diff --git a/.github/workflows/backend-tests.yml b/.github/workflows/backend-tests.yml index e3cbf9365..96fed8321 100644 --- a/.github/workflows/backend-tests.yml +++ b/.github/workflows/backend-tests.yml @@ -28,7 +28,7 @@ jobs: fail-fast: false matrix: # PRs: test on latest Node only. Push to develop: full matrix. - node: ${{ github.event_name == 'pull_request' && fromJSON('[24]') || fromJSON('[20, 22, 24]') }} + node: ${{ github.event_name == 'pull_request' && fromJSON('[24]') || fromJSON('[22, 24, 25]') }} steps: - name: Checkout repository @@ -43,7 +43,6 @@ jobs: - uses: pnpm/action-setup@v6 name: Install pnpm with: - version: 10.33.2 run_install: false - name: Use Node.js uses: actions/setup-node@v6 @@ -85,7 +84,7 @@ jobs: strategy: fail-fast: false matrix: - node: ${{ github.event_name == 'pull_request' && fromJSON('[24]') || fromJSON('[20, 22, 24]') }} + node: ${{ github.event_name == 'pull_request' && fromJSON('[24]') || fromJSON('[22, 24, 25]') }} steps: - name: Checkout repository @@ -100,7 +99,6 @@ jobs: - uses: pnpm/action-setup@v6 name: Install pnpm with: - version: 10.33.2 run_install: false - name: Use Node.js uses: actions/setup-node@v6 @@ -126,7 +124,9 @@ jobs: ep_align ep_author_hover ep_cursortrace + ep_font_color ep_font_size + ep_hash_auth ep_headings2 ep_markdown ep_readonly_guest @@ -150,7 +150,7 @@ jobs: strategy: fail-fast: false matrix: - node: [20, 22, 24] + node: [22, 24, 25] name: Windows without plugins runs-on: windows-latest steps: @@ -167,7 +167,6 @@ jobs: - uses: pnpm/action-setup@v6 name: Install pnpm with: - version: 10.33.2 run_install: false - name: Use Node.js uses: actions/setup-node@v6 @@ -201,7 +200,7 @@ jobs: strategy: fail-fast: false matrix: - node: [20, 22, 24] + node: [22, 24, 25] name: Windows with Plugins runs-on: windows-latest @@ -219,7 +218,6 @@ jobs: - uses: pnpm/action-setup@v6 name: Install pnpm with: - version: 10.33.2 run_install: false - name: Use Node.js uses: actions/setup-node@v6 @@ -238,7 +236,9 @@ jobs: ep_align ep_author_hover ep_cursortrace + ep_font_color ep_font_size + ep_hash_auth ep_headings2 ep_markdown ep_readonly_guest diff --git a/.github/workflows/build-and-deploy-docs.yml b/.github/workflows/build-and-deploy-docs.yml index 84cb1bb00..826b46877 100644 --- a/.github/workflows/build-and-deploy-docs.yml +++ b/.github/workflows/build-and-deploy-docs.yml @@ -1,34 +1,38 @@ -# Workflow for deploying static content to GitHub Pages +# Workflow for building and deploying the VitePress site to GitHub Pages. +# Build runs on every push to develop and on every PR that touches docs (so +# a build regression is caught at review time instead of breaking develop +# after merge — see #7640). Deploy runs only on push: the github-pages +# environment has protection rules that reject PR refs, and a PR build +# never produced an artifact to deploy anyway. name: Deploy Docs to GitHub Pages on: - # Runs on pushes targeting the default branch push: branches: ["develop"] paths: - - doc/** # Only run workflow when changes are made to the doc directory - # Allows you to run this workflow manually from the Actions tab + - doc/** + - .github/workflows/build-and-deploy-docs.yml + pull_request: + paths: + - doc/** + - .github/workflows/build-and-deploy-docs.yml workflow_dispatch: -# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages permissions: contents: read pages: write id-token: write packages: read -# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued. -# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete. +# Allow