Password protection for new journal sites before launch #5185
Description
User stories
- As an editor setting up a journal for the first time on Janeway, I would like my journal website to be behind a login until I am ready to launch. This would give me time to get the content just right.
- As a press manager, I currently need to create and manage multiple journals, some of them not real or not the final journal that will be used at launch, to give editors the right level of visibility and control over their content as it's coming together. This makes journal launches more complicated and time-consuming.
- As a system administrator, I currently need to put up a login screen using nginx or another server tool outside Janeway, separately from user accounts. If Janeway handled this natively, I would not have to create and share separate passwords.
Proposed solution
Add a security decorator called requires_login_before_launch to all public journal website and API views. The decorator would require a login if the journal publishing status has been set to "Test", or maybe "Coming soon" (building on #4988).
Other considerations and problems
- We could make an exception for the start submission page, or the submissions page, so that journals can accept submissions before launch, if they turn submissions on.
- Because some journals want to conceal their name before launch, to manage a transition from an old publisher smoothly, it might be important to mask the login screen somehow. This raises basic usability and accessibility concerns. How else would a user be able to identify that it is the desired journal, before trying to log in? Perhaps a code name could be introduced that could be displayed on the login screen.
- We'd need to work out whether "Test" or "Coming soon" is better suited for this login screen. Maybe "Coming soon"? Rename it to "Pre-launch?"