Enable Contributors to let other Contributors edit their datasets

[BPeuch]

Version: 4.20

Hello everybody,

(I'm sorry if this was already mentioned in another issue. I had a hard time finding related topics considering how broad the keywords are here.)

I was wondering if a certain functionality could be considered for implementation in Dataverse. I'll introduce it with a use case.

As a researcher, I log in on a Dataverse platform where I'm given by default the Contributor role. I can therefore create datasets but not publish them: I have to click on Submit for Review for them to be published. The reason for this is that the administrators of this Dataverse platform want to check if datasets comply with local standards and publication criteria before they go online. That is also why the administrators of this Dataverse platform did not set Curator as the default role but Contributor, as shown here:

However, as a researcher, because there is more than one investigator involved in the study which the dataset comes from, I want to let other Contributor users on that Dataverse platform edit my dataset, e.g. because they have certain files to upload, because we want to write the description of the dataset together, because I want to allow them to proofread the metadata, etc.

It would be great if Contributor users could, for the datasets that they deposited, give edit rights to other users just like Admin users can, as shown here:

A sort of localized ManageDatasetPermissions role permission if you will.

[BPeuch]

Actually, there is a fairly easy way to do what I described:

1. As admin, go to the dataset webpage, select Edit > Permissions > Dataset, and grant the depositor a role that gives them the ManageDatasetPermissions privilege;
2. The depositor can now manage permissions for this dataset. They are then free to make another user e.g. Contributor for this dataset.
3. This user can then edit the metadata.

It's a bit of a procedure, but I'd say that, if it's nicely explained in a user guide, then it cannot take more than a few extra clicks.

At SODHA, admins will systematically grant the ManageDatasetPermissions to depositors so that they (instead of the SODHA admins) receive the requests for access by e-mail.

[scolapasta]

@BPeuch The above is possible more automatically by setting the default role for a dataset creator to "Curator". That will give the creator the ManageDatasetPermissions permission. Note this also allows them to Publish. The reason there is no role defined with ManageDataserPermissions but not publish is because it wouldn't matter. If a user can Manager Permissions, they could change their role to Curator and then publish anyway.

[BPeuch]

Oh, fudge. I just tested this, and you're right, @scolapasta. That's a loophole I had no idea about. Thanks for bringing this up.

The thing is, we created a "Data Request Manager" role with only the ManageDatasetPermissions privilege so that depositors, instead of admins, get email notifications in case of requests for access. But sure enough, as a non-admin member with this role for a specific dataset, I could grant myself the "Admin" role for that same dataset and then I could bypass the ban on auto-publication.

Welp. Time to further investigate.

[poikilotherm]

This is most likely to become a problem for our installation, too.

Wouldn't it make sense to introduce a new ManageDatasetContributingPermissions to avoid this? I know this is a rather special use case, but would it hurt anyone else? It could be used in custom roles, so everything stays as is for others.

[BPeuch]

@poikilotherm I'm currently researching the Dataverse Google Group and IQSS GitHub for topics that already raised this point. I'll likely open a new issue about this very soon (and I'll make sure to tag you 🚩).

[scolapasta]

Right, while permissions technically are not "ordered", there really is no point to any role with ManageDatasetPermissions and none of the "lower" dataset permissions.

@poikilotherm is right that one possible way to solve this would be a new permission that limits what you can do. In general, we have been careful limiting new permissions because we didn't want to overwhelm users with roles.

An alternative solution that would work with the existing permission system is to add functionality for a contributor to suggest other contributors. The curator / admin would still need to approve, but it could be similar to access request where they would just have to go and click one button to grant.

[pdurbin]

@BPeuch et al., there's some related discussion about ManageDatasetPermissions at #3981 (comment)

[BPeuch]

Thank you for your confirming this, @scolapasta, and thanks a lot @pdurbin for mentioning this issue. Indeed, our problem is very clearly defined there!

I think that for the time being the system described by @scolapasta is the best one. We will include a question along the lines of "I want to let some of my coworkers edit my dataset. How can I do this?" in our FAQ and we will handle their requests as you suggest.