#41 add super user req. and tests

src/main/java/edu/harvard/iq/dataverse/api/HarvestingServer.java

@@ -195,6 +195,17 @@ public Response modifyOaiSet(String jsonBody, @PathParam("specname") String spec
     @DELETE
     @Path("{specname}")
     public Response deleteOaiSet(@PathParam("specname") String spec, @QueryParam("key") String apiKey) {
+
+        AuthenticatedUser dvUser;
+        try {
+            dvUser = findAuthenticatedUserOrDie();
+        } catch (WrappedResponse wr) {
+            return wr.getResponse();
+        }
+        if (!dvUser.isSuperuser()) {   
+            return badRequest(BundleUtil.getStringFromBundle("harvestserver.deleteSetDialog.setspec.superUser.required"));
+        }
+
         OAISet set = null;  
         try {
             set = oaiSetService.findBySpec(spec);

src/main/java/propertyFiles/Bundle.properties

@@ -593,6 +593,7 @@ harvestserver.newSetDialog.btn.create=Create Set
 harvestserver.newSetDialog.success=Successfully created harvesting set "{0}".
 harvestserver.viewEditDialog.title=Edit Harvesting Set
 harvestserver.viewEditDialog.btn.save=Save Changes
+harvestserver.deleteSetDialog.setspec.superUser.required=Only superusers may delete OAI sets.
 
 #dashboard-users.xhtml
 dashboard.card.users=Users

src/test/java/edu/harvard/iq/dataverse/api/HarvestingServerIT.java

@@ -95,6 +95,20 @@ public void testSetCreation() {
         // try to export set as admin user, should succeed (under admin API, not checking that normal user will fail)
         Response r4 = UtilIT.exportOaiSet(setName);
         assertEquals(200, r4.getStatusCode());
+
+        // try to delete as normal user  should fail
+        Response r5 = given()
+                .header(UtilIT.API_TOKEN_HTTP_HEADER, normalUserAPIKey)
+                .delete(u0);
+        logger.info("r5.getStatusCode(): " + r5.getStatusCode());
+        assertEquals(400, r5.getStatusCode());
+
+        // try to delete as admin user  should work
+        Response r6 = given()
+                .header(UtilIT.API_TOKEN_HTTP_HEADER, adminUserAPIKey)
+                .delete(u0);
+        logger.info("r6.getStatusCode(): " + r6.getStatusCode());
+        assertEquals(200, r6.getStatusCode());
 
         // TODO - get an answer to the question of if it's worth cleaning up (users, sets) or not
     }