Get Guestbook list API: add param to return inherited guestbooks

doc/release-notes/12323-get-inherited-guestbooks-list-api.md

@@ -0,0 +1,2 @@
+Added 'includeInherited' to query parameters of /api/guestbooks/{ID}/list?includeInherited=true to return the Collection's Guestbooks as well as the Guestbooks of the Collections' hierarchical owners 
+Also removed the 'EditDataverse' permission requirement to get the list.

doc/sphinx-guides/source/api/native-api.rst

@@ -1223,7 +1223,6 @@ Get a list of Guestbooks for a Dataverse Collection
 For more about guestbooks, see :ref:`dataset-guestbooks` in the User Guide.
 
 Get a list of Guestbooks for a Dataverse Collection
-You must have "EditDataverse" permission on the Dataverse collection.
 
 .. code-block:: bash
 
@@ -1239,6 +1238,12 @@ The fully expanded example above (without environment variables) looks like this
 
   curl -H "X-Dataverse-key:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" "https://demo.dataverse.org/api/guestbooks/root/list"
 
+To include the inherited Guestbooks of the Dataverse Collection add the query parameter `includeInherited=true`
+
+.. code-block:: bash
+
+  curl -H "X-Dataverse-key:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" "https://demo.dataverse.org/api/guestbooks/root/list?includeInherited=true"
+
 Get a Guestbook for a Dataverse Collection
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 

src/main/java/edu/harvard/iq/dataverse/GuestbookServiceBean.java

@@ -33,6 +33,17 @@ public List<Guestbook> findGuestbooksForGivenDataverse(Dataverse dataverse) {
             return List.of();
         }
     }
+    // Get all guestbooks for this collection and it's parent collections
+    public List<Guestbook> findEffectiveGuestbooksForGivenDataverse(Dataverse dataverse) {
+        List<Guestbook> guestbooks = findGuestbooksForGivenDataverse(dataverse);
+        if (dataverse != null) {
+            List<Dataverse> parentDataverses = dataverse.getOwners();
+            for (Dataverse dv : parentDataverses) {
+                guestbooks.addAll(findGuestbooksForGivenDataverse(dv));
+            }
+        }
+        return guestbooks;
+    }
 
     public Long findCountUsages(Long guestbookId, Long dataverseId) {
         String queryString = "";

src/main/java/edu/harvard/iq/dataverse/api/Guestbooks.java

@@ -57,13 +57,12 @@ public Response getGuestbook(@Context ContainerRequestContext crc, @PathParam("i
     @GET
     @AuthRequired
     @Path("{identifier}/list")
-    public Response getGuestbooks(@Context ContainerRequestContext crc, @PathParam("identifier") String identifier) {
+    public Response getGuestbooks(@Context ContainerRequestContext crc, @PathParam("identifier") String identifier, @QueryParam("includeInherited") boolean includeInherited) {
         return response( req -> {
             Dataverse dataverse = findDataverseOrDie(identifier);
-            if (!permissionSvc.request(req).on(dataverse).has(Permission.EditDataverse)) {
-                return error(Response.Status.FORBIDDEN, "Not authorized");
-            }
-            List<Guestbook> guestbooks = guestbookService.findGuestbooksForGivenDataverse(dataverse);
+            List<Guestbook> guestbooks = (includeInherited) ? guestbookService.findEffectiveGuestbooksForGivenDataverse(dataverse):
+            guestbookService.findGuestbooksForGivenDataverse(dataverse);
+
             JsonArrayBuilder guestbookArray = Json.createArrayBuilder();
             JsonPrinter jsonPrinter = new JsonPrinter();
             for (Guestbook gb : guestbooks) {

src/test/java/edu/harvard/iq/dataverse/api/FilesIT.java

@@ -3876,8 +3876,16 @@ public void testDownloadFileWithGuestbookResponse() throws IOException, JsonPars
         String superusername = UtilIT.getUsernameFromResponse(createUserResponse);
         UtilIT.makeSuperUser(superusername).then().assertThat().statusCode(200);
 
