ep_openid_connect 2.5.17 → 3.0.2

package/CHANGELOG.md

@@ -0,0 +1,14 @@
+# Changelog
+
+## v3.0.0
+
+Released 2022-03-04.
+
+#### Compatibility changes
+
+  * Removed the deprecated `displayname_claim` setting. Set
+    `user_properties.displayname.claim` instead.
+  * Displayname rendering was moved to the
+    [ep\_user\_displayname](https://github.com/ether/ep_user_displayname#readme)
+    plugin and the `permit_displayname_change` setting was removed.
+  * The plugin is now much more strict about what it accepts as valid settings.

package/README.md

@@ -52,18 +52,12 @@ Etherpad's `requireAuthentication` setting must be `true`.
 * `base_url` (required): The public base Etherpad URL. When registering Etherpad
   with your identity provider, the redirect URL (a.k.a. callback URL) is this
   base URL plus `/ep_openid_connect/callback`.
-* `displayname_claim` (optional; defaults to `"name"`): The default value of
-  `user_properties.displayname.claim`. **Deprecated:** Set
-  `user_properties.displayname.claim` instead.
 * `scope` (optional; defaults to `["openid"]`): List of OAuth2 scope strings.
-* `permit_displayname_change` (optional; defaults to `false`): Whether users may
-  change their displayed name.
-* `prohibited_usernames` (optional; defaults to `['admin', 'guest']`): List of
+* `prohibited_usernames` (optional; defaults to `["admin", "guest"]`): List of
   strings that will trigger an authentication error if any match the `sub`
   (subject) claim from the identity provider. Use this to avoid conflicts with
   the users in the `users` setting and to avoid conflicts with other plugins
-  (such as
-  [ep\_readonly\_guest](https://github.com/ether/ep_readonly_guest#readme)).
+  (such as [ep\_guest](https://github.com/ether/ep_guest#readme)).
 * `user_properties` (optional): Object that controls the automatic creation of
   additional properties on each authenticated user's account object. See below
   for details.
@@ -79,10 +73,11 @@ will probably look something like "5374".
 Each authenticated user gets their own account object. Default properties for a
 user's account object come from the `users` setting in `settings.json`. Etherpad
 uses the `is_admin`, `readOnly`, and `canCreate` properties to control access,
-and this plugin uses the `displayname` property for the name displayed in the
-user list. For example, the following sets the default display name to
-"Firstname Lastname" and the default access to read-only for the user identified
-by "5374":
+and the
+[ep\_user\_displayname](https://github.com/ether/ep_user_displayname#readme)
+plugin uses the `displayname` property for the name displayed in the user list.
+For example, the following sets the default display name to "Firstname Lastname"
+and the default access to read-only for the user identified by "5374":
 
 ```json
   "users": {
@@ -98,10 +93,57 @@ you can use the `prohibited_usernames` settings to force an authentication error
 if the `sub` claim happens to match. This is useful for preventing a malicious
 identity provider from gaining admin access to your Etherpad instance.
 
-The `user_properties` setting can be used to automatically add or change
-properties on a user's account object when the user authenticates. The
-`user_properties` setting maps a property name to an object that describes how
-the property's value is obtained. For example:
+### Controlling user account object properties with `user_properties`
+
+The `user_properties` setting can be used to automatically add, remove, or
+change properties on a user's account object when the user authenticates. The
+`user_properties` setting maps a property name to a descriptor object that
+describes how the property's value is obtained:
+
+  * If the descriptor object has a `claim` property that names an existing
+    OpenID Connect claim, the value is set to the value of the claim. (If there
+    is no such claim, `claim` has no effect.)
+  * If the descriptor object has a `default` property and the account object
+    property would otherwise be unset, the property is set to the given value.
+    (Note that a property set to `undefined` is not the same as unset.)
+  * If the descriptor object is `null`, the property is removed if present.
