403 Forbidden when assigning duplicate role

[vera]

What steps does it take to reproduce the issue?

Using the API, assign the same role to the same user on the same entity (dataset or collection) twice.

• What happens?

The API returns an error response with code 403 Forbidden and the following message:

{
    "status": "ERROR",
    "message": "Role has already been granted."
}

• What did you expect to happen?

I didn't expect a 403 Forbidden, since it seems to imply my authentications broken or I lack the rights to assign a role. However, the request is merely failing due to the role assignment already existing.

I'd like to suggest changing this error code to something else, e.g. some other more applicable client-error code such as 400 Bad Request, 409 Conflict or 422 Unprocessable Content. (I found a discussion of the error codes here: https://stackoverflow.com/questions/3825990/http-response-code-for-post-when-resource-already-exists)

I'd also like to throw in the option of returning a 201 Created when a role assignment is successfully created, and a 200 OK if the role assignment already exists, since it could be argued it's not even strictly an error situation.

What do you think? Is there an accepted list/guideline for Dataverse API response codes?

Which version of Dataverse are you using?

v6.9

Any related open or closed issues to this bug report?

Did not find any.

Are you thinking about creating a pull request for this issue?
Help is always welcome, is this bug something you or your organization plan to fix?

Yes I would

[pdurbin]

Hmm, prior to this pull request...

• API: Handling creation of duplicate role for a dataset object  #10474

... trying to add a duplicate role resulted in a 500 error so I guess 403 is better than that but I take your point.

We do have a doc about API design here: https://guides.dataverse.org/en/6.9/developers/api-design.html

Also, we're dreaming about a cleaned-up v2 of our API in this issue:

• Write Dataverse API v2 proposal and share with community #11836

There's a design doc you're welcome to contribute to!

[poikilotherm]

One problem here is that any exception thrown in the engine that are not marked by us will be treated as a system exception and get wrapped by the EJB subsystem. So our code to catch exception and handle them appropriately often isn't able to correctly catch things. (For this particular case there might be other circumstances involved, too.)

[vera]

We do have a doc about API design here: https://guides.dataverse.org/en/6.9/developers/api-design.html

Also, we're dreaming about a cleaned-up v2 of our API in this issue:

• Write Dataverse API v2 proposal and share with community #11836

There's a design doc you're welcome to contribute to!

That looks great!

I've opened a PR suggesting a changed error handling here: #12134 Let me know what you think!