ep_openid_connect 3.0.21 → 3.0.23

package/.github/workflows/backend-tests.yml

@@ -33,7 +33,7 @@ jobs:
       - uses: pnpm/action-setup@v6
         name: Install pnpm
         with:
-          version: 10
+          package_json_file: ./etherpad-lite/package.json
           run_install: false
       - name: Get pnpm store directory
         shell: bash

package/.github/workflows/frontend-tests.yml

@@ -23,7 +23,7 @@ jobs:
       - uses: pnpm/action-setup@v6
         name: Install pnpm
         with:
-          version: 10
+          package_json_file: ./etherpad-lite/package.json
           run_install: false
       - name: Get pnpm store directory
         shell: bash

package/.github/workflows/npmpublish.yml

@@ -34,7 +34,6 @@ jobs:
       - uses: pnpm/action-setup@v6
         name: Install pnpm
         with:
-          version: 10
           run_install: false
       - name: Get pnpm store directory
         shell: bash

package/CONTRIBUTING.md

@@ -1,133 +1,74 @@
-# Contributor Guidelines
-(Please talk to people on the mailing list before you change this page, see our section on [how to get in touch](https://github.com/ether/etherpad-lite#get-in-touch))
-
-## Pull requests
-
-* the commit series in the PR should be _linear_ (it **should not contain merge commits**). This is necessary because we want to be able to [bisect](https://en.wikipedia.org/wiki/Bisection_(software_engineering)) bugs easily. Rewrite history/perform a rebase if necessary
-* PRs should be issued against the **develop** branch: we never pull directly into **master**
-* PRs **should not have conflicts** with develop. If there are, please resolve them rebasing and force-pushing
-* when preparing your PR, please make sure that you have included the relevant **changes to the documentation** (preferably with usage examples)
-* contain meaningful and detailed **commit messages** in the form:
-  ```
-  submodule: description
-
-  longer description of the change you have made, eventually mentioning the
-  number of the issue that is being fixed, in the form: Fixes #someIssueNumber
-  ```
-* if the PR is a **bug fix**:
-  * the first commit in the series must be a test that shows the failure
-  * subsequent commits will fix the bug and make the test pass
-  * the final commit message should include the text `Fixes: #xxx` to link it to its bug report
-* think about stability: code has to be backwards compatible as much as possible. Always **assume your code will be run with an older version of the DB/config file**
-* if you want to remove a feature, **deprecate it instead**:
-  * write an issue with your deprecation plan
-  * output a `WARN` in the log informing that the feature is going to be removed
-  * remove the feature in the next version
-* if you want to add a new feature, put it under a **feature flag**:
-  * once the new feature has reached a minimal level of stability, do a PR for it, so it can be integrated early
-  * expose a mechanism for enabling/disabling the feature
-  * the new feature should be **disabled** by default. With the feature disabled, the code path should be exactly the same as before your contribution. This is a __necessary condition__ for early integration
-* think of the PR not as something that __you wrote__, but as something that __someone else is going to read__. The commit series in the PR should tell a novice developer the story of your thoughts when developing it
-
-## How to write a bug report
-
-* Please be polite, we all are humans and problems can occur.
-* Please add as much information as possible, for example
-  * client os(s) and version(s)
-    * browser(s) and version(s), is the problem reproducible on different clients
-    * special environments like firewalls or antivirus
-  * host os and version
-    * npm and nodejs version
-    * Logfiles if available
-  * steps to reproduce
-  * what you expected to happen
-  * what actually happened
-* Please format logfiles and code examples with markdown see github Markdown help below the issue textarea for more information.
-
-If you send logfiles, please set the loglevel switch DEBUG in your settings.json file:
+# Contributing to ep_openid_connect
 
