feat: add multi-author tokens

Author: dbirman

scripts/test_contributions_integration.py

@@ -523,6 +523,114 @@ def check(response, expected_status):
 v6 = check(r, 200)
 print(f"  commit v6: {v6['commit'][:12]}")
 
+# ---------------------------------------------------------------------------
+# Step 19: Create multi_author token capped at 7 days → 200
+# ---------------------------------------------------------------------------
+
+sep("Step 19: GET multi_author token (expect 200, expires_days <= 7)")
+r = requests.get(
+    TOKEN_URL,
+    params={
+        "doi": DOI,
+        "type": "multi_author",
+        "days": "9999",
+        "password": PASSWORD,
+    },
+)
+ma_data = check(r, 200)
+assert ma_data["type"] == "multi_author"
+assert "token" in ma_data
+assert ma_data["expires_days"] <= 7, f"expected expires_days <= 7, got {ma_data['expires_days']}"
+multi_author_token = ma_data["token"]
+print(f"  token: {multi_author_token[:12]}...")
+print(f"  expires_days: {ma_data['expires_days']}")
+
+# ---------------------------------------------------------------------------
+# Step 20: First person uses multi_author token to add Evan Torres
+# ---------------------------------------------------------------------------
+
+V7 = {
+    "project_name": PROJECT,
+    "doi": DOI,
+    "contributors": V5["contributors"] + [
+        {
+            "author": {
+                "name": "Evan Torres",
+                "registry": "Open Researcher and Contributor ID (ORCID)",
+                "registry_identifier": "0000-0005-6789-0123",
+                "affiliation": ["Allen Institute for Neural Dynamics"],
+            },
+            "credit_levels": [{"role": "investigation", "level": "equal"}],
+        }
+    ],
+    "sections": ["Introduction", "Methods", "Results"],
+}
+
+sep("Step 20: POST using multi_author token (first use — add Evan, expect 200)")
+r = requests.post(
+    f"{POST_URL}?project={PROJECT}&message=add+evan+via+multi+token&password={multi_author_token}",
+    data=json.dumps(V7).encode("utf-8"),
+    headers={"Content-Type": "application/json"},
+)
+v7 = check(r, 200)
+print(f"  commit v7: {v7['commit'][:12]}")
+
+# ---------------------------------------------------------------------------
+# Step 21: Second person uses the same token to add Fatima (reusable)
+# ---------------------------------------------------------------------------
+
+V8 = {
+    "project_name": PROJECT,
+    "doi": DOI,
+    "contributors": V7["contributors"] + [
+        {
+            "author": {
+                "name": "Fatima Hassan",
+                "registry": "Open Researcher and Contributor ID (ORCID)",
+                "registry_identifier": "0000-0006-7890-1234",
+                "affiliation": ["Allen Institute for Neural Dynamics"],
+            },
+            "credit_levels": [{"role": "validation", "level": "equal"}],
+        }
+    ],
+    "sections": ["Introduction", "Methods", "Results"],
+}
+
+sep("Step 21: POST using same multi_author token (second use — add Fatima, expect 200)")
+r = requests.post(
+    f"{POST_URL}?project={PROJECT}&message=add+fatima+via+multi+token&password={multi_author_token}",
+    data=json.dumps(V8).encode("utf-8"),
+    headers={"Content-Type": "application/json"},
+)
+v8 = check(r, 200)
+print(f"  commit v8: {v8['commit'][:12]}")
+
+# ---------------------------------------------------------------------------
+# Step 22: GET — verify Evan and Fatima both added
+# ---------------------------------------------------------------------------
+
+sep("Step 22: GET (verify Evan and Fatima present)")
+r = requests.get(GET_URL, params={"project": PROJECT})
+data = check(r, 200)
+names = [c["author"]["name"] for c in data["contributors"]]
+assert "Evan Torres" in names, f"Evan Torres not found in {names}"
+assert "Fatima Hassan" in names, f"Fatima Hassan not found in {names}"
+print(f"  contributors: {names}")
+
+# ---------------------------------------------------------------------------
+# Step 23: multi_author token cannot remove an existing author → 403
+# ---------------------------------------------------------------------------
+
+V8_remove = {**V8, "contributors": [c for c in V8["contributors"] if c["author"]["name"] != "Alice Nguyen"]}
+
+sep("Step 23: POST with multi_author token removing an author (expect 403)")
+r = requests.post(
+    f"{POST_URL}?project={PROJECT}&message=remove+alice+via+multi+token&password={multi_author_token}",
+    data=json.dumps(V8_remove).encode("utf-8"),
+    headers={"Content-Type": "application/json"},
+)
+check(r, 403)
+
 print("\n" + "=" * 60)
 print("  ALL STEPS PASSED")
 print("=" * 60)

src/aind_metadata_viz/contributions/handlers.py

@@ -36,6 +36,7 @@
     lookup_token,
     set_project_password,
     verify_project_password,
+    _MAX_MULTI_AUTHOR_DAYS,
 )
 
