ep_openid_connect 3.0.23 → 3.0.25

package/AGENTS.md

@@ -0,0 +1,58 @@
+# Agent Guide — ep_openid_connect
+
+Etherpad plugin to authenticate users against an OpenID Connect provider.
+
+## Tech stack
+
+* Etherpad plugin framework (hooks declared in `ep.json`)
+
+## Project structure
+
+```
+ep_openid_connect/
+├── AGENTS.md
+├── CHANGELOG.md
+├── CONTRIBUTING.md
+├── ep.json
+├── index.js
+├── package.json
+├── static/
+│   ├── tests/
+```
+
+## Helpers used
+
+_None — `ep_plugin_helpers` is not a dependency. Adoption is part of the helpers-adoption sweep (Phase 4)._
+
+
+## Helpers NOT used
+
+_To be audited in the helpers-adoption sweep (Phase 4)._
+
+
+## Running tests locally
+
+`ep_openid_connect` runs inside Etherpad's test harness. From an etherpad checkout that has installed this plugin via `pnpm run plugins i --path ../ep_openid_connect`:
+
+```bash
+# Backend (Mocha) — harness boots its own server
+pnpm --filter ep_etherpad-lite run test
+
+# Playwright — needs `pnpm run dev` in a second terminal
+pnpm --filter ep_etherpad-lite run test-ui
+```
+
+## Standing rules for agent edits
+
+* PRs target `main`. Linear commits, no merge commits.
+* Every bug fix includes a regression test in the same commit.
+* All user-facing strings in `locales/`. No hardcoded English in templates.
+* No hardcoded `aria-label` on icon-only controls — etherpad's html10n auto-populates `aria-label` from the localized string when (a) the element has a `data-l10n-id` and (b) no author-supplied `aria-label` is present. Adding a hardcoded English `aria-label` blocks that and leaves it untranslated. (See `etherpad-lite/src/static/js/vendors/html10n.ts:665-678`.)
+* No nested interactive elements (no `<button>` inside `<a>`).
+* LLM/Agent contributions are explicitly welcomed by maintainers.
+
+## Quick reference: hooks declared in `ep.json`
+
+* Server: `authenticate`, `authnFailure`, `expressCreateServer`, `init_ep_openid_connect`, `loadSettings`, `preAuthorize`
+
+When adding a hook, register it in both `ep.json` *and* the matching `exports.<hook> = ...` in the JS file.

package/README.md

@@ -49,6 +49,11 @@ Etherpad's `requireAuthentication` setting must be `true`.
 * `client_id` (required): The OAuth2 client ID issued by the identity provider.
 * `client_secret` (required): The OAuth2 client secret issued by the identity
   provider.
+* `token_endpoint_auth_method` (optional; defaults to `client_secret_basic`):
+  Client authentication method to use for token endpoint requests. Supported
+  values are `client_secret_basic` and `client_secret_post`. Use
+  `client_secret_post` if your identity provider expects the client secret in
+  the token request body instead of the HTTP `Authorization` header.
 * `base_url` (required): The public base Etherpad URL. When registering Etherpad
   with your identity provider, the redirect URL (a.k.a. callback URL) is this
   base URL plus `/ep_openid_connect/callback`.

package/index.js

@@ -10,6 +10,7 @@ for (const level of ['debug', 'info', 'warn', 'error']) {
 const defaultSettings = {
   prohibited_usernames: ['admin', 'guest'],
   scope: ['openid'],
+  token_endpoint_auth_method: 'client_secret_basic',
   user_properties: {},
 };
 let settings;
@@ -33,6 +34,7 @@ const validSettings = new Ajv().compile({
     issuer_metadata: {},
     prohibited_usernames: {elements: {type: 'string'}},
     scope: {elements: {type: 'string'}},
+    token_endpoint_auth_method: {enum: ['client_secret_basic', 'client_secret_post']},
     user_properties: {values: {
       optionalProperties: {
         claim: {type: 'string'},
@@ -100,11 +102,25 @@ const discoverConfig = async (issuerUrl, clientId, clientAuth) => {
   }
 };
 
+const getClientAuth = (settings) => {
+  switch (settings.token_endpoint_auth_method) {
+    case 'client_secret_basic':
+      // eslint-disable-next-line new-cap
+      return oidc.ClientSecretBasic(settings.client_secret);
+    case 'client_secret_post':
+      // eslint-disable-next-line new-cap
+      return oidc.ClientSecretPost(settings.client_secret);
+    default:
+      throw new Error(
+          `Unsupported token endpoint auth method: ${settings.token_endpoint_auth_method}`);
+  }
+};
+
 const buildConfig = async (settings) => {
   // openid-client@5 defaulted the token endpoint auth method to
   // `client_secret_basic`; v6 defaults to `client_secret_post`. Pin the
-  // method explicitly so existing IdP registrations keep working.
-  const clientAuth = oidc.ClientSecretBasic(settings.client_secret);
+  // default method explicitly so existing IdP registrations keep working.
+  const clientAuth = getClientAuth(settings);
   if (settings.issuer) {
     const config =
         await discoverConfig(settings.issuer, settings.client_id, clientAuth);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ep_openid_connect",
-  "version": "3.0.23",
+  "version": "3.0.25",
   "description": "Etherpad plugin to authenticate users against an OpenID Connect provider.",
   "main": "index.js",
   "repository": {

package/static/tests/backend/specs/tests.js

@@ -125,6 +125,31 @@ describe(__filename, function () {
     assert.equal(msg.data.readonly, false);
   });
 
+  describe('token_endpoint_auth_method', function () {
+    for (const tokenEndpointAuthMethod of ['client_secret_basic', 'client_secret_post']) {
+      it(`supports ${tokenEndpointAuthMethod}`, async function () {
+        await epOpenidConnect.loadSettings('loadSettings', {settings: {ep_openid_connect: {
+          ...pluginSettings,
+          token_endpoint_auth_method: tokenEndpointAuthMethod,
+        }}});
+        const padId = common.randomString();
+        const url = new URL(`/p/${padId}`, common.baseUrl).toString();
+        const res = await login(agent, issuer, url, 'normalUser');
+        assert.equal(res.request.url, url);
+        assert.equal(res.status, 200);
+      });
+    }
+
+    it('rejects unsupported methods', async function () {
+      await epOpenidConnect.loadSettings('loadSettings', {settings: {ep_openid_connect: {
+        ...pluginSettings,
+        token_endpoint_auth_method: 'unsupported',
+      }}});
+      await agent.get(new URL('/ep_openid_connect/login', common.baseUrl))
+          .expect(401);
+    });
+  });
+
   it('noCreate user is unable to create a pad', async function () {
     const padId = common.randomString();
     const url = new URL(`/p/${padId}`, common.baseUrl).toString();