+Thanks for helping improve `ep_openid_connect` — a plugin for [Etherpad](https://etherpad.org/). LLM/Agent contributions are explicitly welcome, provided they follow the rules below.
+
+For shared rules that apply to all Etherpad code (linear commits, deprecation policy, feature flags, stability guarantees), please read [ether/etherpad's CONTRIBUTING.md](https://github.com/ether/etherpad/blob/develop/CONTRIBUTING.md). This document only covers what's specific to plugin work.
+
+## Plugin-specific rules
+
+* **Target branch:** PRs go to `main` on this repo. Plugin repos do not use git-flow's `develop` branch.
+* **Linear commits, no merge commits.** Rebase if needed.
+* **Every bug fix must include a regression test in the same commit.**
+* **Internationalization (i18n):** every user-facing string lives in `locales/<lang>.json` and is referenced via `data-l10n-id` in templates or `html10n.get(key)` in code. No hardcoded English in markup.
+* **Accessibility (a11y):** no nested interactive elements (no `<button>` inside `<a>`); every interactive control has an accessible name; keyboard focus order matches visual order. Note that on icon-only controls you should rely on Etherpad's html10n to populate `aria-label` from the `data-l10n-id` translation — adding a hardcoded English `aria-label` blocks that and leaves the control untranslated.
+
+## Local development
+
+`ep_openid_connect` is a plugin, so you develop it inside a checkout of [ether/etherpad](https://github.com/ether/etherpad).
+
+```bash
+# Once: clone etherpad alongside this repo
+git clone https://github.com/ether/etherpad.git
+cd etherpad
+pnpm install
+
+# Install ep_openid_connect from your local clone
+pnpm run plugins i --path ../ep_openid_connect
+
+# Start the dev server (port 9001)
+pnpm --filter ep_etherpad-lite run dev
 ```
-/* The log level we are using, can be: DEBUG, INFO, WARN, ERROR */
-  "loglevel": "DEBUG",
+
+Edits in `../ep_openid_connect/` are picked up after a server restart.
+
+## Tests
+
+Tests live inside this repo and are executed by Etherpad's test harness:
+
+* Backend (Mocha): `static/tests/backend/specs/`
+* Playwright (frontend E2E): `static/tests/frontend-new/specs/`
+
+Run them from the etherpad checkout:
+
+```bash
+# Backend (no separate server needed, harness boots one)
+pnpm --filter ep_etherpad-lite run test
+
+# Playwright (requires `pnpm run dev` in another terminal)
+pnpm --filter ep_etherpad-lite run test-ui
 ```
 
-The logfile location is defined in startup script or the log is directly shown in the commandline after you have started etherpad.
-
-## General goals of Etherpad
-To make sure everybody is going in the same direction:
-* easy to install for admins and easy to use for people
-* easy to integrate into other apps, but also usable as standalone
-* lightweight and scalable
-* extensible, as much functionality should be extendable with plugins so changes don't have to be done in core.
-Also, keep it maintainable. We don't wanna end up as the monster Etherpad was!
-
-## How to work with git?
-* Don't work in your master branch.
-* Make a new branch for every feature you're working on. (This ensures that you can work you can do lots of small, independent pull requests instead of one big one with complete different features)
-* Don't use the online edit function of github (this only creates ugly and not working commits!)
-* Try to make clean commits that are easy readable (including descriptive commit messages!)
-* Test before you push. Sounds easy, it isn't!
-* Don't check in stuff that gets generated during build or runtime
-* Make small pull requests that are easy to review but make sure they do add value by themselves / individually
+Lint locally before pushing:
+
+```bash
+pnpm run lint
+```
 
