ep_openid_connect 3.0.42 → 3.0.44

package/.github/workflows/backend-tests.yml

@@ -26,11 +26,11 @@ jobs:
         with:
           repository: ether/etherpad-lite
           path: etherpad-lite
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         name: Install Node.js
         with:
           node-version: 25
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v6.1.0
         name: Install pnpm
         with:
           package_json_file: ./etherpad-lite/package.json

package/.github/workflows/frontend-tests.yml

@@ -16,11 +16,11 @@ jobs:
         with:
           repository: ether/etherpad-lite
           path: etherpad-lite
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         name: Install Node.js
         with:
           node-version: 25
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v6.1.0
         name: Install pnpm
         with:
           package_json_file: ./etherpad-lite/package.json

package/.github/workflows/lint.yml

@@ -0,0 +1,39 @@
+name: Lint
+
+on:
+  workflow_call:
+
+jobs:
+  lint:
+    name: ESLint
+    runs-on: ubuntu-latest
+    # `eslint .` executes .eslintrc.cjs and every installed ESLint plugin, so
+    # don't hand it the caller's contents:write / id-token:write token.
+    permissions:
+      contents: read
+    steps:
+      - name: Check out plugin repository
+        uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        name: Install Node.js
+        with:
+          node-version: 25
+      - uses: pnpm/action-setup@v6.1.0
+        name: Install pnpm
+        with:
+          version: 10
+          run_install: false
+      - name: Get pnpm store directory
+        shell: bash
+        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
+      - uses: actions/cache@v6
+        name: Setup pnpm cache
+        with:
+          path: ${{ env.STORE_PATH }}
+          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-
+      - name: Install dependencies
+        run: pnpm install --ignore-scripts
+      - name: Run ESLint
+        run: pnpm run lint

package/.github/workflows/npmpublish.yml

@@ -18,20 +18,24 @@ jobs:
       contents: write   # for the atomic version-bump push (branch + tag)
       id-token: write   # for npm OIDC trusted publishing
     steps:
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
-          # OIDC trusted publishing needs npm >= 11.5.1, which requires
-          # Node >= 20.17.0. setup-node's `20` resolves to the latest
-          # 20.x, which satisfies that.
-          node-version: 25
+          # OIDC trusted publishing needs npm >= 11.5.1. Node 24 is an LTS
+          # line that every npm 11.x and 12.x supports; Node 25 is not —
+          # npm 12 requires ^22.22.2 || ^24.15.0 || >=26.0.0, so on Node 25
+          # the upgrade step below died with EBADENGINE and no plugin could
+          # publish.
+          node-version: 24
           registry-url: https://registry.npmjs.org/
+        # Pinned to a range rather than @latest: the next npm major dropping
+        # this Node line would silently break publishing fleet-wide again.
       - name: Upgrade npm to >=11.5.1 (required for trusted publishing)
-        run: npm install -g npm@latest
+        run: npm install -g npm@^11.5.1
       - name: Check out Etherpad core
         uses: actions/checkout@v7
         with:
           repository: ether/etherpad-lite
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v6.1.0
         name: Install pnpm
         with:
           run_install: false
@@ -73,7 +77,7 @@ jobs:
           # `pnpm version patch` bumps package.json, makes a commit, and creates
           # a `v<new-version>` tag. Capture the new tag name from package.json
           # rather than parsing pnpm's output, which has historically varied.
-          # Bump the patch component directly with Node. pnpm/action-setup@v6
+          # Bump the patch component directly with Node. pnpm/action-setup@v6.0.10
           # sometimes installs pnpm 11 pre-releases even when version: 10.x is
           # requested (pnpm/action-setup#225); those pre-releases either skip
           # the git commit/tag or reject --no-git-tag-version as unknown.

