
+ .containsEntry("emailAddress", BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.provideMissingClaimsDisabled.unableToSetFieldViaJSON", List.of("emailAddress")));
+ });
+ }
+
+ @Test
+ @JvmSetting(key = JvmSettings.FEATURE_FLAG, value = "true", varArgs = "api-bearer-auth-provide-missing-claims")
+ void execute_happyPath_withoutAffiliationAndPosition_missingClaimsInProvider_provideMissingClaimsFeatureFlagEnabled() throws AuthorizationException, CommandException {
+ when(authServiceStub.verifyOIDCBearerTokenAndGetOAuth2UserRecord(TEST_BEARER_TOKEN)).thenReturn(oAuth2UserRecordStub);
+
+ when(oAuth2UserRecordStub.getUsername()).thenReturn(null);
+ when(oAuth2UserRecordStub.getDisplayInfo()).thenReturn(TEST_MISSING_CLAIMS_DISPLAY_INFO);
+
+ sut.execute(contextStub);
+
+ verify(authServiceStub, times(1)).createAuthenticatedUser(
+ eq(userRecordIdentifierMock),
+ eq(testUserDTO.getUsername()),
+ eq(new AuthenticatedUserDisplayInfo(
+ testUserDTO.getFirstName(),
+ testUserDTO.getLastName(),
+ testUserDTO.getEmailAddress(),
+ "",
+ "")
+ ),
+ eq(true)
+ );
+ }
+
+ @Test
+ @JvmSetting(key = JvmSettings.FEATURE_FLAG, value = "true", varArgs = "api-bearer-auth-provide-missing-claims")
+ void execute_happyPath_withAffiliationAndPosition_missingClaimsInProvider_provideMissingClaimsFeatureFlagEnabled() throws AuthorizationException, CommandException {
+ testUserDTO.setPosition("test position");
+ testUserDTO.setAffiliation("test affiliation");
+
+ when(authServiceStub.verifyOIDCBearerTokenAndGetOAuth2UserRecord(TEST_BEARER_TOKEN)).thenReturn(oAuth2UserRecordStub);
+
+ when(oAuth2UserRecordStub.getUsername()).thenReturn(null);
+ when(oAuth2UserRecordStub.getDisplayInfo()).thenReturn(TEST_MISSING_CLAIMS_DISPLAY_INFO);
+
+ sut.execute(contextStub);
+
+ verify(authServiceStub, times(1)).createAuthenticatedUser(
+ eq(userRecordIdentifierMock),
+ eq(testUserDTO.getUsername()),
+ eq(new AuthenticatedUserDisplayInfo(
+ testUserDTO.getFirstName(),
+ testUserDTO.getLastName(),
+ testUserDTO.getEmailAddress(),
+ testUserDTO.getAffiliation(),
+ testUserDTO.getPosition())
+ ),
+ eq(true)
+ );
+ }
+
+ @Test
+ @JvmSetting(key = JvmSettings.FEATURE_FLAG, value = "true", varArgs = "api-bearer-auth-provide-missing-claims")
+ void execute_conflictingClaimsInProvider_provideMissingClaimsFeatureFlagEnabled() throws AuthorizationException {
+ when(authServiceStub.verifyOIDCBearerTokenAndGetOAuth2UserRecord(TEST_BEARER_TOKEN)).thenReturn(oAuth2UserRecordStub);
+
+ when(oAuth2UserRecordStub.getUsername()).thenReturn(TEST_USERNAME);
+ when(oAuth2UserRecordStub.getDisplayInfo()).thenReturn(TEST_VALID_DISPLAY_INFO);
+
+ testUserDTO.setUsername("conflictingUsername");
+ testUserDTO.setFirstName("conflictingFirstName");
+ testUserDTO.setLastName("conflictingLastName");
+ testUserDTO.setEmailAddress("conflictingemail@example.com");
+
+ assertThatThrownBy(() -> sut.execute(contextStub))
+ .isInstanceOf(InvalidFieldsCommandException.class)
+ .satisfies(exception -> {
+ InvalidFieldsCommandException ex = (InvalidFieldsCommandException) exception;
+ assertThat(ex.getFieldErrors())
+ .containsEntry("username", BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.provideMissingClaimsEnabled.fieldAlreadyPresentInProvider", List.of("username")))
+ .containsEntry("emailAddress", BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.provideMissingClaimsEnabled.fieldAlreadyPresentInProvider", List.of("emailAddress")))
