fix: include ProgramSection in getMetadataWithDependencies

dhis-2/dhis-services/dhis-service-dxf2/src/main/java/org/hisp/dhis/dxf2/metadata/DefaultMetadataExportService.java

@@ -84,6 +84,7 @@
 import org.hisp.dhis.option.OptionSet;
 import org.hisp.dhis.program.Program;
 import org.hisp.dhis.program.ProgramIndicator;
+import org.hisp.dhis.program.ProgramSection;
 import org.hisp.dhis.program.ProgramStage;
 import org.hisp.dhis.program.ProgramStageDataElement;
 import org.hisp.dhis.program.ProgramStageSection;
@@ -769,6 +770,9 @@ private SetMap<Class<? extends IdentifiableObject>, IdentifiableObject> handlePr
     handleCategoryCombo(metadata, program.getCategoryCombo());
     handleDataEntryForm(metadata, program.getDataEntryForm());
     handleTrackedEntityType(metadata, program.getTrackedEntityType());
+    program
+        .getProgramSections()
+        .forEach(programSection -> handleProgramSection(metadata, programSection));
 
     program
         .getNotificationTemplates()
@@ -1099,4 +1103,16 @@ private SetMap<Class<? extends IdentifiableObject>, IdentifiableObject> handleAt
 
     return metadata;
   }
+
+  private SetMap<Class<? extends IdentifiableObject>, IdentifiableObject> handleProgramSection(
+      SetMap<Class<? extends IdentifiableObject>, IdentifiableObject> metadata,
+      ProgramSection programSection) {
+    if (programSection == null) return metadata;
+    metadata.putValue(ProgramSection.class, programSection);
+    programSection
+        .getTrackedEntityAttributes()
+        .forEach(tea -> handleTrackedEntityAttribute(metadata, tea));
+
+    return metadata;
+  }
 }

dhis-2/dhis-test-integration/src/test/java/org/hisp/dhis/metadata/export/MetadataExportWithDependenciesTest.java

@@ -0,0 +1,62 @@
+/*
+ * Copyright (c) 2004-2023, University of Oslo
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ * Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * Neither the name of the HISP project nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+package org.hisp.dhis.metadata.export;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import java.util.Map;
+import java.util.Set;
+import javax.persistence.EntityManager;
+import javax.persistence.PersistenceContext;
+import org.hisp.dhis.common.IdentifiableObject;
+import org.hisp.dhis.dxf2.metadata.MetadataExportService;
+import org.hisp.dhis.program.Program;
+import org.hisp.dhis.program.ProgramSection;
+import org.hisp.dhis.test.integration.SingleSetupIntegrationTestBase;
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+
+public class MetadataExportWithDependenciesTest extends SingleSetupIntegrationTestBase {
+
+  @PersistenceContext private EntityManager entityManager;
+  @Autowired private MetadataExportService metadataExportService;
+
+  @Test
+  void testExportProgramWithProgramSection() {
+    Program program = createProgram('A');
+    entityManager.persist(program);
+    ProgramSection programSection = createProgramSection('A', program);
+    program.getProgramSections().add(programSection);
+    entityManager.persist(programSection);
+    Map<Class<? extends IdentifiableObject>, Set<IdentifiableObject>> export =
+        metadataExportService.getMetadataWithDependencies(program);
+
+    assertEquals(1, export.get(Program.class).size());
+    assertEquals(1, export.get(ProgramSection.class).size());
+  }
+}

dhis-2/dhis-test-web-api/src/test/java/org/hisp/dhis/webapi/controller/DataValueSetControllerTest.java

@@ -38,10 +38,13 @@
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.springframework.http.MediaType.APPLICATION_XML;
 
+import java.util.Set;
+import org.hisp.dhis.organisationunit.OrganisationUnit;
 import org.hisp.dhis.web.HttpStatus;
 import org.hisp.dhis.webapi.DhisControllerIntegrationTest;
 import org.hisp.dhis.webapi.json.domain.JsonImportSummary;
 import org.hisp.dhis.webapi.json.domain.JsonWebMessage;
+import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;
 
 /**
@@ -203,4 +206,34 @@ void testGetDataValueSetJson() {
     assertEquals(
         String.format("User is not allowed to view org unit: `%s`", ouId), response.getMessage());
   }
+
+  @Test
+  @DisplayName("Should return error message when user does not have DATA_READ to DataSet")
+  void testGetDataValueSetJsonWithNonAccessibleDataSet() {
+    String orgUnitId =
+        assertStatus(
+            HttpStatus.CREATED,
+            POST(
+                "/organisationUnits/",
+                "{'name':'My Unit', 'shortName':'OU1', 'openingDate': '2020-01-01', 'code':'OU1'}"));
+    String dsId =
+        assertStatus(
+            HttpStatus.CREATED,
+            POST(
+                "/dataSets/",
+                "{'name':'My data set', 'shortName': 'MDS', 'periodType':'Monthly'}"));
+
+    switchToNewUser(
+        createAndAddUser(Set.of(), Set.of(manager.get(OrganisationUnit.class, orgUnitId))));
+    JsonWebMessage response =
+        GET(
+                "/dataValueSets/?inputOrgUnitIdScheme=code&idScheme=name&orgUnit={ou}&period=2022-01&dataSet={ds}&async=true",
+                "OU1",
+                dsId)
+            .content(HttpStatus.CONFLICT)
+            .as(JsonWebMessage.class);
+    assertEquals(
+        String.format("User is not allowed to read data for data set: `%s`", dsId),
+        response.getMessage());
+  }
 }

dhis-2/dhis-web-api/src/main/java/org/hisp/dhis/webapi/controller/DataValueSetController.java

@@ -212,8 +212,9 @@ private void getDataValueSet(
     response.setContentType(contentType);
     setNoStore(response);
 
-    try (OutputStream out =
-        compress(params, response, attachment, Compression.fromValue(compression), format)) {
+    try {
+      OutputStream out =
+          compress(params, response, attachment, Compression.fromValue(compression), format);
       writeOutput.accept(params, out);
     } catch (IOException ex) {
       throw new UncheckedIOException(ex);