only one concurrent deployment, skipping runs queued between the run +# in-progress and latest queued. Do NOT cancel in-progress runs — production +# deployments are allowed to complete. concurrency: group: "pages" cancel-in-progress: false jobs: - # Single deploy job since we're just deploying - deploy: - environment: - name: github-pages - url: ${{ steps.deployment.outputs.page_url }} + build: runs-on: ubuntu-latest steps: - name: Checkout @@ -50,9 +54,17 @@ jobs: - uses: pnpm/action-setup@v6 name: Install pnpm with: - version: 10.33.2 run_install: false + # Pin Node so the build does not silently fall back to whatever the + # runner image ships with. vite 8 requires Node ^20.19.0 || >=22.12.0; + # the repo declares engines.node >=22.12.0 to match. + - name: Use Node.js + uses: actions/setup-node@v6 + with: + node-version: 22 + cache: pnpm - name: Setup Pages + if: github.event_name == 'push' uses: actions/configure-pages@v6 - name: Install dependencies run: pnpm install --frozen-lockfile @@ -60,12 +72,26 @@ jobs: working-directory: doc run: pnpm run docs:build env: + GITHUB_PAGES: ${{ github.event_name == 'push' && 'true' || '' }} COMMIT_REF: ${{ github.sha }} - name: Upload artifact + if: github.event_name == 'push' uses: actions/upload-pages-artifact@v5 with: - # Upload entire repository path: './doc/.vitepress/dist' + + # Deploy to GitHub Pages on push to develop only. Kept as a separate job + # because the github-pages environment's protection rules reject any + # non-develop ref (including PR merge refs), which used to fail the entire + # workflow at job-creation time before any build step could run. + deploy: + needs: build + if: github.event_name == 'push' + environment: + name: github-pages + url: ${{ steps.deployment.outputs.page_url }} + runs-on: ubuntu-latest + steps: - name: Deploy to GitHub Pages id: deployment uses: actions/deploy-pages@v5 diff --git a/.github/workflows/deb-package.yml b/.github/workflows/deb-package.yml new file mode 100644 index 000000000..f8e769304 --- /dev/null +++ b/.github/workflows/deb-package.yml @@ -0,0 +1,408 @@ +name: Debian package +on: + push: + tags: + # Actions tag filters are globs, not regex. Mirrors handleRelease.yml. + - 'v*.*.*' + - 'v*.*.*-*' + branches: [develop] + paths: + - 'packaging/**' + - '.github/workflows/deb-package.yml' + - 'src/package.json' + - 'pnpm-lock.yaml' + - 'src/node/server.ts' + - 'src/node/utils/run_cmd.ts' + - 'src/static/js/pluginfw/**' + - 'settings.json.template' + workflow_dispatch: + inputs: + ref: + description: 'Git ref to package (defaults to current)' + required: false + +# Default to read-only for the workflow; the release job opts in to +# `contents: write` for itself only. Build jobs (which run on every PR) +# don't need write and shouldn't have it. +permissions: + contents: read + +env: + NFPM_VERSION: v2.43.0 + +jobs: + build: + name: Build .deb (${{ matrix.arch }}) + runs-on: ${{ matrix.runner }} + strategy: + fail-fast: false + matrix: + include: + - arch: amd64 + runner: ubuntu-latest + - arch: arm64 + runner: ubuntu-24.04-arm + steps: + - name: Checkout + uses: actions/checkout@v6 + with: + ref: ${{ inputs.ref || github.ref }} + + - uses: pnpm/action-setup@v6 + + - name: Setup Node + uses: actions/setup-node@v6 + with: + node-version: '24' + cache: pnpm + + - name: Resolve version + id: v + # Runs after setup-node so `node` is guaranteed available on + # any runner image (some don't ship it preinstalled). + run: | + if [ "${GITHUB_REF_TYPE}" = "tag" ]; then + VERSION="${GITHUB_REF_NAME#v}" + else + VERSION="$(node -p "require('./package.json').version")" + fi + echo "version=${VERSION}" >>"$GITHUB_OUTPUT" + echo "Packaging version: ${VERSION}" + + - name: Install dependencies + run: pnpm install --frozen-lockfile + + - name: Build UI + admin + run: pnpm run build:etherpad + + - name: Install nfpm + run: | + set -euo pipefail + NFPM_ARCH=amd64 + [ "${{ matrix.arch }}" = "arm64" ] && NFPM_ARCH=arm64 + NFPM_DEB="nfpm_${NFPM_VERSION#v}_${NFPM_ARCH}.deb" + BASE="https://github.com/goreleaser/nfpm/releases/download/${NFPM_VERSION}" + curl -fsSL -o "/tmp/${NFPM_DEB}" "${BASE}/${NFPM_DEB}" + curl -fsSL -o /tmp/nfpm-checksums.txt "${BASE}/checksums.txt" + # Verify upstream artifact before sudo dpkg -i (defense in depth + # against a tampered release asset). + ( cd /tmp && grep " ${NFPM_DEB}\$" nfpm-checksums.txt | sha256sum -c - ) + sudo dpkg -i "/tmp/${NFPM_DEB}" + + - name: Stage tree for packaging + run: | + set -eux + STAGE=staging/opt/etherpad + mkdir -p "${STAGE}" + + # Production footprint = src/ + bin/ + node_modules/ + metadata. + cp -a src bin package.json pnpm-workspace.yaml README.md LICENSE \ + node_modules "${STAGE}/" + + # Make pnpm-workspace.yaml production-only (same trick Dockerfile uses). + printf 'packages:\n - src\n - bin\n' > "${STAGE}/pnpm-workspace.yaml" + + mkdir -p packaging/etc + cp settings.json.template packaging/etc/settings.json.dist + + # Purge test fixtures and dev caches from node_modules to shrink size. + find "${STAGE}/node_modules" -type d \ + \( -name test -o -name tests -o -name '__tests__' \ + -o -name example -o -name examples -o -name docs \) \ + -prune -exec rm -rf {} + 2>/dev/null || true + find "${STAGE}/node_modules" -type f \ + \( -name '*.md' -o -name '*.ts.map' -o -name '*.map' \ + -o -name 'CHANGELOG*' -o -name 'HISTORY*' \) \ + -delete 2>/dev/null || true + + - name: Build .deb + env: + VERSION: ${{ steps.v.outputs.version }} + ARCH: ${{ matrix.arch }} + run: | + mkdir -p dist + nfpm package --packager deb -f packaging/nfpm.yaml --target dist/ + + - name: Smoke-test the package (amd64 only) + if: matrix.arch == 'amd64' + run: | + set -eux + # Ubuntu's default apt nodejs is 18 — too old for our + # `Depends: nodejs (>= 22)`. Add NodeSource's apt repo + # explicitly (key + sources.list) instead of `curl | sudo bash` + # so we don't execute network-fetched code as root. + NODE_MAJOR=24 + # GitHub runner images often ship a NodeSource node_20.x list + # preinstalled (sometimes as a .sources deb822 file). Wipe any + # existing nodesource entries so the only Node candidate apt sees + # is our node_24.x repo. Otherwise `apt-get install -y nodejs` + # picks the higher-version 20.x build that's already cached and + # `dpkg -i` then fails on `Depends: nodejs (>= 22)`. + sudo rm -f /etc/apt/sources.list.d/nodesource.list \ + /etc/apt/sources.list.d/nodesource.sources \ + /etc/apt/preferences.d/nodesource \ + /etc/apt/preferences.d/nodesource.pref + KEYRING=/usr/share/keyrings/nodesource.gpg + curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \ + | sudo gpg --dearmor --yes -o "${KEYRING}" + echo "deb [signed-by=${KEYRING}] https://deb.nodesource.com/node_${NODE_MAJOR}.x nodistro main" \ + | sudo tee /etc/apt/sources.list.d/nodesource.list + # Pin nodejs to the 24.x line so neither Ubuntu's noble-updates + # 20.x nor any leftover NodeSource cache can win the resolver. + printf 'Package: nodejs\nPin: version %s.