 ## Coding style
-* Do write comments. (You don't have to comment every line, but if you come up with something that's a bit complex/weird, just leave a comment. Bear in mind that you will probably leave the project at some point and that other people will read your code. Undocumented huge amounts of code are worthless!)
-* Never ever use tabs
-* Indentation: JS/CSS: 2 spaces; HTML: 4 spaces
-* Don't overengineer. Don't try to solve any possible problem in one step, but try to solve problems as easy as possible and improve the solution over time!
-* Do generalize sooner or later! (if an old solution, quickly hacked together, poses more problems than it solves today, refactor it!)
-* Keep it compatible. Do not introduce changes to the public API, db schema or configurations too lightly. Don't make incompatible changes without good reasons!
-* If you do make changes, document them! (see below)
-* Use protocol independent urls "//"
-
-## Branching model / git workflow
-see git flow http://nvie.com/posts/a-successful-git-branching-model/
-
-### `master` branch
-* the stable
-* This is the branch everyone should use for production stuff
-
-### `develop`branch
-* everything that is READY to go into master at some point in time
-* This stuff is tested and ready to go out
-
-### release branches
-* stuff that should go into master very soon
-* only bugfixes go into these (see http://nvie.com/posts/a-successful-git-branching-model/ for why)
-* we should not be blocking new features to develop, just because we feel that we should be releasing it to master soon. This is the situation that release branches solve/handle.
-
-### hotfix branches
-* fixes for bugs in master
-
-### feature branches (in your own repos)
-* these are the branches where you develop your features in
-* If it's ready to go out, it will be merged into develop
-
-Over the time we pull features from feature branches into the develop branch. Every month we pull from develop into master. Bugs in master get fixed in hotfix branches. These branches will get merged into master AND develop. There should never be commits in master that aren't in develop
-
-## Documentation
-The docs are in the `doc/` folder in the git repository, so people can easily find the suitable docs for the current git revision.
-
-Documentation should be kept up-to-date. This means, whenever you add a new API method, add a new hook or change the database model, pack the relevant changes to the docs in the same pull request.
-
-You can build the docs e.g. produce html, using `make docs`. At some point in the future we will provide an online documentation. The current documentation in the github wiki should always reflect the state of `master` (!), since there are no docs in master, yet.
-
-## Testing
-Front-end tests are found in the `tests/frontend/` folder in the repository. Run them by pointing your browser to `<yourdomainhere>/tests/frontend`.
-
-Back-end tests can be run from the `src` directory, via `npm test`.
-
-## Things you can help with
-Etherpad is much more than software.  So if you aren't a developer then worry not, there is still a LOT you can do!  A big part of what we do is community engagement.  You can help in the following ways
- * Triage bugs (applying labels) and confirming their existence
- * Testing fixes (simply applying them and seeing if it fixes your issue or not) - Some git experience required
- * Notifying large site admins of new releases
- * Writing Changelogs for releases
- * Creating Windows packages
- * Creating releases
- * Bumping dependencies periodically and checking they don't break anything
- * Write proposals for grants
- * Co-Author and Publish CVEs
- * Work with SFC to maintain legal side of project
- * Maintain TODO page - https://github.com/ether/etherpad-lite/wiki/TODO#IMPORTANT_TODOS
 
+* JS/CSS/HTML: 2 spaces, no tabs.
+* `pnpm run lint` must pass (configured via `eslint-config-etherpad`).
+* Avoid breaking changes to public hooks, the line-attribute storage shape, or HTML export output. The backend export spec enforces a stable shape.
+
+## Bug reports
+
+Please include:
+
+* Etherpad version, ep_openid_connect version, browser + OS
+* Steps to reproduce
+* What you expected, what actually happened
+* Server log excerpt (set `"loglevel": "DEBUG"` in `settings.json` for verbose output)
+
+## AI agents
+
+If you are an LLM/agent contributor, also read [`AGENTS.md`](AGENTS.md) — it documents the file layout, helper usage, and standing rules for autonomous edits.

package/index.js

@@ -2,7 +2,6 @@
 
 const Ajv = require('ajv/dist/jtd');
 const {URL} = require('url');
-const {Issuer, generators} = require('openid-client');
 
 let logger = {};
 for (const level of ['debug', 'info', 'warn', 'error']) {
@@ -14,7 +13,14 @@ const defaultSettings = {
   user_properties: {},
 };
 let settings;
-let oidcClient = null;
+let oidcConfig = null;
+// openid-client@6 is ESM-only, so it must be loaded with a dynamic import from
+// this CommonJS module. The reference is cached after the first call.
+let oidc = null;
+const loadOidc = async () => {
+  if (oidc == null) oidc = await import('openid-client');
+  return oidc;
+};
 
 const validSettings = new Ajv().compile({
   properties: {
@@ -53,23 +59,35 @@ const validateSubClaim = (sub) => {
   }
 };
 
-const discoverIssuer = async (issuerUrl) => {
-  issuerUrl = new URL(issuerUrl);
+const isHttp = (urlString) => {
+  try {
+    return new URL(urlString).protocol === 'http:';
+  } catch (e) {
+    return false;
+  }
+};
+
+const discoverConfig = async (issuerUrl, clientId, clientAuth) => {
+  const url = new URL(issuerUrl);
   // https://openid.net/specs/openid-connect-discovery-1_0.html#IssuerDiscovery says that the URI
   // must not have query or fragment components.
-  if (issuerUrl.search) {
-    throw new Error(`Unexpected query in issuer URL (${issuerUrl}): ${issuerUrl.search}`);
+  if (url.search) {
+    throw new Error(`Unexpected query in issuer URL (${url}): ${url.search}`);
   }
-  if (issuerUrl.hash) {
-    throw new Error(`Unexpected fragment in issuer URL (${issuerUrl}): ${issuerUrl.hash}`);
+  if (url.hash) {
+    throw new Error(`Unexpected fragment in issuer URL (${url}): ${url.hash}`);
   }
-  let issuer;
+  // openid-client@6 rejects http:// issuers by default; opt back in for
+  // localhost / private-network providers (matches v5 behaviour).
+  const options = url.protocol === 'http:'
+      ? {execute: [oidc.allowInsecureRequests]}
+      : undefined;
   try {
-    issuer = await Issuer.discover(issuerUrl.href);
+    return await oidc.discovery(url, clientId, undefined, clientAuth, options);
   } catch (err) {
     // The URL used to get the issuer metadata doesn't exactly follow RFC 8615; see:
     // https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig
-    const discoveryUrl = new URL(issuerUrl);
+    const discoveryUrl = new URL(url);
     if (!discoveryUrl.pathname.includes('/.well-known/')) {
       discoveryUrl.pathname =
           `${discoveryUrl.pathname.replace(/\/$/, '')}/.well-known/openid-configuration`;
@@ -80,22 +98,36 @@ const discoverIssuer = async (issuerUrl) => {
         `Does your issuer support Discovery? (hint: ${discoveryUrl})`);
     throw err;
   }
-  logger.info('OpenID Connect Discovery complete.');
-  return issuer;
 };
 
