From 604db6c5f7467a14ce4f63dce8aade897893be07 Mon Sep 17 00:00:00 2001 From: Vera Clemens Date: Tue, 24 Mar 2026 10:46:29 +0100 Subject: [PATCH 1/6] feat: require only LinkDataverse permission to link and unlink collections via API (no superuser) --- .../impl/DeleteDataverseLinkingDataverseCommand.java | 6 +----- .../dataverse/engine/command/impl/LinkDataverseCommand.java | 4 ---- 2 files changed, 1 insertion(+), 9 deletions(-) diff --git a/src/main/java/edu/harvard/iq/dataverse/engine/command/impl/DeleteDataverseLinkingDataverseCommand.java b/src/main/java/edu/harvard/iq/dataverse/engine/command/impl/DeleteDataverseLinkingDataverseCommand.java index 9eddfcd2b9c..33f88d8d768 100644 --- a/src/main/java/edu/harvard/iq/dataverse/engine/command/impl/DeleteDataverseLinkingDataverseCommand.java +++ b/src/main/java/edu/harvard/iq/dataverse/engine/command/impl/DeleteDataverseLinkingDataverseCommand.java @@ -26,7 +26,7 @@ * @author sarahferry */ -@RequiredPermissions( Permission.EditDataverse ) +@RequiredPermissions( Permission.LinkDataverse ) public class DeleteDataverseLinkingDataverseCommand extends AbstractCommand { private final DataverseLinkingDataverse doomed; @@ -42,10 +42,6 @@ public DeleteDataverseLinkingDataverseCommand(DataverseRequest aRequest, Dataver @Override public Dataverse execute(CommandContext ctxt) throws CommandException { - if ((!(getUser() instanceof AuthenticatedUser) || !getUser().isSuperuser())) { - throw new PermissionException("Delete dataverse linking dataverse can only be called by superusers.", - this, Collections.singleton(Permission.DeleteDataverse), editedDv); - } Dataverse merged = ctxt.em().merge(editedDv); DataverseLinkingDataverse doomedAndMerged = ctxt.em().merge(doomed); ctxt.em().remove(doomedAndMerged); diff --git a/src/main/java/edu/harvard/iq/dataverse/engine/command/impl/LinkDataverseCommand.java b/src/main/java/edu/harvard/iq/dataverse/engine/command/impl/LinkDataverseCommand.java index 2e1aecc9a84..3561aba076c 100644 --- a/src/main/java/edu/harvard/iq/dataverse/engine/command/impl/LinkDataverseCommand.java +++ b/src/main/java/edu/harvard/iq/dataverse/engine/command/impl/LinkDataverseCommand.java @@ -45,10 +45,6 @@ public LinkDataverseCommand(DataverseRequest aRequest, Dataverse dataverse, Data @Override public DataverseLinkingDataverse execute(CommandContext ctxt) throws CommandException { - if ((!(getUser() instanceof AuthenticatedUser) || !getUser().isSuperuser())) { - throw new PermissionException("Link Dataverse can only be called by superusers.", - this, Collections.singleton(Permission.LinkDataverse), linkingDataverse); - } if (linkedDataverse.equals(linkingDataverse)) { throw new IllegalCommandException("Can't link a dataverse to itself", this); } From 7b495f8e00b7bb96baadf2ce550b439afbcb40a1 Mon Sep 17 00:00:00 2001 From: Vera Clemens Date: Tue, 24 Mar 2026 10:48:27 +0100 Subject: [PATCH 2/6] feat: show "Link" button for collections in UI to non-superusers --- src/main/java/edu/harvard/iq/dataverse/DataversePage.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/java/edu/harvard/iq/dataverse/DataversePage.java b/src/main/java/edu/harvard/iq/dataverse/DataversePage.java index d9cafbf421a..3776b9db094 100644 --- a/src/main/java/edu/harvard/iq/dataverse/DataversePage.java +++ b/src/main/java/edu/harvard/iq/dataverse/DataversePage.java @@ -218,7 +218,7 @@ public boolean showLinkingPopup() { testquery = query; } - return (session.getUser().isSuperuser() && (dataverse.getOwner() != null || !testquery.isEmpty())); + return (dataverse.getOwner() != null || !testquery.isEmpty()); } public void setupLinkingPopup (String popupSetting){ From e9f4897075ad35268a3583385a75336d4b2d76df Mon Sep 17 00:00:00 2001 From: Vera Clemens Date: Tue, 24 Mar 2026 10:50:28 +0100 Subject: [PATCH 3/6] docs: add/update docs about linking --- .../source/admin/dataverses-datasets.rst | 4 +- doc/sphinx-guides/source/api/native-api.rst | 60 +++++++++++++++++++ .../source/user/dataverse-management.rst | 8 +-- 3 files changed, 66 insertions(+), 6 deletions(-) diff --git a/doc/sphinx-guides/source/admin/dataverses-datasets.rst b/doc/sphinx-guides/source/admin/dataverses-datasets.rst index 9696c758b04..308ff43b369 100644 --- a/doc/sphinx-guides/source/admin/dataverses-datasets.rst +++ b/doc/sphinx-guides/source/admin/dataverses-datasets.rst @@ -22,14 +22,14 @@ Moves a Dataverse collection whose id is passed to an existing Dataverse collect Link a Dataverse Collection ^^^^^^^^^^^^^^^^^^^^^^^^^^^ -Creates a link between a Dataverse collection and another Dataverse collection (see the :ref:`dataverse-linking` section of the User Guide for more information). Only accessible to superusers. :: +Creates a link between a Dataverse collection and another Dataverse collection (see the :ref:`dataverse-linking` section of the User Guide for more information). :: curl -H "X-Dataverse-key: $API_TOKEN" -X PUT http://$SERVER/api/dataverses/$linked-dataverse-alias/link/$linking-dataverse-alias Unlink a Dataverse Collection ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -Removes a link between a Dataverse collection and another Dataverse collection. Only accessible to superusers. :: +Removes a link between a Dataverse collection and another Dataverse collection. Accessible to users with Link Dataverse permission on the linking Dataverse collection. :: curl -H "X-Dataverse-key: $API_TOKEN" -X DELETE http://$SERVER/api/dataverses/$linked-dataverse-alias/deleteLink/$linking-dataverse-alias diff --git a/doc/sphinx-guides/source/api/native-api.rst b/doc/sphinx-guides/source/api/native-api.rst index 808dbeec815..505fbea7167 100644 --- a/doc/sphinx-guides/source/api/native-api.rst +++ b/doc/sphinx-guides/source/api/native-api.rst @@ -3475,6 +3475,66 @@ The fully expanded example above (without environment variables) looks like this curl -H "X-Dataverse-key: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" -X PUT "https://demo.dataverse.org/api/datasets/24/link/test" +Unlink a Dataset +~~~~~~~~~~~~~~~~ + +Removes a link between a dataset and a Dataverse collection (see :ref:`dataset-linking` section of Dataverse Collection Management in the User Guide for more information): + +.. code-block:: bash + +export API_TOKEN=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx +export SERVER_URL=https://demo.dataverse.org +export DATASET_ID=24 +export DATAVERSE_ID=test + +curl -H "X-Dataverse-key: $API_TOKEN" -X DELETE "$SERVER_URL/api/datasets/$DATASET_ID/deleteLink/$DATAVERSE_ID" + +The fully expanded example above (without environment variables) looks like this: + +.. code-block:: bash + +curl -H "X-Dataverse-key: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" -X DELETE "https://demo.dataverse.org/api/datasets/24/deleteLink/test" + +Link a Dataverse collection +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Creates a link between one Dataverse collection and another Dataverse collection (see :ref:`dataverse-linking` section of Dataverse Collection Management in the User Guide for more information): + +.. code-block:: bash + +export API_TOKEN=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx +export SERVER_URL=https://demo.dataverse.org +export LINKED_DATAVERSE_ID=linked-collection +export LINKING_DATAVERSE_ID=linking-collection + +curl -H "X-Dataverse-key: $API_TOKEN" -X PUT "$SERVER_URL/api/dataverses/$LINKED_DATAVERSE_ID/link/$LINKING_DATAVERSE_ID" + +The fully expanded example above (without environment variables) looks like this: + +.. code-block:: bash + +curl -H "X-Dataverse-key: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" -X PUT "https://demo.dataverse.org/api/dataverses/linked-collection/link/linking-collection" + +Unlink a Dataverse collection +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Removes a link between one Dataverse collection and another Dataverse collection (see :ref:`dataverse-linking` section of Dataverse Collection Management in the User Guide for more information): + +.. code-block:: bash + +export API_TOKEN=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx +export SERVER_URL=https://demo.dataverse.org +export LINKED_DATAVERSE_ID=linked-collection +export LINKING_DATAVERSE_ID=linking-collection + +curl -H "X-Dataverse-key: $API_TOKEN" -X DELETE "$SERVER_URL/api/dataverses/$LINKED_DATAVERSE_ID/deleteLink/$LINKING_DATAVERSE_ID" + +The fully expanded example above (without environment variables) looks like this: + +.. code-block:: bash + +curl -H "X-Dataverse-key: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" -X DELETE "https://demo.dataverse.org/api/dataverses/linked-collection/deleteLink/linking-collection" + Dataset Locks ~~~~~~~~~~~~~ diff --git a/doc/sphinx-guides/source/user/dataverse-management.rst b/doc/sphinx-guides/source/user/dataverse-management.rst index 4e94bfad256..2586a6e90e0 100755 --- a/doc/sphinx-guides/source/user/dataverse-management.rst +++ b/doc/sphinx-guides/source/user/dataverse-management.rst @@ -221,18 +221,18 @@ In order to link a dataset, you will need your account to have the "Link Dataset To link a dataset to your Dataverse collection, you must navigate to that dataset and click the white "Link" button in the upper-right corner of the dataset page. This will open up a window where you can type in the name of the Dataverse collection that you would like to link the dataset to. Select your Dataverse collection and click the save button. This will establish the link, and the dataset will now appear under your Dataverse collection. -A draft dataset can be linked to other Dataverse collections. It will only become publicly visible in the linked collection(s) after it has been published. To publish the dataset, your account must have the "Publish Dataset" permission for the Dataverse collection in which the dataset was originally created. Permissions in the linked Dataverse collections do not apply. +To remove an established link, navigate to the linked dataset's page and click the white "Unlink" button in the upper-right corner of the page. -There is currently no way to remove established links in the UI. If you need to remove a link between a Dataverse collection and a dataset, please contact the support team for the Dataverse installation you are using (see the :ref:`unlink-a-dataset` section of the Admin Guide for more information). +A draft dataset can be linked to other Dataverse collections. It will only become publicly visible in the linked collection(s) after it has been published. To publish the dataset, your account must have the "Publish Dataset" permission for the Dataverse collection in which the dataset was originally created. Permissions in the linked Dataverse collections do not apply. .. _dataverse-linking: Dataverse Collection Linking ============================ -Similarly to dataset linking, Dataverse collection linking allows a Dataverse collection owner to "link" their Dataverse collection to another Dataverse collection, so the Dataverse collection being linked will appear in the linking Dataverse collection's list of contents without actually *being* in that Dataverse collection. Currently, the ability to link a Dataverse collection to another Dataverse collection is a superuser only feature. +Similarly to dataset linking, Dataverse collection linking allows a Dataverse collection owner to "link" their Dataverse collection to another Dataverse collection, so the Dataverse collection being linked will appear in the linking Dataverse collection's list of contents without actually *being* in that Dataverse collection. -If you need to have a Dataverse collection linked to your Dataverse collection, please contact the support team for the Dataverse installation you are using. +In order to link a collection, you will need your account to have the "Link Dataverse" permission on the linking Dataverse collection. Publish Your Dataverse Collection ================================= From e08f615eafa8ed545b6badb444ea5541443410c2 Mon Sep 17 