403 Forbidden error: Unable to view/download publicly shared dataset has RCA

[Mrudhulraj]

What happened?

The dataset shared publicly is not viewable or downloadable from any other user account.

Scenario:
Dataset Owner : Create a dataset and share it publicly with download permission enabled.

Non-owner: View the publicly shared dataset.
-> Issue: User cannot view any of the versions or download them

Observation:

1. Regardless of read/write permission granted, the datasets are not viewable or downloadable.
2. Getting 403 forbidden error in a non-owner user account with a response while listing datasets:
   {"code":403, "message": "User not authorized."}
3. The same entity dataset is being listed twice.

How to reproduce?

1. Create a dataset from owner account and share the dataset publicly with write permissions.
2. Note: Share button doesn't do anything -> No API calls sent
3. Log in to a secondary non-owner user and try to view the dataset.
4. Non-owner will not be able to view any of the datasets or download any of the versions.
5. Errors observed: 403 abandoned error.
6. Same entity id being listed twice.

Version/Branch

1.3.0-incubating-SNAPSHOT (main)

Commit Hash (Optional)

No response

What browsers are you seeing the problem on?

No response

Relevant log output

INFO  [2026-06-26 19:08:50,406] org.eclipse.jetty.server.RequestLog: [0:0:0:0:0:0:0:1] - "GET /api/dataset/1/diff HTTP/1.1" 200
INFO  [2026-06-26 19:08:50,420] org.eclipse.jetty.server.RequestLog: [0:0:0:0:0:0:0:1] - "GET /api/dataset/1/version/2/rootFileNodes HTTP/1.1" 200
INFO  [2026-06-26 19:08:50,451] org.eclipse.jetty.server.RequestLog: [0:0:0:0:0:0:0:1] - "GET /api/dataset/presign-download HTTP/1.1" 200
INFO  [2026-06-26 19:08:57,499] org.eclipse.jetty.server.RequestLog: [0:0:0:0:0:0:0:1] - "GET /api/dataset/user-dataset-owners HTTP/1.1" 200
INFO  [2026-06-26 19:08:57,518] org.eclipse.jetty.server.RequestLog: [0:0:0:0:0:0:0:1] - "GET /api/access/dataset/owner/1 HTTP/1.1" 200
INFO  [2026-06-26 19:08:57,520] org.eclipse.jetty.server.RequestLog: [0:0:0:0:0:0:0:1] - "GET /api/access/dataset/list/1 HTTP/1.1" 200
INFO  [2026-06-26 19:08:57,949] org.eclipse.jetty.server.RequestLog: [0:0:0:0:0:0:0:1] - "GET /api/dataset/1 HTTP/1.1" 200
INFO  [2026-06-26 19:10:06,944] org.eclipse.jetty.server.RequestLog: [0:0:0:0:0:0:0:1] - "GET /api/dataset/user-dataset-owners HTTP/1.1" 200
INFO  [2026-06-26 19:10:06,968] org.eclipse.jetty.server.RequestLog: [0:0:0:0:0:0:0:1] - "GET /api/access/dataset/list/1 HTTP/1.1" 200
INFO  [2026-06-26 19:10:06,970] org.eclipse.jetty.server.RequestLog: [0:0:0:0:0:0:0:1] - "GET /api/access/dataset/owner/1 HTTP/1.1" 200
INFO  [2026-06-26 19:10:06,986] org.eclipse.jetty.server.RequestLog: [0:0:0:0:0:0:0:1] - "GET /api/dataset/1 HTTP/1.1" 200
INFO  [2026-06-26 19:14:27,033] org.eclipse.jetty.server.RequestLog: [0:0:0:0:0:0:0:1] - "GET /api/dataset/1 HTTP/1.1" 403
INFO  [2026-06-26 19:14:27,040] org.eclipse.jetty.server.RequestLog: [0:0:0:0:0:0:0:1] - "GET /api/dataset/1/version/list HTTP/1.1" 403

[github-actions]

👋 Thanks for your first contribution to Texera, @Mrudhulraj!

If you're looking for a good place to start, browse issues labeled starter-task; they're scoped to be approachable for newcomers.

You can drive common housekeeping yourself by commenting one of these commands on its own line:

• Issues. Comment /take to assign an open issue to yourself, or /untake to release it. You can find unclaimed work with the search filter is:issue is:open no:assignee.
• Sub-issues. To link issues into a parent/child hierarchy, comment /sub-issue #5166 #5222 on the parent to attach those children (or /unsub-issue #5166 #5222 to detach them). From a child issue, comment /parent-issue #5166 to set its parent, or /unparent-issue to clear it (the current parent is detected automatically). References may be written as #5166 or as a bare 5166; cross-repository references are not supported.
• Pull requests (author only). Comment /request-review @user to request a review from someone, or /unrequest-review @user to withdraw that request.

Each command must match exactly: /take this will not work, only /take does. For the full contribution flow, see CONTRIBUTING.md.

[Mrudhulraj]

I can address this issue once we confirm if it's a bug.
I'm a master's student at UCI.

[Mrudhulraj]

/take

[chenlica]

Thanks, @Mrudhulraj .

@seongjinyoon Can you confirm?