package/.github/workflows/test-and-release.yml

@@ -8,6 +8,9 @@ permissions:
   id-token: write
 
 jobs:
+  lint:
+    uses: ./.github/workflows/lint.yml
+    secrets: inherit
   backend:
     uses: ./.github/workflows/backend-tests.yml
     secrets: inherit
@@ -17,6 +20,7 @@ jobs:
   release:
     if: ${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main' }}
     needs:
+      - lint
       - backend
       - frontend
     permissions:

package/index.js

@@ -222,8 +222,8 @@ const buildConfig = async (settings) => {
   }
   if (customFetch != null) config[oidc.customFetch] = customFetch;
   const source = settings.token_endpoint_auth_method ? 'configured' : 'auto-picked';
-  logger.info(`${phaseLog} Token endpoint auth method: ${method} (${source})` +
-      (caBundle ? ' with custom CA bundle.' : '.'));
+  const caNote = caBundle ? ' with custom CA bundle.' : '.';
+  logger.info(`${phaseLog} Token endpoint auth method: ${method} (${source})${caNote}`);
   return config;
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ep_openid_connect",
-  "version": "3.0.42",
+  "version": "3.0.44",
   "description": "Etherpad plugin to authenticate users against an OpenID Connect provider.",
   "main": "index.js",
   "repository": {
@@ -24,15 +24,15 @@
   "homepage": "https://github.com/ether/ep_openid_connect#readme",
   "dependencies": {
     "ajv": "^8.20.0",
-    "openid-client": "^6.8.4",
-    "undici": "^8.7.0"
+    "openid-client": "^6.8.8",
+    "undici": "^8.11.2"
   },
   "devDependencies": {
     "eslint": "^8.57.1",
-    "eslint-config-etherpad": "^4.0.5",
-    "oidc-provider": "^9.9.0",
-    "supertest": "^6.3.4",
-    "typescript": "^6.0.3"
+    "eslint-config-etherpad": "^5.0.0",
+    "oidc-provider": "^9.12.2",
+    "supertest": "^7.3.0",
+    "typescript": "~6.0.3"
   },
   "scripts": {
     "lint": "eslint .",
@@ -43,6 +43,6 @@
     "url": "https://etherpad.org/"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=22.0.0"
   }
 }

package/static/tests/backend/oidc-provider.js

@@ -60,8 +60,8 @@ class OidcProvider {
           // are unaffected. `emptyRoles` gets an empty array to exercise the
           // "no matching role" path.
           ...(sub.includes('emptyRoles') ? {roles: []}
-              : sub.includes('role') ? {roles: ['etherpad_admin', 'unrelated_role']}
-              : {}),
+          : sub.includes('role') ? {roles: ['etherpad_admin', 'unrelated_role']}
+          : {}),
         }),
       }),
       jwks: {

package/static/tests/backend/specs/auto_pick_auth_method.js

@@ -43,7 +43,7 @@ describe(__filename, function () {
     };
   });
 
-  beforeEach(function () {
+  beforeEach(async function () {
     agent = supertest.agent('');
     settings.requireAuthentication = true;
     settings.requireAuthorization = false;

package/static/tests/backend/specs/custom_ca.js

@@ -11,7 +11,7 @@
 const Provider = require('oidc-provider').default;
 const MemoryAdapter = require('oidc-provider/lib/adapters/memory_adapter').default;
 const assert = require('assert').strict;
-const child_process = require('child_process');
+const childProcess = require('child_process');
 const common = require('ep_etherpad-lite/tests/backend/common');
 const epOpenidConnect = require('../../../../index');
 const fs = require('fs');
@@ -21,6 +21,17 @@ const path = require('path');
 const settings = require('ep_etherpad-lite/node/utils/Settings');
 const util = require('util');
 
