JMCP: Papers - jmcp/orcid-linking-for-research-identity-nRq9P4wE

[landigf]

Review: ORCID Linking for Research Identity

Change summary

Four files touched (+162 / −3), adding link/unlink ORCID to the demo repository flow:

Layer	File	What
Contracts	packages/contracts/src/index.ts	ORCID_REGEX, linkOrcidInputSchema (Zod), LinkOrcidInput type
DB / Repo	packages/db/src/index.ts	linkOrcid / unlinkOrcid on PapersRepository interface + DemoRepository implementation; validates input, checks uniqueness, mutates demo state
Actions	apps/web/app/actions.ts	linkOrcidAction / unlinkOrcidAction server actions; revalidate relevant paths, redirect
UI	apps/web/app/settings/identity/page.tsx	Conditional rendering for linked/unlinked/demo/oauth/unconfigured states; input with HTML pattern validation

Validation confidence: Medium-High

• Contract-level Zod schema + HTML pattern attribute give double validation on format.
• Uniqueness check prevents the same ORCID being claimed by two demo users.
• Demo-only code path is well-scoped and doesn't touch auth plumbing.

Risks still remaining

1. No server-side validation in linkOrcidAction — the action calls repository.linkOrcid which runs linkOrcidInputSchema.parse, so Zod will throw on bad input. But the error is unhandled — a malformed ORCID will produce an unformatted server error instead of a user-friendly message. Consider wrapping with try/catch or using .safeParse + returning an error state.

2. unlinkOrcidAction has no CSRF / confirmation — a single <form> submit unlinks with no confirmation dialog. Low severity for demo mode, but worth a UX note before this goes live.

3. isVerifiedResearcher set to true on demo self-link — in demo mode anyone can type any ORCID and become "verified." This is fine for the demo, but the flag name implies real verification. Add a comment or rename to avoid confusion when the OAuth path lands.

4. ORCID checksum not validated — the regex validates the format (NNNN-NNNN-NNNN-NNNX) but not the ISO 7064 Mod 11-2 check digit. A typo like 0000-0001-2345-6780 would pass. Low priority but worth noting.

5. Revalidation blast radius — both actions revalidate /, /feed, profile, and two settings paths. This is broad; if caching becomes important, trim to only paths that actually render the ORCID.

6. No integration with the OAuth path yet — the UI shows the "Sign in with ORCID" link when session.orcid.configured is true, but there's no corresponding server route or callback handler. The link will 404. Either gate it behind a "coming soon" label or stub the route.

Verdict

Clean, well-layered change for demo-mode ORCID linking. The main gap is error handling in the server action (#1) — that's worth fixing before merge. The rest are follow-up items.

[landigf]

Closing: will integrate valuable features directly on main to avoid cascade merge conflicts.