Bump express-session from 1.18.2 to 1.19.0

Dockerfile

@@ -3,7 +3,7 @@
 # https://github.com/ether/etherpad-lite
 #
 # Author: muxator
-ARG BUILD_ENV=git
+ARG BUILD_ENV=copy
 
 FROM node:lts-alpine AS adminbuild
 RUN npm install -g pnpm@latest
@@ -21,7 +21,7 @@ ARG http_proxy=
 ARG https_proxy=
 ARG no_proxy=
 
-ARG TIMEZONE=
+ARG TIMEZONE=Asia/Shanghai
 
 RUN \
   [ -z "${TIMEZONE}" ] || { \
@@ -64,15 +64,15 @@ ARG ETHERPAD_GITHUB_PLUGINS=
 #
 # EXAMPLE:
 #   INSTALL_ABIWORD=true
-ARG INSTALL_ABIWORD=
+ARG INSTALL_ABIWORD=false
 
 # Control whether libreoffice will be installed, enabling exports to DOC/PDF/ODT formats.
 # By default, it is not installed.
 # If given any value, libreoffice will be installed.
 #
 # EXAMPLE:
 #   INSTALL_LIBREOFFICE=true
-ARG INSTALL_SOFFICE=
+ARG INSTALL_SOFFICE=false
 
 # Install dependencies required for modifying access.
 RUN apk add --no-cache shadow bash
@@ -83,9 +83,9 @@ RUN apk add --no-cache shadow bash
 #
 # If any of the following args are set to the empty string, default
 # values will be chosen.
-ARG EP_HOME=
+ARG EP_HOME=/opt/etherpad-lite
 ARG EP_UID=5001
-ARG EP_GID=0
+ARG EP_GID=5001
 ARG EP_SHELL=
 
 RUN groupadd --system ${EP_GID:+--gid "${EP_GID}" --non-unique} etherpad && \
@@ -133,7 +133,7 @@ FROM build AS build_copy
 
 FROM build_${BUILD_ENV} AS development
 
-ARG ETHERPAD_PLUGINS=
+ARG ETHERPAD_PLUGINS="ep_font_size@0.4.59 ep_font_color@0.0.86 ep_font_family@0.5.44 ep_headings2@0.2.62 ep_openid_connect@3.0.7 ep_guest@1.0.37 ep_user_displayname@1.0.7 ep_stable_authorid@1.0.3"
 ARG ETHERPAD_LOCAL_PLUGINS=
 ARG ETHERPAD_LOCAL_PLUGINS_ENV=
 ARG ETHERPAD_GITHUB_PLUGINS=
@@ -154,7 +154,7 @@ RUN bin/installDeps.sh && \
 
 FROM build_${BUILD_ENV} AS production
 
-ARG ETHERPAD_PLUGINS=
+ARG ETHERPAD_PLUGINS="ep_font_size@0.4.59 ep_font_color@0.0.86 ep_font_family@0.5.44 ep_headings2@0.2.62 ep_openid_connect@3.0.7 ep_guest@1.0.37 ep_user_displayname@1.0.7 ep_stable_authorid@1.0.3"
 ARG ETHERPAD_LOCAL_PLUGINS=
 ARG ETHERPAD_LOCAL_PLUGINS_ENV=
 ARG ETHERPAD_GITHUB_PLUGINS=
@@ -168,22 +168,23 @@ COPY --chown=etherpad:etherpad --from=adminbuild /opt/etherpad-lite/src/static/o
 
 COPY --chown=etherpad:etherpad ./local_plugin[s] ./local_plugins/
 
-RUN bash -c ./bin/installLocalPlugins.sh
+RUN chmod +x ./bin/installLocalPlugins.sh && bash -c ./bin/installLocalPlugins.sh
 
-RUN bin/installDeps.sh && \
+RUN chmod +x bin/installDeps.sh && bin/installDeps.sh && \
   if [ ! -z "${ETHERPAD_PLUGINS}" ] || [ ! -z "${ETHERPAD_GITHUB_PLUGINS}" ]; then \
       pnpm run plugins i ${ETHERPAD_PLUGINS} ${ETHERPAD_GITHUB_PLUGINS:+--github ${ETHERPAD_GITHUB_PLUGINS}}; \
   fi && \
     pnpm store prune
 
 # Copy the configuration file.
 COPY --chown=etherpad:etherpad ${SETTINGS} "${EP_DIR}"/settings.json
+RUN cp /opt/etherpad-lite/local_plugins/ep_openid_connect/index.js /opt/etherpad-lite/src/plugin_packages/.versions/ep_openid_connect@3.0.7/index.js
 
