DataverseNO - Dataset/Dataverse manage permissions fix by qqmyers · Pull Request #12503 · IQSS/dataverse

qqmyers · 2026-07-01T18:38:27Z

What this PR does / why we need it: As discussed in #3981 and #12218, the dataset and dataverse pages in the JSF UI only show the Edit menu when the user has the relevant edit permission. However, the menus contains items to allow editing permissions and groups which require only the relevant manage permissions permission to use. Due to this, users in custom roles who could manage permissions but not edit the dataset/dataverse could only update permissions via API or navigating to the relevant permissions page manually.

This PR adjusts the logic to show the Edit Menu itself whenever any of the list items in it would be allowed (and then includes/omits the relevant items based on the permissions the user has.

Which issue(s) this PR closes:

Closes dataset.xhtml - Edit button not rendered if user has only ManageDatasetPermissions #3981
Closes Feature Request: Introduce new EditDataversePermissionGroup permission #12218 (tbd - @philippconzett is going to test this change and see if it addresses some/all their use case or if further changes are needed/something to prioritize and keep the issue open for.

Special notes for your reviewer:

For the Dataverse page, this also adds a check to see if the user is authenticated before checking their permissions to edit/manage. That's done for other menus and for datasets already - hopefully a minor perf boost.

The bulk of the single line changes are just use of the (mostly) pre-existing ui:params that were not yet being used everywhere. This PR makes changes such as DataversePage.dataset -> dataset everywhere. If needed, this could be a separate PR, but hopefully AI can do a sanity check on those and any human reviewer can just focus on the changes to the edit menu. I'll mark where those start with comments.

Suggestions on how to test this: Regression, plus create a role that has only the Manage<Dataverse, Dataset, File>Permission permission and not the corresponding Edit<Dataverse, Dataset>Permission and verify that the Edit menu shows and only has the Permission/Group entries.

Here's an example that could be used with the https://guides.dataverse.org/en/latest/api/native-api.html#create-role API:

{
    "alias":"testcurator",
    "name":"TestCurator",
    "description":"For datasets, a person who can't edit, but can manage Permissions, and publish and link datasets.",
    "permissions":[
        "ViewUnpublishedDataset",
        "DownloadFile",
        "DeleteDatasetDraft",
        "PublishDataset",
        "LinkDataset",
        "ManageDatasetPermissions",
        "ManageFilePermissions",
        "AddDataverse",
        "AddDataset",
        "ViewUnpublishedDataverse" 
    ]
}

Creating/assigning that role at the start, you should be able to see the difference in the UI with the menu appearing after the PR.

Does this PR introduce a user interface change? If mockups are available, please link/include them here:

Is there a release notes update needed for this change?: inc.

Additional documentation:

qqmyers · 2026-07-01T18:39:59Z

                                            <!-- Edit Dataset -->
                                            <div class="btn-group btn-group-justified" jsf:rendered="#{sessionUserAuthenticated
-                                                                                                        and canUpdateDataset}">
+                                                                                                        and (canUpdateDataset or canManageDatasetPermissions or canManageFilesOnDataset)}">


This is the start of the menu, which now shows if you can update or manage dataset/file perms.

qqmyers · 2026-07-01T18:40:29Z

-                                                            </p:commandLink>
-                                                        </li>
-                                                        <ui:fragment rendered="#{permissionsWrapper.canManagePermissions(DatasetPage.dataset) || permissionsWrapper.canManageFilesOnDataset(DatasetPage.dataset)}">
+                                                        <ui:fragment rendered="#{canUpdateDataset}">


The menu items related to updating the dataset now only show with that permission (no changes to the items, just wrapping in the ui:fragment)

qqmyers · 2026-07-01T18:44:22Z

                                            </ui:fragment>
                                            <!-- Edit Button -->
-                                            <div class="btn-group" jsf:rendered="#{permissionsWrapper.canIssueUpdateDataverseCommand(DataversePage.dataverse)}">
+                                            <div class="btn-group" jsf:rendered="#{dataverseSession.user.authenticated and


start of menu - added auth user check and then the manageperms option

qqmyers · 2026-07-01T18:45:07Z

-                                                        </h:link>
-                                                    </li>
-                                                    <ui:fragment rendered="#{permissionsWrapper.canManagePermissions(DataversePage.dataverse)}">
+                                                    <ui:fragment


Same as for dataset.xhtml - new ui:fragments to decide when to render and no changes to the items themselves.

pdurbin · 2026-07-07T15:22:10Z

@@ -0,0 +1 @@
+Users without permission to edit a dataset or dataverse were not able to access the permission and group management pages via the dataset/dataverse page menus even if they had the relevant ManagePermissions permission. See #3981 and #12218 for details.


Do we want to pitch this as a feature? Do we want to encourage adding the custom role that @philippconzett has added?

…ermEditOnly # Conflicts: # src/main/webapp/dataverse.xhtml

…ermEditOnly

pdurbin

A quick review.

pdurbin · 2026-08-19T20:52:11Z

+                          let cite = new Cite(#{workingVersion.getCitation("CSL", true, false)});
                      </script>
                      <p:dialog id="cslCitation" header="#{bundle['dataset.cite.cslDialog.title']}"
                          widgetVar="cslCitationDialog" dynamic="true" modal="true">


I'm just putting this at the bottom.

Automated JSF tests are failing.

@qqmyers can you please investigate?

