Dataverse linking still requires superuser despite introduction of LinkDataverse permission

[thisisbillie]

What steps does it take to reproduce the issue?

1. Upgrade a Dataverse installation to version 6.8.
2. Create two dataverses (Dataverse A and Dataverse B).
3. Create or identify a non-superuser account.
4. Grant that user the LinkDataverse permission (or a role containing it) on both dataverses.
5. Log in as that non-superuser.
6. Attempt to link Dataverse A to Dataverse B using either: the UI, or the Dataverse linking API.

• When does this issue occur?

When a non-superuser attempts to link one dataverse to another, even though they have been explicitly granted the LinkDataverse permission.

• Which page(s) does it occurs on?
  The Dataverse page where the “Link Dataverse” action would normally be available in the UI

The API endpoint used for linking dataverses

• What happens?
  In the UI, the “Link Dataverse” button does not appear for non-superusers.

In the API, the linking request fails with an authorization error.

The same operation succeeds when performed by a superuser.

• To whom does it occur (all users, curators, superusers)?
  Occurs for non-superusers (including users with curator/admin roles that include the LinkDataverse permission).

Does not occur for superusers.

• What did you expect to happen?
  Users who have been granted the LinkDataverse permission in both the source and target dataverses should be able to link dataverses via the UI and API, without requiring superuser status—consistent with how dataset linking works.

Which version of Dataverse are you using?

Dataverse 6.8 (observed after upgrading from 6.4 to 6.8)

Any related open or closed issues to this bug report?

PR #4648 – Added linking APIs with superuser-only restriction (Dataverse 4.9)

Issue #4410 – Led to removal of superuser requirement for dataset linking

PR #5014 – Removed superuser-only requirement for dataset linking (Dataverse 4.9.3)

PR #11691 – Introduced separate linking permissions (including LinkDataverse), but did not remove superuser requirement for dataverse linking

Are you thinking about creating a pull request for this issue?
No fix is currently planned by the team.

[pdurbin]

@thisisbillie thanks for the bug report! Do you happen to know if this bug is present in a new installation of 6.8 (or 6.9)? I'm wondering if something went wrong with the SQL migration script.

[qqmyers]

Looks like the link popup/menu/button button only shows for superusers: public boolean showLinkingPopup() has

dataverse/src/main/java/edu/harvard/iq/dataverse/DataversePage.java

Line 221 in 954697d

return (session.getUser().isSuperuser() && (dataverse.getOwner() != null || !testquery.isEmpty()));