feat: ORCID deposition for codecheckers + CODECHECK form in reviewer tab (#16) by subhanLabs · Pull Request #126 · codecheckers/ojs-codecheck

subhanLabs · 2026-06-01T04:04:22Z

Summary

This PR implements two major features for the CODECHECK plugin:

ORCID Deposition — allows codecheckers to authorise the journal to deposit their CODECHECK peer-review activity to their ORCID profile via the ORCID Member API.
CODECHECK form in reviewer tab — injects a collapsible CODECHECK documentation section into the reviewer's Download & Review tab (tab 3).

Changes

New Classes

classes/Orcid/OrcidApiClient.php — low-level ORCID API HTTP client
classes/Orcid/OrcidAuthHandler.php — handles OAuth 2.0 authorisation flow (startAuth/callback)
classes/Orcid/OrcidDepositService.php — builds and deposits peer-review records to ORCID
classes/Orcid/OrcidTokenDAO.php — manages token storage in codecheck_orcid_tokens table
classes/Orcid/PeerReviewPayloadBuilder.php — constructs ORCID peer-review XML payload
classes/Log/CodecheckLogger.php — structured logger with debug/info/error levels

Modified Files

CodecheckPlugin.php — ORCID hooks, reviewer data injection, publish handler
api/v1/CodecheckApiHandler.php — added orcid-status and orcid-deposit endpoints, reviewer role
api/v1/JsonResponse.php — made constructor args optional, added response() convenience method
classes/Constants.php — added all ORCID and GitHub constants
classes/migration/CodecheckSchemaMigration.php — added codecheck_orcid_tokens table
locale/en/locale.po — added ORCID and missing locale keys
registry/uiLocaleKeysBackend.json — added ORCID locale keys
resources/js/main.js — ORCID section in workflow, reviewer form injection via MutationObserver
resources/js/Components/CodecheckOrcidSection.vue — Vue component for ORCID authorisation and deposit UI

How it works

ORCID OAuth flow

Editor opens the CODECHECK tab in the editorial workflow
Each codechecker sees an "Authorise ORCID" button
Clicking redirects to ORCID sandbox/production for consent
On callback, token is stored in codecheck_orcid_tokens
On publication (or manually), deposit is triggered automatically

Reviewer form

When reviewer opens tab 3 (Download & Review), a MutationObserver detects the tab content loading
A collapsible "CODECHECK Documentation" section is injected below the review form
It mounts CodecheckMetadataForm and optionally CodecheckOrcidSection if ORCID is enabled

Notes

ORCID settings (client ID, secret, API type) will appear in the settings page once the settings form PR is merged
Sandbox API is used by default during development
All raw error_log() calls replaced with CodecheckLogger (debug/info/error levels)

Closes #16

…tab (#16) - Full OAuth 2.0 flow for codechecker ORCID authorisation - ORCID Member API peer-review deposition on publish and manually - CODECHECK metadata form injected into reviewer tab 3 (Download & Review) - ORCID section shown in editor workflow CODECHECK tab - codecheck_orcid_tokens DB table for token/deposit tracking - Reviewer role added to API handler - All settings read from plugin configuration

nuest · 2026-06-01T08:48:45Z

Thanks!

Can you please clarify re. "Editor opens the CODECHECK tab in the editorial workflow" > the codechecker needs to be the one that opens the tab and initiates the authentication with ORCID, right?

It would be great, because this is a crucial feature, if you could add a couple of screenshots or maybe even a screencast to document the completed functionality.

nuest

General comments first, detailed line-by-line review later.

nuest · 2026-06-01T08:50:51Z

Does this mean we store the token forever and can edit the profile with that token?

Is there a way for a codechecker to stop allowing us to add data to their profile?

Token storage:
Yes we store the token, but the scope is limited to /activities/update, we can only add/update peer-review records, nothing else on their profile.

Revoking access:
The codechecker must authorise themselves, we match their ORCID ID against the authenticated token, so no one else can authorise on their behalf. To stop allowing deposits, they can revoke access directly from their ORCID account under "Trusted organizations" which immediately invalidates our stored token.

nuest · 2026-06-01T08:54:34Z

+            'review-group-id'        => $groupId,
+            'review-identifiers'     => $this->buildReviewIdentifiers($certificateDoi),
+            'convening-organization' => $this->buildConveningOrganization($journal),
+            'subject-type'           => 'journal-article',


What subject types does the ORCID API know? Could there be the need here to switch to something else, like a preprint?

