File Access API not working for unpublished file -- even with key

[raprasad]

Problem/Symptom

For the genTB project, this TwoRavens page is no longer working:

https://rserve.dataverse.harvard.edu/dataexplore/gui.html?dfId=2693726&key=--TOKEN HERE--

Bug

The failure point is the Dataverse API, particularly this call which returns a 403-Forbidden:

https://dataverse.harvard.edu/api/access/datafile/2693726?key=--TOKEN HERE--&format=prep

This is for a file in an unpublished Dataverse ( Tuberculosis Dataverse > Strain and host phenotype). The TwoRavens page has functioned for months until the last patch for 4.2.1.

• Dataverse: Tuberculosis Dataverse
• Dataset: Strain and host phenotype
• File: Strain_Host_Phenotype.tab

[landreev]

OK, the symptoms are pointing to this being a problem with an API key-based access.
But it hasn't been verified yet for sure.
As we were testing the ticket related to access to unpublished files @kcondon told me he was testing BOTH the gui (session-based) and the token-based authentication.

[landreev]

Yes... It is a problem with the API key auth... Introduced in one of the last commits in 4.2.1.
I would like to patch the production with this quickly. This will be a single class file fix.

[bencomp]

I would like to see a new patch release (4.2.2) instead of single class file fixes.

[landreev]

Sure, of course.
I was talking about patching on our own production server; which needs to be done asap. And I may have to fix it today by dropping in a replacement class; and patch a release later.

[landreev]

I committed a fix. Kevin and I will be testing it some more tomorrow.

[bencomp]

I understand, @landreev, but it seems like a really bad idea to replace classes in production, because it may cause other bugs, just like not testing caused this actual bug. If you really think you can fix bugs quickly, I prefer that they are part of releases, however small they may be. Then go the way of Continuous Deployment. In any case: test properly before deploying fixes/single-class patches/releases. Of course I'm repeating myself here :)

[kcondon]

Tested prior use cases both with session and with key and it is working. Will have Raman verify before closing.

[landreev]

You are @bencomp, you really are. :)

[raprasad]

@kcondon, I verified this as working on https://dataverse-internal.iq.harvard.edu/

[landreev]

OK, so the production servers have been patched with this fix, as of last night. Which has solved the urgent problem this was causing, for these users and their presentation.
We will release a "clean" 4.2.2 patch next week; but we now time to do it properly.

[landreev]

I meant "we now have time to do it properly"; as opposed to having to do it in a hurry and introduce even more bugs on account of that...

[kcondon]

OK, verified both session and key work for downloading an unpublished and published file. Closing.