 
@@ -47,6 +48,8 @@ def _validate_token_scope(project_name, token_type, author_name, new_contributio
 
     * ``"add_author"`` — all existing authors must remain unchanged; exactly
       one new author may be added.
+    * ``"multi_author"`` — same add-one-author rule as ``add_author``, but the
+      token is reusable so multiple people may each add themselves.
     * ``"edit_author"`` — only the author identified by *author_name* may
       be modified; no authors may be added or removed.
     """
@@ -58,23 +61,23 @@ def _validate_token_scope(project_name, token_type, author_name, new_contributio
     existing_names = {c.author.name for c in existing.contributors} if existing else set()
     new_names = {c.author.name for c in new_contributions.contributors}
 
-    if token_type == "add_author":
+    if token_type in ("add_author", "multi_author"):
         removed = existing_names - new_names
         if removed:
             return False, (
-                "add_author token cannot remove existing authors: "
+                f"{token_type} token cannot remove existing authors: "
                 + ", ".join(sorted(removed))
             )
         added = new_names - existing_names
         if len(added) != 1:
-            return False, "add_author token allows adding exactly one new author"
+            return False, f"{token_type} token allows adding exactly one new author"
         if existing:
             existing_by_name = {c.author.name: c for c in existing.contributors}
             for c in new_contributions.contributors:
                 if c.author.name in existing_by_name:
                     if c.model_dump_json() != existing_by_name[c.author.name].model_dump_json():
                         return False, (
-                            f"add_author token cannot modify existing author '{c.author.name}'"
+                            f"{token_type} token cannot modify existing author '{c.author.name}'"
                         )
         return True, None
 
@@ -319,9 +322,9 @@ def get(self):
             return
 
         token_type = self.get_argument("type", None)
-        if token_type not in ("add_author", "edit_author"):
+        if token_type not in ("add_author", "edit_author", "multi_author"):
             self.set_status(400)
-            self.write(json.dumps({"error": "type must be 'add_author' or 'edit_author'"}))
+            self.write(json.dumps({"error": "type must be 'add_author', 'edit_author', or 'multi_author'"}))
             return
 
         author = self.get_argument("author", None)
@@ -362,7 +365,7 @@ def get(self):
             self.write(json.dumps({"error": str(e)}))
             return
 
-        capped_days = min(days, 365)
+        capped_days = min(days, _MAX_MULTI_AUTHOR_DAYS if token_type == "multi_author" else 365)
         self.set_status(200)
         self.write(json.dumps({"token": token_id, "type": token_type, "expires_days": capped_days}))
 

src/aind_metadata_viz/contributions/store.py

@@ -248,6 +248,7 @@ def get_contributions_by_doi(
 
 
 _MAX_TOKEN_DAYS = 365
+_MAX_MULTI_AUTHOR_DAYS = 7
 
 
 def _token_key(project_name: str) -> str:
@@ -268,26 +269,30 @@ def create_token(
     project_name:
         Name of the target project.
     token_type:
-        ``"add_author"`` (one-time use) or ``"edit_author"`` (scoped to
-        *author_name*, reusable until expiry).
+        ``"add_author"`` (one-time use), ``"edit_author"`` (scoped to
+        *author_name*, reusable until expiry), or ``"multi_author"``
+        (reusable, lets multiple people each add themselves, capped at 7 days).
     author_name:
         Required for ``"edit_author"`` tokens.
     expires_days:
-        Days until expiry from now; capped at ``_MAX_TOKEN_DAYS`` (365).
+        Days until expiry from now; capped at ``_MAX_TOKEN_DAYS`` (365) for
+        ``add_author``/``edit_author``, or ``_MAX_MULTI_AUTHOR_DAYS`` (7) for
+        ``multi_author``.
 
