CLARIN-DSpace v9/Port #1350 + #1347 + #1338 (DOI dedup, Shib special groups, tgz preview) to the v9 base

[milanmajchrak]

Tranža BE-1 (Vlna 1) — post-snapshot sync dtq-dev → dtq-dev-9-base

Per CLARIN_V9_POST_SNAPSHOT_SYNC_PLAN.md §4 Vlna 1 / BE-1. Source commits from origin/dtq-dev, one commit per source commit.

e9392ae191 (fork PR #1350) — DOI dedup + QA-checker nonrepeatable — PORT

Clean cherry-pick. Mandatory fixup applied (silent-clean-merge trap from the plan card): the two new DOIIdentifierProviderTest tests carried new Date().getTime() while v9-base's Date→Instant migration removed the java.util.Date import — rewritten to Instant.now().toEpochMilli() (+ one 121-char line wrapped for checkstyle). java.util.Date NOT reintroduced.

74f5862748 (fork PR #1347) — Shib special groups on token refresh — PORT

Conflict-free pick (method bodies only; jakarta imports untouched; Context.getSpecialGroups null-guard included). Regression IT added: ClarinShibbolethSpecialGroupsIT (2 tests) copied verbatim from zcu backport head b7d3c786ac (origin/zcu-pub/backport-1347-shib-special-groups) — fix from the canonical dtq-dev commit, test from the backport branch, per the plan card.

15b296aa2a (fork PR #1338) — tgz preview detection + file-preview --force + password drop — PORT

Single conflict in FilePreviewIT resolved toward the v9-base deletion of testPreviewWithSyncStorage/SyncBitstreamStorageServiceImpl (class absent on v9-base); everything else applied. Resulting FilePreviewIT has exactly 6 tests. ⚠️ Intentional semantics change carried from the fork: the file-preview CLI no longer requires -p/--password — EPerson resolved from context (UI) or -e email, consistent with other DSpace CLI scripts; admin-only operations stay guarded server-side (testWhenScriptCannotCreateFilePreview). Not a regression.

Gates

• mvn clean install -DskipTests (incl. checkstyle) — BUILD SUCCESS locally.
• Content ACs (acceptance doc §5) verified on the branch: alreadyPresent guard, dc.identifier.doi in nonRepeatableMetadata, zero shib.specialgroup/getSession(), request.setAttribute("shib.authenticated"), Context null-guard, tgz endsWith fix, zero password machinery, --force option.
• Targeted unit/IT battery running locally (results will be reported on this PR); CI Unit+Integration jobs are the record gate.
• dev-6 live probes follow after merge with the Vlna 1 live check (plan §4).

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 4110b037-dfdd-4833-84de-eacfd851aed1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[milanmajchrak]

Local test battery — ALL GREEN (on 59387eb, after mvn clean install -DskipTests)

Gate (AC)	Invocation	Result
e9392 AC4	mvn test -pl dspace-api -Dtest=DOIIdentifierProviderTest -DskipUnitTests=false	Tests run: 27, F:0, E:0 — incl. both new tests (verified in surefire XML)
e9392 AC5	mvn verify -pl dspace-api -Dit.test=ItemMetadataQACheckerIT -DskipIntegrationTests=false	Tests run: 17, F:0, E:0 — incl. testItemWithTwoDois
15b2 AC5	mvn verify -pl dspace-api -Dit.test=FilePreviewIT -DskipIntegrationTests=false	Tests run: 6, F:0, E:0 — exactly the 6 expected tests
15b2 AC6	mvn verify -pl dspace-server-webapp -Dit.test=PreviewContentServiceImplIT -DskipIntegrationTests=false	Tests run: 13, F:0, E:0 (N = pre-existing 12 + new tgz-with-gzip-mimetype)
74f5 AC6	mvn verify -pl dspace-server-webapp -Dit.test=ClarinShibbolethSpecialGroupsIT -DskipIntegrationTests=false	Tests run: 2, F:0, E:0
74f5 AC8	4-class shib/auth no-regression suite	Tests run: 77, F:0, E:0, Skipped: 4 (48+1+3+25 per class)

Adversarial gate (74f5 AC7 — IT without the fix must FAIL on a throwaway branch) running; result follows.

[milanmajchrak]

Adversarial gate 74f5862 AC7 — VALID PASS ✅

Throwaway branch b62c53dc8a (= origin/dtq-dev-9-base + ONLY ClarinShibbolethSpecialGroupsIT, fix absent), full mvn clean install -DskipTests then the standard IT invocation:

Tests run: 2, Failures: 2 — both tests fail with java.lang.AssertionError: Status expected:<200> but was:<403>:

• shouldDownloadRestrictedBitstreamWithShortLivedTokenAfterShibLogin (line 132 — restricted-bitstream download via short-lived token)
• shouldKeepSpecialGroupsAfterLoginTokenRefresh

This proves the IT actually guards the fix (no vacuous pass). With the fix (this PR), same invocation = 2/2 green.

(Note: a first attempt with -pl dspace-server-webapp -am reactor-only build failed on the missing test-environment assembly — invalid run, discarded; the valid gate above used a full install of the unfixed tree.)

All local AC gates for this PR are now complete; CI Unit+Integration green.