fix notification user dataset original owner instead of new owner to check permissions

Author: stevenwinship

src/main/java/edu/harvard/iq/dataverse/engine/command/impl/MoveDatasetCommand.java

@@ -148,9 +148,10 @@ public void executeImpl(CommandContext ctxt) throws CommandException {
         }
 
         // OK, move
+        Dataverse originalOwner = moved.getOwner();
         moved.setOwner(destination);
         ctxt.em().merge(moved);
-        sendNotification(moved, ctxt);
+        sendNotification(moved, originalOwner, ctxt);
 
         boolean doNormalSolrDocCleanUp = true;
         ctxt.index().asyncIndexDataset(moved, doNormalSolrDocCleanUp);
@@ -160,14 +161,15 @@ public void executeImpl(CommandContext ctxt) throws CommandException {
      * Sends notifications to those able to publish the dataset upon the successful move of a dataset.
      * <p>
      * This method checks if dataset move notifications are enabled. If so, it
-     * notifies all users with {@code Permission.PublishDataset} on the dataset.
+     * notifies all users with {@code Permission.PublishDataset} on the original owning Dataverse.
      * The user who initiated the action can be included or excluded from this
      * notification based on the allowSelfNotification flag.
      *
      * @param dataset The moved {@code Dataset}.
+     * @param originalOwner The original owning {@code Dataverse}.
      * @param ctxt    The {@code CommandContext} providing access to application services.
      */
-    protected void sendNotification(Dataset dataset, CommandContext ctxt) {
+    protected void sendNotification(Dataset dataset, Dataverse originalOwner, CommandContext ctxt) {
         // 1. Exit early if the SendNotificationOnDatasetMove setting is disabled.
         if (!ctxt.settings().isTrueForKey(SettingsServiceBean.Key.SendNotificationOnDatasetMove, false)) {
             return;
@@ -177,8 +179,9 @@ protected void sendNotification(Dataset dataset, CommandContext ctxt) {
         final User user = getUser();
         final AuthenticatedUser requestor = user.isAuthenticated() ? (AuthenticatedUser) user : null;
 
-        // 3. Get all users with publish permission and notify them.
-        Map<String, AuthenticatedUser> recipients = ctxt.permissions().getDistinctUsersWithPermissionOn(Permission.PublishDataset, dataset);
+        // 3. Get all users with publish permission on the dataset's original owner (dataverse) and notify them.
+        Map<String, AuthenticatedUser> recipients = ctxt.permissions().getDistinctUsersWithPermissionOn(Permission.PublishDataset, originalOwner);
+        // make sure the requestor is in the recipient list in case they don't match the permission
         if (requestor != null) {
             recipients.put(requestor.getIdentifier(), requestor);
         }

src/test/java/edu/harvard/iq/dataverse/api/MoveIT.java

@@ -159,7 +159,7 @@ public void testMoveDataset() {
     @Test
     public void testMoveDatasetNotification() {
         sendNotificationOnDatasetMoveSetting(true);
-        // Create the first user/dataverse/dataset
+        // Create the first user/dataverse (superuser)
         Response createUser1 = UtilIT.createRandomUser();
         createUser1.prettyPrint();
         createUser1.then().assertThat()
@@ -174,12 +174,6 @@ public void testMoveDatasetNotification() {
                 .statusCode(CREATED.getStatusCode());
         String dataverseAlias1 = UtilIT.getAliasFromResponse(createDataverse1);
 
-        Response createDataset = UtilIT.createRandomDatasetViaNativeApi(dataverseAlias1, user1ApiToken);
-        createDataset.prettyPrint();
-        createDataset.then().assertThat()
-                .statusCode(CREATED.getStatusCode());
-        Integer datasetId = UtilIT.getDatasetIdFromResponse(createDataset);
-
         // Create the second user/dataverse
         Response createUser2 = UtilIT.createRandomUser();
         createUser2.prettyPrint();
@@ -194,12 +188,19 @@ public void testMoveDatasetNotification() {
                 .statusCode(CREATED.getStatusCode());
         String dataverseAlias2 = UtilIT.getAliasFromResponse(createDataverse2);
 
-        // clear existing notifications
+        // User2 creates dataset in DV2
+        Response createDataset = UtilIT.createRandomDatasetViaNativeApi(dataverseAlias2, user2ApiToken);
+        createDataset.prettyPrint();
+        createDataset.then().assertThat()
+                .statusCode(CREATED.getStatusCode());
+        Integer datasetId = UtilIT.getDatasetIdFromResponse(createDataset);
+
+        // clear existing notifications (so the DATASETMOVED notification will be the only one)
         clearNotifications(user1ApiToken);
         clearNotifications(user2ApiToken);
 
-        // Move the dataset from dataverse1 to dataverse2
-        Response moveDataset = UtilIT.moveDataset(datasetId.toString(), dataverseAlias2, user1ApiToken);
+        // User1(superuser) moves the dataset from dataverse2 to dataverse1
+        Response moveDataset = UtilIT.moveDataset(datasetId.toString(), dataverseAlias1, user1ApiToken);
         moveDataset.prettyPrint();
         moveDataset.then().assertThat()
                 .statusCode(OK.getStatusCode())