Fix/eng 11829 2 by Vlad0n20 · Pull Request #11885 · CenterForOpenScience/osf.io

Vlad0n20 · 2026-08-27T18:26:57Z

Ticket

ENG-11829

Purpose

Changes

Side Effects

QE Notes

CE Notes

Documentation

cslzchen

1st pass done

cslzchen · 2026-08-27T19:09:46Z

+    sentry.log_message(
+        f'CAS response ORCID attributes: user=[{user._id}], orcidId=[{orcid_id}], '
+        f'orcidAccessToken=[{"present" if access_token else "missing"}]',
+        level=logging.INFO,
+    )


Only log message to sentry if access token or refresh token are missing, level is warning

cslzchen · 2026-08-27T19:10:46Z

    #   },
    #   ...
    # }
+    external_identity_access_token = DateTimeAwareJSONField(default=dict, blank=True)


external_identity_tokens

cslzchen · 2026-08-27T19:12:26Z

+            access_token = cas_resp.attributes.get('orcidAccessToken', None)
+            refresh_token = cas_resp.attributes.get('orcidRefreshToken', None)


Move into if external_credential:

cslzchen · 2026-08-27T19:12:32Z

+                    external_credential['id'],
+                    access_token,
+                    refresh_token,
+                )


No need for this

cslzchen · 2026-08-27T19:17:31Z

+            f'found {len(orcid_tokens)} ORCID token(s) to revoke',
+            level=logging.INFO,
+        )
+        for orcid_id, orcid_token in orcid_tokens.items():


We need to check if there is an external_identity but there is no matching external_identity_tokens, we need to fail the GDPR delete with relevant error messsage.

cslzchen · 2026-08-27T19:31:36Z

+                        'client_secret': website_settings.ORCID_OAUTH_CLIENT_SECRET,
+                        'token': orcid_token,
+                    },
+                    timeout=5,


Future, we probably want a retry just in case

cslzchen · 2026-08-27T19:32:39Z

+                )
+                sentry.log_message(
+                    f'[GDPR delete] user={self._id}: ORCID id={orcid_id} revoked, '
+                    f'status_code={response.status_code}, response_text={response.text}, response={response}',


we probably don't need the full response

cslzchen · 2026-08-27T19:34:53Z

+                    f'status_code={response.status_code}, response_text={response.text}, response={response}',
+                    level=logging.INFO,
+                )
+                response.raise_for_status()


Add unit tests for success, invalid client_id/secret, invalid token, empty token

cslzchen · 2026-08-27T19:35:48Z

+                response.raise_for_status()
+            except requests.exceptions.RequestException as e:
+                sentry.log_message(
+                    f'[GDPR delete] Failed to revoke ORCID token for user {self._id}: {e}',


Add the orcid id just in case user has mulitple

cslzchen · 2026-08-27T19:36:40Z

+                    'Unable to revoke this user\'s ORCID access right now because ORCID\'s '
+                    'service could not be reached. Please try the GDPR delete again later.'


rephrase to a more general message like fail to revoke

cslzchen

2nd pass done ⭐

cslzchen · 2026-08-28T13:01:24Z

+        provider = settings.EXTERNAL_IDENTITY_PROFILE['OrcidProfile']
+        user.external_identity_access_token.setdefault(provider, {})[orcid_id] = {
+            'access_token': access_token,
+            'refresh_token': refresh_token,


Remove refresh_token due to CAS limit

cslzchen · 2026-08-28T13:03:14Z

+        else:
+            raise UserStateError(
+                'User do not have connected ORCID'
+            )


Move this to if statement first,

if failure raise/return the rest for success

cslzchen · 2026-08-28T13:03:35Z

            self.external_accounts.clear()
+
        self.external_identity = {}
+        self.external_identity_access_token = {}


cslzchen · 2026-08-28T13:04:25Z

 SPAM_SUBMIT_TASK_HARD_TIME_LIMIT = 90

 CAS_SERVER_URL = 'http://localhost:8080'
+CAS_ORCID_REVOKE_SHARED_SECRET = os.environ.get('CAS_ORCID_REVOKE_SHARED_SECRET', 'changeme')


Remove this one

cslzchen

3rd pass done 🌟

This is the main PR now, please update ticket title.

cslzchen · 2026-08-31T20:58:29Z

+    #       <external_id>: {
+    #           "access_token" : <token>,
+    #       }


I was able to WAR-Overlay the apereo & pac4j library (see here) to include refresh token. Please add the refresh token back.

