ep_openid_connect 2.0.5 → 2.0.9

package/.github/workflows/backend-tests.yml

@@ -1,6 +1,3 @@
-# You need to change lines 38 and 46 in case the plugin's name on npmjs.com is different
-# from the repository name
-
 name: "Backend tests"
 
 # any branch is useful for testing before a PR is submitted
@@ -17,6 +14,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+    - uses: actions/setup-node@v2
+      with:
+        node-version: 12
+
     - name: Install libreoffice
       run: |
         sudo add-apt-repository -y ppa:libreoffice/ppa
@@ -32,19 +33,29 @@ jobs:
     - name: Install all dependencies and symlink for ep_etherpad-lite
       run: src/bin/installDeps.sh
 
-    # clone this repository into node_modules/ep_plugin-name
     - name: Checkout plugin repository
       uses: actions/checkout@v2
       with:
-        path: ./node_modules/${{github.event.repository.name}}
+        path: ./node_modules/__tmp
+
+    - name: Determine plugin name
+      id: plugin_name
+      run: |
+        cd ./node_modules/__tmp
+        npx -c 'printf %s\\n "::set-output name=plugin_name::${npm_package_name}"'
+
+    - name: Rename plugin directory
+      run: |
+        mv ./node_modules/__tmp ./node_modules/"${PLUGIN_NAME}"
+      env:
+        PLUGIN_NAME: ${{ steps.plugin_name.outputs.plugin_name }}
 
     - name: Install plugin dependencies
       run: |
-        cd node_modules/${{github.event.repository.name}}
+        cd ./node_modules/"${PLUGIN_NAME}"
         npm ci
+      env:
+        PLUGIN_NAME: ${{ steps.plugin_name.outputs.plugin_name }}
 
     - name: Run the backend tests
       run: cd src && npm test
-
-##ETHERPAD_NPM_V=2
-## NPM configuration automatically created using src/bin/plugins/updateAllPluginsScript.sh

package/.github/workflows/frontend-tests.yml

@@ -0,0 +1,92 @@
+# Publicly credit Sauce Labs because they generously support open source
+# projects.
+name: "frontend tests powered by Sauce Labs"
+
+on: [push]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Generate Sauce Labs strings
+      id: sauce_strings
+      run: |
+        printf %s\\n '::set-output name=name::${{github.event.repository.name}} ${{ github.workflow }} - ${{ github.job }}'
+        printf %s\\n '::set-output name=tunnel_id::${{ github.run_id }}-${{ github.run_number }}-${{ github.job }}'
+
+    - uses: actions/setup-node@v2
+      with:
+        node-version: 12
+
+    - name: Check out Etherpad core
+      uses: actions/checkout@v2
+      with:
+        repository: ether/etherpad-lite
+
+    - name: Check out the plugin
+      uses: actions/checkout@v2
+      with:
+        path: ./node_modules/__tmp
+
+    - name: export GIT_HASH to env
+      id: environment
+      run: |
+        cd ./node_modules/__tmp
+        echo "::set-output name=sha_short::$(git rev-parse --short ${{ github.sha }})"
+
+    - name: Determine plugin name
+      id: plugin_name
+      run: |
+        cd ./node_modules/__tmp
+        npx -c 'printf %s\\n "::set-output name=plugin_name::${npm_package_name}"'
+
+    - name: Rename plugin directory
+      env:
+        PLUGIN_NAME: ${{ steps.plugin_name.outputs.plugin_name }}
+      run: |
+        mv ./node_modules/__tmp ./node_modules/"${PLUGIN_NAME}"
+
+    - name: Install plugin dependencies
+      env:
+        PLUGIN_NAME: ${{ steps.plugin_name.outputs.plugin_name }}
+      run: |
+        cd ./node_modules/"${PLUGIN_NAME}"
+        npm ci
+
+    # This must be run after setting up the plugin, otherwise npm will try to
+    # hoist common dependencies by removing them from src/node_modules and
+    # installing them in the top-level node_modules. As of v6.14.10, npm's hoist
+    # logic appears to be buggy, because it sometimes removes dependencies from
+    # src/node_modules but fails to add them to the top-level node_modules. Even
+    # if npm correctly hoists the dependencies, the hoisting seems to confuse
+    # tools such as `npm outdated`, `npm update`, and some ESLint rules.
+    - name: Install Etherpad core dependencies
+      run: src/bin/installDeps.sh
+
+    - name: Create settings.json
+      run: cp settings.json.template settings.json
+
+    - name: Disable import/export rate limiting
+      run: |
+        sed -e '/^ *"importExportRateLimiting":/,/^ *\}/ s/"max":.*/"max": 0/' -i settings.json
+
+    - name: Remove standard frontend test files
+      run: rm -rf src/tests/frontend/specs
+
+    - uses: saucelabs/sauce-connect-action@v1
+      with:
+        username: ${{ secrets.SAUCE_USERNAME }}
+        accessKey: ${{ secrets.SAUCE_ACCESS_KEY }}
+        tunnelIdentifier: ${{ steps.sauce_strings.outputs.tunnel_id }}
+
+    - name: Run the frontend tests
+      shell: bash
+      env:
+        SAUCE_USERNAME: ${{ secrets.SAUCE_USERNAME }}
+        SAUCE_ACCESS_KEY: ${{ secrets.SAUCE_ACCESS_KEY }}
+        SAUCE_NAME: ${{ steps.sauce_strings.outputs.name }}
+        TRAVIS_JOB_NUMBER: ${{ steps.sauce_strings.outputs.tunnel_id }}
+        GIT_HASH: ${{ steps.environment.outputs.sha_short }}
+      run: |
+        src/tests/frontend/travis/runner.sh

