Embed classic MDS protocol into Lupo

.env.example

@@ -37,10 +37,18 @@ ES_HOST=elasticsearch:9200
 MAILGUN_API_KEY=
 MG_DOMAIN=mg.datacite.org
 
-# Needed for tests
+# Needed for tests (seed client credentials, not the MDS protocol server)
 MDS_USERNAME=
 MDS_PASSWORD=
 
+# MDS protocol (embedded former Poodle API). Host-constrained routes under Mds::
+# Set MDS_ENABLED=true and point mds.* hosts at this app to serve classic MDS paths.
+# Only list true MDS hostnames — never api/localhost/example.org or REST will hit MDS catch-all.
+MDS_ENABLED=false
+MDS_HOSTS=mds.datacite.org,mds.test.datacite.org,mds.stage.datacite.org,mds.local
+MDS_URL=https://mds.test.datacite.org
+MDS_REALM=mds.datacite.org
+
 CONCURRENCY=25
 INTEGRATION=1 # Set this environment variable to run the integration tests
 REFRESH=true

Gemfile

@@ -35,7 +35,7 @@ gem "flipper", "~> 1.4", ">= 1.4.1"
 gem "flipper-active_support_cache_store", "~> 1.4", ">= 1.4.1"
 gem "gender_detector", "~> 2.1"
 gem "google-protobuf", "~> 4.34", ">= 4.34.1"
-gem "graphql", "~> 2.5", ">= 2.6.6"
+gem "graphql", "~> 2.5", ">= 2.6.7"
 gem "graphql-batch", "~> 0.6.1"
 gem "hashid-rails", "~> 1.4", ">= 1.4.1"
 gem "iso-639", "~> 0.3.8"

Gemfile.lock

@@ -818,7 +818,7 @@ DEPENDENCIES
   flipper-active_support_cache_store (~> 1.4, >= 1.4.1)
   gender_detector (~> 2.1)
   google-protobuf (~> 4.34, >= 4.34.1)
-  graphql (~> 2.5, >= 2.6.6)
+  graphql (~> 2.5, >= 2.6.7)
   graphql-batch (~> 0.6.1)
   hashdiff (~> 1.2, >= 1.2.1)
   hashid-rails (~> 1.4, >= 1.4.1)

README.md

@@ -13,6 +13,17 @@ Rails API application for managing DataCite providers, clients, prefixes and DOI
 *   **DOI**: Digital Object Identifier, the core entity managed by the system.
 *   **Prefix**: DOIs are assigned within a prefix (e.g., 10.1234).
 
+## MDS API (classic Metadata Store protocol)
+
+Lupo can serve the [classic DataCite MDS API](https://support.datacite.org/docs/mds-api-guide) in-process (paths such as `/doi`, `/metadata`, `/media`), replacing the former standalone [Poodle](https://github.com/datacite/poodle) service.
+
+*   Enable with `MDS_ENABLED=true`.
+*   Requests are accepted only when the HTTP `Host` is listed in `MDS_HOSTS` (e.g. `mds.datacite.org`, `mds.test.datacite.org`, `mds.local`).
+*   Public MDS URLs stay the same; only the backend behind those hosts changes.
+*   Non-MDS hosts continue to serve the JSON:API / GraphQL REST surface only.
+
+See `.env.example` for `MDS_ENABLED`, `MDS_HOSTS`, `MDS_URL`, and `MDS_REALM`.
+
 ## Tech Stack
 
 *   Ruby on Rails

app/controllers/application_controller.rb

@@ -3,6 +3,7 @@
 class ApplicationController < ActionController::API
   include ActionController::HttpAuthentication::Basic::ControllerMethods
   include Authenticable
+  include RequestCredentials
   include CanCan::ControllerAdditions
   include ErrorSerializable
   require "facets/string/snakecase"
@@ -71,31 +72,13 @@ def authenticate_user_with_basic_auth!
   end
 
   def authenticate_user!
-    type, credentials = type_and_credentials_from_request_headers
-
-    return false if credentials.blank?
-
-    if (ENV["JWT_BLACKLISTED"] || "").split(",").include?(credentials)
-      raise JWT::VerificationError
-    end
-
-    @current_user = User.new(credentials, type: type)
-
-    fail CanCan::AuthorizationNotPerformed if @current_user.errors.present?
-
-    set_api_key_sentry_tags
-    @current_user
+    authenticate_request!
   end
 
   def current_ability
     @current_ability ||= Ability.new(current_user)
   end
 
-  # based on https://github.com/nsarno/knock/blob/master/lib/knock/authenticable.rb
-  def type_and_credentials_from_request_headers
-    request.headers["Authorization"]&.split
-  end
-
   def authenticated_user
     current_user.try(:uid)
   end
@@ -197,11 +180,6 @@ def set_raven_context
     end
 
     def set_api_key_sentry_tags
-      return unless current_user.try(:api_key_authenticated?)
-
-      Sentry.set_tags(
-        auth_method: current_user.auth_method,
-        api_key_prefix: current_user.api_key_prefix,
-      )
+      tag_api_key_observability!
     end
 end

