bad API key when clicking "view categories" on a public tabular file

[pdurbin]

Hi! We are playing around with Data Explorer v2 over at Harvard Dataverse:

• Upgrade Data Explorer to v2 IQSS/dataverse.harvard.edu#225

I've noticed some strange behavior when I try my 2023-01-03.tab file at https://dataverse.harvard.edu/file.xhtml?fileId=6867331&version=4.0

I end up on this URL:

https://dataverse.harvard.edu/dataverse-data-explorer-v2/?fileId=6867331&fileMetadataId=6747643&dvLocale=en&siteUrl=https://dataverse.harvard.edu

When I click "view categories" for language, the console tells me "bad API key":

The bad API key/token is "null" from this URL:

https://dataverse.harvard.edu/api/access/datafile/6867331?format=subset&variables=v30256085&key=null

Now here's the interesting thing. If I hack on the URL and enter a valid API key like this...

https://dataverse.harvard.edu/dataverse-data-explorer-v2/?fileId=6867331&fileMetadataId=6747643&dvLocale=en&siteUrl=https://dataverse.harvard.edu&key=REDACTED

... the plot looks fine when I click "view categories":

This is ok in a pinch but a public dataset shouldn't need any API key at all, right?

[lubitchv]

Hi @pdurbin. From the screenshoot it looks like you are using the old version of Data Explorer. I see you have the old icons. The newer version should have

How did you install the explorer, did you use scholarsportal.github.io? scholarsportal.github.io has older version.

[pdurbin]

@lubitchv hi! As mentioned at IQSS/dataverse.harvard.edu#225 (comment) we are using a build from UNC but our understanding is that it should be the latest code. 🤔

[landreev]

No, we are not using scholarsportal.github.io, it's hosted locally. And it was built from sources, by @donsizemore at UNC, who was very kind to share his built with us. We checked and it looked like it was built from the latest sources, but maybe I missed something.

But yes, the problem reported above is that when the file is public, Dataverse does not pass an api key to Data Explorer. But then Data Explorer tries to access the file with /api/access/datafile/<id>?key=null, instead of just using a url without the key. This apparently used to work before with public files (still working for Odum/UNC, who are on Dataverse 5.9); but has stopped in one of the more recent versions of Dataverse. (IQSS/dataverse#10070)

[lubitchv]

I am confused. I went into harvard dataverse into "Open Source at Dataverse" and accessed the tabular file through data explorer and I could see the language category just fine without an API key.

I also tested the latest develop branch with data explorer and categories work

Also, I still think you are using the older version of Data Explorer judging by icons. You can compile the code from source using:

npm install --force
ng build --prod --base-href https://dataverse.harvard.edu/dataverse-data-explorer-v2/

I compiled the code for you. you can try it.
dataverse-data-explorer-v2.zip

[pdurbin]

I am confused. I went into harvard dataverse into "Open Source at Dataverse" and accessed the tabular file through data explorer and I could see the language category just fine without an API key.

Sorry, I didn't update this issue to say that we (ok @landreev ) put in a workaround in Apache to remove key=null, like this:

RewriteCond %{QUERY_STRING} ^(.+?&|)key=null(?:&(.*)|)$ [NC]
RewriteRule ^ %{REQUEST_URI}?%1%2 [PT]

So now it's working for me too, getting to plot above, thanks to the workaround.

Meanwhile, we have documented the change of API behavior, how key=null results in no download, in this PR:

• Add condition for 401 on invalid key and changelog on API Guide IQSS/dataverse#10127
• preview at http://preview.guides.gdcc.io/en/develop/api/changelog.html

The concern, of course, is other installations of Dataverse that don't have the Apache workaround above (or similar) in place.