+ .containsEntry("firstName", BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.provideMissingClaimsEnabled.fieldAlreadyPresentInProvider", List.of("firstName")))
+ .containsEntry("lastName", BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.provideMissingClaimsEnabled.fieldAlreadyPresentInProvider", List.of("lastName")))
+ .containsEntry("emailAddress", BundleUtil.getStringFromBundle("registerOidcUserCommand.errors.provideMissingClaimsEnabled.fieldAlreadyPresentInProvider", List.of("emailAddress")));
+ });
+ }
+
+ @Test
+ @JvmSetting(key = JvmSettings.FEATURE_FLAG, value = "true", varArgs = "api-bearer-auth-provide-missing-claims")
+ void execute_happyPath_withoutAffiliationAndPosition_claimsInProvider_provideMissingClaimsFeatureFlagEnabled() throws AuthorizationException, CommandException {
+ testUserDTO.setTermsAccepted(true);
+ testUserDTO.setEmailAddress(null);
+ testUserDTO.setUsername(null);
+ testUserDTO.setFirstName(null);
+ testUserDTO.setLastName(null);
+
+ when(authServiceStub.verifyOIDCBearerTokenAndGetOAuth2UserRecord(TEST_BEARER_TOKEN)).thenReturn(oAuth2UserRecordStub);
+
+ when(oAuth2UserRecordStub.getUsername()).thenReturn(TEST_USERNAME);
+ when(oAuth2UserRecordStub.getDisplayInfo()).thenReturn(TEST_VALID_DISPLAY_INFO);
+
+ sut.execute(contextStub);
+
+ verify(authServiceStub, times(1)).createAuthenticatedUser(
+ eq(userRecordIdentifierMock),
+ eq(TEST_USERNAME),
+ eq(new AuthenticatedUserDisplayInfo(
+ TEST_VALID_DISPLAY_INFO.getFirstName(),
+ TEST_VALID_DISPLAY_INFO.getLastName(),
+ TEST_VALID_DISPLAY_INFO.getEmailAddress(),
+ "",
+ "")
+ ),
+ eq(true)
+ );
+ }
+
+ @ParameterizedTest
+ @ValueSource(strings = {" ", ""})
+ @JvmSetting(key = JvmSettings.FEATURE_FLAG, value = "true", varArgs = "api-bearer-auth-provide-missing-claims")
+ void execute_happyPath_withoutAffiliationAndPosition_blankClaimInProviderProvidedInJson_provideMissingClaimsFeatureFlagEnabled(String testBlankUsername) throws AuthorizationException, CommandException {
+ String testUsernameNotBlank = "usernameNotBlank";
+ testUserDTO.setUsername(testUsernameNotBlank);
+ testUserDTO.setTermsAccepted(true);
+ testUserDTO.setEmailAddress(null);
+ testUserDTO.setFirstName(null);
+ testUserDTO.setLastName(null);
+
+ when(authServiceStub.verifyOIDCBearerTokenAndGetOAuth2UserRecord(TEST_BEARER_TOKEN)).thenReturn(oAuth2UserRecordStub);
+
+ when(oAuth2UserRecordStub.getUsername()).thenReturn(testBlankUsername);
+ when(oAuth2UserRecordStub.getDisplayInfo()).thenReturn(TEST_VALID_DISPLAY_INFO);
+
+ sut.execute(contextStub);
+
+ verify(authServiceStub, times(1)).createAuthenticatedUser(
+ eq(userRecordIdentifierMock),
+ eq(testUsernameNotBlank),
+ eq(new AuthenticatedUserDisplayInfo(
+ TEST_VALID_DISPLAY_INFO.getFirstName(),
+ TEST_VALID_DISPLAY_INFO.getLastName(),
+ TEST_VALID_DISPLAY_INFO.getEmailAddress(),
+ "",
+ "")
+ ),
+ eq(true)
+ );
+ }
+
+ @Test
+ @JvmSetting(key = JvmSettings.FEATURE_FLAG, value = "true", varArgs = "api-bearer-auth-handle-tos-acceptance-in-idp")
+ void execute_doNotThrowUnacceptedTermsError_unacceptedTermsInUserDTOAndAllClaimsInProvider_handleTosAcceptanceInIdpFeatureFlagEnabled() throws AuthorizationException {
+ testUserDTO.setTermsAccepted(false);
+ testUserDTO.setEmailAddress(null);
+ testUserDTO.setUsername(null);
+ testUserDTO.setFirstName(null);