+
+Furthermore:
+
+  * If `user_properties` does not specifiy a descriptor for `displayname`, one
+    is added as follows:
+
+    ```json
+      "ep_openid_connect": {
+        "user_properties": {
+          "displayname": {"claim": "name"}
+        }
+      },
+    ```
+
+    You can cancel out this default behavior by explicitly specifying an empty
+    object:
+
+    ```json
+      "ep_openid_connect": {
+        "user_properties": {
+          "displayname": {}
+        }
+      },
+    ```
+
+  * The `username` property is described as follows and cannot be overridden or
+    canceled:
+
+    ```json
+      "ep_openid_connect": {
+        "user_properties": {
+          "username": {"claim": "sub"}
+        }
+      },
+    ```
+
+Example:
 
 ```json
   "ep_openid_connect": {
@@ -115,7 +157,8 @@ the property's value is obtained. For example:
       },
       "fixedValue": {
         "default": "fixed value"
-      }
+      },
+      "forcedUnset": null
     }
   },
 ```
@@ -128,6 +171,10 @@ The above example sets properties as follows:
   `claimName` claim if present, otherwise the property is left unset/unchanged.
 * Each user's `fixedValue` property is set to the string `"fixed value"`
   unless already set.
+* Each user's `forcedUnset` property is always deleted if present.
+* Each user's `displayname` property is set to to the value of the user's `name`
+  claim if present, otherwise the property is left unset/unchanged.
+* Each user's `username` property is set to the value of the `sub` claim.
 
 You can use this feature to control access in the OpenID Connect provider if it
 provides suitable claims:
@@ -146,15 +193,43 @@ provides suitable claims:
 To avoid breaking assumptions made by Etherpad, the `username` property cannot
 be altered via the `user_properties` setting.
 
-## Interaction with the ep\_readonly\_guest Plugin
+## Interaction with the ep\_guest Plugin
 
-The [ep\_readonly\_guest
-plugin](https://github.com/ether/ep_readonly_guest#readme) creates a user that
-is used for all guest accesses. It is recommended you add the username you chose
-for the guest user to the `prohibited_usernames` setting. If the identity
+The [ep\_guest](https://github.com/ether/ep_guest#readme) plugin creates a user
+that is used for all guest accesses. It is recommended you add the username you
+chose for the guest user to the `prohibited_usernames` setting. If the identity
 provider ever uses that username in the `sub` claim, you will get an obvious
 error instead of a mysterious inability to edit pads.
 
+## Interaction with the ep\_user\_displayname Plugin
+
+By default, this plugin sets the user's `displayname` property to the value of
+the `name` claim. The
+[ep\_user\_displayname](https://github.com/ether/ep_user_displayname#readme)
+plugin uses this property (and the `displaynameChangeable` property) to control
+the name displayed in the pad's list of users.
+
+You can change the claim used to get the displayname:
+
+```json
+  "ep_openid_connect": {
+    "user_properties": {
+      "displayname": {"claim": "nickname"}
+    }
+  },
+```
+
+Or you can cancel the default behavior:
+
+
+```json
+  "ep_openid_connect": {
+    "user_properties": {
+      "displayname": {}
+    }
+  },
+```
+
 ## Interaction with Etherpad's Built-in HTTP Basic Authentication
 
 If the user has not yet successfully authenticated, this plugin defers the

package/ep.json

@@ -1,18 +1,14 @@
 {
   "parts": [
     {
-      "name": "ep_openid_connect",
-      "client_hooks": {
-        "postToolbarInit": "ep_openid_connect/static/js/client"
-      },
+      "name": "main",
       "hooks": {
-        "authenticate": "ep_openid_connect",
-        "authnFailure": "ep_openid_connect",
-        "clientVars": "ep_openid_connect",
-        "expressCreateServer": "ep_openid_connect",
-        "handleMessage": "ep_openid_connect",
-        "loadSettings": "ep_openid_connect",
-        "preAuthorize": "ep_openid_connect"
+        "authenticate": "",
