2610 orcid tokens by everreau · Pull Request #5110 · openlibhums/janeway

everreau · 2026-01-26T17:50:54Z

Addresses: #2610

When orcid is enabled:

Save orcid auth token and expiration when orcid is authenticated
Allow users to add orcid via authentication
When orcid is removed by admin or user revoke token
Notify users when token is not valid in profile and edit user views
Don't allow users to manually edit orcids.
Allow co-authors to request orcids
Add is_orcid_valid flag to FrozenAuthors
Add authentication element to orcid crossref xml

everreau · 2026-01-26T17:51:27Z

supersedes: #4399

alainna · 2026-01-28T15:09:43Z

So great, @everreau! I've suggested some changes in line with ORCID's brand guidelines

This is only for journals at the moment, is that correct? Could the co-author use the ORCID login option to connect their iD to their account rather than connecting the iD in their profile? What happens if the co-author is a frozen author without an account, or if the account isn't active?

everreau · 2026-02-02T18:03:50Z

@alainna. All of the login features also work for preprints. I don't see any reference at all to orcids in the preprint author interface. I think we (cdl) would send whatever orcid was in the author's account to crossref even though it's not visible and it appears in the preprint front end. The profile and the account are the same as far as I know. The interface on main is a bit different than what we're currently running. Maybe we should setup a time so you can take a look at what I have. I hadn't really thought about what would happen if a user connects their orcid after the frozen authors were already made. I'll take a look at that.

ajrbyers · 2026-02-04T08:04:11Z

@alainna. All of the login features also work for preprints. I don't see any reference at all to orcids in the preprint author interface. I think we (cdl) would send whatever orcid was in the author's account to crossref even though it's not visible and it appears in the preprint front end. The profile and the account are the same as far as I know. The interface on main is a bit different than what we're currently running. Maybe we should setup a time so you can take a look at what I have. I hadn't really thought about what would happen if a user connects their orcid after the frozen authors were already made. I'll take a look at that.

On the FrozenAuthor object orcid is a property that will either return FrozenAuthor.frozen_orcid atrribute and if there is none check if the linked account has an orcid attribute and return that instead.

ajrbyers · 2026-02-04T08:05:43Z

@joemull can you do the first technical review on this and then pass it to me please?

joemull · 2026-02-05T12:26:30Z

Just an update: I should be able to get to this ~~later next week~~ 16 or 17 Feb.

alainna · 2026-02-10T19:56:06Z

Some suggestions for this dev: eScholarship#46

joemull

This is hugely appreciated--thank you for putting it in.

I'm having trouble testing it out (an issue with OLH's ORCID sandbox that will take a few days to resolve), but I've gone ahead and given you some comments from reading the code. Hope they're clear but please do ping me if anything does not make sense.

joemull · 2026-02-16T11:46:23Z

src/core/tests/test_app.py

+        response = self.client.get(reverse("core_edit_profile"))
+        self.assertContains(response, "ORCID iD could not be validated.")
+        self.assertContains(response, "Connect your ORCID")
+        self.assertContains(response, "https://sandbox.orcid.org/0000-0000-0000-0000")


Does this test (or any of the ones below) rely on a network connection? We'll need to put mocks into any test that relies on a network connection.

None of the tests rely on network connection. It's setting the orcid url purely for display purposes. I noticed that ruff is failing now but it was passing at some point and the tests ran successfully.

This is using a network connection, because is_orcid_token_valid calls the ORCID API using requests. I turned my internet off and got the error below. So I think we'll just want to mock it where the Janeway logic that is being tested ends, and the ORCID API code begins, in this and subsequent tests that use the API.

