pas.plugins.oidc 2.0.0b3__tar.gz → 2.0.0rc1__tar.gz

pas_plugins_oidc-2.0.0rc1/.gitignore

@@ -0,0 +1,52 @@
+*.egg-info
+*.pyc
+*.pyo
+
+# translation related
+*.mo
+
+# tools related
+build/
+.coverage
+.*project
+coverage.xml
+dist/
+docs/_build
+__pycache__/
+.tox
+node_modules/
+
+# venv / buildout related
+bin/
+develop-eggs/
+eggs/
+.eggs/
+etc/
+.installed.cfg
+include/
+lib/
+lib64
+.mr.developer.cfg
+parts/
+pyvenv.cfg
+var/
+local.cfg
+.venv
+
+# mxdev
+/instance/
+/.make-sentinels/
+/*-mxdev.txt
+/reports/
+/sources/
+/venv/
+.installed.txt
+constraints*.txt
+requirements*.txt
+
+requirements-mxdev.txt
+
+/.python-version
+/dependencies.svg
+.pytest_cache
+.ruff_cache

pas.plugins.oidc-2.0.0b3/CHANGES.md → pas_plugins_oidc-2.0.0rc1/CHANGELOG.md

@@ -9,12 +9,41 @@
 
 <!-- towncrier release notes start -->
 
+## 2.0.0rc1 (2025-03-26)
+
+
+### Breaking changes:
+
+- Drop support for Python 3.8 @ericof 
+- Drop support for Python 3.9 @ericof 
+
+
+### New features:
+
+- Add support for Plone 6.1 @ericof 
+- Add support for Python 3.12 @ericof 
+- Add support for Python 3.13 @ericof 
+
+
+### Internal:
+
+- Move to pyproject.toml, hatchling and uv @ericof [#71](https://github.com/collective/pas.plugins.oidc/issues/71)
+- Update GHA workflows @ericof 
+
+## 2.0.0b4 (2025-02-28)
+
+
+### New features:
+
+- Add backchannel logout implementation for classic ui session @mamico [#67](https://github.com/collective/pas.plugins.oidc/issues/67)
+
 ## 2.0.0b3 (2025-02-03)
 
 
 ### New features:
 
 - Register the adapter as needed by the @login endpoint present in plone.restapi @erral [#47](https://github.com/collective/pas.plugins.oidc/issues/47)
+- Changes to make compatible with OAM (Oracle Access Manager) @djay [#65](https://github.com/collective/pas.plugins.oidc/pull/64)
 