app/controllers/concerns/mds/doi_lookup.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+module Mds
+  module DoiLookup
+    extend ActiveSupport::Concern
+
+    included do
+      include Bolognese::DoiUtils
+    end
+
+    private
+      def client_symbol
+        (current_user.client_id.presence || current_user.uid).to_s
+      end
+
+      def find_datacite_doi!(doi_string, not_found: Mds::DOI_NOT_FOUND)
+        doi_id = validate_doi(doi_string)
+        fail Mds::Error.new(not_found, status: 404) if doi_id.blank?
+
+        doi = DataciteDoi.where(doi: doi_id).first
+        fail Mds::Error.new(not_found, status: 404) if doi.blank?
+
+        doi
+      end
+
+      # Same visibility rules as REST DataciteDoisController#show: findable is
+      # public; draft/registered only for the owning client (or provider/staff).
+      # Use 404 (not 403) so existence of another repository's draft is not confirmed.
+      # Do not use authorize! :read — Ability has a global can :read, Doi.
+      def authorize_mds_doi_read!(doi, not_found: Mds::DOI_UNKNOWN_TO_MDS)
+        if not_allowed_by_doi_and_user(doi: doi, user: current_user)
+          fail Mds::Error.new(not_found, status: 404)
+        end
+      end
+
+      # DOIs for the authenticated repository's first prefix (MDS GET /doi list).
+      # Returns nil when there is nothing to list (caller should 204).
+      def listed_dois_for_current_user
+        client =
+          Client.where("datacentre.symbol = ?", current_user.uid.upcase).first
+        client_prefix = client&.prefixes&.first
+        return if client_prefix.blank?
+
+        dois =
+          DataciteDoi.get_dois(
+            prefix: client_prefix.uid,
+            username: current_user.uid.upcase,
+          )
+        return if dois.blank? || !dois.is_a?(Array) || dois.empty?
+
+        dois
+      end
+  end
+end

app/controllers/concerns/mds/doi_writer.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module Mds
+  module DoiWriter
+    extend ActiveSupport::Concern
+
+    included do
+      include Mds::DoiLookup
+    end
+
+    private
+      def upsert_datacite_doi!(doi_id, attributes)
+        attrs = attributes.to_h.compact.with_indifferent_access
+        doi = DataciteDoi.where(doi: doi_id).first
+
+        if doi
+          authorize! :update, doi
+          doi.current_user = current_user
+          doi.assign_attributes(attrs.except(:doi, :client_id))
+        else
+          doi = DataciteDoi.new(attrs.merge(doi: doi_id))
+          doi.current_user = current_user
+          authorize! :new, doi
+        end
+
+        return doi if doi.save
+
+        message = doi.errors.full_messages.first || "Unprocessable entity"
+        fail Mds::Error.new(message, status: 422)
+      end
+  end
+end

app/controllers/concerns/request_credentials.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module RequestCredentials
+  extend ActiveSupport::Concern
+
+  # based on https://github.com/nsarno/knock/blob/master/lib/knock/authenticable.rb
+  def type_and_credentials_from_request_headers
+    # Limit 2 keeps JWT/API-key material intact if it ever contained spaces.
+    request.headers["Authorization"]&.split(" ", 2)
+  end
+
+  def user_from_request_credentials
+    type, credentials = type_and_credentials_from_request_headers
+    return if credentials.blank?
+
+    # Only JWT access tokens belong on the blacklist — never DC.* API keys.
+    if !api_key_token?(credentials) &&
+        (ENV["JWT_BLACKLISTED"] || "").split(",").include?(credentials)
+      raise JWT::VerificationError
+    end
+
+    User.new(credentials, type: type)
+  end
+
+  def api_key_token?(token)
+    Authenticable.api_key_token?(token)
+  end
+
+  def authenticate_request!
+    @current_user = user_from_request_credentials
+    return false if @current_user.nil?
+
+    fail CanCan::AuthorizationNotPerformed if @current_user.errors.present?
+
+    tag_api_key_observability!
+    @current_user
+  end
+
+  def tag_api_key_observability!
+    return unless @current_user.try(:api_key_authenticated?)
+    return unless defined?(Sentry)
+
+    Sentry.set_tags(
+      auth_method: @current_user.auth_method,
+      api_key_prefix: @current_user.api_key_prefix,
+    )
+  end
+end

app/controllers/datacite_dois_controller.rb

@@ -728,41 +728,25 @@ def get_url
 
     authorize! :get_url, @doi
 
-    if !@doi.is_registered_or_findable? ||
-        %w[europ].include?(@doi.provider_id) ||
-        @doi.type == "OtherDoi"
-      url = @doi.url
-      head :no_content && return if url.blank?
-    else
-      response = @doi.get_url
-
-      if response.status == 200
-        url = response.body.dig("data", "values", 0, "data", "value")
-      elsif response.status == 400 &&
-          response.body.dig("errors", 0, "title", "responseCode") == 301
-        response =
-          OpenStruct.new(
-            status: 403,
-            body: {
-              "errors" => [
-                {
-                  "status" => 403,
-                  "title" => "SERVER NOT RESPONSIBLE FOR HANDLE",
-                },
-              ],
-            },
-          )
-        url = nil
-      else
-        url = nil
-      end
-    end
-
-    if url.present?
-      render json: { url: url }.to_json, status: :ok
-    else
-      render json: response.body.to_json,
-             status: response.status || :bad_request
+    result = @doi.resolve_landing_url
+    case result.kind
+    when :ok
+      render json: { url: result.url }.to_json, status: :ok
+    when :no_content
+      head :no_content
+    when :forbidden_handle
+      render json: {
+               "errors" => [
+                 {
+                   "status" => 403,
+                   "title" => "SERVER NOT RESPONSIBLE FOR HANDLE",
+                 },
+               ],
+             }.to_json,
+             status: :forbidden
+    when :upstream
+      render json: result.body.to_json,
+             status: result.status || :bad_request
     end
   end
 
@@ -771,8 +755,8 @@ def get_dois
 
     client =
       Client.where("datacentre.symbol = ?", current_user.uid.upcase).first
-    client_prefix = client.prefixes.first
-    head :no_content && return if client_prefix.blank?
+    client_prefix = client&.prefixes&.first
+    return head :no_content if client_prefix.blank?
 
     dois =
       DataciteDoi.get_dois(