Traceback (most recent call last): File "/home/joemull/git/janepr/src/core/tests/test_app.py", line 563, in setUp self.article_one = helpers.create_article( File "/home/joemull/git/janepr/src/utils/testing/helpers.py", line 300, in create_article author.snapshot_as_author(article) File "/home/joemull/git/janepr/src/core/models.py", line 893, in snapshot_as_author frozen_dict["is_frozen_orcid_valid"] = self.is_orcid_token_valid() File "/home/joemull/git/janepr/src/core/models.py", line 963, in is_orcid_token_valid return is_token_valid(self.orcid, self.orcid_token) File "/home/joemull/git/janepr/src/utils/orcid.py", line 76, in is_token_valid r = api_client._get_public_info( File "/home/joemull/git/janepr/.venv/lib/python3.10/site-packages/orcid/orcid.py", line 410, in _get_public_info return requests.get(request_url, headers=headers, File "/home/joemull/git/janepr/.venv/lib/python3.10/site-packages/requests/api.py", line 73, in get return request("get", url, params=params, **kwargs) File "/home/joemull/git/janepr/.venv/lib/python3.10/site-packages/requests/api.py", line 59, in request return session.request(method=method, url=url, **kwargs) File "/home/joemull/git/janepr/.venv/lib/python3.10/site-packages/requests/sessions.py", line 589, in request resp = self.send(prep, **send_kwargs) File "/home/joemull/git/janepr/.venv/lib/python3.10/site-packages/requests/sessions.py", line 703, in send r = adapter.send(request, **kwargs) File "/home/joemull/git/janepr/.venv/lib/python3.10/site-packages/requests/adapters.py", line 700, in send raise ConnectionError(e, request=request) requests.exceptions.ConnectionError: HTTPSConnectionPool(host='pub.orcid.org', port=443): Max retries exceeded with url: /v2.0/0004-5678-9012-345X/record (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7c9bc79e8190>: Failed to establish a new connection: [Errno -3] Temporary failure in name resolution'))

src/core/tests/test_app.py

src/core/models.py

src/core/views.py

src/templates/admin/repository/article.html

src/utils/install/journal_defaults.json

src/utils/orcid.py

alainna · 2026-03-04T21:00:38Z

Suggested email text for the situation in which an author account exists, but may or may not be active.

The below is written with the assumption that:

an author must activate their account to add an authenticated ORCID iD
an inactive account must manually request a password reset/activation key to activate their account, and
it's possible to add specific text for inactive accounts using if.... else

Dear {co-author name},

{object owner name} has added you as a co-author to "{object title}" in {journal / repository name} and requests that you add your ORCID iD to the publication.

[if account is not active]

First, please activate your author {journal / repository name} profile by {setting a password in the system} using the email address {email address on the account}.

Second, {click here to connect your verified ORCID iD to your account}. You may be asked to log into {journal / repository name} again.

[if account is active]

{Please click here to verify your ORCID iD and connect it to your {journal / repository name} account (registered email: {co-author email address}].}

Kind regards,
{journal / repository name }

…n author, refactor templates

…e more fault tolerant

… account

…plicates

…dated orcid already exists

everreau · 2026-03-16T21:59:30Z

@joemull I think this may be ready for review. I think the login logic in core.views is getting quite confusing. I was trying to rewrite so we can favor accounts that have authenticated orcids and prevent duplicate authenticated orcids. Maybe it would be easier to just make the orcid field unique at this point? I'm not sure if there is anything else in the queue that is needed before that.

joemull · 2026-03-17T08:47:27Z

OK @everreau I will try to get to it first thing next week (I'm out the rest of this week). Yes every time I try to read through that logic I get confused. I agree it is high time to make the ORCID unique. I think the hard thing there is that there are duplicates currently. So the data migration would have to enforce the unique constraint while also recording the duplicates somehow and making them visible to someone (press manager, editor)? to resolve.

everreau · 2026-03-24T15:15:52Z

@joemull so, my thought on dealing with the duplicates would be to create a migration that looks for the best account to retain the orcid by a set of criteria (eg is active, matches info held in orcid, last login), remove it from the others and create a log entry that says it was removed. Then we could add some logic that would allow a user to reclaim the orcid to their own account by authenticating with orcid and we could add a view that lets managers see everything that has the given log entry and resolve manually?

joemull

This is getting really close to being ready, and it's great that you were able to loop in the frozen author piece. I took a careful read through the logic and tested it out, and it's mostly working great for me. I just have a few requests around tests, the admin view, and maintainability, and one suggestion for usability--in the verification request, taking the user straight to the verification step rather than to their profile.

joemull · 2026-03-25T15:16:31Z

src/core/tests/test_app.py

+        response = self.client.get(reverse("core_edit_profile"))
+        self.assertContains(response, "ORCID iD could not be validated.")
+        self.assertContains(response, "Connect your ORCID")
+        self.assertContains(response, "https://sandbox.orcid.org/0000-0000-0000-0000")


This is using a network connection, because is_orcid_token_valid calls the ORCID API using requests. I turned my internet off and got the error below. So I think we'll just want to mock it where the Janeway logic that is being tested ends, and the ORCID API code begins, in this and subsequent tests that use the API.