+ testUserDTO.setLastName(null);
+
+ when(authServiceStub.verifyOIDCBearerTokenAndGetOAuth2UserRecord(TEST_BEARER_TOKEN)).thenReturn(oAuth2UserRecordStub);
+
+ when(oAuth2UserRecordStub.getUsername()).thenReturn(TEST_USERNAME);
+ when(oAuth2UserRecordStub.getDisplayInfo()).thenReturn(TEST_VALID_DISPLAY_INFO);
+
+ assertDoesNotThrow(() -> sut.execute(contextStub));
+ }
+}
diff --git a/src/test/java/edu/harvard/iq/dataverse/export/ddi/DdiExportUtilTest.java b/src/test/java/edu/harvard/iq/dataverse/export/ddi/DdiExportUtilTest.java
index 41e6be61bb8..f594de4757d 100644
--- a/src/test/java/edu/harvard/iq/dataverse/export/ddi/DdiExportUtilTest.java
+++ b/src/test/java/edu/harvard/iq/dataverse/export/ddi/DdiExportUtilTest.java
@@ -64,6 +64,23 @@ public void testJson2DdiNoFiles() throws Exception {
XmlAssert.assertThat(result).and(datasetAsDdi).ignoreWhitespace().areSimilar();
}
+ @Test
+ public void testJson2DdiNoFilesTermsOfUse() throws Exception {
+ // given
+ Path datasetVersionJson = Path.of("src/test/java/edu/harvard/iq/dataverse/export/ddi/dataset-finch-terms-of-use.json");
+ String datasetVersionAsJson = Files.readString(datasetVersionJson, StandardCharsets.UTF_8);
+ Path ddiFile = Path.of("src/test/java/edu/harvard/iq/dataverse/export/ddi/dataset-finch-terms-of-use.xml");
+ String datasetAsDdi = XmlPrinter.prettyPrintXml(Files.readString(ddiFile, StandardCharsets.UTF_8));
+ logger.fine(datasetAsDdi);
+
+ // when
+ String result = DdiExportUtil.datasetDtoAsJson2ddi(datasetVersionAsJson);
+ logger.fine(result);
+
+ // then
+ XmlAssert.assertThat(result).and(datasetAsDdi).ignoreWhitespace().areSimilar();
+ }
+
@Test
public void testExportDDI() throws Exception {
// given
diff --git a/src/test/java/edu/harvard/iq/dataverse/export/ddi/dataset-finch-terms-of-use.json b/src/test/java/edu/harvard/iq/dataverse/export/ddi/dataset-finch-terms-of-use.json
new file mode 100644
index 00000000000..b3d6caff2e9
--- /dev/null
+++ b/src/test/java/edu/harvard/iq/dataverse/export/ddi/dataset-finch-terms-of-use.json
@@ -0,0 +1,404 @@
+{
+ "id": 11,
+ "identifier": "PCA2E3",
+ "persistentUrl": "https://doi.org/10.5072/FK2/PCA2E3",
+ "protocol": "doi",
+ "authority": "10.5072/FK2",
+ "metadataLanguage": "en",
+ "datasetVersion": {
+ "id": 2,
+ "versionNumber": 1,
+ "versionMinorNumber": 0,
+ "versionState": "RELEASED",
+ "productionDate": "Production Date",
+ "lastUpdateTime": "2015-09-24T17:07:57Z",
+ "releaseTime": "2015-09-24T17:07:57Z",
+ "createTime": "2015-09-24T16:47:51Z",
+ "termsOfUse":"This dataset is made available without information on how it can be used. You should communicate with the Contact(s) specified before use.",
+ "metadataBlocks": {
+ "citation": {
+ "displayName": "Citation Metadata",
+ "name":"citation",
+ "fields": [
+ {
+ "typeName": "title",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "Darwin's Finches"
+ },
+ {
+ "typeName": "alternativeTitle",
+ "multiple": true,
+ "typeClass": "primitive",
+ "value": ["Darwin's Finches Alternative Title1", "Darwin's Finches Alternative Title2"]
+ },
+ {
+ "typeName": "author",
+ "multiple": true,
+ "typeClass": "compound",
+ "value": [
+ {
+ "authorName": {
+ "typeName": "authorName",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "Finch, Fiona"
+ },
+ "authorAffiliation": {
+ "typeName": "authorAffiliation",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "Birds Inc."