-const getIssuer = async (settings) => {
-  if (settings.issuer) return await discoverIssuer(settings.issuer);
-  return new Issuer(settings.issuer_metadata);
+const buildConfig = async (settings) => {
+  // openid-client@5 defaulted the token endpoint auth method to
+  // `client_secret_basic`; v6 defaults to `client_secret_post`. Pin the
+  // method explicitly so existing IdP registrations keep working.
+  const clientAuth = oidc.ClientSecretBasic(settings.client_secret);
+  if (settings.issuer) {
+    const config =
+        await discoverConfig(settings.issuer, settings.client_id, clientAuth);
+    logger.info('OpenID Connect Discovery complete.');
+    return config;
+  }
+  const config =
+      new oidc.Configuration(settings.issuer_metadata, settings.client_id, undefined, clientAuth);
+  if (isHttp(settings.issuer_metadata && settings.issuer_metadata.issuer)) {
+    oidc.allowInsecureRequests(config);
+  }
+  return config;
 };
 
 exports.init_ep_openid_connect = async (hookName, {logger: l}) => {
   if (l != null) logger = l;
+  await loadOidc();
 };
 
 exports.loadSettings = async (hookName, {settings: {ep_openid_connect: s = {}}}) => {
-  oidcClient = null;
+  oidcConfig = null;
   settings = null;
+  await loadOidc();
   if (!validSettings(s)) {
     logger.error('Invalid settings. Detailed validation errors:', validSettings.errors);
     return;
@@ -121,12 +153,7 @@ exports.loadSettings = async (hookName, {settings: {ep_openid_connect: s = {}}})
   // Make sure base_url ends with '/' so that relative URLs are appended:
   if (!settings.base_url.endsWith('/')) settings.base_url += '/';
   logger.debug('Settings:', {...settings, client_secret: '********'});
-  oidcClient = new (await getIssuer(settings)).Client({
-    client_id: settings.client_id,
-    client_secret: settings.client_secret,
-    response_types: ['code'],
-    redirect_uris: [endpointUrl('callback')],
-  });
+  oidcConfig = await buildConfig(settings);
   logger.info('Configured.');
 };
 
