2610 orcid tokens by everreau · Pull Request #5110 · openlibhums/janeway

everreau · 2026-01-26T17:50:54Z

Addresses: #2610

When orcid is enabled:

Save orcid auth token and expiration when orcid is authenticated
Allow users to add orcid via authentication
When orcid is removed by admin or user revoke token
Notify users when token is not valid in profile and edit user views
Don't allow users to manually edit orcids.
Allow co-authors to request orcids

everreau · 2026-01-26T17:51:27Z

supersedes: #4399

alainna · 2026-01-28T15:09:43Z

So great, @everreau! I've suggested some changes in line with ORCID's brand guidelines

This is only for journals at the moment, is that correct? Could the co-author use the ORCID login option to connect their iD to their account rather than connecting the iD in their profile? What happens if the co-author is a frozen author without an account, or if the account isn't active?

everreau · 2026-02-02T18:03:50Z

@alainna. All of the login features also work for preprints. I don't see any reference at all to orcids in the preprint author interface. I think we (cdl) would send whatever orcid was in the author's account to crossref even though it's not visible and it appears in the preprint front end. The profile and the account are the same as far as I know. The interface on main is a bit different than what we're currently running. Maybe we should setup a time so you can take a look at what I have. I hadn't really thought about what would happen if a user connects their orcid after the frozen authors were already made. I'll take a look at that.

ajrbyers · 2026-02-04T08:04:11Z

@alainna. All of the login features also work for preprints. I don't see any reference at all to orcids in the preprint author interface. I think we (cdl) would send whatever orcid was in the author's account to crossref even though it's not visible and it appears in the preprint front end. The profile and the account are the same as far as I know. The interface on main is a bit different than what we're currently running. Maybe we should setup a time so you can take a look at what I have. I hadn't really thought about what would happen if a user connects their orcid after the frozen authors were already made. I'll take a look at that.

On the FrozenAuthor object orcid is a property that will either return FrozenAuthor.frozen_orcid atrribute and if there is none check if the linked account has an orcid attribute and return that instead.

ajrbyers · 2026-02-04T08:05:43Z

@joemull can you do the first technical review on this and then pass it to me please?

joemull · 2026-02-05T12:26:30Z

Just an update: I should be able to get to this ~~later next week~~ 16 or 17 Feb.

alainna · 2026-02-10T19:56:06Z

Some suggestions for this dev: eScholarship#46

joemull

This is hugely appreciated--thank you for putting it in.

I'm having trouble testing it out (an issue with OLH's ORCID sandbox that will take a few days to resolve), but I've gone ahead and given you some comments from reading the code. Hope they're clear but please do ping me if anything does not make sense.

joemull · 2026-02-16T11:46:23Z

src/core/tests/test_app.py

+        response = self.client.get(reverse("core_edit_profile"))
+        self.assertContains(response, "ORCID iD could not be validated.")
+        self.assertContains(response, "Connect your ORCID")
+        self.assertContains(response, "https://sandbox.orcid.org/0000-0000-0000-0000")


Does this test (or any of the ones below) rely on a network connection? We'll need to put mocks into any test that relies on a network connection.

None of the tests rely on network connection. It's setting the orcid url purely for display purposes. I noticed that ruff is failing now but it was passing at some point and the tests ran successfully.

joemull · 2026-02-16T11:54:15Z

src/core/tests/test_app.py

+            response, '<input type="text" name="orcid" maxlength="40" id="id_orcid">'
+        )
+
+    def test_profile_orcid_enabled_no_orcid(self):


Maybe add an override_settings decorator on this and other tests that expect ENABLE_ORCID=True, in case someone has it off and runs tests.

joemull · 2026-02-16T11:55:32Z

src/core/models.py

    orcid = models.CharField(
        max_length=40, null=True, blank=True, verbose_name=_("ORCiD")
    )
+    orcid_token = models.CharField(max_length=40, null=True, blank=True)


Charfields should not have null=True

joemull · 2026-02-16T11:59:26Z

src/core/models.py

    expiry = models.DateTimeField(
        default=generate_expiry_date, verbose_name=_("Expires on")
    )
+    access_token = models.CharField(max_length=40, null=True, blank=True)


Same as the other one--charfields should not have null=True

joemull · 2026-02-16T12:04:43Z

src/core/views.py

+            messages.SUCCESS,
+            _("Your ORCID has been connected to your account."),
+        )
+        return redirect(logic.reverse_with_next("core_edit_profile", next_url))


Haven't been able to test this yet but I'm actually having trouble working out what's happening just by reading it, especially the case where they're not authenticated and they get sent to a different login screen. Can you add a comment above with context, like the other if / else branches have?

joemull · 2026-02-16T12:22:33Z

src/templates/admin/repository/article.html

                        <tr>
                            <th>{% trans 'Name' %}</th>
                            <th>{% trans 'Email' %}</th>
+                            <th>{% trans 'ORCID' %}</th>


"ORCID iD"?

joemull · 2026-02-16T12:22:44Z

src/utils/install/journal_defaults.json

+            "type": "rich-text"
+        },
+        "value": {
+            "default": "<p>Dear {{ user.full_name }}<br/><br/>Your co-author has requested your ORCID iD. You can add it by through your profile {{ user_profile_url }}.<br/></p>"


Typo: "by through"

joemull · 2026-02-16T12:26:00Z

src/utils/install/journal_defaults.json

+            "editor",
+            "journal-manager"
+        ]
+    },


It looks like this separate template isn't needed, since the email text is the same and the link is the same. Only the subject differs. Is there another reason for it?