00:00:00 2001 From: Vera Clemens Date: Tue, 24 Mar 2026 10:51:08 +0100 Subject: [PATCH 4/6] test: update LinkIT to test required permissions for collection linking + unlinking --- .../edu/harvard/iq/dataverse/api/LinkIT.java | 86 ++++++++++++------- 1 file changed, 56 insertions(+), 30 deletions(-) diff --git a/src/test/java/edu/harvard/iq/dataverse/api/LinkIT.java b/src/test/java/edu/harvard/iq/dataverse/api/LinkIT.java index dfc132c3b3f..a8658efa076 100644 --- a/src/test/java/edu/harvard/iq/dataverse/api/LinkIT.java +++ b/src/test/java/edu/harvard/iq/dataverse/api/LinkIT.java @@ -105,56 +105,82 @@ public void testLinkedDataset() { @Test public void testCreateDeleteDataverseLink() { - Response createUser = UtilIT.createRandomUser(); + // Create user #1 who owns Dataverse collection #1 + Response createUser1 = UtilIT.createRandomUser(); + createUser1.prettyPrint(); + String apiToken1 = UtilIT.getApiTokenFromResponse(createUser1); + String username1 = UtilIT.getUsernameFromResponse(createUser1); - createUser.prettyPrint(); - String username = UtilIT.getUsernameFromResponse(createUser); - String apiToken = UtilIT.getApiTokenFromResponse(createUser); + Response createDataverse1Response = UtilIT.createRandomDataverse(apiToken1); + createDataverse1Response.prettyPrint(); + String dataverse1Alias = UtilIT.getAliasFromResponse(createDataverse1Response); + Integer dataverse1Id = UtilIT.getDataverseIdFromResponse(createDataverse1Response); - Response superuserResponse = UtilIT.makeSuperUser(username); + // Create user #2 who owns Dataverse collection #2 + Response createUser2 = UtilIT.createRandomUser(); + createUser2.prettyPrint(); + String apiToken2 = UtilIT.getApiTokenFromResponse(createUser2); - Response createDataverseResponse = UtilIT.createRandomDataverse(apiToken); - createDataverseResponse.prettyPrint(); - String dataverseAlias = UtilIT.getAliasFromResponse(createDataverseResponse); - Integer dataverseId = UtilIT.getDataverseIdFromResponse(createDataverseResponse); + Response createDataverse2Response = UtilIT.createRandomDataverse(apiToken2); + createDataverse2Response.prettyPrint(); + String dataverse2Alias = UtilIT.getAliasFromResponse(createDataverse2Response); + Integer dataverse2Id = UtilIT.getDataverseIdFromResponse(createDataverse2Response); - Response createDataverseResponse2 = UtilIT.createRandomDataverse(apiToken); - createDataverseResponse2.prettyPrint(); - String dataverseAlias2 = UtilIT.getAliasFromResponse(createDataverseResponse2); - Integer dataverseId2 = UtilIT.getDataverseIdFromResponse(createDataverseResponse2); + // Let user #1 try to link their collection #1 into collection #2 + // This should fail, because user #1 has not been granted permission to link into collection #2 + Response createDataverseLinkWithoutPermissionResponse = UtilIT.createDataverseLink(dataverse1Alias, dataverse2Alias, apiToken1); + createDataverseLinkWithoutPermissionResponse.prettyPrint(); + createDataverseLinkWithoutPermissionResponse.then().assertThat() + .statusCode(UNAUTHORIZED.getStatusCode()); - Response createLinkingDataverseResponse = UtilIT.createDataverseLink(dataverseAlias, dataverseAlias2, apiToken); - createLinkingDataverseResponse.prettyPrint(); - createLinkingDataverseResponse.then().assertThat() - .statusCode(OK.getStatusCode()) - .body("data.message", equalTo("Dataverse " + dataverseAlias + " linked successfully to " + dataverseAlias2)); + // Let user #2 grant user #1 admin access for collection #2 + // (The admin role is the only preconfigured role which includes the "Link Dataverse" permission) + Response grantUser2AccessOnDataverse1 = UtilIT.grantRoleOnDataverse(dataverse2Alias, "admin", "@" + username1, apiToken2); + grantUser2AccessOnDataverse1.prettyPrint(); + grantUser2AccessOnDataverse1.then().assertThat() + .statusCode(OK.getStatusCode()); - Response tryLinkingAgain = UtilIT.createDataverseLink(dataverseAlias, dataverseAlias2, apiToken); + // Let user #1 try again + // Now that they have access, this