+        "authnFailure": "",
+        "expressCreateServer": "",
+        "init_ep_openid_connect": "",
+        "loadSettings": "",
+        "preAuthorize": ""
       }
     }
   ]

package/index.js

@@ -1,21 +1,42 @@
 'use strict';
 
-const log4js = require('ep_etherpad-lite/node_modules/log4js');
+const Ajv = require('ajv/dist/jtd');
 const {URL} = require('url');
 const {Issuer, generators} = require('openid-client');
-const authorManager = require('ep_etherpad-lite/node/db/AuthorManager');
 
-const logger = log4js.getLogger('ep_openid_connect');
+let logger = {};
+for (const level of ['debug', 'info', 'warn', 'error']) {
+  logger[level] = console[level].bind(console, 'ep_openid_connect:');
+}
 const defaultSettings = {
-  displayname_claim: 'name',
-  permit_displayname_change: false,
   prohibited_usernames: ['admin', 'guest'],
   scope: ['openid'],
   user_properties: {},
 };
-const settings = {...defaultSettings};
+let settings;
 let oidcClient = null;
 
+const validSettings = new Ajv().compile({
+  properties: {
+    base_url: {type: 'string'},
+    client_id: {type: 'string'},
+    client_secret: {type: 'string'},
+  },
+  optionalProperties: {
+    issuer: {type: 'string'},
+    issuer_metadata: {},
+    prohibited_usernames: {elements: {type: 'string'}},
+    scope: {elements: {type: 'string'}},
+    user_properties: {values: {
+      optionalProperties: {
+        claim: {type: 'string'},
+        default: {type: 'string'},
+      },
+      nullable: true,
+    }},
+  },
+});
+
 const ep = (endpoint) => `/ep_openid_connect/${endpoint}`;
 const endpointUrl = (endpoint) => new URL(ep(endpoint).substr(1), settings.base_url).toString();
 
@@ -64,35 +85,37 @@ const getIssuer = async (settings) => {
   return new Issuer(settings.issuer_metadata);
 };
 
-exports.loadSettings = async (hookName, {settings: {ep_openid_connect: config = {}}}) => {
-  Object.assign(settings, config);
-  for (const setting of ['base_url', 'client_id', 'client_secret']) {
-    if (!settings[setting]) {
-      logger.error(`Required setting missing from settings.json: ep_openid_connect.${setting}`);
-      return;
-    }
-  }
-  if (!settings.issuer && !settings.issuer_metadata) {
-    logger.error(
-        'Either ep_openid_connect.issuer or ep_openid_connect.issuer_metadata must be set');
+exports.init_ep_openid_connect = async (hookName, {logger: l}) => {
+  if (l != null) logger = l;
+};
+
+exports.loadSettings = async (hookName, {settings: {ep_openid_connect: s = {}}}) => {
+  oidcClient = null;
+  settings = null;
+  if (!validSettings(s)) {
+    logger.error('Invalid settings. Detailed validation errors:', validSettings.errors);
     return;
   }
-  if (settings.issuer && settings.issuer_metadata) {
-    logger.warn('Ignoring ep_openid_connect.issuer_metadata setting ' +
-                'because ep_openid_connect.issuer is set');
+  if ((s.issuer == null) === (s.issuer_metadata == null)) {
+    logger.error('Either ep_openid_connect.issuer or .issuer_metadata must be set (but not both)');
+    return;
   }
-  if (settings.response_types) {
-    logger.warn('Ignoring ep_openid_connect.response_types setting (it is no longer used)');
-    delete settings.response_types;
+  if ('username' in (s.user_properties || {})) {
+    logger.error('ep_openid_connect.user_properties.username must not be set');
+    return;
   }
+  settings = {
+    ...defaultSettings,
+    ...s,
+    user_properties: {
+      displayname: {claim: 'name'},
+      ...s.user_properties,
+      // The username property must always match the key used in settings.users.
+      username: {claim: 'sub'},
+    },
+  };
   // Make sure base_url ends with '/' so that relative URLs are appended:
   if (!settings.base_url.endsWith('/')) settings.base_url += '/';
-  settings.user_properties = {
-    displayname: {claim: settings.displayname_claim},
-    ...settings.user_properties,
-    // The username property must always match the key used in settings.users.