 
 ### Internal:

{pas.plugins.oidc-2.0.0b3 → pas_plugins_oidc-2.0.0rc1}/PKG-INFO

@@ -1,61 +1,57 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: pas.plugins.oidc
-Version: 2.0.0b3
+Version: 2.0.0rc1
 Summary: OIDC support for Plone sites
-Home-page: https://github.com/collective/pas.plugins.oidc
-Author: mamico
-Author-email: mauro.amico@gmail.com
-License: GPL version 2
-Project-URL: PyPI, https://pypi.python.org/pypi/pas.plugins.oidc
+Project-URL: Homepage, https://github.com/collective/pas.plugins.oidc
+Project-URL: PyPI, https://pypi.org/project/pas.plugins.oidc
 Project-URL: Source, https://github.com/collective/pas.plugins.oidc
 Project-URL: Tracker, https://github.com/collective/pas.plugins.oidc/issues
-Keywords: Python Plone CMS PAS Authentication OAuth OIDC
+Author-email: Mauro Amico <mauro.amico@gmail.com>, Érico Andrei <ericof@plone.org>
+License-Expression: GPL-2.0-only
+License-File: LICENSE.GPL
+License-File: LICENSE.md
+Keywords: Authentication,CMS,OAuth,OIDC,PAS,Plone,Python
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Web Environment
 Classifier: Framework :: Plone
-Classifier: Framework :: Plone :: Addon
 Classifier: Framework :: Plone :: 6.0
+Classifier: Framework :: Plone :: 6.1
+Classifier: Framework :: Plone :: Addon
+Classifier: License :: OSI Approved :: GNU General Public License v2 (GPLv2)
+Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python
-Classifier: Programming Language :: Python :: 3.8
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
-Classifier: Operating System :: OS Independent
-Classifier: License :: OSI Approved :: GNU General Public License v2 (GPLv2)
-Requires-Python: >=3.8
-Description-Content-Type: text/markdown
-License-File: LICENSE.GPL
-License-File: LICENSE.md
-Requires-Dist: setuptools
-Requires-Dist: Plone
-Requires-Dist: Zope
-Requires-Dist: Products.CMFCore
-Requires-Dist: plone.api
-Requires-Dist: plone.app.registry
-Requires-Dist: plone.base
-Requires-Dist: plone.protect
-Requires-Dist: plone.restapi>=9.10.0
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Requires-Python: >=3.10
 Requires-Dist: oic
+Requires-Dist: plone-api
+Requires-Dist: plone-app-registry
+Requires-Dist: plone-base
+Requires-Dist: plone-protect
+Requires-Dist: plone-restapi>=9.10.0
+Requires-Dist: products-cmfcore
+Requires-Dist: products-cmfplone>=6.0
 Requires-Dist: requests
-Requires-Dist: z3c.form
+Requires-Dist: z3c-form
+Requires-Dist: zope
 Provides-Extra: test
-Requires-Dist: zope.pytestlayer; extra == "test"
-Requires-Dist: plone.app.contenttypes; extra == "test"
-Requires-Dist: plone.app.testing; extra == "test"
-Requires-Dist: plone.restapi[test]; extra == "test"
-Requires-Dist: plone.testing; extra == "test"
-Requires-Dist: pytest-cov; extra == "test"
-Requires-Dist: pytest-plone>=0.2.0; extra == "test"
-Requires-Dist: pytest-docker; extra == "test"
-Requires-Dist: pytest-mock; extra == "test"
-Requires-Dist: pytest; extra == "test"
-Requires-Dist: zest.releaser[recommended]; extra == "test"
-Requires-Dist: zestreleaser.towncrier; extra == "test"
-Requires-Dist: pytest-mock; extra == "test"
-Requires-Dist: requests-mock; extra == "test"
-
-
-<div align="center"><img alt="pas.plugins.oidc logo" src="https://raw.githubusercontent.com/collective/pas.plugins.oidc/main/docs/icon.png" width="70" /></div>
+Requires-Dist: plone-app-contenttypes; extra == 'test'
+Requires-Dist: plone-app-testing; extra == 'test'
+Requires-Dist: plone-restapi[test]; extra == 'test'
+Requires-Dist: plone-testing; extra == 'test'
+Requires-Dist: pytest; extra == 'test'
+Requires-Dist: pytest-cov; extra == 'test'
+Requires-Dist: pytest-docker; extra == 'test'
+Requires-Dist: pytest-mock; extra == 'test'
+Requires-Dist: pytest-plone>=0.5.0; extra == 'test'
+Requires-Dist: requests-mock; extra == 'test'
+Requires-Dist: zest-releaser[recommended]>=9.5.0; extra == 'test'
+Requires-Dist: zestreleaser-towncrier>=1.3.0; extra == 'test'
+Description-Content-Type: text/markdown
+
+<div align="center"><img alt="pas.plugins.oidc logo" src="https://raw.githubusercontent.com/collective/pas.plugins.oidc/main/docs/_static/icon.png" width="70" /></div>
 
 <h1 align="center">pas.plugins.oidc</h1>
 
@@ -70,7 +66,7 @@ Requires-Dist: requests-mock; extra == "test"
 
 [![PyPI - Plone Versions](https://img.shields.io/pypi/frameworkversions/plone/pas.plugins.oidc)](https://pypi.org/project/pas.plugins.oidc/)
 
-[![Meta](https://github.com/collective/pas.plugins.oidc/actions/workflows/meta.yml/badge.svg)](https://github.com/collective/pas.plugins.oidc/actions/workflows/meta.yml)
+[![CI](https://github.com/collective/pas.plugins.oidc/actions/workflows/ci.yml/badge.svg)](https://github.com/collective/pas.plugins.oidc/actions/workflows/ci.yml)
 ![Code Style](https://img.shields.io/badge/Code%20Style-Black-000000)
 
 [![GitHub contributors](https://img.shields.io/github/contributors/collective/pas.plugins.oidc)](https://github.com/collective/pas.plugins.oidc)
@@ -143,7 +139,6 @@ When using this plugin with a [Volto frontend](https://6.docs.plone.org/volto/in
 
 Also, on the OpenID provider, configure the Redirect URL as **`<Path to your Plone site>`/login-oidc/oidc**.
 
