Merge branch 'hotfix/26.1.5'

Author: cslzchen

CHANGELOG

@@ -2,6 +2,18 @@
 
 We follow the CalVer (https://calver.org/) versioning scheme: YY.MINOR.MICRO.
 
+26.1.5 (2026-01-12)
+===================
+
+- Fix authenticated ORCID is not shown on user profile page (BE part)
+- Fix some links in preprint & registration moderation digest emails
+- Enable admin/admin read/write access for NR tables
+- Handle multiple notification subscriptions gracefully in emit()
+- Remove subscription when moderators/admins are removed
+- Set proper default message frequency when adding moderator/admins
+- Add a management command to remove duplicated notifications
+- Fix subscription population script's digest option
+
 26.1.4 (2026-01-06)
 ===================
 

api/providers/serializers.py

@@ -401,7 +401,7 @@ def update(self, instance, validated_data):
             return instance
 
         try:
-            provider.remove_from_group(instance, instance.permission_group, unsubscribe=False)
+            provider.remove_from_group(instance, instance.permission_group, unsubscribe=True)
         except ValueError as e:
             raise ValidationError(str(e))
         provider.add_to_group(instance, perm_group)

api/users/serializers.py

@@ -63,6 +63,26 @@ def to_representation(self, value):
             value = social
         return super().to_representation(value)
 
+class ExternalIdentityField(ser.DictField):
+    def __init__(self, **kwargs):
+        super().__init__(**kwargs)
+
+    def to_representation(self, value):
+        if not value or not isinstance(value, dict):
+            return value
+        result = {}
+        for provider, identities in value.items():
+            if not identities or not isinstance(identities, dict):
+                result[provider] = identities
+                continue
+            identity_id, status = next(iter(identities.items()))
+            if status != 'VERIFIED':
+                continue
+            result[provider] = {
+                'id': identity_id,
+                'status': status,
+            }
+        return result
 
 class UserSerializer(JSONAPISerializer):
     filterable_fields = frozenset([
@@ -97,6 +117,7 @@ class UserSerializer(JSONAPISerializer):
     allow_indexing = ShowIfCurrentUser(ser.BooleanField(required=False, allow_null=True))
     can_view_reviews = ShowIfCurrentUser(ser.SerializerMethodField(help_text='Whether the current user has the `view_submissions` permission to ANY reviews provider.'))
     accepted_terms_of_service = ShowIfCurrentUser(ser.SerializerMethodField())
+    external_identity = HideIfDisabled(ExternalIdentityField(required=False))
 
     links = HideIfDisabled(
         LinksField(

notifications/listeners.py

@@ -97,7 +97,7 @@ def reviews_withdraw_requests_notification_moderators(self, timestamp, context,
     # Set message
     context['message'] = f'has requested withdrawal of "{resource.title}".'
     # Set submission url
-    context['reviews_submission_url'] = f'{DOMAIN}reviews/registries/{provider._id}/{resource._id}'
+    context['reviews_submission_url'] = f'{DOMAIN}{resource._id}?mode=moderator'
     context['localized_timestamp'] = str(timestamp)
     NotificationType.Type.PROVIDER_NEW_PENDING_WITHDRAW_REQUESTS.instance.emit(
         subscribed_object=provider,

notifications/tasks.py

@@ -1,6 +1,6 @@
 import itertools
 from calendar import monthrange
-from datetime import date
+from datetime import date, datetime
 from django.contrib.contenttypes.models import ContentType
 from django.db import connection
 from django.utils import timezone
@@ -205,10 +205,11 @@ def send_moderator_email_task(self, user_id, notification_ids, provider_content_
         if current_moderators is None or not current_moderators.user_set.filter(id=user.id).exists():
             current_admins = provider.get_group('admin')
             if current_admins is None or not current_admins.user_set.filter(id=user.id).exists():
-                log_message(f"User is not a moderator for provider {provider._id} - skipping email")
+                log_message(f"User is not a moderator for provider {provider._id} - notifications will be marked as sent.")
                 email_task.status = 'FAILURE'
                 email_task.error_message = f'User is not a moderator for provider {provider._id}'
                 email_task.save()
+                notifications_qs.update(sent=datetime(1000, 1, 1))
                 return
 
