Open ewhanson opened 9 months ago
PRs:
stable-3_4_0
: #306 stable-3_3_0
: #307stable-3-2_1
: #308@bozana, could you review these changes? They update the API URLs, account for the non-pub
prefixed URL being saved in the database, and update the OAuth-related calls to use the plain orcid.org
or sandbox.orcid.org
URLs. Thanks!
Hi @ewhanson, great! That all looks good to me. Thanks a lot!
Thanks, @bozana! I've merged them. I'll leave the issue open until I have a chance to get these changes reflected in main
, considering the current rewrite underway.
Update OAuth and API URLs
The URLs used in the plugin must be updated to use the correct endpoint for each action.
The correct endpoints per ORCID are as follows (see Orcid Github for documentation):
https://orcid.org/oauth/authorize
https://orcid.org/oauth/token
https://pub.orcid.org/[version]
https://api.orcid.org/[version]
https://sandbox.orcid.org/oauth/authorize
https://sandbox.orcid.org/oauth/token
https://pub.sandbox.orcid.org/[version]
https://api.sandbox.orcid.org/[version]
Previously, the
/oauth/token
endpoint was accessed viahttps://pub.orcid.org/oauth/token
and is now accessed viahttps://orcid.org/oauth/token
. A redirect is in place from the old URL to the new (as announced in the ORCID API Users Group, but the plugin was not previously following the redirects (see pkp/orcidProfile#281). While this solved the/oauth/token
redirect issue, it introduced a new issue by completely replacing the URL for public API calls fromhttps://pub.orcid.org/[version]
tohttps://orcid.org/[version]
, the latter of which is not a valid URL and redirects to the central sign in page.This issue was tricky to track down as much of the public API functionality is satisfied with the response of the
/oauth/authorize
step of the OAuth authentication process, which includes among other things, the access/refresh token and the authenticated users ORCID.Ensuring all OAuth related actions use the corresponding
https://orcid.org/[endpoint]
orhttps://sandbox.orcid.org/[endpoint]
URL while the calls to the versioned APIs use the correctpub
orapi
prefixes as needed.In summary, all API and authentication URLs should function as listed above.
Regardless of sandbox status:
pub
api
This change will affect
stable-3_3_0
,stable-3_4_0
,main
, and potentiallystable-3_2_1
if that version of the plugin is still maintained.TODOs
stable-3_2_1
stable-3_3_0
stable-3_4_0
main