+// The TLS failure surfaces with different wording depending on the Node and
+// undici versions in play, so match any of the known phrasings.
+const TLS_ERROR_RE = new RegExp([
+  'self-signed',
+  'self signed',
+  'unable to verify',
+  'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
+  'CERT',
+  'TLS',
+].join('|'), 'i');
+
 // Generate a self-signed cert valid for localhost via the OpenSSL CLI.
 // Using a CLI avoids pulling in `selfsigned`+`@peculiar/x509`+`node-forge`
 // as devDependencies just for one test, and `openssl` is available on every
@@ -29,15 +40,22 @@ const generateSelfSignedCert = () => {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ep-openid-cert-'));
   const keyPath = path.join(dir, 'key.pem');
   const certPath = path.join(dir, 'cert.pem');
-  child_process.execFileSync('openssl', [
-    'req', '-x509',
-    '-newkey', 'rsa:2048',
+  childProcess.execFileSync('openssl', [
+    'req',
+    '-x509',
+    '-newkey',
+    'rsa:2048',
     '-nodes',
-    '-keyout', keyPath,
-    '-out', certPath,
-    '-days', '1',
-    '-subj', '/CN=localhost',
-    '-addext', 'subjectAltName=DNS:localhost,IP:127.0.0.1',
+    '-keyout',
+    keyPath,
+    '-out',
+    certPath,
+    '-days',
+    '1',
+    '-subj',
+    '/CN=localhost',
+    '-addext',
+    'subjectAltName=DNS:localhost,IP:127.0.0.1',
   ], {stdio: 'pipe'});
   return {
     dir,
@@ -156,13 +174,13 @@ describe(__filename, function () {
     });
   });
 
-  beforeEach(function () {
+  beforeEach(async function () {
     settings.requireAuthentication = true;
     settings.requireAuthorization = false;
     settings.users = {};
   });
 
-  afterEach(function () {
+  afterEach(async function () {
     settings.requireAuthentication = backup.settings.requireAuthentication;
     settings.requireAuthorization = backup.settings.requireAuthorization;
     settings.users = backup.settings.users;
@@ -171,27 +189,31 @@ describe(__filename, function () {
   after(async function () {
     if (provider != null) await provider.stop();
     provider = null;
-    if (pems && pems.dir) try { fs.rmSync(pems.dir, {recursive: true, force: true}); } catch (_) { /* ignore */ }
+    if (pems && pems.dir) {
+      try {
+        fs.rmSync(pems.dir, {recursive: true, force: true});
+      } catch (_) { /* ignore */ }
+    }
   });
 
   describe('loadCaBundle', function () {
     const {loadCaBundle} = epOpenidConnect.exportedForTestingOnly;
 
-    it('returns null for an empty / missing value', function () {
+    it('returns null for an empty / missing value', async function () {
       assert.equal(loadCaBundle(undefined), null);
       assert.equal(loadCaBundle(null), null);
       assert.equal(loadCaBundle(''), null);
     });
 
-    it('returns inline PEM content unchanged', function () {
+    it('returns inline PEM content unchanged', async function () {
       assert.equal(loadCaBundle(pems.cert), pems.cert);
     });
 
-    it('reads PEM content from a path', function () {
+    it('reads PEM content from a path', async function () {
       assert.equal(loadCaBundle(pems.certPath), pems.cert);
     });
 
-    it('throws on a non-existent path', function () {
+    it('throws on a non-existent path', async function () {
       assert.throws(() => loadCaBundle('/this/path/does/not/exist.pem'),
           /ENOENT|no such file/);
     });
@@ -221,7 +243,7 @@ describe(__filename, function () {
               if (e.code) messages.push(String(e.code));
             }
             const joined = messages.join(' | ');
-            return /self-signed|self signed|unable to verify|UNABLE_TO_VERIFY_LEAF_SIGNATURE|CERT|TLS/i.test(joined);
+            return TLS_ERROR_RE.test(joined);
           });
     });
 

package/static/tests/backend/specs/default_type.js

@@ -10,7 +10,7 @@ const baseSettings = () => ({
 });
 
 describe(__filename, function () {
-  it('still accepts a string default on user_properties', function () {
+  it('still accepts a string default on user_properties', async function () {
     const s = {
       ...baseSettings(),
       user_properties: {displayname: {claim: 'name', default: 'Anon'}},
@@ -19,7 +19,7 @@ describe(__filename, function () {
         `expected valid settings, got errors: ${JSON.stringify(validSettings.errors)}`);
   });
 
