feat: Add preview URL support for Globus downloads

Enable users with preview URLs to download draft datasets via Globus.

Flow:
1. First arrival: check if user is logged in to Dataverse
   - If logged in: redirect to Globus OAuth immediately
   - If not logged in: show popup BEFORE OAuth redirect
2. Popup options:
   - 'Continue as guest': strips session_required_single_domain, allows any Globus account
   - 'Continue with preview URL': same as guest + uses preview token for API auth
   - 'Log in with KU Leuven': keeps session_required_single_domain restriction
3. After OAuth return: load files using the chosen authentication mode

Technical changes:
- Add isGuestMode, isPreviewUrlMode, previewUrlToken to LoginState
- Add checkUserAndShowPopupOrRedirect() for first arrival flow
- Add continueAsLoggedInUser() for KU Leuven login path
- Strip session_required_single_domain based on isGuestMode flag
- Preserve all state across OAuth redirect

Author: ErykKul

src/app/download/download.component.html

@@ -1,28 +1,54 @@
 <!-- Author: Eryk Kulikowski @ KU Leuven (2024). Apache 2.0 License -->
 
-<!-- Guest/Login choice popup -->
+<!-- Guest/Login choice popup - shown BEFORE OAuth redirect -->
 <p-dialog
   header="Access Options"
   [modal]="true"
   [(visible)]="showGuestLoginPopup"
   [closable]="false"
 >
   <p class="m-0">
-    You are not logged in. You can continue as a guest to download publicly
-    accessible files, or log in to access restricted files.
+    You are not logged in to Dataverse. Choose how you want to access Globus:
   </p>
+
+  <!-- Preview URL input section - visible when downloadId is present -->
+  @if (downloadId) {
+    <div class="preview-url-section mt-3">
+      <p class="m-0">
+        <strong>Have a preview URL?</strong> Paste it below to access draft files:
+      </p>
+      <div class="p-inputgroup mt-2">
+        <input
+          type="text"
+          pInputText
+          [(ngModel)]="previewUrlInput"
+          placeholder="Paste preview URL or token here"
+          class="w-full"
+        />
+      </div>
+    </div>
+  }
+
   <ng-template pTemplate="footer">
-    <p-button
-      (click)="continueAsGuest()"
-      styleClass="p-button-sm p-button-raised p-button-secondary"
-      >Continue as guest</p-button
-    >
-    <p-button
-      (click)="redirectToLogin()"
-      styleClass="p-button-sm p-button-raised p-button-primary"
-      [disabled]="!pluginService.getLoginRedirectUrl()"
-      >Log in</p-button
-    >
+    <div>
+      <p-button
+        (click)="continueAsGuest()"
+        styleClass="p-button-sm p-button-raised p-button-secondary"
+        >Continue as guest</p-button
+      >
+      @if (downloadId && previewUrlInput) {
+        <p-button
+          (click)="continueWithPreviewUrl()"
+          styleClass="p-button-sm p-button-raised p-button-warning"
+          >Continue with preview URL</p-button
+        >
+      }
+      <p-button
+        (click)="continueAsLoggedInUser()"
+        styleClass="p-button-sm p-button-raised p-button-primary"
+        >Log in with KU Leuven</p-button
+      >
+    </div>
   </ng-template>
 </p-dialog>
 

src/app/download/download.component.ts

@@ -27,6 +27,7 @@ import { FormsModule } from '@angular/forms';
 import { PrimeTemplate, SelectItem, TreeNode } from 'primeng/api';
 import { Button, ButtonDirective } from 'primeng/button';
 import { Dialog } from 'primeng/dialog';
+import { InputTextModule } from 'primeng/inputtext';
 import { ProgressSpinnerModule } from 'primeng/progressspinner';
 import { Select } from 'primeng/select';
 import { Tree } from 'primeng/tree';
@@ -60,6 +61,7 @@ import { SubscriptionManager } from '../shared/types';
     ButtonDirective,
     Dialog,
     FormsModule,
+    InputTextModule,
     Select,
     TreeTableModule,
     PrimeTemplate,
@@ -114,6 +116,9 @@ export class DownloadComponent
   done = false;
   datasetUrl = '';
   showGuestLoginPopup = false;
+  previewUrlInput = '';
+  isPreviewUrlMode = false;
+  isGuestMode = false;
 