Traceback (most recent call last): File "/home/joemull/git/janepr/src/core/tests/test_app.py", line 563, in setUp self.article_one = helpers.create_article( File "/home/joemull/git/janepr/src/utils/testing/helpers.py", line 300, in create_article author.snapshot_as_author(article) File "/home/joemull/git/janepr/src/core/models.py", line 893, in snapshot_as_author frozen_dict["is_frozen_orcid_valid"] = self.is_orcid_token_valid() File "/home/joemull/git/janepr/src/core/models.py", line 963, in is_orcid_token_valid return is_token_valid(self.orcid, self.orcid_token) File "/home/joemull/git/janepr/src/utils/orcid.py", line 76, in is_token_valid r = api_client._get_public_info( File "/home/joemull/git/janepr/.venv/lib/python3.10/site-packages/orcid/orcid.py", line 410, in _get_public_info return requests.get(request_url, headers=headers, File "/home/joemull/git/janepr/.venv/lib/python3.10/site-packages/requests/api.py", line 73, in get return request("get", url, params=params, **kwargs) File "/home/joemull/git/janepr/.venv/lib/python3.10/site-packages/requests/api.py", line 59, in request return session.request(method=method, url=url, **kwargs) File "/home/joemull/git/janepr/.venv/lib/python3.10/site-packages/requests/sessions.py", line 589, in request resp = self.send(prep, **send_kwargs) File "/home/joemull/git/janepr/.venv/lib/python3.10/site-packages/requests/sessions.py", line 703, in send r = adapter.send(request, **kwargs) File "/home/joemull/git/janepr/.venv/lib/python3.10/site-packages/requests/adapters.py", line 700, in send raise ConnectionError(e, request=request) requests.exceptions.ConnectionError: HTTPSConnectionPool(host='pub.orcid.org', port=443): Max retries exceeded with url: /v2.0/0004-5678-9012-345X/record (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7c9bc79e8190>: Failed to establish a new connection: [Errno -3] Temporary failure in name resolution'))

joemull · 2026-03-26T13:13:43Z

src/core/models.py

    )
+    orcid_token = models.CharField(max_length=40, blank=True, default="")
+    orcid_token_expiration = models.DateTimeField(null=True, blank=True)
+    date_orcid_requested = models.DateTimeField(blank=True, null=True)


The admin view for the account is a bit unique in that we have to manually add the fields we want to see. I think it would be helpful to see these new ones in the admin when troubleshooting login issues for users, so could we add them in the list in AccountAdmin.fieldsets?

joemull · 2026-03-26T13:51:59Z

src/core/views.py

+                messages.WARNING,
+                _("You must be logged in to connect an ORCID iD to your account."),
+            )
+            return redirect(logic.reverse_with_next("core_login", next_url))


OK, with my proposed change to the email template, this might catch a fair number of users. So if you like that change, let's make sure users come back here after they've done the non-ORCID login. Something like this:

next_url = request.get_full_path() redirect(logic.reverse_with_next("core_login", next_url))

joemull · 2026-03-26T14:06:30Z

src/core/tests/test_views.py

+        self.assertIn(
+            f"/register/step/orcid/",
+            response.redirect_chain[0][0],
+        )


If I'm reading this right, the redirect to registration would happen here even if the account was active, because neither the ORCID nor email matches. Should we add some of those in here so it's clear the test is just testing active / inactive status?

joemull · 2026-03-26T14:09:12Z

src/core/tests/test_views.py

+        self.assertIn(
+            f"/register/step/orcid/",
+            response.redirect_chain[0][0],
+        )


I'm not sure what this test is testing. Is it about duplicate ORCIDs, or the account being inactive? I think it basically does what I was asking for, for the previous test, but it also has a bit in the name about duplicates, so I'm not sure.

joemull · 2026-03-26T14:11:06Z

src/core/logic.py

+        subject = "subject_orcid_request"
+    else:
+        template = "orcid_activate_request"
+        subject = "subject_orcid_activate_request"


I think we just want one of these now, since there is just one template, right?

joemull · 2026-03-26T14:15:26Z

src/core/logic.py

+        "user": user,
+        "user_profile_url": request.site_type.site_url(
+            reverse("core_edit_profile"),
+        ),


Have you considered making the link straight to the verification step? I think this might be clearer for users who do not remember what the profile page looks like. If they are taken to the profile page, they have to scroll down to the social media and accounts section and notice the button to connect their ORCID, but if they are taken straight to the redirect cycle, they'll be prompted at each step what to do.

We have a helper function in this file that might be useful:

reverse_with_query("core_edit_profile", { "action": "add_profile_orcid" })

joemull · 2026-03-26T14:30:11Z

src/core/models.py

        return username.lower()

+    def get_orcid_url(self):
+        return f"{settings.ORCID_URL.replace('oauth/authorize', '')}{self.orcid}"


I wonder what are the benefits and drawbacks of this versus the logic in orcid_uri for the frozen author (and now the preprint author)? I'm thinking of a few things:

The ORCID IDs in Janeway databases have sometimes been input as URLs (obviously something to fix when we make the field unique), so get_orcid_url would potentially result in repeating the host name and domain parts.