-    username: {claim: 'sub'},
-  };
   logger.debug('Settings:', {...settings, client_secret: '********'});
   oidcClient = new (await getIssuer(settings)).Client({
     client_id: settings.client_id,
@@ -103,12 +126,6 @@ exports.loadSettings = async (hookName, {settings: {ep_openid_connect: config =
   logger.info('Configured.');
 };
 
-exports.clientVars = (hookName, context) => {
-  if (oidcClient == null) return;
-  const {permit_displayname_change} = settings;
-  return {ep_openid_connect: {permit_displayname_change}};
-};
-
 exports.expressCreateServer = (hookName, {app}) => {
   logger.debug('Configuring auth routes');
   app.get(ep('callback'), async (req, res, next) => {
@@ -194,7 +211,9 @@ exports.authenticate = (hookName, {req, res, users}) => {
   req.session.user = users[userinfo.sub];
   if (req.session.user == null) req.session.user = users[userinfo.sub] = {};
   for (const [propName, descriptor] of Object.entries(settings.user_properties)) {
-    if (descriptor.claim != null && descriptor.claim in userinfo) {
+    if (descriptor == null) {
+      delete req.session.user[propName];
+    } else if (descriptor.claim != null && descriptor.claim in userinfo) {
       req.session.user[propName] = userinfo[descriptor.claim];
     } else if ('default' in descriptor && !(propName in req.session.user)) {
       req.session.user[propName] = descriptor.default;
@@ -244,24 +263,6 @@ exports.authnFailure = (hookName, {req, res}) => {
   return true;
 };
 
-exports.handleMessage = async (hookName, {message, socket}) => {
-  if (oidcClient == null) return;
-  logger.debug('handleMessage hook', message);
-  const {user: {displayname} = {}} = socket.client.request.session;
-  if (!displayname) return;
-  if (message.type === 'CLIENT_READY') {
-    logger.debug(
-        `CLIENT_READY ${socket.id}: Setting username for token ${message.token} to ${displayname}`);
-    // TODO: author ID might come from session ID, not token.
-    const authorId = await authorManager.getAuthor4Token(message.token);
-    await authorManager.setAuthorName(authorId, displayname);
-  } else if (message.type === 'COLLABROOM' && message.data.type === 'USERINFO_UPDATE') {
-    if (message.data.userInfo.name !== displayname && !settings.permit_displayname_change) {
-      message.data.userInfo.name = displayname;
-    }
-  }
-};
-
 exports.preAuthorize = (hookName, {req}) => {
   if (oidcClient == null) return;
   if (req.path.startsWith(ep(''))) return true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ep_openid_connect",
-  "version": "2.5.17",
+  "version": "3.0.2",
   "description": "Etherpad plugin to authenticate users against an OpenID Connect provider.",
   "main": "index.js",
   "repository": {
@@ -23,11 +23,12 @@
   },
   "homepage": "https://github.com/ether/ep_openid_connect#readme",
   "dependencies": {
-    "openid-client": "^5.1.3"
+    "ajv": "^8.10.0",
+    "openid-client": "^5.1.4"
   },
   "devDependencies": {
-    "eslint": "^8.10.0",
-    "eslint-config-etherpad": "^3.0.4",
+    "eslint": "^8.11.0",
+    "eslint-config-etherpad": "^3.0.9",
     "oidc-provider": "^7.10.6",
     "supertest": "^6.2.2",
     "typescript": "^4.6.2"

package/static/tests/backend/oidc-provider.js

@@ -26,6 +26,8 @@ class OidcProvider {
           'etherpad_is_admin',
           'etherpad_readOnly',
           'etherpad_canCreate',
+          'name',
+          'prop',
         ],
       },
       cookies: {
@@ -38,10 +40,12 @@ class OidcProvider {
         accountId: sub,
         claims: async (use, scope, claims, rejected) => ({
           sub,
+          name: 'Firstname Lastname',
           etherpad_is_admin: sub.includes('admin'),
           etherpad_readOnly: !sub.includes('admin') && sub.includes('readOnly'),
           etherpad_canCreate:
               sub.includes('admin') || (!sub.includes('readOnly') && !sub.includes('noCreate')),
+          ...(sub === 'claimNull' ? {prop: null} : sub === 'claimVal' ? {prop: 'claimValue'} : {}),
         }),
       }),
       jwks: {

package/static/tests/backend/specs/tests.js

@@ -6,6 +6,7 @@ const common = require('ep_etherpad-lite/tests/backend/common');
 const epOpenidConnect = require('../../../../index');
 const login = require('../login');
 const padManager = require('ep_etherpad-lite/node/db/PadManager');
+const plugins = require('ep_etherpad-lite/static/js/pluginfw/plugin_defs');
 const settings = require('ep_etherpad-lite/node/utils/Settings');
 const supertest = require('supertest');
 
@@ -33,33 +34,37 @@ describe(__filename, function () {
 
   before(async function () {
     await common.init();
+    if (!plugins.hooks.clientVars) plugins.hooks.clientVars = [];
+    backup.hooks = {clientVars: plugins.hooks.clientVars};
     backup.settings = {...settings};
-    settings.requireAuthentication = true;
-    settings.requireAuthorization = false;
     provider = new OidcProvider();
     const clients =
         [{...client, redirect_uris: [new URL('/ep_openid_connect/callback', common.baseUrl)]}];
     await provider.start({clients});
+  });
+
+  beforeEach(async function () {
+    agent = supertest.agent('');
     issuer = provider.issuer;
     pluginSettings.base_url = common.baseUrl;
     pluginSettings.issuer = issuer;
+    settings.requireAuthentication = true;