-
 #### Classic UI
 
 When using this plugin with *Plone 6 Classic UI* the standard URLs used for login (`http://localhost:8080/Plone/login`) and logout (`http://localhost:8080/Plone/logout`)
@@ -270,6 +265,40 @@ Currently, the Plone logout form is unchanged.
 Instead, for testing go to the logout page of the plugin: http://localhost:8080/Plone/acl_users/oidc/logout,
 this will take you to Keycloak to logout, and then return to the post-logout redirect URL.
 
+#### Backchannel SLO (experimental)
+
+OIDC Backchannel Logout is a server-to-server mechanism where the IdP notifies RPs via an HTTP POST request to terminate user sessions upon logout, ensuring secure and seamless Single Logout (SLO) without relying on the user's browser.
+See the specification [OpenID Connect Back-Channel Logout 1.0](https://openid.net/specs/openid-connect-backchannel-1_0.html).
+
+Current backchannel logout implementation, in this product, utilizes functionality introduced in plone.session >= 4.0.0 (Plone 6 and later) for server-side session invalidation (see plone.session PR [plone.session#26](https://github.com/plone/plone.session/pull/26)), and, at the moment, applies only to Plone Classic UI.
+
+To enable this functionality:
+
+1. Navigate to `.../acl_users/session/manage_secret` and enable the `Enable per-user keyring` option.
+
+2. Configure the OpenID Provider (e.g., Keycloak) to use the backchannel logout endpoint with the url: `.../acl_users/oidc/backchannel-logout`
+
+#### Allowed groups
+
+If you need to restrict access to a specific group, you can use the `Allowed groups` field in the plugin configuration. If the user is not in any of the groups listed, the login will be denied.
+
+To use this feature, you need to create a new scope in the OIDC Provider (e.g., Keycloak) and add the groups to the user's token.
+
+In Keycloak, go to the `Client Scopes` section and create a new scope named `groups`. Then, go to the `Mappers` tab and create a new mapper with the name `groups` and type `Group Membership` (Uncheck the `Full groups path` option).
+You can find this configuration in the `plone` realm in the `tests` directory. The `plone` client is also configured to use the `groups` scope.
+
+![Create a new scope groups](docs/_static/allowedgroups1.png)
+
+![Add a new mapper Group Membership](docs/_static/allowedgroups2.png)
+
+After that, go to the `Client Scopes` section and add the new scope to the client you are using with the plugin (for instance, `plone`).
+
+![Add the new scope to the client](docs/_static/allowedgroups3.png)
+
+Finally, in the plugin configuration, add `groups` to the scopes field.
+
+In the `Allowed groups` field, you can add the groups that are allowed to log in. For example, in this repository, you could set `Foundation Members`. Users who are not in this group will not be able to log in.
+
 ## Technical Decisions
 