package/.github/workflows/npmpublish.yml

@@ -56,15 +56,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
       - uses: actions/setup-node@v1
         with:
           node-version: 12
           registry-url: https://registry.npmjs.org/
-      - run: git config user.name 'github-actions[bot]'
-      - run: git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
-      - run: npm ci
-      - run: npm version patch
-      - run: git push --follow-tags
+      - name: Bump version (patch)
+        run: |
+          LATEST_TAG=$(git describe --tags --abbrev=0) || exit 1
+          NEW_COMMITS=$(git rev-list --count "${LATEST_TAG}"..) || exit 1
+          [ "${NEW_COMMITS}" -gt 0 ] || exit 0
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          npm ci
+          npm version patch
+          git push --follow-tags
       # `npm publish` must come after `git push` otherwise there is a race
       # condition: If two PRs are merged back-to-back then master/main will be
       # updated with the commits from the second PR before the first PR's
@@ -78,6 +85,3 @@ jobs:
       - run: npm publish
         env:
           NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
-
-##ETHERPAD_NPM_V=2
-## NPM configuration automatically created using bin/plugins/updateAllPluginsScript.sh

package/README.md

@@ -34,8 +34,18 @@ Etherpad's `requireAuthentication` setting must be `true`.
 
 ### Configuration Details
 
-* `issuer` (required): The base URL of the OpenID Connect identity provider,
-  used to perform discovery of the endpoints.
+* `issuer` (required if `issuer_metadata` is not set): The base URL of the
+  OpenID Connect identity provider, used to discover the relevant OpenID Connect
+  endpoints. If set, your identity provider must support the [OpenID Connect
+  Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html)
+  protocol.
+* `issuer_metadata` (required if `issuer` is not set): Object containing details
+  about your OpenID Connect identity provider. Used for manual configuration if
+  your identity provider does not support the Discovery protocol. If your
+  identity provider does support Discovery, you are encouraged to set `issuer`
+  instead. For properties, see the [documentation for the openid-client `Issuer`
+  object
+  constructor](https://github.com/panva/node-openid-client/blob/v4.7.4/docs/README.md#new-issuermetadata).
 * `client_id` (required): The OAuth2 client ID issued by the identity provider.
 * `client_secret` (required): The OAuth2 client secret issued by the identity
   provider.

package/index.js

@@ -7,41 +7,88 @@ const authorManager = require('ep_etherpad-lite/node/db/AuthorManager');
 
 const pluginName = 'ep_openid_connect';
 const logger = log4js.getLogger(pluginName);
-const settings = {};
+const settings = {
+  displayname_claim: 'name',
+  response_types: ['code'],
+  permit_displayname_change: false,
+  prohibited_usernames: ['admin', 'guest'],
+};
 let oidcClient = null;
 
 const ep = (endpoint) => `/${pluginName}/${endpoint}`;
 const endpointUrl = (endpoint) => new URL(ep(endpoint).substr(1), settings.base_url).toString();
 