@alainna suggested having different text for active and inactive users. I asked her for text but she hasn't sent any yet. I'll check with her today.

Apologies @joemull @everreau: just back in office. Re: template:

@joemull could you confirm whether this situation is true? If an author is added to a Janeway journal or repository article, then an account is created for them and set as "inactive". In order for the user to connect an authenticated ORCID iD to their Janeway account/author profile, they must first activate their Janeway account, then go to their profile to connect their ORCID iD.

Is that correct?

A second question: If an active user tries to sign into Janeway with ORCID, but there's no iD in their account, they will be redirected back to the Janeway login page and asked to sign in -- is that correct?

(Apologies, our ORCID integration is currently undergoing issues; i may try to get a local copy running to test tomorrow.)

@alainna this is a complicated thing to answer, because the changes to journals and repositories are getting out of sync. Let's discuss on Discord.

But to try to answer just for the repository side:

If an author is added to a Janeway journal or repository article, then an account is created for them and set as "inactive". In order for the user to connect an authenticated ORCID iD to their Janeway account/author profile, they must first activate their Janeway account, then go to their profile to connect their ORCID iD.

I believe that's correct for the behavior before this PR. However, we should consider whether we can provide these users with a link that will do it all--authenticate with ORCID and activate their Janeway account.

If an active user tries to sign into Janeway with ORCID, but there's no iD in their account, they will be redirected back to the Janeway login page and asked to sign in -- is that correct?

No, if there is no ORCID for them in Janeway, Janeway will attempt to match on email address. If the email address in their Janeway account matches one of the email addresses on their public ORCID profile, it will add the ORCID and log them in automatically. However, if there is no match by email, Janeway will say there is no matching account and redirect them to the registration page. This could potentially result in duplicate accounts, or an error when the user types in their email and it says "an account with that email already exists". So I think this PR should introduce a third option, where Janeway is able to identify the user attached to an ORCID authentication token, and input the ORCID and activate the account.

joemull · 2026-02-16T12:27:20Z

src/utils/orcid.py

+def is_token_valid(orcid_id, token):
+    api_client = OrcidAPI(
+        settings.ORCID_CLIENT_ID, settings.ORCID_CLIENT_SECRET, sandbox=True
+    )


The sandbox parameter needs to be able to change in production. Maybe it should be based on whether sandbox.orcid.org is present in the URL in settings.py?

ugh, yes, this was actually mistakenly commited but I can actually fix it.

joemull · 2026-02-16T12:28:37Z

src/utils/orcid.py

        logger.info("Retrieving ORCID profile for %s", orcid)
-        api_client = OrcidAPI(settings.ORCID_CLIENT_ID, settings.ORCID_CLIENT_SECRET)
+        api_client = OrcidAPI(
+            settings.ORCID_CLIENT_ID, settings.ORCID_CLIENT_SECRET, sandbox=True


Same comment about changing sandbox in production.

everreau added 5 commits January 21, 2026 16:17

save orcid tokens and expirations

efafcf3

don't allow users to edit orcids directly in profile

3d051e7

allow authors to request orcid from co-authors

d2b237d

fix tests

c1d4244

add tests

1250329

ruff formatting

7b90eb1

everreau requested a review from alainna January 27, 2026 19:11

ajrbyers requested a review from joemull February 4, 2026 08:05

ajrbyers assigned joemull Feb 4, 2026

everreau added 2 commits February 6, 2026 16:03

fix icon link, capitalize i per alainna

aba83d4

update tests

90c8b1d

everreau added 5 commits February 13, 2026 11:38

use ORCID iD (from Alainna)

0fc0f01

show orcids in repository admin and allow requests

be0af16

fix test

c68057d

allow different emails for inactive accounts

641995c

add date orcid request was sent

1a6767d

joemull requested changes Feb 16, 2026

View reviewed changes

joemull assigned everreau and unassigned joemull Feb 16, 2026

everreau added 4 commits February 17, 2026 12:05

fix typos, minor changes

839d954

fix date format

e5e69e3

use is_staff

78e659e

add comments, fix messages

a4a866d

everreau added 3 commits February 18, 2026 15:57

use url_with_return and require post

6a1023c

don't use null=True for charfields, fix tests

e9bb6b4

ruff

d80fbdc

joemull assigned joemull and unassigned joemull Feb 23, 2026

Conversation

everreau commented Jan 26, 2026

Uh oh!

everreau commented Jan 26, 2026

Uh oh!

alainna commented Jan 28, 2026

Uh oh!

everreau commented Feb 2, 2026

Uh oh!

ajrbyers commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ajrbyers commented Feb 4, 2026

Uh oh!

joemull commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alainna commented Feb 10, 2026

Uh oh!

joemull left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

joemull Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

ajrbyers commented Feb 4, 2026 •

edited

Loading

joemull commented Feb 5, 2026 •

edited

Loading

joemull Feb 23, 2026 •

edited

Loading