ep_openid_connect 2.3.0 → 2.5.2

package/.github/workflows/backend-tests.yml

@@ -14,10 +14,6 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/setup-node@v2
-      with:
-        node-version: 12
-
     - name: Install libreoffice
       run: |
         sudo add-apt-repository -y ppa:libreoffice/ppa
@@ -30,9 +26,6 @@ jobs:
       with:
         repository: ether/etherpad-lite
 
-    - name: Install all dependencies and symlink for ep_etherpad-lite
-      run: src/bin/installDeps.sh
-
     - name: Checkout plugin repository
       uses: actions/checkout@v2
       with:
@@ -50,6 +43,15 @@ jobs:
       env:
         PLUGIN_NAME: ${{ steps.plugin_name.outputs.plugin_name }}
 
+    - uses: actions/setup-node@v2
+      with:
+        node-version: 12
+        cache: 'npm'
+        cache-dependency-path: |
+          src/package-lock.json
+          src/bin/doc/package-lock.json
+          node_modules/${{ steps.plugin_name.outputs.plugin_name }}/package-lock.json
+
     - name: Install plugin dependencies
       run: |
         cd ./node_modules/"${PLUGIN_NAME}"
@@ -57,5 +59,15 @@ jobs:
       env:
         PLUGIN_NAME: ${{ steps.plugin_name.outputs.plugin_name }}
 
+    # This must be run after setting up the plugin, otherwise npm will try to
+    # hoist common dependencies by removing them from src/node_modules and
+    # installing them in the top-level node_modules. As of v6.14.10, npm's hoist
+    # logic appears to be buggy, because it sometimes removes dependencies from
+    # src/node_modules but fails to add them to the top-level node_modules. Even
+    # if npm correctly hoists the dependencies, the hoisting seems to confuse
+    # tools such as `npm outdated`, `npm update`, and some ESLint rules.
+    - name: Install Etherpad core dependencies
+      run: src/bin/installDeps.sh
+
     - name: Run the backend tests
       run: cd src && npm test

package/.github/workflows/frontend-tests.yml

@@ -15,15 +15,19 @@ jobs:
         printf %s\\n '::set-output name=name::${{github.event.repository.name}} ${{ github.workflow }} - ${{ github.job }}'
         printf %s\\n '::set-output name=tunnel_id::${{ github.run_id }}-${{ github.run_number }}-${{ github.job }}'
 
-    - uses: actions/setup-node@v2
-      with:
-        node-version: 12
-
     - name: Check out Etherpad core
       uses: actions/checkout@v2
       with:
         repository: ether/etherpad-lite
 
+    - uses: actions/setup-node@v2
+      with:
+        node-version: 12
+        cache: 'npm'
+        cache-dependency-path: |
+          src/package-lock.json
+          src/bin/doc/package-lock.json
+
     - name: Check out the plugin
       uses: actions/checkout@v2
       with:

package/.github/workflows/npmpublish.yml

@@ -32,6 +32,11 @@ jobs:
       - uses: actions/setup-node@v1
         with:
           node-version: 12
+          cache: 'npm'
+          cache-dependency-path: |
+            ../etherpad-lite/src/package-lock.json
+            ../etherpad-lite/src/bin/doc/package-lock.json
+            package-lock.json
       # All of ep_etherpad-lite's devDependencies are installed because the
       # plugin might do `require('ep_etherpad-lite/node_modules/${devDep}')`.
       # Eventually it would be nice to create an ESLint plugin that prohibits
@@ -62,6 +67,7 @@ jobs:
         with:
           node-version: 12
           registry-url: https://registry.npmjs.org/
+          cache: 'npm'
       - name: Bump version (patch)
         run: |
           LATEST_TAG=$(git describe --tags --abbrev=0) || exit 1
@@ -85,3 +91,7 @@ jobs:
       - run: npm publish
         env:
           NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
+      - name: Add package to etherpad organization
+        run: npm access grant read-write etherpad:developers
+        env:
+          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}