 # Fix group permissions
 # Note: For some reason increases image size from 257 to 334.
 # RUN chmod -R g=u .
 
-USER etherpad
+#USER etherpad
 
 HEALTHCHECK --interval=5s --timeout=3s \
   CMD curl --silent http://localhost:9001/health | grep -E "pass|ok|up" > /dev/null || exit 1

credentials.json

@@ -0,0 +1,38 @@
+{
+  "ep_openid_connect": {
+    "issuer_metadata": {
+      "authorization_endpoint": "${ISSUER_AUTHORIZATION_ENDPOINT}",
+      "token_endpoint": "${ISSUER_TOKEN_ENDPOINT}",
+      "userinfo_endpoint": "${ISSUER_USERINFO_ENDPOINT}",
+      "token_endpoint_auth_methods_supported": [
+        "${TOKEN_ENDPOINT_AUTH_METHODS_SUPPORTED:client_secret_basic}"
+      ],
+      "issuer": "${ISSUER_ENDPOINT}",
+      "jwks_uri": "${ISSUER_CLIENT_SECRET}"
+    },
+    "client_id": "${ISSUER_CLIENT_ID}",
+    "client_secret": "${ISSUER_CLIENT_SECRET}",
+    "scope": [
+      "openid",
+      "profile",
+      "id_token"
+    ],
+    "base_url": "${ISSUER_BASE_URL}",
+    "user_properties": {
+      "displayname": {
+        "claim": "username"
+      }
+    }
+  },
+  "dbType": "${DB_TYPE}",
+  "dbSettings": {
+    "host": "${DB_HOST}",
+    "port": "${DB_PORT}",
+    "database": "${DB_NAME}",
+    "user": "${DB_USER}",
+    "password": "${DB_PASS}",
+    "charset": "${DB_CHARSET}"
+  }
+}
+
+

local_plugins/ep_openid_connect/.eslintrc.cjs

@@ -0,0 +1,9 @@
+'use strict';
+
+// This is a workaround for https://github.com/eslint/eslint/issues/3458
+require('eslint-config-etherpad/patch/modern-module-resolution');
+
+module.exports = {
+  root: true,
+  extends: 'etherpad/plugin',
+};

local_plugins/ep_openid_connect/.npmrc

@@ -0,0 +1 @@
+@jsr:registry=https://npm.jsr.io

local_plugins/ep_openid_connect/.travis.yml

@@ -0,0 +1,70 @@
+language: node_js
+
+node_js:
+  - "lts/*"
+
+cache: false
+
+services:
+  - docker
+
+install:
+  - "export GIT_HASH=$(git rev-parse --verify --short HEAD)"
+
+#script:
+#  - "tests/frontend/travis/runner.sh"
+
+env:
+  global:
+    - secure: "WMGxFkOeTTlhWB+ChMucRtIqVmMbwzYdNHuHQjKCcj8HBEPdZLfCuK/kf4rG\nVLcLQiIsyllqzNhBGVHG1nyqWr0/LTm8JRqSCDDVIhpyzp9KpCJQQJG2Uwjk\n6/HIJJh/wbxsEdLNV2crYU/EiVO3A4Bq0YTHUlbhUqG3mSCr5Ec="
+    - secure: "gejXUAHYscbR6Bodw35XexpToqWkv2ifeECsbeEmjaLkYzXmUUNWJGknKSu7\nEUsSfQV8w+hxApr1Z+jNqk9aX3K1I4btL3cwk2trnNI8XRAvu1c1Iv60eerI\nkE82Rsd5lwUaMEh+/HoL8ztFCZamVndoNgX7HWp5J/NRZZMmh4g="
+
+jobs:
+  include:
+    - name: "Lint test package-lock"
+      install:
+        - "npm install lockfile-lint"
+      script:
+        - npx lockfile-lint --path package-lock.json --validate-https --allowed-hosts npm
+    - name: "Run the Backend tests"
+      before_install:
+        - sudo add-apt-repository -y ppa:libreoffice/ppa
+        - sudo apt-get update
+        - sudo apt-get -y install libreoffice
+        - sudo apt-get -y install libreoffice-pdfimport
+      install:
+        - "npm install"
+        - "mkdir ep_openid_connect"
+        - "mv !(ep_openid_connect) ep_openid_connect"
+        - "git clone https://github.com/ether/etherpad-lite.git etherpad"
+        - "cd etherpad"
+        - "mkdir -p node_modules"
+        - "mv ../ep_openid_connect node_modules"
+        - "bin/installDeps.sh"
+        - "export GIT_HASH=$(git rev-parse --verify --short HEAD)"
+        - "cd src && npm install && cd -"
+      script:
+        - "tests/frontend/travis/runnerBackend.sh"
+    - name: "Test the Frontend"
+      before_script:
+        - "tests/frontend/travis/sauce_tunnel.sh"
+      install:
+        - "npm install"
+        - "mkdir ep_openid_connect"
+        - "mv !(ep_openid_connect) ep_openid_connect"
+        - "git clone https://github.com/ether/etherpad-lite.git etherpad"
+        - "cd etherpad"
+        - "mkdir -p node_modules"
+        - "mv ../ep_openid_connect node_modules"
+        - "bin/installDeps.sh"
+        - "export GIT_HASH=$(git rev-parse --verify --short HEAD)"
+      script:
+        - "tests/frontend/travis/runner.sh"
+
+notifications:
+  irc:
+    channels:
+      - "irc.freenode.org#etherpad-lite-dev"
+
+##ETHERPAD_TRAVIS_V=9
+## Travis configuration automatically created using bin/plugins/updateAllPluginsScript.sh

