ep_oauth 11.0.17 → 11.0.18

package/.github/workflows/backend-tests.yml

@@ -26,7 +26,7 @@ jobs:
         with:
           repository: ether/etherpad-lite
           path: etherpad-lite
-      - uses: pnpm/action-setup@v3
+      - uses: pnpm/action-setup@v6
         name: Install pnpm
         with:
           version: 10

package/.github/workflows/frontend-tests.yml

@@ -15,7 +15,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           repository: ether/etherpad-lite
-      - uses: pnpm/action-setup@v3
+      - uses: pnpm/action-setup@v6
         name: Install pnpm
         with:
           version: 10

package/.github/workflows/npmpublish.yml

@@ -31,7 +31,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           repository: ether/etherpad-lite
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6
         name: Install pnpm
         with:
           version: 10
@@ -59,12 +59,20 @@ jobs:
           [ "${NEW_COMMITS}" -gt 0 ] || exit 0
           git config user.name 'github-actions[bot]'
           git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
-          pnpm i
+          pnpm i --frozen-lockfile
           # `pnpm version patch` bumps package.json, makes a commit, and creates
           # a `v<new-version>` tag. Capture the new tag name from package.json
           # rather than parsing pnpm's output, which has historically varied.
-          pnpm version patch
-          NEW_TAG="v$(node -p "require('./package.json').version")"
+          # Bump the patch component directly with Node. pnpm/action-setup@v6
+          # sometimes installs pnpm 11 pre-releases even when version: 10.x is
+          # requested (pnpm/action-setup#225); those pre-releases either skip
+          # the git commit/tag or reject --no-git-tag-version as unknown.
+          # Doing the bump in Node sidesteps both failure modes.
+          NEW_VERSION=$(node -e "const fs=require('fs');const p=require('./package.json');const v=p.version.split('.');v[2]=String(Number(v[2])+1);p.version=v.join('.');fs.writeFileSync('./package.json',JSON.stringify(p,null,2)+'\n');console.log(p.version);")
+          NEW_TAG="v${NEW_VERSION}"
+          git add package.json
+          git commit -m "${NEW_TAG}"
+          git tag -a "${NEW_TAG}" -m "${NEW_TAG}"
           # CRITICAL: use --atomic so the branch update and the tag update
           # succeed (or fail) as a single transaction on the server. The old
           # `git push --follow-tags` was non-atomic per ref: if a concurrent

package/auth.js

@@ -8,15 +8,29 @@ const request = require('request');
 /* eslint-disable-next-line node/no-unpublished-require */
 const OAuth2 = require('oauth').OAuth2;
 
-// Setup the oauth2 connector -- Doesn't establish any connections etc.
-const oauth2 = new OAuth2(settings.ep_oauth.clientID,
-    settings.ep_oauth.clientSecret,
-    'https://github.com/',
-    'login/oauth/authorize',
-    'login/oauth/access_token',
-    null); /** Custom headers */
+// If the plugin is installed but the operator hasn't added the
+// `ep_oauth` block to settings.json yet, reading `.clientID` on an
+// undefined object used to crash Etherpad at startup with a cryptic
+// "Cannot read properties of undefined" (that's what produced the "can't
+// access site" report in #63). Bail cleanly with a warning instead so
+// Etherpad keeps running; the plugin's hooks self-disable when the
+// client isn't configured.
+let oauth2 = null;
+if (settings.ep_oauth && settings.ep_oauth.clientID && settings.ep_oauth.clientSecret) {
+  // Setup the oauth2 connector -- Doesn't establish any connections etc.
+  oauth2 = new OAuth2(settings.ep_oauth.clientID,
+      settings.ep_oauth.clientSecret,
+      'https://github.com/',
+      'login/oauth/authorize',
+      'login/oauth/access_token',
+      null); /** Custom headers */
+} else {
+  console.warn(
+      'ep_oauth: missing settings.ep_oauth.clientID / clientSecret — plugin disabled');
+}
 
 exports.expressConfigure = (hookName, args, cb) => {
+  if (!oauth2) return cb && cb();
   // args.app.get('/auth/callback', function(req, res){
 
   // THIRD STEP
@@ -92,6 +106,7 @@ exports.expressConfigure = (hookName, args, cb) => {
 
 // FIRST STEP
 exports.authorize = (hookName, args, cb) => {
+  if (!oauth2) return cb([true]); // plugin disabled, don't block the request
   // Never lands here for url /auth/callback
   if (args.req.url.indexOf('/auth') === 0) return cb([true]);
 
@@ -104,6 +119,7 @@ exports.authorize = (hookName, args, cb) => {
 
 // SECOND STEP
 exports.authenticate = (hookName, args, cb) => {
+  if (!oauth2) return cb([]); // plugin disabled, defer to other auth plugins
   console.debug(`Database Write -> oauthredirectlookup:${args.req.sessionID}`, '---', args.req.url);
   db.set(`oauthredirectlookup:${args.req.sessionID}`, args.req.url);
   // User is not authorized so we need to do the authentication step

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ep_oauth",
   "description": "Oauth2 authentication for Etherpad",
-  "version": "11.0.17",
+  "version": "11.0.18",
   "author": {
     "name": "John McLear",
     "email": "john@mclear.co.uk",
@@ -25,8 +25,8 @@
   },
   "devDependencies": {
     "eslint": "^8.57.1",
-    "eslint-config-etherpad": "^4.0.4",
-    "typescript": "^6.0.2"
+    "eslint-config-etherpad": "^4.0.5",
+    "typescript": "^6.0.3"
   },
   "scripts": {
     "lint": "eslint .",