package/index.js

@@ -135,7 +135,7 @@ exports.expressCreateServer = (hookName, {app}) => {
       // userinfo should not be stored in req.session until after all checks have passed. (Otherwise
       // it would be too easy to accidentally introduce a vulnerability.)
       oidcSession.userinfo = userinfo;
-      res.redirect(oidcSession.next || settings.base_url);
+      res.redirect(303, oidcSession.next || settings.base_url);
       // Defer deletion of state until success so that the user can reload the page to retry after a
       // transient backchannel failure.
       delete oidcSession.callbackChecks;
@@ -152,7 +152,6 @@ exports.expressCreateServer = (hookName, {app}) => {
     }
     if (req.session.ep_openid_connect == null) req.session.ep_openid_connect = {};
     const oidcSession = req.session.ep_openid_connect;
-    oidcSession.next = req.query.redirect_uri || settings.base_url;
     const commonParams = {
       nonce: generators.nonce(),
       scope: settings.scope.join(' '),
@@ -162,7 +161,7 @@ exports.expressCreateServer = (hookName, {app}) => {
       ...commonParams,
       code_verifier: generators.codeVerifier(), // RFC7636
     };
-    res.redirect(oidcClient.authorizationUrl({
+    res.redirect(303, oidcClient.authorizationUrl({
       ...commonParams,
       // RFC7636
       code_challenge: generators.codeChallenge(oidcSession.callbackChecks.code_verifier),
@@ -175,7 +174,7 @@ exports.expressCreateServer = (hookName, {app}) => {
       logger.warn('Not configured; ignoring request.');
       return next();
     }
-    req.session.destroy(() => res.redirect(settings.base_url));
+    req.session.destroy(() => res.redirect(303, settings.base_url));
   });
 };
 
@@ -207,8 +206,41 @@ exports.authenticate = (hookName, {req, res, users}) => {
 
 exports.authnFailure = (hookName, {req, res}) => {
   if (oidcClient == null) return;
-  const url = new URL(req.url.substr(1), settings.base_url).toString();
-  res.redirect(`${endpointUrl('login')}?redirect_uri=${encodeURIComponent(url)}`);
+  // Normally the user is redirected to the login page which would then redirect the user back once
+  // authenticated. For non-GET requests, send a 401 instead because users can't be redirected back.
+  // Also send a 401 if an Authorization header is present to facilitate API error handling.
+  //
+  // 401 is the status that most closely matches the desired semantics. However, RFC7235 section
+  // 3.1 says, "The server generating a 401 response MUST send a WWW-Authenticate header field
+  // containing at least one challenge applicable to the target resource." Etherpad uses a token
+  // (signed session identifier) transmitted via cookie for authentication, but there is no
+  // standard authentication scheme name for that. So we use a non-standard name here.
+  //
+  // We could theoretically implement Bearer authorization (RFC6750), but it's unclear to me how
+  // to do this correctly and securely:
+  //   * The userinfo endpoint is meant for the OAuth client, not the resource server, so it
+  //     shouldn't be used to look up claims.
+  //   * In general, access tokens might be opaque (not JWTs) so we can't get claims by parsing
+  //     them.
+  //   * The token introspection endpoint should return scope and subject (I think?), but probably
+  //     not claims.
+  //   * If claims can't be used to convey access level, how is it conveyed? Scope? Resource
+  //     indicators (RFC8707)?
+  //   * How is intended audience checked? Or is introspection guaranteed to do that for us?
+  //   * Should tokens be limited to a particular pad?
+  //   * Bearer tokens are only meant to convey authorization; authentication is handled by the
+  //     authorization server. Should Bearer tokens be processed during the authorize hook?
+  //   * How should bearer authentication interact with authorization plugins?
+  //   * How should bearer authentication interact with plugins that add new endpoints?
+  //   * Would we have to implement our own OAuth server to issue access tokens?
+  res.header('WWW-Authenticate', 'Etherpad');
+  if (!['GET', 'HEAD'].includes(req.method) || req.headers.authorization) {
+    res.status(401).end();
+    return true;
+  }
+  if (req.session.ep_openid_connect == null) req.session.ep_openid_connect = {};
+  req.session.ep_openid_connect.next = new URL(req.url.slice(1), settings.base_url).toString();
+  res.redirect(303, endpointUrl('login'));
   return true;
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ep_openid_connect",
-  "version": "2.3.0",
+  "version": "2.5.2",
   "description": "Etherpad plugin to authenticate users against an OpenID Connect provider.",
   "main": "index.js",
   "repository": {
@@ -54,6 +54,6 @@
     "ep_etherpad-lite": ">=1.8.6"
   },
   "engines": {
-    "node": ">=12.13.0"
+    "node": ">=12.17.0"
   }
 }