local_plugins/ep_openid_connect/CHANGELOG.md

@@ -0,0 +1,14 @@
+# Changelog
+
+## v3.0.0
+
+Released 2022-03-04.
+
+#### Compatibility changes
+
+  * Removed the deprecated `displayname_claim` setting. Set
+    `user_properties.displayname.claim` instead.
+  * Displayname rendering was moved to the
+    [ep\_user\_displayname](https://github.com/ether/ep_user_displayname#readme)
+    plugin and the `permit_displayname_change` setting was removed.
+  * The plugin is now much more strict about what it accepts as valid settings.

local_plugins/ep_openid_connect/CONTRIBUTING.md

@@ -0,0 +1,133 @@
+# Contributor Guidelines
+(Please talk to people on the mailing list before you change this page, see our section on [how to get in touch](https://github.com/ether/etherpad-lite#get-in-touch))
+
+## Pull requests
+
+* the commit series in the PR should be _linear_ (it **should not contain merge commits**). This is necessary because we want to be able to [bisect](https://en.wikipedia.org/wiki/Bisection_(software_engineering)) bugs easily. Rewrite history/perform a rebase if necessary
+* PRs should be issued against the **develop** branch: we never pull directly into **master**
+* PRs **should not have conflicts** with develop. If there are, please resolve them rebasing and force-pushing
+* when preparing your PR, please make sure that you have included the relevant **changes to the documentation** (preferably with usage examples)
+* contain meaningful and detailed **commit messages** in the form:
+  ```
+  submodule: description
+
+  longer description of the change you have made, eventually mentioning the
+  number of the issue that is being fixed, in the form: Fixes #someIssueNumber
+  ```
+* if the PR is a **bug fix**:
+  * the first commit in the series must be a test that shows the failure
+  * subsequent commits will fix the bug and make the test pass
+  * the final commit message should include the text `Fixes: #xxx` to link it to its bug report
+* think about stability: code has to be backwards compatible as much as possible. Always **assume your code will be run with an older version of the DB/config file**
+* if you want to remove a feature, **deprecate it instead**:
+  * write an issue with your deprecation plan
+  * output a `WARN` in the log informing that the feature is going to be removed
+  * remove the feature in the next version
+* if you want to add a new feature, put it under a **feature flag**:
+  * once the new feature has reached a minimal level of stability, do a PR for it, so it can be integrated early
+  * expose a mechanism for enabling/disabling the feature
+  * the new feature should be **disabled** by default. With the feature disabled, the code path should be exactly the same as before your contribution. This is a __necessary condition__ for early integration
+* think of the PR not as something that __you wrote__, but as something that __someone else is going to read__. The commit series in the PR should tell a novice developer the story of your thoughts when developing it
+
+## How to write a bug report
+
+* Please be polite, we all are humans and problems can occur.
+* Please add as much information as possible, for example
+  * client os(s) and version(s)
+    * browser(s) and version(s), is the problem reproducible on different clients
+    * special environments like firewalls or antivirus
+  * host os and version
+    * npm and nodejs version
+    * Logfiles if available
+  * steps to reproduce
+  * what you expected to happen
+  * what actually happened
+* Please format logfiles and code examples with markdown see github Markdown help below the issue textarea for more information.
+
+If you send logfiles, please set the loglevel switch DEBUG in your settings.json file:
+
+```
+/* The log level we are using, can be: DEBUG, INFO, WARN, ERROR */
+  "loglevel": "DEBUG",
+```
+
+The logfile location is defined in startup script or the log is directly shown in the commandline after you have started etherpad.
+
+## General goals of Etherpad
+To make sure everybody is going in the same direction:
+* easy to install for admins and easy to use for people
+* easy to integrate into other apps, but also usable as standalone
+* lightweight and scalable
+* extensible, as much functionality should be extendable with plugins so changes don't have to be done in core.
+Also, keep it maintainable. We don't wanna end up as the monster Etherpad was!
+
+## How to work with git?
+* Don't work in your master branch.
