Added DataDistributor Uri binding authorization checks

[litvinovg]

Related to VIVO GitHub issue

What does this pull request do?

Adds authorization checks for bound URI values in Data Distribution API

How should this be tested?

For each type of distributors: SelectFromContentDistributor, SelectFromGraphDistributor, RDFGraphDistributor

• Create a Data distributor with URI Binding variable (In case of RDFGraphDistributor binding should be configured in dependent GraphBuilder).
• Run distributor, providing individual URI as a variable value for data distributor.
• Make sure the distributor responds "Not authorized" if access to an individual page is denied to the user, and functions correctly if access to an individual page is allowed.

Interested parties

@VIVO-project/vivo-committers

Candidates for reviewing this PR should have some of the following expertises:

1. Java
2. SPARQL

Reviewers' report template

General comment

A reviewer should provide here comments and suggestions for requested changes if any.

Testing

A reviewer should briefly describe here how it was tested

Code reviewing

A reviewer should briefly describe here which part was code reviewed

[chenejac]

@litvinovg please check my comment(s)

[chenejac]

Suggested change

	log.debug("403Forbidden");
	log.debug("403 Forbidden");

[litvinovg]

Fixed

[chenejac]

@litvinovg thanks

[brianjlowe]

I haven't been able to reproduce the intended behavior. I added a select-from-content distributor with URI binding "thething":

PREFIX owl: <http://www.w3.org/2002/07/owl#>
PREFIX rdfs: <http://www.w3.org/2000/01/rdf-schema#>
SELECT ?x ?label WHERE {
  ?thething a owl:Thing .
  ?thething rdfs:label ?label
  BIND(?thething AS ?x)
} LIMIT 25

I have a vivo:AcademicDepartment http://vivo.mydomain.edu/individual/n6267 where I've set "Suppress Display for roles": Public
When I request that individual's profile, I get redirected to the login as expected. But if I request http://localhost:8080/vivo/api/dataRequest/select-things?thething=http%3A%2F%2Fvivo.mydomain.edu%2Findividual%2Fn6267 it returns the results for the individual as if I were logged in. It's supposed to return unauthorized, right?

[litvinovg]

I have a vivo:AcademicDepartment http://vivo.mydomain.edu/individual/n6267 where I've set "Suppress Display for roles": Public When I request that individual's profile, I get redirected to the login as expected. But if I request http://localhost:8080/vivo/api/dataRequest/select-things?thething=http%3A%2F%2Fvivo.mydomain.edu%2Findividual%2Fn6267 it returns the results for the individual as if I were logged in. It's supposed to return unauthorized, right?

Right, it's supposed to return unauthorized. I applied authorization checks to sparql select data distributors. Please try it when you have time.

[brianjlowe]

Checked all three of SelectFromContentDistributor, SelectFromGraphDistributor and RDFGraphDistributor, and the authorization check behaves as expected. The only issue is that for the SelectFromGraphDistributor and and RDFGraphDistributor I got the plain-text "Not authorized..." message returned with the wrong content type (application/sparql-results+json and application/rdf+xml, respectively), leading to these two screenshots:

[chenejac]

One checkstyle validation has been reported:

Error: /home/runner/work/Vitro/Vitro/Vitro/api/src/main/java/edu/cornell/library/scholars/webapp/controller/api/DistributeDataApiController.java:38:8: Unused import - edu.cornell.mannlib.vitro.webapp.web.ContentType. [UnusedImports]