+    settings.requireAuthorization = false;
+    settings.users = {};
     await epOpenidConnect.loadSettings(
         'loadSettings', {settings: {ep_openid_connect: pluginSettings}});
   });
 
-  beforeEach(async function () {
-    agent = supertest.agent('');
-  });
-
   afterEach(async function () {
     if (socket != null) socket.close();
     socket = null;
+    Object.assign(plugins.hooks, backup.hooks);
+    Object.assign(settings, backup.settings);
   });
 
   after(async function () {
     if (provider != null) await provider.stop();
     provider = null;
-    Object.assign(settings, backup.settings);
   });
 
   it('not logged in redirects to login endpoint', async function () {
@@ -225,4 +230,166 @@ describe(__filename, function () {
         .expect(401)
         .expect('www-authenticate', 'Etherpad');
   });
+
+  describe('user_properties', function () {
+    it('uses existing settings.users[username] object', async function () {
+      const wantUser = {foo: 'bar'};
+      settings.users.normalUser = wantUser;
+      const padId = common.randomString();
+      const url = new URL(`/p/${padId}`, common.baseUrl).toString();
+      const res = await login(agent, issuer, url, 'normalUser');
+      assert.equal(res.request.url, url);
+      assert.equal(res.status, 200);
+      socket = await common.connect(res);
+      const gotUserP = new Promise((resolve) => {
+        plugins.hooks.clientVars =
+            [{hook_fn: (hn, ctx) => resolve(ctx.socket.client.request.session.user)}];
+      });
+      const msg = await common.handshake(socket, padId);
+      assert.equal(msg.type, 'CLIENT_VARS', `not a CLIENT_VARS message: ${JSON.stringify(msg)}`);
+      assert.equal(settings.users.normalUser, wantUser);
+      assert.equal(settings.users.normalUser.foo, 'bar');
+      // They won't be reference equal because each request loads the user object from the session
+      // store.
+      assert.deepEqual(await gotUserP, settings.users.normalUser);
+    });
+
+    it('sets settings.users[username] to new object if missing', async function () {
+      assert(settings.users.normalUser == null);
+      const padId = common.randomString();
+      const url = new URL(`/p/${padId}`, common.baseUrl).toString();
+      const res = await login(agent, issuer, url, 'normalUser');
+      assert.equal(res.request.url, url);
+      assert.equal(res.status, 200);
+      socket = await common.connect(res);
+      const gotUserP = new Promise((resolve) => {
+        plugins.hooks.clientVars =
+            [{hook_fn: (hn, ctx) => resolve(ctx.socket.client.request.session.user)}];
+      });
+      const msg = await common.handshake(socket, padId);
+      assert.equal(msg.type, 'CLIENT_VARS', `not a CLIENT_VARS message: ${JSON.stringify(msg)}`);
+      assert(settings.users.normalUser != null);
+      // They won't be reference equal because each request loads the user object from the session
+      // store.
+      assert.deepEqual(await gotUserP, settings.users.normalUser);
+    });
+
+    it('displayname defaults to name claim', async function () {
+      assert(settings.users.normalUser == null);
+      const padId = common.randomString();
+      const url = new URL(`/p/${padId}`, common.baseUrl).toString();
+      const res = await login(agent, issuer, url, 'normalUser');
+      assert.equal(res.request.url, url);
+      assert.equal(res.status, 200);
+      assert.equal(settings.users.normalUser.displayname, 'Firstname Lastname');
+    });
+
+    it('setting empty displayname descriptor cancels default behavior', async function () {
+      assert(settings.users.normalUser == null);
+      await epOpenidConnect.loadSettings('loadSettings', {settings: {ep_openid_connect: {
+        ...pluginSettings,
+        user_properties: {displayname: {}},
+      }}});
+      const padId = common.randomString();
+      const url = new URL(`/p/${padId}`, common.baseUrl).toString();
+      const res = await login(agent, issuer, url, 'normalUser');
+      assert.equal(res.request.url, url);
+      assert.equal(res.status, 200);
+      assert(!('displayname' in settings.users.normalUser));
+    });
+
+    it('username is set to sub claim', async function () {
+      assert(settings.users.normalUser == null);
+      const padId = common.randomString();
+      const url = new URL(`/p/${padId}`, common.baseUrl).toString();
+      const res = await login(agent, issuer, url, 'normalUser');
+      assert.equal(res.request.url, url);
+      assert.equal(res.status, 200);
+      assert.equal(settings.users.normalUser.username, 'normalUser');
+    });
+
+    describe('username can\'t be changed', function () {
+      for (const dsc of [
+        null,
+        {},
+        {default: 'something else'},
+        {claim: 'preferred_username'},
+        {claim: 'preferred_username', default: 'something else'},
+      ]) {
+        it(`descriptor: ${JSON.stringify(dsc)}`, async function () {
+          await epOpenidConnect.loadSettings('loadSettings', {settings: {ep_openid_connect: {
+            ...pluginSettings,
+            user_properties: {username: dsc},
+          }}});
+          // Settings validation should fail, resulting in an unconfigured state and causing
+          // Etherpad to fall back to built-in authn.