should succeed + Response tryLinkingAgain = UtilIT.createDataverseLink(dataverse1Alias, dataverse2Alias, apiToken1); tryLinkingAgain.prettyPrint(); tryLinkingAgain.then().assertThat() + .statusCode(OK.getStatusCode()) + .body("data.message", equalTo("Dataverse " + dataverse1Alias + " linked successfully to " + dataverse2Alias)); + + // And again, to see if the creation of duplicate links is correctly rejected + Response tryLinkingAgainAndAgain = UtilIT.createDataverseLink(dataverse1Alias, dataverse2Alias, apiToken1); + tryLinkingAgainAndAgain.prettyPrint(); + tryLinkingAgainAndAgain.then().assertThat() .statusCode(FORBIDDEN.getStatusCode()) - .body("message", equalTo(dataverseAlias + " has already been linked to " + dataverseAlias2 + ".")); + .body("message", equalTo(dataverse1Alias + " has already been linked to " + dataverse2Alias + ".")); - Response getLinksResponse = UtilIT.getDataverseLinks(dataverseAlias, apiToken); + // Make user #1 superuser because it's required to list a collection's links + UtilIT.setSuperuserStatus(username1, true); + + Response getLinksResponse = UtilIT.getDataverseLinks(dataverse1Alias, apiToken1); getLinksResponse.prettyPrint(); getLinksResponse.then().assertThat() .statusCode(OK.getStatusCode()) - .body("data.dataversesLinkingToThis[0].id", equalTo(dataverseId2)) - .body("data.dataversesLinkingToThis[0].alias", equalTo(dataverseAlias2)) - .body("data.dataversesLinkingToThis[0].displayName", equalTo(dataverseAlias2)); - getLinksResponse = UtilIT.getDataverseLinks(dataverseAlias2, apiToken); + .body("data.dataversesLinkingToThis[0].id", equalTo(dataverse2Id)) + .body("data.dataversesLinkingToThis[0].alias", equalTo(dataverse2Alias)) + .body("data.dataversesLinkingToThis[0].displayName", equalTo(dataverse2Alias)); + getLinksResponse = UtilIT.getDataverseLinks(dataverse2Alias, apiToken1); getLinksResponse.prettyPrint(); getLinksResponse.then().assertThat() .statusCode(OK.getStatusCode()) - .body("data.linkedDataverses[0].id", equalTo(dataverseId)) - .body("data.linkedDataverses[0].alias", equalTo(dataverseAlias)) - .body("data.linkedDataverses[0].displayName", equalTo(dataverseAlias)); + .body("data.linkedDataverses[0].id", equalTo(dataverse1Id)) + .body("data.linkedDataverses[0].alias", equalTo(dataverse1Alias)) + .body("data.linkedDataverses[0].displayName", equalTo(dataverse1Alias)); + + // Undo superuser status to test that it's not required for deleting a link + UtilIT.setSuperuserStatus(username1, false); - Response deleteLinkingDataverseResponse = UtilIT.deleteDataverseLink(dataverseAlias, dataverseAlias2, apiToken); + Response deleteLinkingDataverseResponse = UtilIT.deleteDataverseLink(dataverse1Alias, dataverse2Alias, apiToken1); deleteLinkingDataverseResponse.prettyPrint(); deleteLinkingDataverseResponse.then().assertThat() .statusCode(OK.getStatusCode()) - .body("data.message", equalTo("Link from Dataverse " + dataverseAlias + " to linked Dataverse " + dataverseAlias2 + " deleted")); + .body("data.message", equalTo("Link from Dataverse " + dataverse2Alias + " to linked Dataverse " + dataverse1Alias + " deleted")); } @Test From 6073738a5db18ce90d8c306028b1454133a4a413 Mon Sep 17 00:00:00 2001 From: Vera Clemens Date: Tue, 24 Mar 2026 10:53:26 +0100 Subject: [PATCH 5/6] fix: fix mix-up of linking + linked collection when finding/deleting collection links --- .../iq/dataverse/DataverseLinkingServiceBean.java | 10 +++++----- .../java/edu/harvard/iq/dataverse/api/Dataverses.java | 2 +- .../search/savedsearch/SavedSearchServiceBean.java | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/main/java/edu/harvard/iq/dataverse/DataverseLinkingServiceBean.java b/src/main/java/edu/harvard/iq/dataverse/DataverseLinkingServiceBean.java index 9f1bcde4c0e..cd806d250d4 100644 --- a/src/main/java/edu/harvard/iq/dataverse/DataverseLinkingServiceBean.java +++ b/src/main/java/edu/harvard/iq/dataverse/DataverseLinkingServiceBean.java @@ -89,19 +89,19 @@ public void save(DataverseLinkingDataverse