   // globus
   token?: string;
@@ -149,34 +154,11 @@ export class DownloadComponent
     // eslint-disable-next-line no-console
     console.debug('[DownloadComponent] Config loaded');
 
-    // Check if user is logged in and show popup if not
-    // eslint-disable-next-line no-console
-    console.debug('[DownloadComponent] Checking user info for popup...');
-    try {
-      const userInfo = await firstValueFrom(this.dataService.getUserInfo());
-      // eslint-disable-next-line no-console
-      console.debug('[DownloadComponent] getUserInfo response:', userInfo);
-      if (!userInfo.loggedIn) {
-        // eslint-disable-next-line no-console
-        console.debug('[DownloadComponent] User not logged in, showing popup');
-        this.showGuestLoginPopup = true;
-      } else {
-        // eslint-disable-next-line no-console
-        console.debug('[DownloadComponent] User is logged in, no popup needed');
-      }
-    } catch (err) {
-      // eslint-disable-next-line no-console
-      console.error('[DownloadComponent] getUserInfo error:', err);
-      // eslint-disable-next-line no-console
-      console.debug('[DownloadComponent] Assuming not logged in, showing popup');
-      this.showGuestLoginPopup = true;
-    }
-
     const dvToken = localStorage.getItem('dataverseToken');
     if (dvToken !== null) {
       this.dataverseToken = dvToken;
     }
-    this.route.queryParams.subscribe((params) => {
+    this.route.queryParams.subscribe(async (params) => {
       const apiToken = params['apiToken'];
       if (apiToken) {
         this.dataverseToken = apiToken;
@@ -189,17 +171,27 @@ export class DownloadComponent
       this.downloadId = params['downloadId'];
       const code = params['code'];
       if (code !== undefined) {
+        // Returning from OAuth - parse state
         const loginState: LoginState = JSON.parse(params['state']);
         if (loginState.nonce) {
           const doi = loginState.datasetId?.value
             ? loginState.datasetId?.value
             : '?';
           this.doiItems = [{ label: doi, value: doi }];
           this.datasetId = doi;
-          // Only try to load files if we have a valid dataset ID
-          if (doi && doi !== '?' && doi !== 'undefined') {
-            this.onDatasetChange();
+
+          // Restore state from OAuth redirect
+          if (loginState.downloadId) {
+            this.downloadId = loginState.downloadId;
+          }
+          if (loginState.isGuestMode) {
+            this.isGuestMode = true;
           }
+          if (loginState.isPreviewUrlMode && loginState.previewUrlToken) {
+            this.isPreviewUrlMode = true;
+            this.dataverseToken = loginState.previewUrlToken;
+          }
+
           const tokenSubscription = this.oauth
             .getToken('globus', code, loginState.nonce)
             .subscribe((x) => {
@@ -211,9 +203,15 @@ export class DownloadComponent
             });
         }
         this.globusPlugin = this.pluginService.getGlobusPlugin();
+
+        // After OAuth return, load files (user already made their choice before redirect)
+        if (this.datasetId && this.datasetId !== '?' && this.datasetId !== 'undefined') {
+          this.onDatasetChange();
+        }
       } else {
+        // First arrival - check if user is logged in and show popup if not
         this.globusPlugin = this.pluginService.getGlobusPlugin();
-        this.getRepoToken();
+        await this.checkUserAndShowPopupOrRedirect();
       }
     });
     this.datasetSearchResultsSubscription =
@@ -277,9 +275,82 @@ export class DownloadComponent
   }
 