-  it('accepts a boolean default on user_properties (regression for #100)', function () {
+  it('accepts a boolean default on user_properties (regression for #100)', async function () {
     const s = {
       ...baseSettings(),
       user_properties: {
@@ -29,17 +29,17 @@ describe(__filename, function () {
       },
     };
     assert(validSettings(s),
-        `expected boolean defaults to validate, got errors: ` +
+        'expected boolean defaults to validate, got errors: ' +
         `${JSON.stringify(validSettings.errors)}`);
   });
 
-  it('accepts a numeric default on user_properties', function () {
+  it('accepts a numeric default on user_properties', async function () {
     const s = {
       ...baseSettings(),
       user_properties: {quota: {default: 100}},
     };
     assert(validSettings(s),
-        `expected numeric defaults to validate, got errors: ` +
+        'expected numeric defaults to validate, got errors: ' +
         `${JSON.stringify(validSettings.errors)}`);
   });
 });

package/static/tests/backend/specs/pick_auth_method.js

@@ -5,21 +5,21 @@ const {pickAuthMethod} = require('../../../..').exportedForTestingOnly;
 
 describe(__filename, function () {
   describe('with no override', function () {
-    it('prefers client_secret_post when advertised', function () {
+    it('prefers client_secret_post when advertised', async function () {
       assert.equal(
           pickAuthMethod(['client_secret_basic', 'client_secret_post']),
           'client_secret_post');
     });
 
-    it('uses client_secret_basic when only that is advertised', function () {
+    it('uses client_secret_basic when only that is advertised', async function () {
       assert.equal(pickAuthMethod(['client_secret_basic']), 'client_secret_basic');
     });
 
-    it('uses client_secret_post when only that is advertised', function () {
+    it('uses client_secret_post when only that is advertised', async function () {
       assert.equal(pickAuthMethod(['client_secret_post']), 'client_secret_post');
     });
 
-    it('ignores unsupported methods', function () {
+    it('ignores unsupported methods', async function () {
       // None of these are methods this plugin can implement, so the picker
       // must fall back rather than pretend to support them.
       assert.equal(
@@ -27,42 +27,43 @@ describe(__filename, function () {
           'client_secret_basic');
     });
 
-    it('prefers client_secret_post even when other methods are advertised first', function () {
-      assert.equal(
-          pickAuthMethod(['private_key_jwt', 'client_secret_post', 'client_secret_basic']),
-          'client_secret_post');
-    });
+    it('prefers client_secret_post even when other methods are advertised first',
+        async function () {
+          assert.equal(
+              pickAuthMethod(['private_key_jwt', 'client_secret_post', 'client_secret_basic']),
+              'client_secret_post');
+        });
 
-    it('falls back to client_secret_basic when supported is undefined', function () {
+    it('falls back to client_secret_basic when supported is undefined', async function () {
       // RFC 8414 §2: absence of token_endpoint_auth_methods_supported defaults
       // to client_secret_basic.
       assert.equal(pickAuthMethod(undefined), 'client_secret_basic');
     });
 
-    it('falls back to client_secret_basic when supported is empty', function () {
+    it('falls back to client_secret_basic when supported is empty', async function () {
       assert.equal(pickAuthMethod([]), 'client_secret_basic');
     });
 
-    it('falls back to client_secret_basic when supported is not an array', function () {
+    it('falls back to client_secret_basic when supported is not an array', async function () {
       assert.equal(pickAuthMethod('client_secret_post'), 'client_secret_basic');
       assert.equal(pickAuthMethod(null), 'client_secret_basic');
     });
   });
 
   describe('with override', function () {
-    it('honours an explicit client_secret_basic override', function () {
+    it('honours an explicit client_secret_basic override', async function () {
       assert.equal(
           pickAuthMethod(['client_secret_post'], 'client_secret_basic'),
           'client_secret_basic');
     });
 
-    it('honours an explicit client_secret_post override', function () {
+    it('honours an explicit client_secret_post override', async function () {
       assert.equal(
           pickAuthMethod(['client_secret_basic'], 'client_secret_post'),
           'client_secret_post');
     });
 
-    it('honours override even when supported list is missing', function () {
+    it('honours override even when supported list is missing', async function () {
       assert.equal(
           pickAuthMethod(undefined, 'client_secret_post'),
           'client_secret_post');