 ### Usage of sessions in the login process
@@ -389,147 +418,3 @@ Run tests named `TestServiceOIDCPost`:
 ## License
 
 The project is licensed under the GPLv2.
-
-
-# Contributors
-
-- mamico, mauro.amico@gmail.com
-- erral, Mikel Larreategi
-- alecghica, alec.ghica@eaudeweb.ro
-- macagua, leonardocaballero@gmail.com
-- ericof, ericof@plone.org
-
-
-# Changelog
-
-<!--
-   You should *NOT* be adding new change log entries to this file.
-   You should create a file in the news directory instead.
-   For helpful instructions, please see:
-   https://github.com/plone/plone.releaser/blob/master/ADD-A-NEWS-ITEM.rst
--->
-
-<!-- towncrier release notes start -->
-
-## 2.0.0b3 (2025-02-03)
-
-
-### New features:
-
-- Register the adapter as needed by the @login endpoint present in plone.restapi @erral [#47](https://github.com/collective/pas.plugins.oidc/issues/47)
-
-
-### Internal:
-
-- Bump plone.restapi to 9.10.0 [@ericof]
-
-
-## 2.0.0b2 (2024-12-09)
-
-
-### New features:
-
-- Update the Deutsch translation [macagua] [#60](https://github.com/collective/pas.plugins.oidc/issues/60)
-- Implement control panel to configure pas.plugins.oidc [@ericof] [#65](https://github.com/collective/pas.plugins.oidc/issues/65)
-
-
-### Documentation:
-
-- Fixed port numbers on README file [macagua] [#51](https://github.com/collective/pas.plugins.oidc/issues/51)
-
-
-## 2.0.0b1 (2024-06-25)
-
-
-### New features:
-
-- Added Deutsch translation
-  [@macagua] [#45](https://github.com/collective/pas.plugins.oidc/issues/45)
-- Allow multiple instances of OIDC plugin in a given Plone site @erral [#48](https://github.com/collective/pas.plugins.oidc/issues/48)
-- Notify user events on creation and authentication. [@Arkusm][@ericof] [#53](https://github.com/collective/pas.plugins.oidc/issues/53)
-- Updated the latest .po templates for translate
-  Updated Spanish translation
-  [@macagua] [#55](https://github.com/collective/pas.plugins.oidc/issues/55)
-
-
-### Internal:
-
-- Update configuration files @plone 
-
-
-### Documentation:
-
-- Recommend using `[pas.plugins.keycloakgroups](https://pypi.org/project/pas.plugins.keycloakgroups/)` for groups support with Keycloak [@ericof] [#42](https://github.com/collective/pas.plugins.oidc/issues/42)
-
-
-## 2.0.0a1 (2023-11-23)
-
-
-### New features:
-
-- Implement [plone/meta](https://github.com/plone/meta) and convert documentation to Markdown [@ericof] [#32](https://github.com/collective/pas.plugins.oidc/issues/32)
-- Drop support to Python 2.7 and Plone 5.2 [@ericof] [#33](https://github.com/collective/pas.plugins.oidc/issues/33)
-- Implement restapi services to handle authentication flow [@ericof] [#38](https://github.com/collective/pas.plugins.oidc/issues/38)
-
-
-### Internal:
-
-- Rewrite tests from unittest to pytest with [pytest-plone](https://pypi.org/project/pytest-plone/) [@ericof] [#34](https://github.com/collective/pas.plugins.oidc/issues/34)
-- Allow dict instances to hold userinfo [@erral] [#35](https://github.com/collective/pas.plugins.oidc/issues/35)
-- Declare the minimum requirements for Plone/python in the readme [mamico] [#36](https://github.com/collective/pas.plugins.oidc/issues/36)
-
-
-## 1.0.0 (2023-11-11)
-
-- Allow dict instances to hold userinfo [@erral]
-
-## 1.0a6 (2023-07-20)
-
-- Added Spanish translation [@macagua]
-
-- Added improvements about i18n support [macagua]
-
-- Drop python 2.7 and Plone 4 support [@erral]
-
-- Add support for the post_logout parameter for logout api. [@ramiroluz]
-
-
-## 1.0a5 (2023-04-05)
-
-- Catch exceptions during the OAuth process [@erral]
-
-- Update the plugin to make challenges.
-  An anonymous user who visits a page for which you have to be authenticated,
-  is redirected to the new require_login view on the plugin.
-  This works the same way as the standard require_login page of Plone.
-  [@maurits]
-
-- Add a property for the default userinfo instead of using only sub. [@eikichi18]
-
-
-## 1.0a4 (2023-01-16)
-
-- Call getProperty only once when getting redirect_uris or scope. [@maurits]
-
-- use getProperty accessor [@mamico]
-
-
-## 1.0a3 (2022-10-30)
-
-- Removed the hardcoded auth cookie name [@alecghica]
-
-- Fixed Python compatibility with version >= 3.6 [@alecghica]
-
-- check if url is in portal before redirect #2 [@erral]
-
-- manage came_from [@mamico]
-
-## 1.0a2 (unreleased)
-
-- do userinforequest if there is a client.userinfo_endpoint [@mamico]
-
-## 1.0a1 (unreleased)
-
-- Initial release. [@mamico]
-
-

{pas.plugins.oidc-2.0.0b3 → pas_plugins_oidc-2.0.0rc1}/README.md

@@ -1,4 +1,4 @@
-<div align="center"><img alt="pas.plugins.oidc logo" src="https://raw.githubusercontent.com/collective/pas.plugins.oidc/main/docs/icon.png" width="70" /></div>
+<div align="center"><img alt="pas.plugins.oidc logo" src="https://raw.githubusercontent.com/collective/pas.plugins.oidc/main/docs/_static/icon.png" width="70" /></div>
 
 <h1 align="center">pas.plugins.oidc</h1>
 
@@ -13,7 +13,7 @@
 
 [![PyPI - Plone Versions](https://img.shields.io/pypi/frameworkversions/plone/pas.plugins.oidc)](https://pypi.org/project/pas.plugins.oidc/)
 