   continueAsGuest(): void {
-    // User chose to continue without Dataverse login
-    // They will still need to authenticate with Globus OAuth
+    // User chose to continue as guest - strip session_required_single_domain and redirect to OAuth
+    this.isGuestMode = true;
+    this.showGuestLoginPopup = false;
+    this.getRepoToken();
+  }
+
+  continueAsLoggedInUser(): void {
+    // User chose to log in with KU Leuven account - keep session_required_single_domain
+    this.isGuestMode = false;
     this.showGuestLoginPopup = false;
+    this.getRepoToken();
+  }
+
+  async checkUserAndShowPopupOrRedirect(): Promise<void> {
+    // Check if user is logged in; show popup if not, otherwise redirect to OAuth
+    // eslint-disable-next-line no-console
+    console.debug('[DownloadComponent] Checking user info on first arrival...');
+    try {
+      const userInfo = await firstValueFrom(this.dataService.getUserInfo());
+      // eslint-disable-next-line no-console
+      console.debug('[DownloadComponent] getUserInfo response:', userInfo);
+      if (!userInfo.loggedIn) {
+        // eslint-disable-next-line no-console
+        console.debug('[DownloadComponent] User not logged in, showing popup');
+        this.showGuestLoginPopup = true;
+      } else {
+        // eslint-disable-next-line no-console
+        console.debug('[DownloadComponent] User is logged in, redirecting to OAuth');
+        this.getRepoToken();
+      }
+    } catch (err) {
+      // eslint-disable-next-line no-console
+      console.error('[DownloadComponent] getUserInfo error:', err);
+      // eslint-disable-next-line no-console
+      console.debug('[DownloadComponent] Assuming not logged in, showing popup');
+      this.showGuestLoginPopup = true;
+    }
+  }
+
+  continueWithPreviewUrl(): void {
+    // Extract token from pasted preview URL and redirect to OAuth
+    const token = this.extractPreviewUrlToken(this.previewUrlInput);
+    if (token) {
+      this.dataverseToken = token;
+      this.isPreviewUrlMode = true;
+      this.isGuestMode = true; // Preview users also need guest Globus access
+      this.showGuestLoginPopup = false;
+      // eslint-disable-next-line no-console
+      console.debug('[DownloadComponent] Preview URL token extracted, redirecting to OAuth');
+      this.getRepoToken();
+    } else {
+      // eslint-disable-next-line no-console
+      console.error('[DownloadComponent] Could not extract token from preview URL');
+    }
+  }
+
+  extractPreviewUrlToken(input: string): string | null {
+    if (!input) return null;
+    const trimmed = input.trim();
+    // If it's just a UUID-like token, return it directly
+    const uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+    if (uuidPattern.test(trimmed)) {
+      return trimmed;
+    }
+    // Try to extract token from URL like https://.../previewurl.xhtml?token=...
+    try {
+      const url = new URL(trimmed);
+      const token = url.searchParams.get('token');
+      if (token) return token;
+    } catch {
+      // Not a valid URL, ignore
+    }
+    // Try regex fallback for token= in any string
+    const tokenMatch = trimmed.match(/token=([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})/i);
+    if (tokenMatch) return tokenMatch[1];
+    return null;
   }
 
   onUserChange() {
@@ -685,20 +756,24 @@ export class DownloadComponent
     if (tg.URL?.includes('://')) {
       url = tg.URL;
     }
-    // For guest users, strip session_required_single_domain to allow any Globus identity
-    if (this.showGuestLoginPopup) {
+    // For guest/preview users, strip session_required_single_domain to allow any Globus identity
+    if (this.isGuestMode) {
       url = url.replace(/[&?]session_required_single_domain=[^&]*/g, '');
     }
     if (tg.oauth_client_id !== undefined && tg.oauth_client_id !== '') {
       const nonce = this.newNonce(44);
-      // Only include datasetId if one is actually selected
+      // Include all state to preserve across OAuth redirect
       const loginState: LoginState = {
         datasetId:
           this.datasetId && this.datasetId !== '?'
             ? { value: this.datasetId, label: this.datasetId }
             : undefined,
         nonce: nonce,
         download: true,
+        downloadId: this.downloadId,
+        isGuestMode: this.isGuestMode,
+        isPreviewUrlMode: this.isPreviewUrlMode,
+        previewUrlToken: this.isPreviewUrlMode ? this.dataverseToken : undefined,
       };
       let clId = '?client_id=';
       if (url.includes('?')) {

src/app/models/oauth.ts

@@ -13,6 +13,10 @@ export interface LoginState {
   datasetId?: Item;
   collectionId?: Item;
   download?: boolean;
+  downloadId?: string;
+  isGuestMode?: boolean;
+  isPreviewUrlMode?: boolean;
+  previewUrlToken?: string;
 }
 
 export interface Item {