ep_oauth 11.0.11 → 11.0.13

package/README.md

@@ -1,14 +1,25 @@
-![Publish Status](https://github.com/ether/ep_oauth/workflows/Node.js%20Package/badge.svg) [![Backend Tests Status](https://github.com/ether/ep_oauth/actions/workflows/test-and-release.yml/badge.svg)](https://github.com/ether/ep_oauth/actions/workflows/test-and-release.yml)
+# ep_oauth
+
+OAuth2 authentication for Etherpad via GitHub.
+
+## Install
 
-Example config to be placed in settings.json
 ```
-  "ep_oauth":{
-    "clientID": "9829038409234fuckingnumbersandl1e1tt1er1s111yo",
-    "clientSecret": "herpderp22",
-    "callbackURL": "http://etherpoop.com:9001/auth/callback"
-  }
+pnpm run plugins i ep_oauth
 ```
 
-Note that we currently only support Github, we need better logic for events to fire after succesful Auth IE what user data to grab
+## Settings
+
+Add to your `settings.json`:
+
+```json
+"ep_oauth": {
+  "clientID": "your_github_client_id",
+  "clientSecret": "your_github_client_secret",
+  "callbackURL": "https://your-etherpad.example.com/auth/callback"
+}
+```
 
+## License
 
+Apache-2.0

package/auth.js

@@ -93,15 +93,13 @@ exports.expressConfigure = (hookName, args, cb) => {
 // FIRST STEP
 exports.authorize = (hookName, args, cb) => {
   // Never lands here for url /auth/callback
-  if (args.req.url.indexOf('/auth') === 0) return cb.true;
+  if (args.req.url.indexOf('/auth') === 0) return cb([true]);
 
-  let userIsAuthedAlready = false;
   console.debug(`Database lookup -> oauth:${args.req.sessionID}`);
   db.get(`oauth:${args.req.sessionID}`, (k, user) => {
     console.debug(`Oauth session found ->${args.req.sessionID}`, 'has user data of ', user);
-    if (user) userIsAuthedAlready = true;
+    return cb([!!user]);
   });
-  return cb([userIsAuthedAlready]);
 };
 
 // SECOND STEP

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ep_oauth",
   "description": "Oauth2 authentication for Etherpad",
-  "version": "11.0.11",
+  "version": "11.0.13",
   "author": {
     "name": "John McLear",
     "email": "john@mclear.co.uk",

package/static/tests/backend/specs/authorize.ts

@@ -0,0 +1,38 @@
+'use strict';
+
+import {strict as assert} from 'assert';
+import {init} from 'ep_etherpad-lite/tests/backend/common';
+import {generateJWTToken} from 'ep_etherpad-lite/tests/backend/common';
+
+let agent: any;
+
+describe('ep_oauth authorize hook', () => {
+  before(async () => {
+    agent = await init();
+  });
+
+  it('allows access to /auth paths without authentication', async () => {
+    // The authorize hook should return true for /auth/* paths,
+    // allowing the OAuth flow to proceed without prior auth.
+    // We test this by verifying the server doesn't reject /auth/callback
+    // with a 401 (it will 302 or handle it via the OAuth flow).
+    const res = await agent
+      .get('/auth/callback')
+      .set('Authorization', await generateJWTToken())
+      .redirects(0);
+    // Should not be 401 (unauthorized) — the authorize hook allows /auth paths
+    assert.notStrictEqual(res.status, 401);
+  });
+
+  it('rejects unauthenticated requests to pad paths', async () => {
+    // Without an OAuth session, accessing a pad should not be authorized.
+    // The exact behavior depends on etherpad config, but we verify the
+    // authorize hook is being called (server doesn't crash).
+    const res = await agent
+      .get('/p/test-oauth-pad')
+      .redirects(0);
+    // Should get some response (redirect to auth, or 200/302) but not crash
+    assert.ok([200, 302, 401, 403].includes(res.status),
+      `Expected 200/302/401/403, got ${res.status}`);
+  });
+});