@@ -137,16 +164,22 @@ exports.expressCreateServer = (hookName, {app}) => {
     // otherwise the user could be caught in an infinite redirect loop.
     try {
       logger.debug(`Processing ${req.url}`);
-      if (oidcClient == null) {
+      if (oidcConfig == null) {
         logger.warn('Not configured; ignoring request.');
         return next();
       }
-      const params = oidcClient.callbackParams(req);
       const oidcSession = req.session.ep_openid_connect || {};
       if (oidcSession.callbackChecks == null) throw new Error('missing authentication checks');
-      const tokenset =
-          await oidcClient.callback(endpointUrl('callback'), params, oidcSession.callbackChecks);
-      const userinfo = await oidcClient.userinfo(tokenset);
+      const currentUrl = new URL(req.originalUrl || req.url, settings.base_url);
+      const tokens = await oidc.authorizationCodeGrant(oidcConfig, currentUrl, {
+        expectedNonce: oidcSession.callbackChecks.nonce,
+        expectedState: oidcSession.callbackChecks.state,
+        pkceCodeVerifier: oidcSession.callbackChecks.code_verifier,
+        idTokenExpected: true,
+      });
+      const claims = tokens.claims();
+      const userinfo =
+          await oidc.fetchUserInfo(oidcConfig, tokens.access_token, claims && claims.sub);
       validateSubClaim(userinfo.sub);
       // The user has successfully authenticated, but don't set req.session.user here -- do it in
       // the authenticate hook so that Etherpad can log the authentication success. However, DO "log
@@ -165,33 +198,36 @@ exports.expressCreateServer = (hookName, {app}) => {
       return next(err);
     }
   });
-  app.get(ep('login'), (req, res, next) => {
-    logger.debug(`Processing ${req.url}`);
-    if (oidcClient == null) {
-      logger.warn('Not configured; ignoring request.');
-      return next();
+  app.get(ep('login'), async (req, res, next) => {
+    try {
+      logger.debug(`Processing ${req.url}`);
+      if (oidcConfig == null) {
+        logger.warn('Not configured; ignoring request.');
+        return next();
+      }
+      if (req.session.ep_openid_connect == null) req.session.ep_openid_connect = {};
+      const oidcSession = req.session.ep_openid_connect;
+      const code_verifier = oidc.randomPKCECodeVerifier(); // RFC7636
+      const code_challenge = await oidc.calculatePKCECodeChallenge(code_verifier);
+      const nonce = oidc.randomNonce();
+      const state = oidc.randomState();
+      oidcSession.callbackChecks = {nonce, state, code_verifier};
+      const url = oidc.buildAuthorizationUrl(oidcConfig, {
+        redirect_uri: endpointUrl('callback'),
+        scope: settings.scope.join(' '),
+        nonce,
+        state,
+        code_challenge,
+        code_challenge_method: 'S256',
+      });
+      res.redirect(303, url.toString());
+    } catch (err) {
+      return next(err);
     }
-    if (req.session.ep_openid_connect == null) req.session.ep_openid_connect = {};
-    const oidcSession = req.session.ep_openid_connect;
-    const commonParams = {
-      nonce: generators.nonce(),
-      scope: settings.scope.join(' '),
-      state: generators.state(),
-    };
-    oidcSession.callbackChecks = {
-      ...commonParams,
-      code_verifier: generators.codeVerifier(), // RFC7636
-    };
-    res.redirect(303, oidcClient.authorizationUrl({
-      ...commonParams,
-      // RFC7636
-      code_challenge: generators.codeChallenge(oidcSession.callbackChecks.code_verifier),
-      code_challenge_method: 'S256',
-    }));
   });
   app.get(ep('logout'), (req, res, next) => {
     logger.debug(`Processing ${req.url}`);
-    if (oidcClient == null) {
+    if (oidcConfig == null) {
       logger.warn('Not configured; ignoring request.');
       return next();
     }
@@ -200,7 +236,7 @@ exports.expressCreateServer = (hookName, {app}) => {
 };
 
 exports.authenticate = (hookName, {req, res, users}) => {
-  if (oidcClient == null) return;
+  if (oidcConfig == null) return;
   logger.debug('authenticate hook for', req.url);
   const {ep_openid_connect: {userinfo} = {}} = req.session;
   if (userinfo == null) { // Nullish means the user isn't authenticated.
@@ -228,7 +264,7 @@ exports.authenticate = (hookName, {req, res, users}) => {
 };
 
 exports.authnFailure = (hookName, {req, res}) => {
-  if (oidcClient == null) return;
+  if (oidcConfig == null) return;
   // Normally the user is redirected to the login page which would then redirect the user back once
   // authenticated. For non-GET requests, send a 401 instead because users can't be redirected back.
   // Also send a 401 if an Authorization header is present to facilitate API error handling.
@@ -268,7 +304,7 @@ exports.authnFailure = (hookName, {req, res}) => {
 };
 
 exports.preAuthorize = (hookName, {req}) => {
-  if (oidcClient == null) return;
+  if (oidcConfig == null) return;
   if (req.path.startsWith(ep(''))) return true;
   return;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ep_openid_connect",
-  "version": "3.0.21",
+  "version": "3.0.23",
   "description": "Etherpad plugin to authenticate users against an OpenID Connect provider.",
   "main": "index.js",
   "repository": {
@@ -24,7 +24,7 @@
   "homepage": "https://github.com/ether/ep_openid_connect#readme",
   "dependencies": {
     "ajv": "^8.20.0",
-    "openid-client": "^5.7.1"
+    "openid-client": "^6.8.4"
   },
   "devDependencies": {
     "eslint": "^8.57.1",