ObsCore's data_rights and VODataService - broken reference

[Markus Demleitner]

Dear DM,

On Fri, Oct 06, 2023 at 01:42:57AM +0000, Dubois-Felsmann, Gregory P. wrote:
> Apologies if this has been noted previously, but I just noticed
> that because ObsCore 1.1's definition of the "data_rights"
> attribute depends on VODataService, and because the relevant parts
> of VODataService were removed in the transition from 1.1 to 1.2,
> the definitions of "public", "secure", and "proprietary" have been
> effectively orphaned.

Oh bother... I had totally disregarded this incoming link into
VODataService.  Sorry about this.

> What's the right way to fix this in ObsCore?  Pull the definitions
> into the body of the document?  Can we do this in an erratum?

The short-term fix is, I think, to have a version-sharp reference
(which, incidentally, is also what ivoatex does).  So, I'd say we
ought to have an erratum that says:

  Replace the content of section B 4.4 with:

    This parameter allows mentioning the availability of a dataset.
    Possible values are: public, secure, or proprietary as stated in
    VODataService 1.1 (Plante et al. 2010), sect. 3.1.1.

  Replace the citation for Plante et al. 2010 with

    Plante, R., Stébé, A., Benson, K., Dowler, P., Graham, M.,
    Greene, G., Harrison, P., Lemson, G., Linde, T. and Rixon, G.
    (2010), ‘VODataService: a VOResource Schema Extension for
    Describing Collections, Services Version 1.1’, IVOA
    Recommendation 02 December 2010, arXiv:1110.0516.
    http://doi.org/10.5479/ADS/bib/2010ivoa.spec.1202P

Poke me and I'll write it.

On the longer run, however, I'd raise the question of whether
data_rights should stay the way it is in the first place.  In
Registry, we've found that the three values in VODataService 1.1
turned out to be woefully inadequate and hence unused, which is why
we changed it.

This *may* be different on the dataset level (i.e., obscore), but: Is
anyone aware of data_rights actually being used (as in: read and
evaluated, not just given a value in a table)?  If so, what for?

My suspicion is that it would be worth revisiting the use cases and
then figure out what we'd actually need in this department; this
could be

* nothing (people just try the access URL and we rely on the
  headers of a potential 401 response to tell them what they need to
  know; I think that's what our current work on auth converges upon),

* a machine-readable licence declaration (if we believe discovering
  data by the strings attached to it is an important use case),

* free text (if we consider obscore to be the right place for things
  like "if you use this data, please tell janet at doe.person and cite
  1955Sci...122..911B")

* use the link_auth/link_authorized combo from Datalink 1.1
  (https://ivoa.net/documents/DataLink/20230413/PR-DataLink-1.1-20230413.html#tth_sEc3.2.11)

* still something else.

       -- Markus