     Returns
     -------
     str
         The UUID token the recipient presents in place of a password.
     """
-    if token_type not in ("add_author", "edit_author"):
+    if token_type not in ("add_author", "edit_author", "multi_author"):
         raise ValueError(
-            f"token_type must be 'add_author' or 'edit_author', got {token_type!r}"
+            f"token_type must be 'add_author', 'edit_author', or 'multi_author', got {token_type!r}"
         )
     if token_type == "edit_author" and not author_name:
         raise ValueError("author_name is required for edit_author tokens")
 
-    days = min(max(1, expires_days), _MAX_TOKEN_DAYS)
+    max_days = _MAX_MULTI_AUTHOR_DAYS if token_type == "multi_author" else _MAX_TOKEN_DAYS
+    days = min(max(1, expires_days), max_days)
     expires_at = (datetime.now(timezone.utc) + timedelta(days=days)).isoformat()
 
     token_id = uuid.uuid4().hex

tests/test_contributions.py

@@ -932,6 +932,30 @@ def test_edit_author_without_name_raises(self):
         with self.assertRaises(ValueError):
             create_token("tok-project", "edit_author")
 
+    def test_create_multi_author_token(self):
+        token = create_token("tok-project", "multi_author")
+        record = lookup_token("tok-project", token)
+        self.assertIsNotNone(record)
+        self.assertEqual(record["token_type"], "multi_author")
+        self.assertIsNone(record["author_name"])
+
+    def test_multi_author_expires_capped_at_7_days(self):
+        from datetime import datetime, timezone
+        token = create_token("tok-project", "multi_author", expires_days=9999)
+        record = lookup_token("tok-project", token)
+        expires = datetime.fromisoformat(record["expires_at"])
+        delta = expires - datetime.now(timezone.utc)
+        self.assertLessEqual(delta.days, 7)
+
+    def test_multi_author_expires_custom_within_7_days(self):
+        from datetime import datetime, timezone
+        token = create_token("tok-project", "multi_author", expires_days=3)
+        record = lookup_token("tok-project", token)
+        expires = datetime.fromisoformat(record["expires_at"])
+        delta = expires - datetime.now(timezone.utc)
+        self.assertLessEqual(delta.days, 3)
+        self.assertGreater(delta.days, 1)
+
     def test_lookup_unknown_token_returns_none(self):
         self.assertIsNone(lookup_token("tok-project", "notavalidtoken"))
 
@@ -1155,6 +1179,34 @@ def test_invalid_type_returns_400(self):
         resp = self.fetch("/contributions/token?doi=10.1/x&type=bad_type")
         self.assertEqual(resp.code, 400)
 
+    def test_multi_author_token_created(self):
+        pc = _make_project("tok-project")
+        with self._patch_contributions_by_doi(pc), self._patch_verify(True), \
+                self._patch_create_token("ccddee11" * 4):
+            resp = self.fetch("/contributions/token?doi=10.1/x&type=multi_author")
+            self.assertEqual(resp.code, 200)
+            body = json.loads(resp.body)
+            self.assertEqual(body["type"], "multi_author")
+            self.assertEqual(body["token"], "ccddee11" * 4)
+
+    def test_multi_author_expires_days_capped_at_7(self):
+        pc = _make_project("tok-project")
+        with self._patch_contributions_by_doi(pc), self._patch_verify(True), \
+                self._patch_create_token():
+            resp = self.fetch("/contributions/token?doi=10.1/x&type=multi_author&days=9999")
+            self.assertEqual(resp.code, 200)
+            body = json.loads(resp.body)
+            self.assertEqual(body["expires_days"], 7)
+
+    def test_multi_author_custom_days_within_cap(self):
+        pc = _make_project("tok-project")
+        with self._patch_contributions_by_doi(pc), self._patch_verify(True), \
+                self._patch_create_token():
+            resp = self.fetch("/contributions/token?doi=10.1/x&type=multi_author&days=3")
+            self.assertEqual(resp.code, 200)
+            body = json.loads(resp.body)
+            self.assertEqual(body["expires_days"], 3)
+
     def test_edit_author_without_author_param_returns_400(self):
         resp = self.fetch("/contributions/token?doi=10.1/x&type=edit_author")
         self.assertEqual(resp.code, 400)
@@ -1339,6 +1391,22 @@ def test_valid_edit_author_token_not_consumed(self):
             self.assertEqual(resp.code, 200)
             mock_consume.assert_not_called()
 
+    def test_valid_multi_author_token_not_consumed(self):
+        record = {"token_id": "tok4", "token_type": "multi_author", "author_name": None}
+        body = to_json(self._make_project_with_two_authors())
+        mock_consume = MagicMock()
+        with self._patch_store(), self._patch_lookup_token(record), \
+                self._patch_validate_scope((True, None)), \
+                patch("aind_metadata_viz.contributions.handlers.consume_token", mock_consume):
+            resp = self.fetch(
+                "/contributions/post?project=tok-post-project&password=tok4",
+                method="POST",
+                body=body,
+                headers={"Content-Type": "application/json"},
+            )
+            self.assertEqual(resp.code, 200)
+            mock_consume.assert_not_called()
+
     def test_out_of_scope_token_returns_403(self):
         record = {"token_id": "tok1", "token_type": "add_author", "author_name": None}
         body = to_json(self._make_project_with_two_authors())