Guestbook issue with Preview URL and restricted files

[Lora Leligdon]

We're running Dataverse v6.11 and seeing a guestbook issue with Preview URLs on an unpublished dataset and want to determine whether this is expected behavior or a larger bug before we publish.

We have a Dataverse collection with two unpublished datasets. The first has a guestbook enabled and contains both restricted and unrestricted files. When a reviewer uses the Preview URL to download any file (restricted or unrestricted), they receive the following error:

status: "ERROR"

message: "You may not download this file without the required Guestbook response for guestbookID 60."

 

Disabling the guestbook resolves the issue and files download normally through the Preview URL.

1. Should guestbooks be expected to work correctly with Preview URLs? We found some past GitHub issues touching on guestbooks and Preview/Private URLs, but they seemed contradictory and we couldn't confirm current expected behavior for 6.11.
2. Is there a fix or configuration change we should make? We're hesitant to publish this dataset until we understand whether this same guestbook/restricted-file issue will affect access after publication, since the data is sensitive and we need access controls to work correctly.

Any guidance, or pointers to a relevant issue if this is already tracked, would be much appreciated.

[Philip Durbin]

Hi Lora,

I tested* our latest code and I'm pretty convinced there's a bug. Can you please open one at https://github.com/IQSS/dataverse/issues ? You can call it something like "When there is a guestbook, you cannot download files using a Preview URL", please.

If it's ok for the reviewer to see the author's name, etc, you could ask them to create an account and give them the "Member" role for the dataset. That should allow them to download files.

I suspect the guestbook will work fine after you publish. That is, I'm guessing that Preview URLs are not working with guestbooks. We did make a change** in Dataverse 6.10 with guestbooks but I thought it only affected API users. I was able to reproduce the problem you described in a browser. (I'll include a screenshot.)

Thanks for bringing this to our attention,

Phil

* This commit does the setup for testing: https://github.com/IQSS/dataverse/commit/bd94466d56dd1ddbdf52c31e275f72c60ad98974

** See "A Guestbook Response Can Be Required for File Access (File Download) APIs" at https://github.com/IQSS/dataverse/releases/tag/v6.10

--
You received this message because you are subscribed to the Google Groups "Dataverse Users Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to dataverse-commu...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/dataverse-community/9e35db29-8b04-4c13-b056-405a551f562an%40googlegroups.com.

--

Philip Durbin
Software Developer for http://dataverse.org
http://www.iq.harvard.edu/people/philip-durbin

[Julian Gautier]

Hi everyone,

Thought it might be helpful to more directly answer your questions here Lora:

"Should guestbooks be expected to work correctly with Preview URLs? We found some past GitHub issues touching on guestbooks and Preview/Private URLs, but they seemed contradictory and we couldn't confirm current expected behavior for 6.11."

When someone uses a Preview URL to download files in a dataset that has a guestbook, they shouldn't see the guestbook.

"Is there a fix or configuration change we should make? We're hesitant to publish this dataset until we understand whether this same guestbook/restricted-file issue will affect access after publication, since the data is sensitive and we need access controls to work correctly."

We're thinking the fix will be to adjust the API that Dataverse uses to let people download files, so that when they're using a Preview URL to download files in an unpublished dataset, they don't see the guestbook and they'll get the files instead of the error message you let us know about. So when we make this fix, we hope to be able to close the GitHub issue you opened yesterday at https://github.com/IQSS/dataverse/issues/12535.

I also wanted to ask: What do you think of Phil's workaround, to ask the reviewer to create an account, so that you can give their account the "Member" role and they can view download the files?

Lastly, because you're using guestbooks to help with access controls for sensitive data, I thought I'd point out a guestbook bug we plan to fix that might affect how well you can use guestbooks to collect information from people who want to download the files. The bug is described at https://github.com/IQSS/dataverse/issues/12483, and we plan to fix it for the 6.12 version of Dataverse.

In the meantime, if your guestbooks have custom questions that are required, I think you should make sure that the questions that are "single line" so that the person who fills out the guestbook as the answer those questions. When a custom question is "multi line" - so that the user has a bigger textbox to write their reply - v6.11 of Dataverse doesn't require that they enter anything in that textbox.

All best,

Julian

Julian Gautier (he/him)

Product Research Specialist, IQSS

Interested in helping test Dataverse? Sign up for user experience research

[Lora Leligdon]

Thanks for this information.

The account/Member role workaround won't quite fit our specific use case, though it seems reasonable for other scenarios. 

We were interested in using the Preview URL to demonstrate the full functionality of the guestbook and restricted file access to our tech transfer office before publishing the full Dataverse. A Preview URL that grants "Restricted files with access already granted" works well for blind reviewer scenarios, but it doesn't let us actually demonstrate how the restricted file and guestbook workflow behaves for an end user before publishing, which was what we ultimately needed here.

On the guestbook question issue, ours includes a required custom question written as a Multiple Choice question rather than multi-line text. I didn't see that question type mentioned in #12483. Should we expect the same "not actually enforced as required" behavior with Multiple Choice questions, or is that bug specific to multi-line text fields?

Thanks,

Lora

[Julian Gautier]

The bug mentioned in #12483 is only about multi-line text fields. You should expect Dataverse to require uses to answer Multiple Choice questions.

You wrote that:

"A Preview URL that grants "Restricted files with access already granted" works well for blind reviewer scenarios, but it doesn't let us actually demonstrate how the restricted file and guestbook workflow behaves for an end user before publishing, which was what we ultimately needed here."

And the Preview URL doesn't currently let you actually demonstrate to your tech transfer office how the restricted file and guestbook workflow behaves for an end user before publishing because of the bug you reported at https://github.com/IQSS/dataverse/issues/12535, right? And once that bug is fixed, you'll be able to demonstrate how it should work? Just making sure I understand your use cases :)

Thanks so much for the extra context!