Inconsistent behaviour of dataset delete API

[vera]

While testing the dataset delete API, I just noticed the following behavior, which was unexpected to me:

When logged in as a superuser, and then calling the delete API on a dataset with exactly one published version and no draft currently existing, the request seems to be automatically "upgraded" to a destroy action. The request succeeds and the dataset is deleted.

I expected the request to fail, since the delete API is not meant for deleting published datasets (at least according to the docs where the API is titled "Delete Unpublished Dataset" and the destroy API exists, which is in contrast meant for deleting published datasets as a superuser).

What makes the behavior even more confusing to me, as soon as more than one published version exists, the delete API always fails even when I'm a superuser (message: This is a published dataset with multiple versions. This API can only delete the latest version if it is a DRAFT).

When not logged in as a superuser, everything works as I expected (delete API succeeds for drafts but fails for published versions).

Here's the related code:

dataverse/src/main/java/edu/harvard/iq/dataverse/api/Datasets.java

Lines 278 to 287 in f4380ea

	if (doomed.getVersions().size() == 1) {
	if (doomed.isReleased() && (!(u instanceof AuthenticatedUser) || !u.isSuperuser())) {
	throw new WrappedResponse(error(Response.Status.UNAUTHORIZED, "Only superusers can delete published datasets"));
	}
	destroy = true;
	} else {
	if (!doomedVersion.isDraft()) {
	throw new WrappedResponse(error(Response.Status.UNAUTHORIZED, "This is a published dataset with multiple versions. This API can only delete the latest version if it is a DRAFT"));
	}
	}

And my question: Is this intended behavior? If yes, I think the special case (superuser + exactly one published version allows delete API to succeed) should be documented in the API docs.

[pdurbin]

@vera yes, I'd say you're finding some unexpected behavior when using a superuser token with that "Delete Unpublished Dataset" API:

• it should never destroy the dataset
• it should work on drafts when there are previously published versions

I'll go ahead and flag this as a bug. Please feel free to make a PR if you'd like! ❤

[qqmyers]

+1 for simply calling the delete draft version method for this endpoint.

[DonRichards]

Possibly related, specifically talking about tracking activity like creation/publishing/Deleting/etc. https://guides.dataverse.org/en/5.10.1/installation/config.html?highlight=notification#sendnotificationondatasetcreation
There is no messages going to those, other than the dataset creator that a dataset was deleted.

A boolean setting that, if true, will send an email and notification to users when a Dataset is created. Messages go to those, other than the dataset creator, who have the ability/permission necessary to publish the dataset. The intent of this functionality is to simplify tracking activity and planning to follow-up contact.

I would expect deleting a draft would have also triggered that same tracking activity.