10207 bug api datasets versions latest fix

src/main/java/edu/harvard/iq/dataverse/api/Datasets.java

@@ -2731,7 +2731,7 @@ private DatasetVersion getDatasetVersionOrDie(final DataverseRequest req, String
 
             @Override
             public Command<DatasetVersion> handleLatest() {
-                return new GetLatestAccessibleDatasetVersionCommand(req, ds, includeDeaccessioned);
+                return new GetLatestAccessibleDatasetVersionCommand(req, ds, includeDeaccessioned, checkPermsWhenDeaccessioned);
             }
 
             @Override

src/main/java/edu/harvard/iq/dataverse/engine/command/impl/GetLatestAccessibleDatasetVersionCommand.java

@@ -25,22 +25,24 @@
 public class GetLatestAccessibleDatasetVersionCommand extends AbstractCommand<DatasetVersion> {
     private final Dataset ds;
     private final boolean includeDeaccessioned;
+    private boolean checkPerms;
 
     public GetLatestAccessibleDatasetVersionCommand(DataverseRequest aRequest, Dataset anAffectedDataset) {
-        this(aRequest, anAffectedDataset, false);
+        this(aRequest, anAffectedDataset, false, false);
     }
 
-    public GetLatestAccessibleDatasetVersionCommand(DataverseRequest aRequest, Dataset anAffectedDataset, boolean includeDeaccessioned) {
+    public GetLatestAccessibleDatasetVersionCommand(DataverseRequest aRequest, Dataset anAffectedDataset, boolean includeDeaccessioned, boolean checkPerms) {
         super(aRequest, anAffectedDataset);
         ds = anAffectedDataset;
         this.includeDeaccessioned = includeDeaccessioned;
+        this.checkPerms = checkPerms;
     }
 
     @Override
     public DatasetVersion execute(CommandContext ctxt) throws CommandException {
         if (ds.getLatestVersion().isDraft() && ctxt.permissions().requestOn(getRequest(), ds).has(Permission.ViewUnpublishedDataset)) {
             return ctxt.engine().submit(new GetDraftDatasetVersionCommand(getRequest(), ds));
         }
-        return ctxt.engine().submit(new GetLatestPublishedDatasetVersionCommand(getRequest(), ds, includeDeaccessioned, true));
+        return ctxt.engine().submit(new GetLatestPublishedDatasetVersionCommand(getRequest(), ds, includeDeaccessioned, checkPerms));
     }
 }

src/main/java/edu/harvard/iq/dataverse/engine/command/impl/GetLatestPublishedDatasetVersionCommand.java

@@ -17,33 +17,49 @@
 public class GetLatestPublishedDatasetVersionCommand extends AbstractCommand<DatasetVersion> {
     private final Dataset ds;
     private final boolean includeDeaccessioned;
-    private boolean checkPerms;
+    private final boolean checkPermsWhenDeaccessioned;
 
     public GetLatestPublishedDatasetVersionCommand(DataverseRequest aRequest, Dataset anAffectedDataset) {
         this(aRequest, anAffectedDataset, false, false);
     }
 
-    public GetLatestPublishedDatasetVersionCommand(DataverseRequest aRequest, Dataset anAffectedDataset, boolean includeDeaccessioned, boolean checkPerms) {
+    public GetLatestPublishedDatasetVersionCommand(DataverseRequest aRequest, Dataset anAffectedDataset, boolean includeDeaccessioned, boolean checkPermsWhenDeaccessioned) {
         super(aRequest, anAffectedDataset);
         ds = anAffectedDataset;
         this.includeDeaccessioned = includeDeaccessioned;
-        this.checkPerms = checkPerms;
+        this.checkPermsWhenDeaccessioned = checkPermsWhenDeaccessioned;
     }
 
+    /*
+     * This command depending on the requested parameters will return:
+     *
+     * If the user requested to include a deaccessioned dataset with the files, the command will return the deaccessioned version if the user has permissions to view the files. Otherwise, it will return null.
+     * If the user requested to include a deaccessioned dataset but did not request the files, the command will return the deaccessioned version.
+     * If the user did not request to include a deaccessioned dataset, the command will return the latest published version.
+     *
+     */
     @Override
     public DatasetVersion execute(CommandContext ctxt) throws CommandException {
+        DatasetVersion dsVersionResult = getReleaseOrDeaccessionedDatasetVersion();
+        if (dsVersionResult != null && userHasPermissionsOnDatasetVersion(dsVersionResult, checkPermsWhenDeaccessioned, ctxt, ds)) {
+            return dsVersionResult;
+        }
+        return null;
+    }
 
-        for (DatasetVersion dsv : ds.getVersions()) {
-            if (dsv.isReleased() || (includeDeaccessioned && dsv.isDeaccessioned())) {
-
-                if(dsv.isDeaccessioned() && checkPerms){
-                    if(!ctxt.permissions().requestOn(getRequest(), ds).has(Permission.EditDataset)){
-                        return null;
-                    }
-                }
-                return dsv;
+    private DatasetVersion getReleaseOrDeaccessionedDatasetVersion() {
+        for (DatasetVersion dsVersion : ds.getVersions()) {
+            if (dsVersion.isReleased() || (includeDeaccessioned && dsVersion.isDeaccessioned())) {
+                return dsVersion;
             }
         }
         return null;
     }
+
+    private boolean userHasPermissionsOnDatasetVersion(DatasetVersion dsVersionResult, boolean checkPermsWhenDeaccessioned, CommandContext ctxt, Dataset ds) {
+        if (dsVersionResult.isDeaccessioned() && checkPermsWhenDeaccessioned) {
+            return ctxt.permissions().requestOn(getRequest(), ds).has(Permission.EditDataset);
+        }
+        return true;
+    }
 }