-[![Meta](https://github.com/collective/pas.plugins.oidc/actions/workflows/meta.yml/badge.svg)](https://github.com/collective/pas.plugins.oidc/actions/workflows/meta.yml)
+[![CI](https://github.com/collective/pas.plugins.oidc/actions/workflows/ci.yml/badge.svg)](https://github.com/collective/pas.plugins.oidc/actions/workflows/ci.yml)
 ![Code Style](https://img.shields.io/badge/Code%20Style-Black-000000)
 
 [![GitHub contributors](https://img.shields.io/github/contributors/collective/pas.plugins.oidc)](https://github.com/collective/pas.plugins.oidc)
@@ -86,7 +86,6 @@ When using this plugin with a [Volto frontend](https://6.docs.plone.org/volto/in
 
 Also, on the OpenID provider, configure the Redirect URL as **`<Path to your Plone site>`/login-oidc/oidc**.
 
-
 #### Classic UI
 
 When using this plugin with *Plone 6 Classic UI* the standard URLs used for login (`http://localhost:8080/Plone/login`) and logout (`http://localhost:8080/Plone/logout`)
@@ -213,6 +212,40 @@ Currently, the Plone logout form is unchanged.
 Instead, for testing go to the logout page of the plugin: http://localhost:8080/Plone/acl_users/oidc/logout,
 this will take you to Keycloak to logout, and then return to the post-logout redirect URL.
 
+#### Backchannel SLO (experimental)
+
+OIDC Backchannel Logout is a server-to-server mechanism where the IdP notifies RPs via an HTTP POST request to terminate user sessions upon logout, ensuring secure and seamless Single Logout (SLO) without relying on the user's browser.
+See the specification [OpenID Connect Back-Channel Logout 1.0](https://openid.net/specs/openid-connect-backchannel-1_0.html).
+
+Current backchannel logout implementation, in this product, utilizes functionality introduced in plone.session >= 4.0.0 (Plone 6 and later) for server-side session invalidation (see plone.session PR [plone.session#26](https://github.com/plone/plone.session/pull/26)), and, at the moment, applies only to Plone Classic UI.
+
+To enable this functionality:
+
+1. Navigate to `.../acl_users/session/manage_secret` and enable the `Enable per-user keyring` option.
+
+2. Configure the OpenID Provider (e.g., Keycloak) to use the backchannel logout endpoint with the url: `.../acl_users/oidc/backchannel-logout`
+
+#### Allowed groups
+
+If you need to restrict access to a specific group, you can use the `Allowed groups` field in the plugin configuration. If the user is not in any of the groups listed, the login will be denied.
+
+To use this feature, you need to create a new scope in the OIDC Provider (e.g., Keycloak) and add the groups to the user's token.
+
+In Keycloak, go to the `Client Scopes` section and create a new scope named `groups`. Then, go to the `Mappers` tab and create a new mapper with the name `groups` and type `Group Membership` (Uncheck the `Full groups path` option).
+You can find this configuration in the `plone` realm in the `tests` directory. The `plone` client is also configured to use the `groups` scope.
+
+![Create a new scope groups](docs/_static/allowedgroups1.png)
+
+![Add a new mapper Group Membership](docs/_static/allowedgroups2.png)
+
+After that, go to the `Client Scopes` section and add the new scope to the client you are using with the plugin (for instance, `plone`).
+
+![Add the new scope to the client](docs/_static/allowedgroups3.png)
+
+Finally, in the plugin configuration, add `groups` to the scopes field.
+
+In the `Allowed groups` field, you can add the groups that are allowed to log in. For example, in this repository, you could set `Foundation Members`. Users who are not in this group will not be able to log in.
+
 ## Technical Decisions
 
 ### Usage of sessions in the login process

pas_plugins_oidc-2.0.0rc1/dependabot.yml

@@ -0,0 +1,11 @@
+# Generated from:
+# https://github.com/plone/meta/tree/main/config/default
+# See the inline comments on how to expand/tweak this configuration file
+version: 2
+updates:
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      # Check for updates to GitHub Actions every week
+      interval: "weekly"

