Fix HTTP 500 on anonymous CLARIN link rels (#1431)

Three CLARIN link rels answered HTTP 500 instead of 401 for an anonymous
caller on an id that exists:

  core/clarinuserregistrations/1/userMetadata     500  (parent: 401)
  core/clarinuserregistrations/1/clarinLicenses   500  (parent: 401)
  core/clarinlruallowances/242/resourceMapping    500  (parent: 401)

The same rels answer 404 on an id that does not exist, so the route
resolves and the repository body runs - the 500 is thrown inside it.
Two independent causes, both in fork code:

1. ClarinUserRegistrationServiceImpl.authorizeClarinUserRegistrationAction()
   dereferenced context.getCurrentUser() with no null check. isAdmin()
   returns false rather than throwing for an anonymous context, so the
   authorization helper itself threw NullPointerException before it could
   throw AuthorizeException. Its sibling authorizeClruaAction() already
   carries the Objects.nonNull(currentUser) guard, which is why the
   clarinlruallowances rels answer 401 and these two did not.

2. CLRUAResourceMappingLinkRepository let the checked AuthorizeException
   escape. RestResourceController.findRelInternal re-throws a
   RuntimeException target as-is but wraps a checked one in
   new RuntimeException(e), which surfaces as 500. Its two siblings
   convert that exception, which is why the same service call produced
   401, 401 and 500 from three repositories.

Both defects predate the DSpace 9 upgrade; registering the link
repositories under the plural model name (#1404) only made the bodies
reachable. RestResourceController is byte-identical with dspace-9.3 and
vanilla link repositories use @PreAuthorize plus AccessDeniedException,
so nothing here belongs upstream.

The three link repositories now follow that vanilla pattern: a coarse
@PreAuthorize("hasAuthority('AUTHENTICATED')") matching the parent
repository's findOne, and a translation of the service's checked
AuthorizeException into AccessDeniedException. AccessDeniedException
rather than the fork's RESTAuthorizationException because
Utils.embedRelFromRepository swallows only the former; the Angular UI
embeds userMetadata via followLink(), and any other RuntimeException
raised while embedding would fail the parent request with a 500.

ClarinLinkRestRepositoryBeanNameIT grows from 3 to 10 tests: the three
existing bean-name tests, the fork's one rel on a vanilla model, an
automatic check that every registered LinkRestRepository bean names a
model repository that exists (so a future model that forgets PLURAL_NAME
fails without editing this class), and the anonymous/owner/other-user/
admin matrix for the four rels above.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: milanmajchrak

dspace-api/src/main/java/org/dspace/content/clarin/ClarinUserRegistrationServiceImpl.java

@@ -145,7 +145,9 @@ private void authorizeClarinUserRegistrationAction(Context context, List<ClarinU
         EPerson currentUser = context.getCurrentUser();
         ClarinUserRegistration clarinUserRegistration = userRegistrationList.get(0);
         UUID userRegistrationEpersonUUID = clarinUserRegistration.getPersonID();
-        if (currentUser.getID().equals(userRegistrationEpersonUUID)) {
+        // An anonymous request has no current user. Deny it here instead of throwing a NullPointerException,
+        // so that the callers can translate the AuthorizeException into 401/403.
+        if (Objects.nonNull(currentUser) && currentUser.getID().equals(userRegistrationEpersonUUID)) {
             return;
         }
 

dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/CLRUAResourceMappingLinkRepository.java

@@ -23,6 +23,8 @@
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.data.domain.Pageable;
 import org.springframework.data.rest.webmvc.ResourceNotFoundException;
+import org.springframework.security.access.AccessDeniedException;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.stereotype.Component;
 
 /**
@@ -36,15 +38,27 @@ public class CLRUAResourceMappingLinkRepository extends AbstractDSpaceRestReposi
     @Autowired
     ClarinLicenseResourceUserAllowanceService clarinLicenseResourceUserAllowanceService;
 
+    /**
+     * The resource mapping behind a CLARIN license resource user allowance is readable by the user the allowance
+     * belongs to and by administrators. See
+     * {@link ClarinUserRegistrationUserMetadataLinkRepository#getUserMetadata} for why the checked
+     * {@link AuthorizeException} must be translated into an unchecked one here.
+     */
+    @PreAuthorize("hasAuthority('AUTHENTICATED')")
     public ClarinLicenseResourceMappingRest getResourceMapping(@Nullable HttpServletRequest request,
                                                                Integer clruaID,
                                                                @Nullable Pageable optionalPageable,
                                                                Projection projection)
-            throws SQLException, AuthorizeException {
+            throws SQLException {
         Context context = obtainContext();
 