+          const res = await agent.get(new URL('/ep_openid_connect/login', common.baseUrl));
+          assert.equal(res.status, 401);
+        });
+      }
+    });
+
+    describe('{settings.json, claim value, user_properties} combinations', function () {
+      const testCases = [];
+      for (const user of [{}, {prop: undefined}, {prop: null}, {prop: 'userValue'}]) {
+        for (const claimValue of [undefined, null, 'claimValue']) {
+          for (const cfg of [
+            {},
+            {prop: null},
+            {prop: {}},
+            {prop: {default: 'defaultValue'}},
+            {prop: {claim: 'prop'}},
+            {prop: {claim: 'prop', default: 'defaultValue'}},
+          ]) {
+            const p = cfg.prop || {};
+            const wantIn = !!(
+              p.default ||
+              (p.claim && claimValue !== undefined) ||
+              ('prop' in user && cfg.prop !== null)); // eslint-disable-line eqeqeq
+            const wantValue =
+                p.claim && claimValue !== undefined ? claimValue
+                : 'prop' in user ? user.prop
+                : p.default ? p.default
+                : undefined;
+            const desc =
+                `user.prop=${'prop' in user ? user.prop : '<unset>'}, ` +
+                `claimValue=${claimValue === undefined ? '<unset>' : claimValue}, ` +
+                `user_properties.prop=${'prop' in cfg ? JSON.stringify(cfg.prop) : '<unset>'} -> ` +
+                `${wantIn ? wantValue : '<unset>'}`;
+            testCases.push({desc, user, claimValue, cfg, wantIn, wantValue});
+          }
+        }
+      }
+
+      for (const {desc, user, claimValue, cfg, wantIn, wantValue} of testCases) {
+        it(desc, async function () {
+          const username =
+              claimValue === undefined ? 'claimUnset'
+              : claimValue != null ? 'claimVal'
+              : 'claimNull';
+          settings.users[username] = {...user};
+          await epOpenidConnect.loadSettings('loadSettings', {settings: {ep_openid_connect: {
+            ...pluginSettings,
+            user_properties: cfg,
+          }}});
+          const padId = common.randomString();
+          const url = new URL(`/p/${padId}`, common.baseUrl).toString();
+          const res = await login(agent, issuer, url, username);
+          assert.equal(res.request.url, url);
+          assert.equal(res.status, 200);
+          socket = await common.connect(res);
+          const userP = new Promise((resolve) => {
+            plugins.hooks.clientVars =
+                [{hook_fn: (hn, ctx) => resolve(ctx.socket.client.request.session.user)}];
+          });
+          const msg = await common.handshake(socket, padId);
+          assert.equal(
+              msg.type, 'CLIENT_VARS', `not a CLIENT_VARS message: ${JSON.stringify(msg)}`);
+          const gotUser = await userP;
+          assert.equal('prop' in gotUser, wantIn);
+          if (wantIn) assert.equal(gotUser.prop, wantValue);
+        });
+      }
+    });
+  });
 });

package/static/js/client.js

@@ -1,6 +0,0 @@
-'use strict';
-
-exports.postToolbarInit = () => {
-  const {ep_openid_connect: {permit_displayname_change = true} = {}} = clientVars;
-  if (!permit_displayname_change) $('#myusernameedit').attr('disabled', true);
-};