-exports.loadSettings = async (hookName, {settings: globalSettings}) => {
-  const mySettings = globalSettings[pluginName];
+const discoverIssuer = async (issuerUrl) => {
+  issuerUrl = new URL(issuerUrl);
+  // https://openid.net/specs/openid-connect-discovery-1_0.html#IssuerDiscovery says that the URI
+  // must not have query or fragment components.
+  if (issuerUrl.search) {
+    throw new Error(`Unexpected query in issuer URL (${issuerUrl}): ${issuerUrl.search}`);
+  }
+  if (issuerUrl.hash) {
+    throw new Error(`Unexpected fragment in issuer URL (${issuerUrl}): ${issuerUrl.hash}`);
+  }
+  let issuer;
+  try {
+    issuer = await Issuer.discover(issuerUrl.href);
+  } catch (err) {
+    // The URL used to get the issuer metadata doesn't exactly follow RFC 8615; see:
+    // https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig
+    const discoveryUrl = new URL(issuerUrl);
+    if (!discoveryUrl.pathname.includes('/.well-known/')) {
+      discoveryUrl.pathname =
+          `${discoveryUrl.pathname.replace(/\/$/, '')}/.well-known/openid-configuration`;
+    }
+    logger.error(
+        'Failed to discover issuer metadata via OpenID Connect Discovery ' +
+        '(https://openid.net/specs/openid-connect-discovery-1_0.html). ' +
+        `Does your issuer support Discovery? (hint: ${discoveryUrl})`);
+    throw err;
+  }
+  logger.info('OpenID Connect Discovery complete.');
+  return issuer;
+};
 
-  if (!mySettings) logger.error(`Expecting an ${pluginName} block in settings.`);
-  for (const setting of ['base_url', 'client_id', 'client_secret', 'issuer']) {
-    if (!mySettings[setting]) logger.error(`Expecting an ${pluginName}.${setting} setting.`);
+const getIssuer = async (settings) => {
+  if (settings.issuer) return await discoverIssuer(settings.issuer);
+  return new Issuer(settings.issuer_metadata);
+};
+
+exports.loadSettings = async (hookName, {settings: {[pluginName]: config = {}}}) => {
+  Object.assign(settings, config);
+  for (const setting of ['base_url', 'client_id', 'client_secret']) {
+    if (!settings[setting]) {
+      logger.error(`Required setting missing from settings.json: ${pluginName}.${setting}`);
+      return;
+    }
+  }
+  if (!settings.issuer && !settings.issuer_metadata) {
+    logger.error(`Either ${pluginName}.issuer or ${pluginName}.issuer_metadata must be set`);
+    return;
+  }
+  if (settings.issuer && settings.issuer_metadata) {
+    logger.warn(
+        `Ignoring ${pluginName}.issuer_metadata setting because ${pluginName}.issuer is set`);
   }
-  Object.assign(settings, mySettings);
   // Make sure base_url ends with '/' so that relative URLs are appended:
   if (!settings.base_url.endsWith('/')) settings.base_url += '/';
-  settings.displayname_claim = settings.displayname_claim || 'name';
-  settings.response_types = settings.response_types || ['code'];
-  settings.permit_displayname_change = settings.permit_displayname_change || false;
-  settings.prohibited_usernames = settings.prohibited_usernames || ['admin', 'guest'];
-  oidcClient = new (await Issuer.discover(settings.issuer)).Client({
+  oidcClient = new (await getIssuer(settings)).Client({
     client_id: settings.client_id,
     client_secret: settings.client_secret,
     response_types: settings.response_types,
     redirect_uris: [endpointUrl('callback')],
   });
-  logger.info('Client discovery complete. Configured.');
+  logger.info('Configured.');
 };
 
-exports.clientVars = (hookName, context, callback) => {
+exports.clientVars = (hookName, context) => {
+  if (oidcClient == null) return;
   const {permit_displayname_change} = settings;
-  return callback({[pluginName]: {permit_displayname_change}});
+  return {[pluginName]: {permit_displayname_change}};
 };
 
 exports.expressCreateServer = (hookName, {app}) => {
+  if (oidcClient == null) return;
   logger.debug('Configuring auth routes');
   app.get(ep('callback'), (req, res, next) => {
     logger.debug(`Processing ${req.url}`);
@@ -79,7 +126,8 @@ exports.expressCreateServer = (hookName, {app}) => {
   app.get(ep('logout'), (req, res) => req.session.destroy(() => res.redirect(settings.base_url)));
 };
 
