Donate to Postulo/postulo

• https://buymeacoffee.com/tiagoagueda

---

See the documentation for more details on donation links.

Suggest a publication from its DOI or the person's ORCID record (#688) #1062

Merged

tiagoagueda merged 1 commit from 688-publication-lookup into main 2026-10-28 01:58:56 +00:00

Conversation 0 Commits 1 Files changed 193 +17420 -3

tiagoagueda commented 2026-10-27 16:08:25 +00:00

Owner

• Copy link
• Copy Markdown

Typing a paper's authors, venue, volume and pages by hand is the part of adding a
publication nobody wants to do. Two buttons now ask a public registry, and only when
pressed:

• Look up, beside a publication's DOI, asks doi.org for that one record by content
  negotiation (CSL JSON); doi.org passes it to Crossref, DataCite or mEDRA. The button
  posts the whole form (formaction, so it works with scripts off) and the form is drawn
  back unsaved with only the empty boxes filled, saying which and from which service.
  A new entry still on its opening type takes the record's type; a saved one never does.
• Suggest from my ORCID record, on the Publications section, is shown only to a person
  who stored an ORCID, and always asks about that one: one request to ORCID's Anonymous
  API for the works summary, a review page that marks what is held (same DOI, else title
  and year), ticks none, lists at most 100 and adds at most 20, from the summary alone.

resume/lookups.py makes both requests through the public-only client inside until(),
read with read_body: fixed hosts, the identifier percent-encoded into the path alone,
three https redirects at most, each approved by the guard, 2 MiB or 4 MiB and ten
seconds, no retry, no email address sent. What is kept is a short list read as untrusted
text: markup, control and bidirectional characters stripped, cut to each column, up to
100 authors then "and others"; the abstract, references, funders and the record's URL
are never read into anything. Crossref's, CSL's and ORCID's type names all map, and an
unknown one is Other.

Each press spends POSTULO_LOOKUP_RATE (20/h by default), before the request, so a
failure costs one too. A feature plugin, publication-lookups, on by default, hides both
buttons and makes both addresses answer 404 when switched off. The threat model says
what leaves the instance and when.

Closes #688

Notes for review

• Decisions the issue left open:
  • A new entry still on the default type takes the record's type; a saved entry's type is never changed.
  • Hosts after the doi.org redirect are not allow-listed. They must be https and approved by the guard, so mEDRA and other agencies still work.
  • An ORCID DOI is used only when its relationship is self.
  • Ticking more than 20 works adds nothing; the page says so.
  • CSL thesis maps to phdthesis.
  • A hidden Save button comes first in the form, so Enter saves rather than looking up.
• The plugin publication_lookups ships its own catalogues, per the plugin locale rule. Its Weblate component still has to be added.

🤖 Generated with Claude Code

Typing a paper's authors, venue, volume and pages by hand is the part of adding a publication nobody wants to do. Two buttons now ask a public registry, and only when pressed: - Look up, beside a publication's DOI, asks doi.org for that one record by content negotiation (CSL JSON); doi.org passes it to Crossref, DataCite or mEDRA. The button posts the whole form (formaction, so it works with scripts off) and the form is drawn back unsaved with only the empty boxes filled, saying which and from which service. A new entry still on its opening type takes the record's type; a saved one never does. - Suggest from my ORCID record, on the Publications section, is shown only to a person who stored an ORCID, and always asks about that one: one request to ORCID's Anonymous API for the works summary, a review page that marks what is held (same DOI, else title and year), ticks none, lists at most 100 and adds at most 20, from the summary alone. resume/lookups.py makes both requests through the public-only client inside until(), read with read_body: fixed hosts, the identifier percent-encoded into the path alone, three https redirects at most, each approved by the guard, 2 MiB or 4 MiB and ten seconds, no retry, no email address sent. What is kept is a short list read as untrusted text: markup, control and bidirectional characters stripped, cut to each column, up to 100 authors then "and others"; the abstract, references, funders and the record's URL are never read into anything. Crossref's, CSL's and ORCID's type names all map, and an unknown one is Other. Each press spends POSTULO_LOOKUP_RATE (20/h by default), before the request, so a failure costs one too. A feature plugin, publication-lookups, on by default, hides both buttons and makes both addresses answer 404 when switched off. The threat model says what leaves the instance and when. Closes #688 ## Notes for review - **Decisions the issue left open:** - A new entry still on the default type takes the record's type; a saved entry's type is never changed. - Hosts after the doi.org redirect are not allow-listed. They must be https and approved by the guard, so mEDRA and other agencies still work. - An ORCID DOI is used only when its relationship is `self`. - Ticking more than 20 works adds nothing; the page says so. - CSL `thesis` maps to `phdthesis`. - A hidden Save button comes first in the form, so Enter saves rather than looking up. - **The plugin `publication_lookups`** ships its own catalogues, per the plugin locale rule. Its Weblate component still has to be added. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