+ }
+ }
+ ]
+ },
+ {
+ "typeName": "timePeriodCovered",
+ "multiple": true,
+ "typeClass": "compound",
+ "value": [
+ {
+ "timePeriodStart": {
+ "typeName": "timePeriodCoveredStart",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "20020816"
+ },
+ "timePeriodEnd": {
+ "typeName": "timePeriodCoveredEnd",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "20160630"
+ }
+ }
+ ]
+ },
+ {
+ "typeName": "dateOfCollection",
+ "multiple": true,
+ "typeClass": "compound",
+ "value": [
+ {
+ "timePeriodStart": {
+ "typeName": "dateOfCollectionStart",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "20070831"
+ },
+ "timePeriodEnd": {
+ "typeName": "dateOfCollectionEnd",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "20130630"
+ }
+ }
+ ]
+ },
+ {
+ "typeName": "datasetContact",
+ "multiple": true,
+ "typeClass": "compound",
+ "value": [
+ {
+ "datasetContactEmail": {
+ "typeName": "datasetContactEmail",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "finch@mailinator.com"
+ },
+ "datasetContactName": {
+ "typeName": "datasetContactName",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "Jimmy Finch"
+ },
+ "datasetContactAffiliation": {
+ "typeName": "datasetContactAffiliation",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "Finch Academy"
+ }
+ }
+ ]
+ },
+ {
+ "typeName": "producer",
+ "multiple": true,
+ "typeClass": "compound",
+ "value": [
+ {
+ "producerAbbreviation": {
+ "typeName": "producerAbbreviation",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "ProdAbb"
+ },
+ "producerName": {
+ "typeName": "producerName",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "Johnny Hawk"
+ },
+ "producerAffiliation": {
+ "typeName": "producerAffiliation",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "Hawk Institute"
+ },
+ "producerURL": {
+ "typeName": "producerURL",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "http://www.hawk.edu/url"
+ },
+ "producerLogoURL": {
+ "typeName": "producerLogoURL",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "http://www.hawk.edu/logo"
+ }
+ }
+ ]
+ },
+ {
+ "typeName": "distributor",
+ "multiple": true,
+ "typeClass": "compound",
+ "value": [
+ {
+ "distributorAbbreviation": {
+ "typeName": "distributorAbbreviation",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "Dist-Abb"
+ },
+ "producerName": {
+ "typeName": "distributorName",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "Odin Raven"
+ },
+ "distributorAffiliation": {
+ "typeName": "distributorAffiliation",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "Valhalla Polytechnic"
+ },
+ "distributorURL": {
+ "typeName": "distributorURL",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "http://www.valhalla.edu/url"
+ },
+ "distributorLogoURL": {
+ "typeName": "distributorLogoURL",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "http://www.valhalla.edu/logo"
+ }
+ }
+ ]
+ },
+ {
+ "typeName": "dsDescription",
+ "multiple": true,
+ "typeClass": "compound",
+ "value": [
+ {
+ "dsDescriptionValue": {
+ "typeName": "dsDescriptionValue",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "Darwin's finches (also known as the Galápagos finches) are a group of about fifteen species of passerine birds."
+ }
+ }
+ ]
+ },
+ {
+ "typeName": "subject",
+ "multiple": true,
+ "typeClass": "controlledVocabulary",
+ "value": [
+ "Medicine, Health and Life Sciences"
+ ]
+ },
+ {
+ "typeName": "keyword",
+ "multiple": true,
+ "typeClass": "compound",
+ "value": [
+ {
+ "keywordValue": {
+ "typeName": "keywordValue",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "Keyword Value 1"
+ },
+ "keywordTermURI": {
+ "typeName": "keywordTermURI",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "http://keywordTermURI1.org"
+ },
+ "keywordVocabulary": {
+ "typeName": "keywordVocabulary",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "Keyword Vocabulary"
+ },
+ "keywordVocabularyURI": {
+ "typeName": "keywordVocabularyURI",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "http://www.keyword.com/one"
+ }
+ },
+ {
+ "keywordValue": {
+ "typeName": "keywordValue",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "Keyword Value Two"
+ },
+ "keywordTermURI": {
+ "typeName": "keywordTermURI",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "http://keywordTermURI1.org"
+ },
+ "keywordVocabulary": {
+ "typeName": "keywordVocabulary",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "Keyword Vocabulary"
+ },
+ "keywordVocabularyURI": {