-exports.authenticate = (hookName, {req, res, users}, cb) => {
+exports.authenticate = (hookName, {req, res, users}) => {
+  if (oidcClient == null) return;
   logger.debug('authenticate hook for', req.url);
   const {session} = req;
   const {[pluginName]: {userinfo = {}} = {}} = session;
@@ -89,29 +137,31 @@ exports.authenticate = (hookName, {req, res, users}, cb) => {
     // force regeneration.
     delete session[pluginName];
     // Authn failed. Let another plugin try to authenticate the user.
-    return cb([]);
+    return;
   }
   // Successfully authenticated.
   if (users[sub] == null) users[sub] = {};
   session.user = users[sub];
   session.user.username = sub;
   session.user.displayname = userinfo[settings.displayname_claim] || session.user.displayname;
-  return cb([true]);
+  return true;
 };
 
-exports.authnFailure = (hookName, {req, res}, cb) => {
+exports.authnFailure = (hookName, {req, res}) => {
+  if (oidcClient == null) return;
   const url = new URL(req.url.substr(1), settings.base_url).toString();
   res.redirect(`${endpointUrl('login')}?redirect_uri=${encodeURIComponent(url)}`);
-  return cb([true]);
+  return true;
 };
 
-exports.handleMessage = async (hookName, {message, client}) => {
+exports.handleMessage = async (hookName, {message, socket}) => {
+  if (oidcClient == null) return;
   logger.debug('handleMessage hook', message);
-  const {user: {displayname} = {}} = client.client.request.session;
+  const {user: {displayname} = {}} = socket.client.request.session;
   if (!displayname) return;
   if (message.type === 'CLIENT_READY') {
     logger.debug(
-        `CLIENT_READY ${client.id}: Setting username for token ${message.token} to ${displayname}`
+        `CLIENT_READY ${socket.id}: Setting username for token ${message.token} to ${displayname}`
     );
     // TODO: author ID might come from session ID, not token.
     const authorId = await authorManager.getAuthor4Token(message.token);
@@ -123,7 +173,8 @@ exports.handleMessage = async (hookName, {message, client}) => {
   }
 };
 
-exports.preAuthorize = (hookName, {req}, cb) => {
-  if (req.path.startsWith(ep(''))) return cb([true]);
-  return cb([]);
+exports.preAuthorize = (hookName, {req}) => {
+  if (oidcClient == null) return;
+  if (req.path.startsWith(ep(''))) return true;
+  return;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ep_openid_connect",
-  "version": "2.0.5",
+  "version": "2.0.9",
   "description": "Etherpad plugin to authenticate users against an OpenID Connect provider.",
   "main": "index.js",
   "repository": {
@@ -23,17 +23,18 @@
   },
   "homepage": "https://github.com/ether/ep_openid_connect#readme",
   "dependencies": {
-    "openid-client": "^3.15.9"
+    "openid-client": "^4.7.4"
   },
   "devDependencies": {
-    "eslint": "^7.18.0",
-    "eslint-config-etherpad": "^1.0.24",
+    "eslint": "^7.32.0",
+    "eslint-config-etherpad": "^2.0.2",
+    "eslint-plugin-cypress": "^2.12.1",
     "eslint-plugin-eslint-comments": "^3.2.0",
-    "eslint-plugin-mocha": "^8.0.0",
+    "eslint-plugin-mocha": "^9.0.0",
     "eslint-plugin-node": "^11.1.0",
     "eslint-plugin-prefer-arrow": "^1.2.3",
-    "eslint-plugin-promise": "^4.2.1",
-    "eslint-plugin-you-dont-need-lodash-underscore": "^6.10.0"
+    "eslint-plugin-promise": "^5.1.1",
+    "eslint-plugin-you-dont-need-lodash-underscore": "^6.12.0"
   },
   "eslintConfig": {
     "root": true,
@@ -45,12 +46,12 @@
   },
   "funding": {
     "type": "individual",
-    "url": "http://etherpad.org/"
+    "url": "https://etherpad.org/"
   },
   "peerDependencies": {
     "ep_etherpad-lite": ">=1.8.6"
   },
   "engines": {
-    "node": ">=10.13.0"
+    "node": ">=12.13.0"
   }
 }

package/static/js/client.js

@@ -1,7 +1,6 @@
 'use strict';
 
 exports.postToolbarInit = () => {
-  if (!clientVars.ep_openid_connect.permit_displayname_change) {
-    $('#myusernameedit').attr('disabled', true);
-  }
+  const {ep_openid_connect: {permit_displayname_change = true} = {}} = clientVars;
+  if (!permit_displayname_change) $('#myusernameedit').attr('disabled', true);
 };