It might be useful in some contexts to surface the sandbox.orcid.org domain, but this is not accounted for by orcid_uri because it hard-codes the domain.

Maybe it's time to combine the logic and have one method for Account, FrozenAuthor, and PreprintAuthor?

joemull · 2026-03-26T14:52:26Z

@joemull so, my thought on dealing with the duplicates would be to create a migration that looks for the best account to retain the orcid by a set of criteria (eg is active, matches info held in orcid, last login), remove it from the others and create a log entry that says it was removed. Then we could add some logic that would allow a user to reclaim the orcid to their own account by authenticating with orcid and we could add a view that lets managers see everything that has the given log entry and resolve manually?

That does sound like a good approach to me. I think we'd open another can of worms by putting it in this PR, but I added your comment on the thread for #4751, where a few people commented on how to go about de-duping.

everreau added 5 commits January 21, 2026 16:17

save orcid tokens and expirations

efafcf3

don't allow users to edit orcids directly in profile

3d051e7

allow authors to request orcid from co-authors

d2b237d

fix tests

c1d4244

add tests

1250329

ruff formatting

7b90eb1

everreau requested a review from alainna January 27, 2026 19:11

ajrbyers requested a review from joemull February 4, 2026 08:05

ajrbyers assigned joemull Feb 4, 2026

everreau added 2 commits February 6, 2026 16:03

fix icon link, capitalize i per alainna

aba83d4

update tests

90c8b1d

everreau added 5 commits February 13, 2026 11:38

use ORCID iD (from Alainna)

0fc0f01

show orcids in repository admin and allow requests

be0af16

fix test

c68057d

allow different emails for inactive accounts

641995c

add date orcid request was sent

1a6767d

joemull requested changes Feb 16, 2026

View reviewed changes

joemull assigned everreau and unassigned joemull Feb 16, 2026

everreau added 4 commits February 17, 2026 12:05

fix typos, minor changes

839d954

fix date format

e5e69e3

use is_staff

78e659e

add comments, fix messages

a4a866d

everreau added 4 commits February 18, 2026 15:58

don't use null=True for charfields, fix tests

e9bb6b4

ruff

d80fbdc

typo

725bbbb

use sandbox parameter when appropriate

59803ef

joemull assigned joemull and unassigned joemull Feb 23, 2026

re-arrange orcid field

52fe5e8

alainna mentioned this pull request Mar 4, 2026

Changes to ORCID oauth + request eScholarship/janeway#46

Open

everreau mentioned this pull request Mar 4, 2026

ORCID parent issue #4896

Open

everreau added 11 commits March 11, 2026 16:06

add orcid display to more view, add is_valid flag for orcids in froze…

11cb04f

…n author, refactor templates

add tests for inactive accounts, re-write account matching logic to b…

fd251e9

…e more fault tolerant

ruff

24a1d5d

add orcid authenticated flag to crossref metadata

f0eb00a

don't allow users to add an orcid that is already attached to another…

fc889aa

… account

remove unused code

a411892

remove unused setting and update request text

c27a70a

use validation to determine which account to login to if there are du…

94357ae

…plicates

make sure orcid display matches ENABLE_ORCID setting

f362c2b

don't let users register with or add orcids if an account with a vali…

0ca9e28

…dated orcid already exists

ruff

ab71ca6

joemull self-requested a review March 17, 2026 08:47

joemull self-assigned this Mar 17, 2026

joemull requested changes Mar 26, 2026

View reviewed changes

joemull mentioned this pull request Mar 26, 2026

Inactive account holder cannot log in with ORCID #4751

Open

joemull removed their assignment Mar 26, 2026

Conversation

everreau commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

everreau commented Jan 26, 2026

Uh oh!

alainna commented Jan 28, 2026

Uh oh!

everreau commented Feb 2, 2026

Uh oh!

ajrbyers commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ajrbyers commented Feb 4, 2026

Uh oh!

joemull commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alainna commented Feb 10, 2026

Uh oh!

joemull left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

alainna commented Mar 4, 2026

Uh oh!

everreau commented Mar 16, 2026

Uh oh!

joemull commented Mar 17, 2026

Uh oh!

everreau commented Mar 24, 2026

Uh oh!

joemull left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

joemull commented Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

everreau commented Jan 26, 2026 •

edited

Loading

ajrbyers commented Feb 4, 2026 •

edited

Loading

joemull commented Feb 5, 2026 •

edited

Loading