         additional_context = {}

osf/management/commands/remove_duplicate_notification_subscriptions.py

@@ -0,0 +1,55 @@
+from django.core.management.base import BaseCommand
+from django.db import transaction
+from django.db.models import OuterRef, Exists
+
+from osf.models import NotificationSubscription
+
+
+class Command(BaseCommand):
+    help = (
+        'Remove duplicate NotificationSubscription records, keeping only '
+        'the highest-id record per (user, content_type, object_id, notification_type).'
+    )
+
+    def add_arguments(self, parser):
+        parser.add_argument(
+            '--dry',
+            action='store_true',
+            help='Show how many rows would be deleted without deleting anything.',
+        )
+
+    def handle(self, *args, **options):
+        self.stdout.write('Finding duplicate NotificationSubscription records…')
+
+        to_remove = NotificationSubscription.objects.filter(
+            Exists(
+                NotificationSubscription.objects.filter(
+                    user_id=OuterRef('user_id'),
+                    content_type_id=OuterRef('content_type_id'),
+                    object_id=OuterRef('object_id'),
+                    notification_type_id=OuterRef('notification_type_id'),
+                    _is_digest=OuterRef('_is_digest'),
+                    id__gt=OuterRef('id'),  # keep most recent record
+                )
+            )
+        )
+
+        count = to_remove.count()
+        self.stdout.write(f"Duplicates to remove: {count}")
+
+        if options['dry']:
+            self.stdout.write(
+                self.style.WARNING('Dry run enabled — no records were deleted.')
+            )
+            return
+
+        if count == 0:
+            self.stdout.write(self.style.SUCCESS('No duplicates found.'))
+            return
+
+        with transaction.atomic():
+            deleted, _ = to_remove.delete()
+
+        self.stdout.write(
+            self.style.SUCCESS(f"Successfully removed {deleted} duplicate records.")
+        )

osf/migrations/__init__.py

@@ -61,6 +61,10 @@ def get_admin_read_permissions():
         'view_registration',
         'view_registrationapproval',
         'view_registrationschema',
+        'view_notification',
+        'view_notificationtype',
+        'view_notificationsubscription',
+        'view_emailtask',
     ])
 
 
@@ -103,7 +107,15 @@ def get_admin_write_permissions():
         'change_notabledomain',
         'delete_notabledomain',
         'change_cedarmetadatatemplate',
-        'change_registrationapproval'
+        'change_registrationapproval',
+        'change_notification',
+        'delete_notification',
+        'change_notificationtype',
+        'delete_notificationtype',
+        'change_notificationsubscription',
+        'delete_notificationsubscription',
+        'change_emailtask',
+        'delete_emailtask',
     ])
 
 

osf/models/mixins.py

@@ -1087,6 +1087,7 @@ def add_to_group(self, user, group):
                 content_type=ContentType.objects.get_for_model(self, for_concrete_model=False),
                 object_id=self.id,
                 notification_type=subscription.instance,
+                message_frequency='instantly',
                 _is_digest=True
             )
 

osf/models/notification_type.py

@@ -5,6 +5,7 @@
 from website import settings
 from enum import Enum
 from osf.utils.caching import ttl_cached_property
+from framework import sentry
 
 
 def get_default_frequency_choices():
@@ -222,14 +223,31 @@ def emit(
                 _is_digest=is_digest,
             )
         else:
-            subscription, created = NotificationSubscription.objects.get_or_create(
-                notification_type=self,
-                user=user,
-                content_type=content_type,
-                object_id=subscribed_object.pk if subscribed_object else None,
-                defaults={'message_frequency': message_frequency},
-                _is_digest=is_digest,
-            )
+            try:
+                subscription, created = NotificationSubscription.objects.get_or_create(
+                    notification_type=self,
+                    user=user,
+                    content_type=content_type,
+                    object_id=subscribed_object.pk if subscribed_object else None,
+                    defaults={'message_frequency': message_frequency},
+                    _is_digest=is_digest,
+                )
+            except NotificationSubscription.MultipleObjectsReturned as e:
+                # Temporary fix before we deduplicate and add constraints: use the last created one if duplicates found
+                subscriptions_qs = NotificationSubscription.objects.filter(
+                    notification_type=self,
+                    user=user,
+                    content_type=content_type,
+                    object_id=subscribed_object.pk if subscribed_object else None,
+                    defaults={'message_frequency': message_frequency},
+                    _is_digest=is_digest,
+                ).order_by('id')
+                sentry.log_exception(e)
+                count = subscriptions_qs.count()
+                subscription = subscriptions_qs.last()
+                sentry.log_message(f'Multiple notification subscriptions found, using the last created one: '
+                                   f'[count={count}, user={user._id}, type={self.name}, last={subscription.id}]')
+
         subscription.emit(
             destination_address=destination_address,
             event_context=event_context,

package.json

@@ -1,6 +1,6 @@
 {
   "name": "OSF",
-  "version": "26.1.4",
+  "version": "26.1.5",
   "description": "Facilitating Open Science",
   "repository": "https://github.com/CenterForOpenScience/osf.io",
   "author": "Center for Open Science",