+* Make a new branch for every feature you're working on. (This ensures that you can work you can do lots of small, independent pull requests instead of one big one with complete different features)
+* Don't use the online edit function of github (this only creates ugly and not working commits!)
+* Try to make clean commits that are easy readable (including descriptive commit messages!)
+* Test before you push. Sounds easy, it isn't!
+* Don't check in stuff that gets generated during build or runtime
+* Make small pull requests that are easy to review but make sure they do add value by themselves / individually
+
+## Coding style
+* Do write comments. (You don't have to comment every line, but if you come up with something that's a bit complex/weird, just leave a comment. Bear in mind that you will probably leave the project at some point and that other people will read your code. Undocumented huge amounts of code are worthless!)
+* Never ever use tabs
+* Indentation: JS/CSS: 2 spaces; HTML: 4 spaces
+* Don't overengineer. Don't try to solve any possible problem in one step, but try to solve problems as easy as possible and improve the solution over time!
+* Do generalize sooner or later! (if an old solution, quickly hacked together, poses more problems than it solves today, refactor it!)
+* Keep it compatible. Do not introduce changes to the public API, db schema or configurations too lightly. Don't make incompatible changes without good reasons!
+* If you do make changes, document them! (see below)
+* Use protocol independent urls "//"
+
+## Branching model / git workflow
+see git flow http://nvie.com/posts/a-successful-git-branching-model/
+
+### `master` branch
+* the stable
+* This is the branch everyone should use for production stuff
+
+### `develop`branch
+* everything that is READY to go into master at some point in time
+* This stuff is tested and ready to go out
+
+### release branches
+* stuff that should go into master very soon
+* only bugfixes go into these (see http://nvie.com/posts/a-successful-git-branching-model/ for why)
+* we should not be blocking new features to develop, just because we feel that we should be releasing it to master soon. This is the situation that release branches solve/handle.
+
+### hotfix branches
+* fixes for bugs in master
+
+### feature branches (in your own repos)
+* these are the branches where you develop your features in
+* If it's ready to go out, it will be merged into develop
+
+Over the time we pull features from feature branches into the develop branch. Every month we pull from develop into master. Bugs in master get fixed in hotfix branches. These branches will get merged into master AND develop. There should never be commits in master that aren't in develop
+
+## Documentation
+The docs are in the `doc/` folder in the git repository, so people can easily find the suitable docs for the current git revision.
+
+Documentation should be kept up-to-date. This means, whenever you add a new API method, add a new hook or change the database model, pack the relevant changes to the docs in the same pull request.
+
+You can build the docs e.g. produce html, using `make docs`. At some point in the future we will provide an online documentation. The current documentation in the github wiki should always reflect the state of `master` (!), since there are no docs in master, yet.
+
+## Testing
+Front-end tests are found in the `tests/frontend/` folder in the repository. Run them by pointing your browser to `<yourdomainhere>/tests/frontend`.
+
+Back-end tests can be run from the `src` directory, via `npm test`.
+
+## Things you can help with
+Etherpad is much more than software.  So if you aren't a developer then worry not, there is still a LOT you can do!  A big part of what we do is community engagement.  You can help in the following ways
+ * Triage bugs (applying labels) and confirming their existence
+ * Testing fixes (simply applying them and seeing if it fixes your issue or not) - Some git experience required
+ * Notifying large site admins of new releases
+ * Writing Changelogs for releases
+ * Creating Windows packages
+ * Creating releases
+ * Bumping dependencies periodically and checking they don't break anything
+ * Write proposals for grants
+ * Co-Author and Publish CVEs
+ * Work with SFC to maintain legal side of project
+ * Maintain TODO page - https://github.com/ether/etherpad-lite/wiki/TODO#IMPORTANT_TODOS
+

local_plugins/ep_openid_connect/LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2020 Stefano Rivera,
+              2016 Olivier Amblet, EPFL, The Human Brain Project, Toni Iltanen
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.