package/static/tests/backend/login.js

@@ -6,7 +6,7 @@ const common = require('ep_etherpad-lite/tests/backend/common');
 const logger = common.logger;
 
 const followRedirects = async (agent, res) => {
-  if (![302, 303].includes(res.status)) return res;
+  if (res.status !== 303) return res;
   const url = new URL(res.headers.location, res.request.url);
   logger.debug(`redirected to ${url}`);
   return await followRedirects(agent, await agent.get(url));

package/static/tests/backend/specs/tests.js

@@ -63,19 +63,14 @@ describe(__filename, function () {
   });
 
   it('not logged in redirects to login endpoint', async function () {
-    const params = new URLSearchParams();
-    params.append('redirect_uri', new URL('/', common.baseUrl));
-    const wantRedirect = new URL(`/ep_openid_connect/login?${params}`, common.baseUrl).toString();
     await agent.get(common.baseUrl)
-        .expect(302)
-        .expect('location', wantRedirect);
+        .expect(303)
+        .expect('location', new URL('/ep_openid_connect/login', common.baseUrl).toString());
   });
 
   it('login endpoint redirects to authorization URL', async function () {
-    const params = new URLSearchParams();
-    params.append('redirect_uri', new URL('/', common.baseUrl));
-    await agent.get(new URL(`/ep_openid_connect/login?${params}`, common.baseUrl))
-        .expect(302)
+    await agent.get(new URL('/ep_openid_connect/login', common.baseUrl))
+        .expect(303)
         .expect('location', /.*/)
         .expect((res) => {
           assert(res.headers.location.startsWith(`${new URL('/auth', issuer)}?`));
@@ -210,13 +205,24 @@ describe(__filename, function () {
     assert.equal(res.request.url, url);
     assert.equal(res.status, 200);
     await agent.get(new URL('/ep_openid_connect/logout', common.baseUrl))
-        .expect(302)
+        .expect(303)
         .expect('location', new URL('/', common.baseUrl).toString());
     // Visiting any page that requires authentication should now redirect to the login page.
     await agent.get(new URL('/', common.baseUrl))
-        .expect(302)
-        .expect('location', /./)
-        .expect((res) => assert(res.headers.location.startsWith(
-            new URL('/ep_openid_connect/login?', common.baseUrl).toString())));
+        .expect(303)
+        .expect('location', new URL('/ep_openid_connect/login', common.baseUrl).toString());
+  });
+
+  it('HTTP PUT gives 401 instead of redirect', async function () {
+    await agent.put(common.baseUrl)
+        .expect(401)
+        .expect('www-authenticate', 'Etherpad');
+  });
+
+  it('Authorization header results in 401 instead of redirect', async function () {
+    await agent.get(common.baseUrl)
+        .set('Authorization', 'Basic dXNlcm5hbWU6cGFzc3dvcmQ=')
+        .expect(401)
+        .expect('www-authenticate', 'Etherpad');
   });
 });