-        ClarinLicenseResourceUserAllowance clarinLicenseResourceUserAllowance =
-                clarinLicenseResourceUserAllowanceService.find(context, clruaID);
+        ClarinLicenseResourceUserAllowance clarinLicenseResourceUserAllowance;
+        try {
+            clarinLicenseResourceUserAllowance = clarinLicenseResourceUserAllowanceService.find(context, clruaID);
+        } catch (AuthorizeException e) {
+            throw new AccessDeniedException("The current user is not allowed to read the resource mapping of the "
+                    + "CLARIN license resource user allowance with id: " + clruaID, e);
+        }
         if (Objects.isNull(clarinLicenseResourceUserAllowance)) {
             throw new ResourceNotFoundException("The ClarinLicenseResourceUserAllowance for id: " + clruaID +
                     " couldn't be found");

dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/CUserRegistrationCLicenseLinkRepository.java

@@ -25,6 +25,8 @@
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.Pageable;
 import org.springframework.data.rest.webmvc.ResourceNotFoundException;
+import org.springframework.security.access.AccessDeniedException;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.stereotype.Component;
 
 @Component(ClarinUserRegistrationRest.CATEGORY + "." + ClarinUserRegistrationRest.PLURAL_NAME + "." +
@@ -35,12 +37,24 @@ public class CUserRegistrationCLicenseLinkRepository extends AbstractDSpaceRestR
     @Autowired
     ClarinUserRegistrationService clarinUserRegistrationService;
 
+    /**
+     * The CLARIN licenses a user registration has agreed to are readable by the owner of the registration and by
+     * administrators. See {@link ClarinUserRegistrationUserMetadataLinkRepository#getUserMetadata} for why the
+     * checked {@link AuthorizeException} must be translated into an unchecked one here.
+     */
+    @PreAuthorize("hasAuthority('AUTHENTICATED')")
     public Page<ClarinLicenseRest> getClarinLicenses(@Nullable HttpServletRequest request,
                                                      Integer userRegistrationID,
                                                      @Nullable Pageable optionalPageable,
-                                                     Projection projection) throws SQLException, AuthorizeException {
+                                                     Projection projection) throws SQLException {
         Context context = obtainContext();
-        ClarinUserRegistration clarinUserRegistration = clarinUserRegistrationService.find(context, userRegistrationID);
+        ClarinUserRegistration clarinUserRegistration;
+        try {
+            clarinUserRegistration = clarinUserRegistrationService.find(context, userRegistrationID);
+        } catch (AuthorizeException e) {
+            throw new AccessDeniedException("The current user is not allowed to read the CLARIN licenses of the "
+                    + "CLARIN user registration with id: " + userRegistrationID, e);
+        }
         if (Objects.isNull(clarinUserRegistration)) {
             throw new ResourceNotFoundException("The CLARIN User Registration for id: " + userRegistrationID +
                     " couldn't be found");

dspace-server-webapp/src/main/java/org/dspace/app/rest/repository/ClarinUserRegistrationUserMetadataLinkRepository.java

@@ -23,6 +23,8 @@
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.Pageable;
 import org.springframework.data.rest.webmvc.ResourceNotFoundException;
+import org.springframework.security.access.AccessDeniedException;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.stereotype.Component;
 
 @Component(ClarinUserRegistrationRest.CATEGORY + "." + ClarinUserRegistrationRest.PLURAL_NAME + "." +
@@ -33,15 +35,30 @@ public class ClarinUserRegistrationUserMetadataLinkRepository extends AbstractDS
     @Autowired
     ClarinUserRegistrationService clarinUserRegistrationService;
 
+    /**
+     * The user metadata of a CLARIN user registration is readable by the owner of the registration and by
+     * administrators. Anonymous callers are rejected by {@code @PreAuthorize}; a logged-in caller who does not
+     * own the registration is rejected by the service. The service reports that with a checked
+     * {@link AuthorizeException}, which must be translated here: {@code RestResourceController.findRelInternal}
+     * wraps a checked exception thrown by a link method into a {@code RuntimeException} and the client sees an
+     * HTTP 500 instead of 401/403.
+     */
+    @PreAuthorize("hasAuthority('AUTHENTICATED')")
     public Page<ClarinUserMetadataRest> getUserMetadata(@Nullable HttpServletRequest request,
                                                         Integer userRegistrationID,
                                                         @Nullable Pageable optionalPageable,
-                                                        Projection projection) throws SQLException, AuthorizeException {
+                                                        Projection projection) throws SQLException {
         Context context = obtainContext();
 
-        ClarinUserRegistration clarinUserRegistration = clarinUserRegistrationService.find(context, userRegistrationID);
+        ClarinUserRegistration clarinUserRegistration;
+        try {
+            clarinUserRegistration = clarinUserRegistrationService.find(context, userRegistrationID);
+        } catch (AuthorizeException e) {
+            throw new AccessDeniedException("The current user is not allowed to read the user metadata of the "
+                    + "CLARIN user registration with id: " + userRegistrationID, e);
+        }
         if (Objects.isNull(clarinUserRegistration)) {
-            throw new ResourceNotFoundException("The ClarinLicenseResourceUserAllowance for if: " + userRegistrationID +
+            throw new ResourceNotFoundException("The ClarinUserRegistration for id: " + userRegistrationID +
                     " couldn't be found");
         }