+        // Create Parent Dataverse
+        String parentDataverseAlias = createDataverseGetAlias(ownerApiToken);
+        Response publishResponse = UtilIT.publishDataverseViaNativeApi(parentDataverseAlias, ownerApiToken);
+        assertEquals(200, publishResponse.getStatusCode());
+        // Create a Parent Guestbook
+        Guestbook parentGuestbook = UtilIT.createRandomGuestbook(parentDataverseAlias, null, ownerApiToken);
+
         // Create Dataverse
         String dataverseAlias = createDataverseGetAlias(ownerApiToken);
+        UtilIT.moveDataverse(dataverseAlias, parentDataverseAlias, null, ownerApiToken);
 
         // Create user with no permission
         createUserResponse = UtilIT.createRandomUser();
@@ -3912,6 +3920,10 @@ public void testDownloadFileWithGuestbookResponse() throws IOException, JsonPars
         getGuestbooksResponse = UtilIT.getGuestbooks(dataverseAlias, ownerApiToken);
         getGuestbooksResponse.then().assertThat().statusCode(200);
         assertEquals(1, getGuestbooksResponse.getBody().jsonPath().getList("data").size());
+        // Get the list of Guestbooks including Parent Guestbook
+        getGuestbooksResponse = UtilIT.getGuestbooks(dataverseAlias, ownerApiToken, Boolean.TRUE);
+        getGuestbooksResponse.then().assertThat().statusCode(200);
+        assertEquals(2, getGuestbooksResponse.getBody().jsonPath().getList("data").size());
 
         // Upload files
         JsonObjectBuilder json1 = Json.createObjectBuilder().add("description", "my description1").add("directoryLabel", "data/subdir1").add("categories", Json.createArrayBuilder().add("Data"));

src/test/java/edu/harvard/iq/dataverse/api/UtilIT.java

@@ -612,8 +612,16 @@ static Response getGuestbook(Long guestbookId, String apiToken) {
     }
 
     static Response getGuestbooks(String dataverseAlias, String apiToken) {
-        RequestSpecification requestSpec = given()
-                .header(API_TOKEN_HTTP_HEADER, apiToken);
+        return getGuestbooks(dataverseAlias, apiToken, null);
+    }
+    static Response getGuestbooks(String dataverseAlias, String apiToken, Boolean includeInherited) {
+        RequestSpecification requestSpec = given();
+        if (apiToken != null) {
+            requestSpec.header(API_TOKEN_HTTP_HEADER, apiToken);
+        }
+        if (includeInherited != null) {
+            requestSpec.queryParam("includeInherited", includeInherited);
+        }
         return requestSpec.get("/api/guestbooks/" + dataverseAlias + "/list" );
     }
 
@@ -2265,10 +2273,15 @@ static Response rejectFileAccessRequest(String fileIdOrPersistentId, String iden
     }
 
     static Response moveDataverse(String movedDataverseAlias, String targetDataverseAlias, Boolean force, String apiToken) {
-        Response response = given()
-                .header(API_TOKEN_HTTP_HEADER, apiToken)
-                .post("api/dataverses/" + movedDataverseAlias + "/move/" + targetDataverseAlias + "?forceMove=" + force + "&key=" + apiToken);
-        return response;
+        RequestSpecification requestSpecification = given();
+        if (apiToken != null) {
+            requestSpecification.header(API_TOKEN_HTTP_HEADER, apiToken);
+            requestSpecification.queryParam("key", apiToken);
+        }
+        if (force != null) {
+            requestSpecification.queryParam("forceMove", force);
+        }
+        return requestSpecification.post("api/dataverses/" + movedDataverseAlias + "/move/" + targetDataverseAlias);
     }
 
     static Response moveDataset(String idOrPersistentIdOfDatasetToMove, String destinationDataverseAlias, String apiToken) {
@@ -5510,8 +5523,10 @@ public static Guestbook createRandomGuestbook(String ownerAlias, String persiste
         gb.getCustomQuestions().get(2).setId(jsonPath.getLong("data.customQuestions[2].id"));
 
         // Add the Guestbook to the Dataset
-        Response setGuestbook = UtilIT.updateDatasetGuestbook(persistentId, guestbookId, apiToken);
-        setGuestbook.prettyPrint();
+        if (persistentId != null) {
+            Response setGuestbook = UtilIT.updateDatasetGuestbook(persistentId, guestbookId, apiToken);
+            setGuestbook.prettyPrint();
+        }
         return gb;
     }