IQSS / IQSS/dataverse

Cannot delete empty subdataverse if it once contained a dataset which had a custom role in its Permissions

Open
#7,389 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Feature: Dataverse General Info Feature: Permissions Type: Bug User Role: Superuser
Dominant language
Java
Stars
1.1k
Forks
564
Avg merge
2d 2h
Merged PRs (30d)
29

Description

Version: 4.20

Guten Tag,

I think that custom roles can prevent deletion of an empty subdataverse. By custom roles I mean roles created as Dataverse admin by following this path: Edit (on a (sub)dataverse homepage) > Permissions > Roles > Add New Role.

This is what happened:

  1. I created a subdataverse;
  2. I added a new dataset in this subdataverse;
  3. I published it (as admin);
  4. I created a custom role, "Data Request Manager," who only has the ManageDatasetPermissions privilege;
  5. At the level of this dataset, I gave a certain user (not myself, the admin) this custom role, "Data Request Manager";
  6. I then moved the dataset out of the subdataverse into the root dataverse thanks to the Move Data functionality in the admin dashboard;
  7. I then tried to delete the – now empty – subdataverse via the GUI, but I got the following error message:

errordel

(Transcript: "Error – This dataverse was not able to be deleted. If you believe this is an error, please contact Team SODHA for assistance.")

I think it's because of the custom role for two reasons:

  1. By following the exact same steps described above but by giving a default role (e.g. Contributor or Curator) to the user at step 5 instead of a custom role, I could then successfully delete the subdataverse after I had emptied it;

  2. The error messages in the server logs seem to go in this direction as well:

[2020-11-04T16:41:00.494+0100] [glassfish 4.1] [WARNING] [] [org.eclipse.persistence.session.file:/usr/local/glassfish4/glassfish/domains/domain1/applications/dataverse-4.20/WEB-INF/classes/_VDCNet-ejbPU] [tid: _ThreadID=26 _ThreadName=http-listener-1(2)] [timeMillis: 1604504460494] [levelValue: 900] [[

Local Exception Stack:
Exception [EclipseLink-4002] (Eclipse Persistence Services - 2.5.2.v20140319-9ad6abd): org.eclipse.persistence.exceptions.DatabaseException
Internal Exception: org.postgresql.util.PSQLException: ERROR: update or delete on table "dataverserole" violates foreign key constraint "fk_roleassignment_role_id" on table "roleassignment"
Detail: Key (id)=(10) is still referenced from table "roleassignment".

Error Code: 0
Call: DELETE FROM DATAVERSEROLE WHERE (ID = ?)
bind => [1 parameter bound]
Query: DeleteObjectQuery(DataverseRole{id=10, alias=datamanag})
at org.eclipse.persistence.exceptions.DatabaseException.sqlException(DatabaseException.java:340)
[…]

Here is the full report:

error-cust-role-del-subd.log

Could this mean that, in order to delete a subdataverse, one must not just remove subdataverses and datasets within but also custom roles created at this level?

(As far as I could see, custom roles cannot be deleted via the GUI.)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the GUI sequence in the issue: create a custom role, assign it to a user on a dataset, move the dataset, and delete the empty subdataverse. Inspect the server log and the roleassignment foreign-key error, then verify that deletion succeeds without leaving custom-role references behind.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, postgresql
Domain
authorization, backend, databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.