Add handler to associate IA ocaids with OL edition records

[jimchamp]

Closes #11490

Creates new /api/link.json handler for the purpose of syncing data between IA and OL. POST requests to this endpoint are expected to have the following query parameters:

• msg : A colon delimited string in the format {ocaid}|{openlibrary_edition_id}|{expiry}
• digest : The sha256 hashed value of msg

All inputs required for the operation are expected to be sent in the msg string.

The POST handler will, in order:

1. Verify the digest and check the expiry
2. Validate the request inputs
3. Query for the OL edition that matches the Open Library edition ID given in the msg
4. Adds given ocaid to the OL edition

Possible responses:

Status	Condition	Response Body
200	Success	{"status": "ok"}
400	Missing/malformed ocaid or ts in msg	{"error": "Invalid inputs"}
401	Invalid or expired HMAC digest	(empty)
404	No edition found with given ocaid	(empty)
500	DB/save failure	{"error": "exception_message"}

Technical

Testing

Screenshot

Stakeholders

[Copilot]

Pull request overview

Adds a new internal API endpoint intended to let Internet Archive associate an IA ocaid with an Open Library edition record.

Changes:

• Introduces a new POST /api/link (JSON) handler to validate an HMAC token + expiry and then update an edition record.
• Updates the target edition’s ocaid and appends an ia:{ocaid} entry to source_records.

[Copilot]

PR description says digest is a SHA-256 hash of msg, but this endpoint uses HMACToken.verify, which expects an HMAC using a shared secret (and currently MD5-based). Please align the PR description and the IA client implementation with what the server actually verifies.

[jimchamp]

HMAC.verify has been updated to use sha256 in #12402.

[Copilot]

This adds a new /api/link handler with multiple behaviors (401/400/404/500 + a successful update to ocaid/source_records), but there are no tests covering it. Please add unit tests following existing openlibrary/plugins/openlibrary/tests/* patterns to assert the expected status codes and that edition fields are updated correctly.

[hornc]

@jimchamp This should not add an archive.org source_record if the record's metadata was not sourced from archive.org. Doing so would be confusing to librarians who are tracking down metadata issues, and imply an import has occurred when only a 'link' has.

[jimchamp]

Thanks @hornc! I had already forgotten to ask about that assumption...

Will update shortly.