Validate ORCIDs in codecheck.yml

[nuest]

Only existing ORCIDs should be used.

rorcid::orcid_id(orcid = "0000-0002-9341-7985")
# should not be empty

Also, we can point to rorcid package in the documentaiton, which might streamline lookup of ORCIDs for names. Note when I tried this in a container, the callback for the authentication did not work :-/.

Also add rorcid to Suggests in the DESCRIPTION file.

[sje30]

https://stackoverflow.com/questions/3262569/validating-a-yaml-document-in-python for validating more generally.

[nuest]

Re. general YAML valiation, the R yaml package does not seem to have that feature yet: vubiostat/r-yaml#19 However, since we parse the yaml file, we should test if the parsing catches generic errors.

[nuest]

rorcid::orcid_id requires authentication to access the ORCID API.

[nuest]

> httr::GET("https://orcid.org/0000-0002-9341-7985")$status
[1] 200
> httr::GET("https://orcid.org/0000-not-an-orcid")$status
[1] 200
> httr::GET("https://orcid.org/0000-not-an-orcid")
Response [https://orcid.org/signin]
  Date: 2020-09-02 08:31
  Status: 200
  Content-Type: text/html;charset=UTF-8
[...]

Even the HTTP request requires login.

[nuest]

See also https://github.com/MangoTheCat/goodpractice/issues/111 - maybe they come up with a solution.

[nuest]

A regex - based validation happens with ropensci-review-tools/goodpractice#18 - for everything else we need API access, which I'd say is too much right now.

[sckott]

sorry to just drop in here but I stumbled upon this - i'm the rorcid maintainer. seems like a use case that should be possible to check that an ORCID is valid without requiring auth. a head request seems to work without auth:

# real orcid
curl -IL -s -o /dev/null -w "%{http_code}" https://pub.orcid.org/v3.0/0000-0002-9341-7985/person
200

# not real orcid
curl -IL -s -o /dev/null -w "%{http_code}" https://pub.orcid.org/v3.0/0000-0002-9341-7985234234/person
404

Also curious why can't you use your own personal auth for this? Would each user need to use their own auth or could you use your auth for everyone?