dataverseLinkingDataverse) { } } - public DataverseLinkingDataverse findDataverseLinkingDataverse(Long dataverseId, Long linkingDataverseId) { + public DataverseLinkingDataverse findDataverseLinkingDataverse(Long linkingDataverseId, Long linkedDataverseId) { try { return em.createNamedQuery("DataverseLinkingDataverse.findByDataverseIdAndLinkingDataverseId", DataverseLinkingDataverse.class) - .setParameter("dataverseId", dataverseId) + .setParameter("dataverseId", linkedDataverseId) .setParameter("linkingDataverseId", linkingDataverseId) .getSingleResult(); } catch (jakarta.persistence.NoResultException e) { - logger.fine("No DataverseLinkingDataverse found for dataverseId " + dataverseId + " and linkedDataverseId " + linkingDataverseId); + logger.fine("No DataverseLinkingDataverse found for linkingDataverseId " + linkingDataverseId + " and linkedDataverseId " + linkedDataverseId); return null; } } - public boolean alreadyLinked(Dataverse definitionPoint, Dataverse dataverseToLinkTo) { - return findDataverseLinkingDataverse(dataverseToLinkTo.getId(), definitionPoint.getId()) != null; + public boolean alreadyLinked(Dataverse linkingDataverse, Dataverse linkedDataverse) { + return findDataverseLinkingDataverse(linkingDataverse.getId(), linkedDataverse.getId()) != null; } } diff --git a/src/main/java/edu/harvard/iq/dataverse/api/Dataverses.java b/src/main/java/edu/harvard/iq/dataverse/api/Dataverses.java index caf778be675..97316d79a41 100644 --- a/src/main/java/edu/harvard/iq/dataverse/api/Dataverses.java +++ b/src/main/java/edu/harvard/iq/dataverse/api/Dataverses.java @@ -843,7 +843,7 @@ private List parseFacets(JsonArray facetsArray) throws Wrapped @DELETE @AuthRequired - @Path("{linkingDataverseId}/deleteLink/{linkedDataverseId}") + @Path("{linkedDataverseId}/deleteLink/{linkingDataverseId}") public Response deleteDataverseLinkingDataverse(@Context ContainerRequestContext crc, @PathParam("linkingDataverseId") String linkingDataverseId, @PathParam("linkedDataverseId") String linkedDataverseId) { boolean index = true; return response(req -> { diff --git a/src/main/java/edu/harvard/iq/dataverse/search/savedsearch/SavedSearchServiceBean.java b/src/main/java/edu/harvard/iq/dataverse/search/savedsearch/SavedSearchServiceBean.java index 4840131a57e..fcb423fa492 100644 --- a/src/main/java/edu/harvard/iq/dataverse/search/savedsearch/SavedSearchServiceBean.java +++ b/src/main/java/edu/harvard/iq/dataverse/search/savedsearch/SavedSearchServiceBean.java @@ -276,7 +276,7 @@ public void removeLinks(DataverseRequest dvReq, SavedSearch savedSearch) throws if (dvObjectThatDefinitionPointWillLinkTo.isInstanceofDataverse()) { Dataverse linkedDataverse = (Dataverse) dvObjectThatDefinitionPointWillLinkTo; - DataverseLinkingDataverse dvld = dvLinkingService.findDataverseLinkingDataverse(linkedDataverse.getId(), linkingDataverse.getId()); + DataverseLinkingDataverse dvld = dvLinkingService.findDataverseLinkingDataverse(linkingDataverse.getId(), linkedDataverse.getId()); if(dvld != null) { Dataverse dv = commandEngine.submitInNewTransaction(new DeleteDataverseLinkingDataverseCommand(dvReq, linkingDataverse, dvld, true)); } From dce93cedd9e7683ed24a2725373485c7cc34a73c Mon Sep 17 00:00:00 2001 From: Vera Clemens Date: Tue, 24 Mar 2026 11:45:25 +0100 Subject: [PATCH 6/6] docs: add release note for #12076 --- doc/release-notes/12076-non-superuser-dataverse-linking.md | 1 + 1 file changed, 1 insertion(+) create mode 100644 doc/release-notes/12076-non-superuser-dataverse-linking.md diff --git a/doc/release-notes/12076-non-superuser-dataverse-linking.md b/doc/release-notes/12076-non-superuser-dataverse-linking.md new file mode 100644 index 00000000000..6ed55b65031 --- /dev/null +++ b/doc/release-notes/12076-non-superuser-dataverse-linking.md @@ -0,0 +1 @@ +Dataverse collection linking and unlinking no longer requires superuser status. Users with the "Link Dataverse" permission on a collection can now perform these actions through the UI and API.