tiagoagueda added 1 commit 2026-10-27 16:08:25 +00:00

Suggest a publication from its DOI or the person's ORCID record (#688) ... 0de307b8db

Typing a paper's authors, venue, volume and pages by hand is the part of adding a
publication nobody wants to do. Two buttons now ask a public registry, and only when
pressed:

- Look up, beside a publication's DOI, asks doi.org for that one record by content
  negotiation (CSL JSON); doi.org passes it to Crossref, DataCite or mEDRA. The button
  posts the whole form (formaction, so it works with scripts off) and the form is drawn
  back unsaved with only the empty boxes filled, saying which and from which service.
  A new entry still on its opening type takes the record's type; a saved one never does.
- Suggest from my ORCID record, on the Publications section, is shown only to a person
  who stored an ORCID, and always asks about that one: one request to ORCID's Anonymous
  API for the works summary, a review page that marks what is held (same DOI, else title
  and year), ticks none, lists at most 100 and adds at most 20, from the summary alone.

resume/lookups.py makes both requests through the public-only client inside until(),
read with read_body: fixed hosts, the identifier percent-encoded into the path alone,
three https redirects at most, each approved by the guard, 2 MiB or 4 MiB and ten
seconds, no retry, no email address sent. What is kept is a short list read as untrusted
text: markup, control and bidirectional characters stripped, cut to each column, up to
100 authors then "and others"; the abstract, references, funders and the record's URL
are never read into anything. Crossref's, CSL's and ORCID's type names all map, and an
unknown one is Other.

Each press spends POSTULO_LOOKUP_RATE (20/h by default), before the request, so a
failure costs one too. A feature plugin, publication-lookups, on by default, hides both
buttons and makes both addresses answer 404 when switched off. The threat model says
what leaves the instance and when.

Closes #688

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tiagoagueda force-pushed 688-publication-lookup from 0de307b8db to 24b4afb5b4 2026-10-27 20:48:35 +00:00 Compare

tiagoagueda force-pushed 688-publication-lookup from 24b4afb5b4 to 39813c73db 2026-10-28 01:55:29 +00:00 Compare

tiagoagueda merged commit c9f0d7819e into main 2026-10-28 01:58:56 +00:00

tiagoagueda referenced this pull request from a commit 2026-10-28 01:58:56 +00:00

Suggest a publication from its DOI or the person's ORCID record (#688) (#1062)

tiagoagueda deleted branch 688-publication-lookup 2026-10-28 01:59:00 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

accessibility

Usable by everyone, including people with disabilities: one of the project's stated missions

  

authentication

Signing in, and proving who you are

  

breaking change

Changes behaviour or data in a way operators must act on

  

bug

Something does not do what it says it does

  

documentation

The wiki, the docs, or the words in the interface

  

enhancement

An improvement or a new capability

  

interface

The shape of the pages: what is where, and how it reads

  

internationalisation

Languages, regions, and the formats and symbols that go with them

  

observability

What an operator can see about a running instance: metrics, logs, health

  

performance

Uses fewer resources, or is more reliable, with no loss of features or accessibility

  

security

Keeping the code and the data secure: one of the project's stated missions

  

tier

1

Easy: small, self-contained, no prerequisites

  

tier

2

High-severity security: account access, personal data, the boundaries

  

tier

3

Foundations: prerequisite work that unblocks other issues

  

tier/4

Later: large features and long-horizon work

No labels

accessibility

authentication

breaking change

bug

documentation

enhancement

interface

internationalisation

observability

performance

security

tier

1

tier

2

tier

3

tier/4

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Postulo/postulo!1062

No description provided.