From 01bc37e0e7e80c9bf2d65f8938c0071959f45e7e Mon Sep 17 00:00:00 2001 From: Ash Manda Date: Fri, 31 Jul 2026 20:24:08 -0400 Subject: [PATCH 1/2] fix: possible locally fair dataset download fix --- src/main/java/edu/harvard/iq/dataverse/api/Access.java | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/main/java/edu/harvard/iq/dataverse/api/Access.java b/src/main/java/edu/harvard/iq/dataverse/api/Access.java index 7d12e5e8b3f..2f5b654639d 100644 --- a/src/main/java/edu/harvard/iq/dataverse/api/Access.java +++ b/src/main/java/edu/harvard/iq/dataverse/api/Access.java @@ -279,6 +279,10 @@ public BundleDownloadInstance datafileBundleWithGuestbookResponse(@Context Conta private DataFile findDataFileUserCanSeeOrDieWrapper(String fileId, DataverseRequest req){ DataFile df = null; + + if (req.getUser() instanceof GuestUser) { + req = dvRequestService.getDataverseRequest(); + } try { df = findDataFileUserCanSeeOrDie(fileId, req); From f9e2dc484ae0d7dea132b0d71875fcb46d8a72b0 Mon Sep 17 00:00:00 2001 From: Ash Manda Date: Fri, 31 Jul 2026 20:42:15 -0400 Subject: [PATCH 2/2] docs: add inline comment for the locally fair dataset download fix Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- src/main/java/edu/harvard/iq/dataverse/api/Access.java | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/main/java/edu/harvard/iq/dataverse/api/Access.java b/src/main/java/edu/harvard/iq/dataverse/api/Access.java index 2f5b654639d..960e1699dc6 100644 --- a/src/main/java/edu/harvard/iq/dataverse/api/Access.java +++ b/src/main/java/edu/harvard/iq/dataverse/api/Access.java @@ -281,6 +281,8 @@ private DataFile findDataFileUserCanSeeOrDieWrapper(String fileId, DataverseRequ DataFile df = null; if (req.getUser() instanceof GuestUser) { + // For JSF/UI requests, the ContainerRequestContext user can be GuestUser even when the session is authenticated. + // Locally FAIR visibility checks rely on the DataverseRequest user, so pull the session-backed request here. req = dvRequestService.getDataverseRequest(); }