API: Slash "/" is not allowed in path parameter when checking permissions

[ErykKul]

What steps does it take to reproduce the issue?
Calling API at "/api/admin/permissions/{dvo}" with global identifier as dvo fails. Slashes are not allowed as path parameters by default and escaping them with %2F does not work.
E.g. http://locahost:8080/api/admin/permissions/doi:10.80442/5CPZVH and http://locahost:8080/api/admin/permissions/doi:10.80442%2F5CPZVH both fail

What happens?
Error: 404 not found.

To whom does it occur (all users, curators, superusers)?
Superusers (only superusers can check permissions with api)

What did you expect to happen?
A valid response with listed permissions for a given object.

Which version of Dataverse are you using?
Develop.

Allowing slashes in dvo path parameter solves the problem
@Path("permissions/{dvo:.+}")
http://locahost:8080/api/admin/permissions/doi:10.80442/5CPZVH works with this setting.

[qqmyers]

The pattern Dataverse uses generally to allow a persistentId is to use the word :persistentId and then require a ?persistentId= query param. Is there any reason not to do that here? There are findDatasetOrDie API methods that check for either an id or doi when this method is used.

[pdurbin]

@qqmyers yes, good point.

@ErykKul please see PaulBoon#6 for an example of making a new API follow our usual pattern. The "permissions" API has been around for a long time so we can't simply change and break it. Maybe a new API?

[ErykKul]

@qqmyers @pdurbin

The reason for the way I have changed it like this, is for the compatibility reasons. Everything that worked before on this endpoint still works as before. This change means that everything after "/permissions/" until "?" is one path parameter, including slashes. Since slashes did not work, when you do a call as before, without slashes in path parameter: everything after "/permissions/" until "?" is one path parameter, unless you use a slash (you can even use escaped special characters, but not escaped slash). And it is the findDatasetOrDie that is behind it, it just could not work for persistentId because of the slashes.

Nevertheless, I like the solution with the :persistentId in path. This method already supports :root, but making a new method and leaving the old one as is, feels better to me. I will work something out.

[ErykKul]

@qqmyers @pdurbin

I did look at this api again, and it still makes sense to me to use the existing method, but then make it work with ":persistentId" as ID and the persistent ID in "persistentId" parameter. Can you take a look at the new version and say what you think now?

[pdurbin]

@ErykKul I think the latest code looks good. I haven't tried it but are you saying the following now works in your PR?

http://locahost:8080/api/admin/permissions/:persistentId?persistentId=doi:10.80442/5CPZVH

If so, can you please modify the docs for this API endpoint to explain this?

[ErykKul]

@pdurbin This works indeed. The documentation mentions already that a dataset's persistent ID can be used, but it was not possible until now. I have added a note in the documentation, together with an example, on how to use the :persistentId option.