+ "typeName": "keywordVocabularyURI",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "http://www.keyword.com/one"
+ }
+ }
+ ]
+ },
+ {
+ "typeName": "topicClassification",
+ "multiple": true,
+ "typeClass": "compound",
+ "value": [
+ {
+ "topicClassValue": {
+ "typeName": "topicClassValue",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "TC Value 1"
+ },
+ "topicClassVocab": {
+ "typeName": "topicClassVocab",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "TC Vocabulary"
+ },
+ "topicClassVocabURI": {
+ "typeName": "topicClassVocabURI",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "http://www.topicClass.com/one"
+ }
+ }
+ ]
+ },
+ {
+ "typeName": "kindOfData",
+ "multiple": true,
+ "typeClass": "primitive",
+ "value": [
+ "Kind of Data"
+ ]
+ },
+ {
+ "typeName": "depositor",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "Added, Depositor"
+ }
+ ]
+ },
+ "geospatial": {
+ "displayName": "Geospatial",
+ "name":"geospatial",
+ "fields": [
+ {
+ "typeName": "geographicCoverage",
+ "multiple": true,
+ "typeClass": "compound",
+ "value": [
+ {
+ "country": {
+ "typeName": "country",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "USA"
+ },
+ "state": {
+ "typeName": "state",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "MA"
+ },
+ "city": {
+ "typeName": "city",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "Cambridge"
+ },
+ "otherGeographicCoverage": {
+ "typeName": "otherGeographicCoverage",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "Other Geographic Coverage"
+ }
+ }
+ ]
+ },
+ {
+ "typeName": "geographicBoundingBox",
+ "multiple": true,
+ "typeClass": "compound",
+ "value": [
+ {
+ "westLongitude": {
+ "typeName": "westLongitude",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "60.3"
+ },
+ "eastLongitude": {
+ "typeName": "eastLongitude",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "59.8"
+ },
+ "southLatitude": {
+ "typeName": "southLatitude",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "41.6"
+ },
+ "northLatitude": {
+ "typeName": "northLatitude",
+ "multiple": false,
+ "typeClass": "primitive",
+ "value": "43.8"
+ }
+ }
+ ]
+ }
+ ]
+ }
+ },
+ "files": [],
+ "citation": "Finch, Fiona, 2015, \"Darwin's Finches\", https://doi.org/10.5072/FK2/PCA2E3, Root Dataverse, V1"
+ }
+}
\ No newline at end of file
diff --git a/src/test/java/edu/harvard/iq/dataverse/export/ddi/dataset-finch-terms-of-use.xml b/src/test/java/edu/harvard/iq/dataverse/export/ddi/dataset-finch-terms-of-use.xml
new file mode 100644
index 00000000000..d813d155a90
--- /dev/null
+++ b/src/test/java/edu/harvard/iq/dataverse/export/ddi/dataset-finch-terms-of-use.xml
@@ -0,0 +1,78 @@
+
+
+
+
+
+ Darwin's Finches
+ doi:10.5072/FK2/PCA2E3
+
+
+
+ 1
+
+ Finch, Fiona, 2015, "Darwin's Finches", https://doi.org/10.5072/FK2/PCA2E3, Root Dataverse, V1
+
+
+
+
+
+ Darwin's Finches
+ Darwin's Finches Alternative Title1
+ Darwin's Finches Alternative Title2
+ doi:10.5072/FK2/PCA2E3
+
+
+ Finch, Fiona
+
+
+ Johnny Hawk
+
+
+ Odin Raven
+ Jimmy Finch
+ Added, Depositor
+
+
+
+
+
+ Medicine, Health and Life Sciences
+ Keyword Value 1
+ Keyword Value Two
+ TC Value 1
+
+ Darwin's finches (also known as the Galápagos finches) are a group of about fifteen species of passerine birds.
+
+ 20020816
+ 20160630
+ 20070831
+ 20130630
+ USA
+ Cambridge
+ MA
+ Other Geographic Coverage
+
+ 60.3
+ 59.8
+ 41.6
+ 43.8
+
+ Kind of Data
+
+
+
+
+
+
+
+
+
+
+
+
+ This dataset is made available without information on how it can be used. You should communicate with the Contact(s) specified before use.
+
+
+
+
+
diff --git a/src/test/java/edu/harvard/iq/dataverse/export/ddi/dataset-finch1.xml b/src/test/java/edu/harvard/iq/dataverse/export/ddi/dataset-finch1.xml
index 6730c44603a..010a5db4f2b 100644
--- a/src/test/java/edu/harvard/iq/dataverse/export/ddi/dataset-finch1.xml
+++ b/src/test/java/edu/harvard/iq/dataverse/export/ddi/dataset-finch1.xml
@@ -69,6 +69,7 @@
+ <a href="http://creativecommons.org/publicdomain/zero/1.0">CC0 1.0</a>
diff --git a/src/test/java/edu/harvard/iq/dataverse/export/ddi/exportfull.xml b/src/test/java/edu/harvard/iq/dataverse/export/ddi/exportfull.xml
index 507d752192d..e865dc0ffe4 100644
--- a/src/test/java/edu/harvard/iq/dataverse/export/ddi/exportfull.xml
+++ b/src/test/java/edu/harvard/iq/dataverse/export/ddi/exportfull.xml
@@ -161,6 +161,7 @@
Disclaimer
Terms of Access
+ <a href="http://creativecommons.org/publicdomain/zero/1.0">CC0 1.0</a>
RelatedMaterial1