add pin-based security for doc requests

[phluid61]

When configured (see cfg.d/request_copy.pl), this security model allows authors to respond to copy requests without having a valid login.

The pin-based model allows the contact author to respond whether they have an EPrints account associated with the specified email address or not. The normal repository authentication mechanism is not used, instead the presence of a random pin in the querystring identifies the contact author and grants access.

[jesusbagpuss]

Also related to: #192
May need an Admin/Manager screen to allow response to request?

[cziaarm]

This is almost "looks good to me".

• Checked functionality
• Added something to documentation (http://wiki.eprints.org/w/RequestEprint)
• No new phrases used (v. clever)
• runs OK on multiple repos

BUT

• Install not smooth: Bundled Session::Token ends up missing from @inc despite appearing to be OK on the face of it. Tested the above with pre-installed Session::Token.

[phluid61]

Yeah, if Session::Token is an issue it should be removed, and instead be listed as an EPrints dependency. I wasn't able to fully test that, since I already have it installed too.

(Feel free to send a PR to our branch if you know of a simple fix)

[MrkGrgsn]

I haven't checked it out but EPrints must be generating tokens for sessions somehow; perhaps the Session::Token dependency could be replaced with whatever that is?

[cziaarm]

John (jesusbagpuss) and I were just asking that same question. The "code" param for the token used by the current Request::Repond does this to generate a random string:

my @A = ();
srand;
for(1..16) { push @A, sprintf( "%02X",int rand 256 ); }
my $code = join( "", @A );

This is what DataObj::LoginTicket does:

sub _code
{
my $ctx = Digest::MD5->new;
srand;
$ctx->add( $$, time, rand() );
return $ctx->hexdigest;
}

I suspect that Session::Token does a more robust job than both of these (?), but if those other methods suffice then we would avoid the need to create a dependency.

Better would be to abstract the Token generation (EPrints::Utils perhaps?) and have it done conditionally so that if someone has Session::Token installed Eprints will use that. Otherwise use one of those first-principle methods.

[phluid61]

I updated the PR using Request::Respond's code; if accepted we could update Request::Respond to use the new method in EPrints::Utils too, to keep things DRY.

Maybe even DataObj::LoginTicket.

[denics]

Dear all,

this is a great functionality. There is a specific motivation why it has not been merged yet?

[MrkGrgsn]

Glad to see this finally went in! 👍