The ORCID peer-review API supports these subject types: book, book-chapter, book-review, dataset, edited-book, encyclopedia-entry, journal-article, journal-issue, magazine-article, manual, newsletter-article, newspaper-article, online-resource, other, preprint, report, research-tool, supervised-student-publication, test, translation, website, working-paper.

You raise a valid point, if the submission is a preprint rather than a published journal article, preprint would be more accurate.

We could either hardcode journal-article since CODECHECK is journal-focused, or make the subject type configurable or derived from the submission type. What would you recommend, should we keep it fixed or add flexibility here?

nuest · 2026-06-01T08:54:58Z

+
+        $payload = [
+            'reviewer-role'          => 'reviewer',
+            'review-type'            => 'review',


What review types does the ORCID API know?

The ORCID peer-review API does not have a codechecker role. The available roles are chair, editor, member, organizer, reviewer, reviewer-external, and senior-editor. We used reviewer as the closest match, Happy to change this if you have a preference.

nuest · 2026-06-01T09:03:01Z

Should this file be actually added here?

Good catch, that file was accidentally included. I have removed it.

nuest · 2026-06-01T09:04:43Z

+    /**
+     * Triggered when an editor publishes an article.
+     */
+    public function onPublicationPublish(string $hookName, array $args): bool


This ssems to require that the ORCID credentials must be provided by codecheckers before the publication.

_Is it also possible that a CODECHECK goes to the OJS backend after the article is published and then triggers the deposition?

Yes, absolutely. The automatic deposition on publication is just a convenience, if the codechecker has not authorised before publication, or if the deposit fails, editors can still trigger it manually at any time using the "Deposit to ORCID" button in the CODECHECK workflow tab. The button remains available after publication so codecheckers can authorise and deposit retroactively.

nuest · 2026-06-01T09:05:40Z

+            $depositService = new OrcidDepositService($this);
+            $results = $depositService->depositForSubmission($submission->getId());
+            foreach ($results as $result) {
+                if ($result['status'] === 'success') {


Please make a proposal how to include user facing messaging about the results and failures here.

If that means we need a database table to capture the deposition state, then that is fine.

I already store the deposition state in the codecheck_orcid_tokens table, each row has a deposit_status column (pending, success, failed), a put_code for successful deposits, and an error_message for failures.

The results are surfaced to editors in the CODECHECK workflow tab via the ORCID Deposition section, which shows each codechecker's current status badge (NOT AUTHORISED / PENDING / DEPOSITED / FAILED) and displays the error message inline when a deposit fails. This is loaded via the orcid-status API endpoint on every page load so the state is always current.

- Fix ORCID iD mismatch check to validate against all codecheckers - Remove city as required field, only name and country needed - Bundle ORCID icon locally instead of loading from orcid.org - Restrict auth button to reviewer form, editors see status only - Add Test ORCID Setup button in plugin settings - Add ORCID settings section to settings form and template

nuest · 2026-06-08T11:40:46Z

@subhanLabs For the sake of documentation, can you please update local docs or the README file which field mentioned in https://support.orcid.org/hc/en-us/articles/360006971333-Peer-Reviews your code sets, and what values are put in there? Thanks!

nuest · 2026-06-08T11:42:32Z

@subhanLabs For the sake of documentation, please post a screenshot of the ORCID Deposition section here.

nuest requested changes Jun 1, 2026

View reviewed changes

subhanLabs added 2 commits June 8, 2026 06:00

Merge remote-tracking branch 'origin/main' into feature/orcid-deposit

b3dc3ee

subhanLabs requested a review from nuest June 8, 2026 04:15

Conversation

subhanLabs commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

New Classes

Modified Files

How it works

ORCID OAuth flow

Reviewer form

Notes

Uh oh!

nuest commented Jun 1, 2026

Uh oh!

nuest left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

nuest commented Jun 8, 2026

Uh oh!

nuest commented Jun 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

subhanLabs commented Jun 1, 2026 •

edited

Loading