pas_plugins_oidc-2.0.0rc1/docs/Makefile

@@ -0,0 +1,107 @@
+### Defensive settings for make:
+#     https://tech.davis-hansson.com/p/make/
+SHELL:=bash
+.ONESHELL:
+.SHELLFLAGS:=-xeu -o pipefail -O inherit_errexit -c
+.SILENT:
+.DELETE_ON_ERROR:
+MAKEFLAGS+=--warn-undefined-variables
+MAKEFLAGS+=--no-builtin-rules
+
+# Python checks
+UV?=uv
+
+# installed?
+ifeq (, $(shell which $(UV) ))
+  $(error "UV=$(UV) not found in $(PATH)")
+endif
+
+DOCS_FOLDER=$(shell dirname $(realpath $(firstword $(MAKEFILE_LIST))))
+
+VENV_FOLDER=$(DOCS_FOLDER)/.venv
+BIN_FOLDER=$(VENV_FOLDER)/bin
+
+# Sphinx variables
+# You can set these variables from the command line.
+SPHINXOPTS      ?=
+VALEOPTS        ?=
+# Internal variables.
+BUILDDIR        = $(DOCS_FOLDER)/_build/
+ALLSPHINXOPTS   = -d $(BUILDDIR)/doctrees $(SPHINXOPTS) .
+VALEFILES       := $(shell find $(DOCS_FOLDER) -type f -name "*.md" -print)
+
+# We like colors
+# From: https://coderwall.com/p/izxssa/colored-makefile-for-golang-projects
+RED=`tput setaf 1`
+GREEN=`tput setaf 2`
+RESET=`tput sgr0`
+YELLOW=`tput setaf 3`
+
+.PHONY: all
+all: install
+
+# Add the following 'help' target to your Makefile
+# And add help text after each target name starting with '\#\#'
+.PHONY: help
+help: ## This help message
+	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
+
+$(VENV_FOLDER): ## Install dependencies
+	@echo "$(GREEN)==> Install environment$(RESET)"
+	@uv sync
+
+.PHONY: install
+install: $(VENV_FOLDER) ## Install dependencies
+
+.PHONY: sync
+sync: ## Install dependencies
+	@echo "$(GREEN)==> Sync environment$(RESET)"
+	@uv sync
+
+.PHONY: clean
+clean:  ## Clean current and legacy docs build directories, and Python virtual environment
+	rm -rf $(VENV_FOLDER) .python-version
+	rm -rf $(BUILDDIR)
+
+.PHONY: html
+html: $(VENV_FOLDER)  ## Build html
+	@uv run sphinx-build  -b html $(ALLSPHINXOPTS) $(BUILDDIR)/html
+	@echo
+	@echo "Build finished. The HTML pages are in $(BUILDDIR)/html."
+
+.PHONY: build
+build: html  ## Build html
+
+.PHONY: livehtml
+livehtml: $(VENV_FOLDER)  ## Rebuild Sphinx documentation on changes, with live-reload in the browser
+	@uv run sphinx-autobuild --ignore "*.swp"  -b html . "$(BUILDDIR)/html" $(SPHINXOPTS)
+
+.PHONY: linkcheck
+linkcheck: $(VENV_FOLDER)  ## Run linkcheck
+	@uv run sphinxbuild-b linkcheck $(ALLSPHINXOPTS) $(BUILDDIR)/linkcheck
+	@echo
+	@echo "Link check complete; look for any errors in the above output " \
+		"or in $(BUILDDIR)/linkcheck/ ."
+
+.PHONY: linkcheckbroken
+linkcheckbroken: $(VENV_FOLDER)  ## Run linkcheck and show only broken links
+	@uv run sphinxbuild-b linkcheck $(ALLSPHINXOPTS) $(BUILDDIR)/linkcheck | GREP_COLORS='0;31' grep -wi "broken\|redirect" --color=always | GREP_COLORS='0;31' grep -vi "https://github.com/plone/volto/issues/" --color=always && if test $$? -eq 0; then exit 1; fi || test $$? -ne 0
+
+.PHONY: vale
+vale: $(VENV_FOLDER)  ## Install (once) and run Vale style, grammar, and spell checks
+	@uv run vale sync
+	@uv run vale --no-wrap $(VALEOPTS) $(VALEFILES)
+	@echo
+	@echo "Vale is finished; look for any errors in the above output."
+
+.PHONY: rtd-pr-preview
+rtd-pr-preview: ## Build previews of pull requests that have documentation changes on Read the Docs via CI
+	@pip install uv
+	@uv sync
+	@uv run sphinx-build -b html $(ALLSPHINXOPTS) ${READTHEDOCS_OUTPUT}/html/
+
+.PHONY: rtd-build
+rtd-build: ## Build Volto Light Theme docs on RTD
+	@pip install uv
+	@uv sync
+	@uv run sphinx-build -b html $(ALLSPHINXOPTS) ${READTHEDOCS_OUTPUT}/html/