cslzchen · 2026-08-31T21:00:07Z

+        # A user has at most one ORCID identity, so there is at most one token entry to revoke.
+        orcid_id, token_entry = next(iter(self.external_identity_tokens.get('ORCID', {}).items()), (None, None))


Please write a small python code snippet for CE to run to check if we have any users with more than one ORCiD ID (via cloud request).

cslzchen · 2026-08-31T21:01:40Z

        '''
+        # A user has at most one ORCID identity, so there is at most one token entry to revoke.
+        orcid_id, token_entry = next(iter(self.external_identity_tokens.get('ORCID', {}).items()), (None, None))
+        orcid_token = token_entry.get('access_token') if token_entry else None


Similarly, add refresh_token back and make it optional (just in case some user's privacy settings in ORCiD doesn't release refresh token to us.

cslzchen · 2026-08-31T21:02:12Z

+            raise UserStateError(
+                'User do not have connected ORCID'
+            )
+        else:


No need for else since error would have been raised

cslzchen · 2026-08-31T21:03:34Z

+import osf.utils.fields
+
+
+class Migration(migrations.Migration):


Rename to 0053_gdpr_delete_and_orcid_revoke

cslzchen · 2026-08-31T21:05:49Z

+    sentry.log_message(
+        f'CAS response ORCID attributes: user=[{user._id}], orcidId=[{orcid_id}], '
+        f'orcidAccessToken=[{"present" if access_token else "missing"}]',
+        level=logging.WARNING,
+    )


Future (new ticket), change this to debug log and only log empty access token error after we dev tested on staging1.

cslzchen · 2026-08-31T21:05:57Z

+        sentry.log_message(
+            f'ORCID token stored on external_identity_tokens: user=[{user._id}], '
+            f'provider_id=[{orcid_id}], access_token=[{"present" if access_token else "missing"}]',
+            level=logging.INFO,
+        )


cslzchen · 2026-08-31T21:06:17Z

            # this extra step will guarantee that 2FA are enforced
            # current CAS session created by external login must be cleared first before authentication
            if external_credential:
+                access_token = cas_resp.attributes.get('orcidAccessToken', None)


Similarly, let's get refresh token as optional.

cslzchen · 2026-08-31T21:06:30Z

            user = {
                'external_id_provider': external_credential['provider'],
                'external_id': external_credential['id'],
+                'external_id_access_token': cas_resp.attributes.get('orcidAccessToken', None),


cslzchen · 2026-08-31T21:07:00Z

 SPAM_SUBMIT_TASK_HARD_TIME_LIMIT = 90

 CAS_SERVER_URL = 'http://localhost:8080'
+CAS_ORCID_REVOKE_SHARED_SECRET = os.environ.get('CAS_ORCID_REVOKE_SHARED_SECRET', 'changeme')


Why do we still need this one?

Vlad0n20 added 2 commits August 27, 2026 14:58

Add revoke endpoint request for ORCID

68da146

Added external_identity_access_token field and func to save it

4c48222

Vlad0n20 force-pushed the fix/ENG-11829-2 branch from 292149b to 4c48222 Compare August 27, 2026 18:33

cslzchen requested changes Aug 27, 2026

View reviewed changes

Update column name, fix comments

eebddd6

Vlad0n20 force-pushed the fix/ENG-11829-2 branch from f757b97 to eebddd6 Compare August 27, 2026 20:20

cslzchen requested changes Aug 28, 2026

View reviewed changes

cslzchen changed the base branch from feature/pbs-26-15 to feature/gdpr-delete-orcid-rewrite August 28, 2026 13:09

Vlad0n20 added 2 commits August 28, 2026 15:46

Remove orcid refresh token

b364f1f

fix tests

f5aa332

cslzchen requested changes Aug 31, 2026

View reviewed changes

		access_token = cas_resp.attributes.get('orcidAccessToken', None)
		refresh_token = cas_resp.attributes.get('orcidRefreshToken', None)

		'Unable to revoke this user\'s ORCID access right now because ORCID\'s '
		'service could not be reached. Please try the GDPR delete again later.'

		# A user has at most one ORCID identity, so there is at most one token entry to revoke.
		orcid_id, token_entry = next(iter(self.external_identity_tokens.get('ORCID', {}).items()), (None, None))

		import osf.utils.fields


		class Migration(migrations.Migration):

Uh oh!

Conversation

Vlad0n20 commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Ticket

Purpose

Changes

Side Effects

QE Notes

CE Notes

Documentation

Uh oh!

cslzchen left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cslzchen left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cslzchen left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Vlad0n20 commented Aug 27, 2026 •

edited

Loading

cslzchen left a comment •

edited

Loading