Clarified the conditions under which users can manage permissions without edit rights, specifying the interface changes for Dataverse and Dataset pages.

…ermEditOnly

coveralls · 2026-08-20T19:04:30Z

coverage: 25.02% (+0.001%) from 25.019% — GlobalDataverseCommunityConsortium:DNO/allowCollectionPermEditOnly into IQSS:develop

pdurbin

I didn't test this but the changes make sense to me and all tests, including JSF tests are now passing. Approved.

@qqmyers if you're willing to provide a custom role or two in the "how to test" section, it would ease testing. Concrete examples, that is.

My understanding of this PR is that there should be no difference in behavior if custom roles are not used.

qqmyers added 2 commits July 1, 2026 14:15

fix IQSS#3981 and related dataverse issue, use more params

3662d91

rel note

74672da

qqmyers added Size: 10 A percentage of a sprint. 7 hours. GDCC: DataverseNO labels Jul 1, 2026

qqmyers added this to IQSS Dataverse Project Jul 1, 2026

qqmyers moved this to Ready for Triage in IQSS Dataverse Project Jul 1, 2026

qqmyers added this to the 6.12 milestone Jul 1, 2026

qqmyers commented Jul 1, 2026

View reviewed changes

pdurbin reviewed Jul 7, 2026

View reviewed changes

pdurbin moved this from Ready for Triage to Ready for Review ⏩ in IQSS Dataverse Project Jul 7, 2026

cmbz added the FY27 Sprint 1 FY27 Sprint 1 (2026-07-01 - 2026-07-15) label Jul 15, 2026

qqmyers added 3 commits July 15, 2026 14:17

fix ordering of params

ddad70a

Merge remote-tracking branch 'IQSS/develop' into DNO/allowCollectionP…

72f618a

…ermEditOnly # Conflicts: # src/main/webapp/dataverse.xhtml

note possibility with custom role per review

dc589a9

cmbz added the FY27 Sprint 2 FY27 Sprint 2 (2026-07-15 - 2026-07-29) label Jul 15, 2026

cmbz added the FY27 Sprint 3 FY27 Sprint 3 (2026-07-29 - 2026-08-12) label Jul 29, 2026

cmbz assigned pdurbin Aug 12, 2026

cmbz moved this from Ready for Review ⏩ to In Review 🔎 in IQSS Dataverse Project Aug 12, 2026

cmbz added the FY27 Sprint 4 FY27 Sprint 4 (2026-08-12 - 2026-08-26) label Aug 12, 2026

Merge remote-tracking branch 'IQSS/develop' into DNO/allowCollectionP…

6cd9348

…ermEditOnly

pdurbin reviewed Aug 19, 2026

View reviewed changes

pdurbin assigned qqmyers Aug 19, 2026

qqmyers and others added 4 commits August 20, 2026 13:02

Update release notes for permission management changes

a13e536

Clarified the conditions under which users can manage permissions without edit rights, specifying the interface changes for Dataverse and Dataset pages.

Merge remote-tracking branch 'IQSS/develop' into DNO/allowCollectionP…

e8f000d

…ermEditOnly

add sleep for search

b0253b9

use writable owner

ebf2f1e

don't use DataversePage.owner - inefficient

f71f8da

qqmyers removed their assignment Aug 21, 2026

pdurbin approved these changes Aug 21, 2026

View reviewed changes

github-project-automation Bot moved this from In Review 🔎 to Ready for QA ⏩ in IQSS Dataverse Project Aug 21, 2026

pdurbin removed their assignment Aug 21, 2026

Navigation Menu

Uh oh!

DataverseNO - Dataset/Dataverse manage permissions fix - #12503

DataverseNO - Dataset/Dataverse manage permissions fix#12503
qqmyers wants to merge 11 commits into
IQSS:developfrom
GlobalDataverseCommunityConsortium:DNO/allowCollectionPermEditOnly

qqmyers commented Jul 1, 2026 •

edited

Loading

Uh oh!

qqmyers Jul 1, 2026

Uh oh!

qqmyers Jul 1, 2026 •

edited

Loading

Uh oh!

qqmyers Jul 1, 2026

Uh oh!

qqmyers Jul 1, 2026

Uh oh!

pdurbin Jul 7, 2026

Uh oh!

pdurbin left a comment

Uh oh!

pdurbin Aug 19, 2026

Uh oh!

qqmyers Aug 21, 2026

Uh oh!

pdurbin Aug 21, 2026

Uh oh!

Uh oh!

coveralls commented Aug 20, 2026

Uh oh!

pdurbin left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		@@ -0,0 +1 @@
		Users without permission to edit a dataset or dataverse were not able to access the permission and group management pages via the dataset/dataverse page menus even if they had the relevant ManagePermissions permission. See #3981 and #12218 for details. No newline at end of file

Uh oh!

Conversation

qqmyers commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qqmyers Jul 1, 2026

Choose a reason for hiding this comment

Uh oh!

qqmyers Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

qqmyers Jul 1, 2026

Choose a reason for hiding this comment

Uh oh!

qqmyers Jul 1, 2026

Choose a reason for hiding this comment

Uh oh!

pdurbin Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

pdurbin left a comment

Choose a reason for hiding this comment

Uh oh!

pdurbin Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

qqmyers Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

pdurbin Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coveralls commented Aug 20, 2026

Uh oh!

pdurbin left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

qqmyers commented Jul 1, 2026 •

edited

Loading

qqmyers Jul 1, 2026 •

edited

Loading