*\nPin-Priority: 1001\n' "${NODE_MAJOR}" \ + | sudo tee /etc/apt/preferences.d/nodesource >/dev/null + sudo apt-get update + # Pin the major explicitly on the install line as a belt-and- + # suspenders guard against any preference file being ignored. + sudo apt-get install -y "nodejs=${NODE_MAJOR}.*" + # Sanity check before invoking dpkg so the failure mode is obvious + # if pinning ever regresses again. + installed_major=$(dpkg-query -W -f='${Version}' nodejs | cut -d. -f1) + if [ "${installed_major}" != "${NODE_MAJOR}" ]; then + echo "::error::Expected nodejs major ${NODE_MAJOR}, got ${installed_major}" + apt-cache policy nodejs || true + exit 1 + fi + sudo dpkg -i dist/*.deb || sudo apt-get install -f -y + # /etc/etherpad is mode 0750 root:etherpad on purpose (DB creds + # live here) so the runner user can't read into it. Each check + # that crosses /etc/etherpad or /var/lib/etherpad runs under sudo. + sudo test -x /usr/bin/etherpad + sudo test -f /etc/etherpad/settings.json + sudo test -L /opt/etherpad/settings.json + sudo test -L /opt/etherpad/var + [ "$(sudo readlink /opt/etherpad/var)" = "/var/lib/etherpad/var" ] + sudo test -L /opt/etherpad/src/plugin_packages + [ "$(sudo readlink /opt/etherpad/src/plugin_packages)" = "/var/lib/etherpad/plugin_packages" ] + sudo test -d /var/lib/etherpad/plugin_packages + [ "$(sudo stat -c '%U' /var/lib/etherpad/plugin_packages)" = "etherpad" ] + [ "$(stat -c '%G' /opt/etherpad/src/node_modules)" = "etherpad" ] + sudo test -f /var/lib/etherpad/var/installed_plugins.json + sudo grep -q '"ep_etherpad-lite"' /var/lib/etherpad/var/installed_plugins.json + sudo grep -q '"dbType": "sqlite"' /etc/etherpad/settings.json + id etherpad + systemctl cat etherpad.service + sudo systemctl start etherpad + ok= + for i in $(seq 1 30); do + if curl -fsS http://127.0.0.1:9001/health; then + ok=1 + break + fi + sleep 2 + done + if [ -z "${ok}" ]; then + # Attach logs so the failing run is diagnosable. + sudo journalctl -u etherpad --no-pager -n 200 || true + exit 1 + fi + sudo systemctl stop etherpad + sudo dpkg --purge etherpad + ! id etherpad 2>/dev/null + + - name: Upload artifact + uses: actions/upload-artifact@v7 + with: + name: etherpad-${{ steps.v.outputs.version }}-${{ matrix.arch }}-deb + path: dist/*.deb + if-no-files-found: error + + release: + name: Attach to GitHub Release + needs: build + if: startsWith(github.ref, 'refs/tags/v') + runs-on: ubuntu-latest + permissions: + contents: write + steps: + - uses: actions/download-artifact@v8 + with: + path: dist + pattern: etherpad-*-deb + merge-multiple: true + - name: Create stable "latest" aliases + run: | + set -euo pipefail + # Publish stable filenames alongside the versioned ones so users + # can curl https://github.com/.../releases/latest/download/etherpad-latest_amd64.deb + # without knowing the version. + for f in dist/etherpad_*_amd64.deb; do + [ -e "$f" ] && cp "$f" dist/etherpad-latest_amd64.deb + done + for f in dist/etherpad_*_arm64.deb; do + [ -e "$f" ] && cp "$f" dist/etherpad-latest_arm64.deb + done + ls -la dist/ + - name: Attach .deb files to release + uses: softprops/action-gh-release@v3 + with: + files: dist/*.deb + fail_on_unmatched_files: true + + apt-publish: + # Generates a signed apt repository (Packages.gz + Release/InRelease) + # from the .deb artefacts and cross-pushes it into ether/ether.github.com + # under public/apt/. The Next.js site that powers etherpad.org serves + # public/ verbatim, so the repo lands at: + # + # https://etherpad.org/apt/ (apt repo root) + # https://etherpad.org/key.asc (public key for `apt-key`/keyring) + # + # Tag pushes go into the `stable` suite. Required secrets: + # APT_SIGNING_KEY ASCII-armoured private key for the Etherpad APT + # Repository keypair (fingerprint + # 6953FA0C6431F30347D65B03AF0CD687D51A6E63). + # SITE_DEPLOY_KEY SSH private key matching a deploy key with write + # access on ether/ether.github.com. The site repo + # holds the public half. + name: Publish apt repository to etherpad.org + needs: release + if: startsWith(github.ref, 'refs/tags/v') + runs-on: ubuntu-latest + steps: + - name: Checkout etherpad source (for packaging/apt/key.asc) + uses: actions/checkout@v6 + with: + fetch-depth: 1 + + - name: Configure deploy key for ether/ether.github.com + env: + SITE_DEPLOY_KEY: ${{ secrets.SITE_DEPLOY_KEY }} + run: | + set -euo pipefail + if [ -z "${SITE_DEPLOY_KEY:-}" ]; then + echo "::error::SITE_DEPLOY_KEY secret is not set on ether/etherpad." + echo "::error::Add an SSH deploy key with write access on ether/ether.github.com and store the private key here." + exit 1 + fi + mkdir -p ~/.ssh + chmod 700 ~/.ssh + printf '%s\n' "${SITE_DEPLOY_KEY}" > ~/.ssh/id_deploy + chmod 600 ~/.ssh/id_deploy + ssh-keyscan -t ed25519,rsa github.com >> ~/.ssh/known_hosts 2>/dev/null + cat > ~/.ssh/config <<'CFG' + Host github.com + HostName github.com + User git + IdentityFile ~/.ssh/id_deploy + IdentitiesOnly yes + CFG + chmod 600 ~/.ssh/config + + - name: Clone ether/ether.github.com + run: git clone --depth 1 git@github.com:ether/ether.github.com.git site + + - uses: actions/download-artifact@v8 + with: + path: dist + pattern: etherpad-*-deb + merge-multiple: true + + - name: Install apt-utils + gpg + run: | + sudo apt-get update -qq + sudo apt-get install -y -qq apt-utils gnupg + + - name: Import signing key + env: + APT_SIGNING_KEY: ${{ secrets.APT_SIGNING_KEY }} + run: | + set -euo pipefail + if [ -z "${APT_SIGNING_KEY:-}" ]; then + echo "::error::APT_SIGNING_KEY secret is not set; cannot sign Release file." + exit 1 + fi + export GNUPGHOME="$(mktemp -d)" + chmod 700 "${GNUPGHOME}" + echo "GNUPGHOME=${GNUPGHOME}" >>"${GITHUB_ENV}" + printf '%s' "${APT_SIGNING_KEY}" | gpg --batch --import + # Sanity check: expected long key id. + gpg --list-secret-keys --keyid-format=long | grep -q AF0CD687D51A6E63 + + - name: Generate apt repo metadata + run: | + set -euo pipefail + REPO=site/public/apt + SUITE=stable + COMP=main + # Wipe any previous repo state so removed versions don't linger + # in pool/. Packages.gz is regenerated from whatever is in pool/ + # right now, so this is the simplest correct option — alternative + # is per-version diffing which is fragile. + rm -rf "${REPO}" + # We ship one architecture-agnostic suite with per-arch pools. + # Layout: apt/dists//main/binary-{amd64,arm64}/ + for arch in amd64 arm64; do + mkdir -p "${REPO}/pool/main/e/etherpad" "${REPO}/dists/${SUITE}/${COMP}/binary-${arch}" + done + # Drop the .debs into pool/. The leading-digit pattern + # excludes the etherpad-latest_*.deb filename aliases the + # release job stages — apt resolves by package name + version, + # not filename, so including the alias would create duplicate + # Packages entries. (Also defends against any future alias that + # accidentally lands on dist/etherpad__.deb.) + shopt -s nullglob + DEBS=(dist/etherpad_[0-9]*_amd64.deb dist/etherpad_[0-9]*_arm64.deb) + shopt -u nullglob + # Refuse to publish nothing. Without this, a missing or renamed + # build artefact would wipe site/public/apt and push an empty, + # signed apt repo — breaking `apt update` for every existing + # subscriber until the next successful release. + if [ ${#DEBS[@]} -lt 2 ]; then + echo "::error::Expected per-arch .deb artifacts in dist/, found ${#DEBS[@]}: ${DEBS[*]:-}" + echo "::error::Refusing to publish a partial / empty apt repository." + exit 1 + fi + cp "${DEBS[@]}" "${REPO}/pool/main/e/etherpad/" + # Generate per-arch Packages files. + ( + cd "${REPO}" + for arch in amd64 arm64; do + apt-ftparchive --arch "${arch}" packages pool/main \ + > "dists/${SUITE}/${COMP}/binary-${arch}/Packages" + gzip -kf "dists/${SUITE}/${COMP}/binary-${arch}/Packages" + done + # Generate the suite's Release file. The heredoc lines + # MUST start at column 1 — apt parsers reject leading + # whitespace on header fields (RFC 822 / Debian control). + # printf is used over a heredoc to make that contract + # impossible to lose to a future re-indent. + printf '%s\n' \ + "Origin: Etherpad" \ + "Label: Etherpad" \ + "Suite: ${SUITE}" \ + "Codename: ${SUITE}" \ + "Architectures: amd64 arm64" \ + "Components: ${COMP}" \ + "Description: Etherpad official apt repository (${SUITE} channel)" \ + "Date: $(date -Ru)" \ + > "dists/${SUITE}/Release" + # apt-ftparchive appends checksums. + apt-ftparchive release "dists/${SUITE}" >> "dists/${SUITE}/Release" + # Sign it (clear-signed InRelease + detached Release.gpg). + gpg --default-key AF0CD687D51A6E63 --batch --yes \ + --clearsign -o "dists/${SUITE}/InRelease" "dists/${SUITE}/Release" + gpg --default-key AF0CD687D51A6E63 --batch --yes \ + -abs -o "dists/${SUITE}/Release.gpg" "dists/${SUITE}/Release" + ) + + - name: Stage public key alongside the site + run: | + # Users curl this to add our key to their keyring before apt update. + cp packaging/apt/key.asc site/public/key.asc + + - name: Commit + push to ether/ether.github.com + env: + TAG: ${{ github.ref_name }} + run: | + set -euo pipefail + cd site + git -c user.email=actions@github.com -c user.name='github-actions[bot]' \ + add public/apt public/key.asc + if git diff --cached --quiet; then + echo "No apt-repo changes to publish." + exit 0 + fi + git -c user.email=actions@github.com -c user.name='github-actions[bot]' \ + commit -m "apt: publish Etherpad ${TAG}" + git push origin HEAD:master diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 35811cad5..2d84cafd0 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -52,8 +52,16 @@ jobs: - uses: pnpm/action-setup@v6 name: Install pnpm with: - version: 10.33.2 run_install: false + # Repo is checked out into ./etherpad, so the action can't find + # packageManager in a root package.json. + package_json_file: etherpad/package.json + - name: Use Node.js + uses: actions/setup-node@v6 + with: + node-version: 22 + cache: pnpm + cache-dependency-path: etherpad/pnpm-lock.yaml - name: Test working-directory: etherpad @@ -74,6 +82,10 @@ jobs: git clean -dxf . build-test-db-drivers: + # Spinning up MySQL + Postgres + cross-driver smoke is expensive; only + # run it on pushes to develop (and tagged release pushes), not on every + # feature-branch PR. + if: github.event_name == 'push' runs-on: ubuntu-latest permissions: contents: read diff --git a/.github/workflows/frontend-admin-tests.yml b/.github/workflows/frontend-admin-tests.yml index dff5fc24d..544f801b3 100644 --- a/.github/workflows/frontend-admin-tests.yml +++ b/.github/workflows/frontend-admin-tests.yml @@ -22,7 +22,7 @@ jobs: fail-fast: false matrix: # PRs: single Node version. Push: full matrix. - node: ${{ github.event_name == 'pull_request' && fromJSON('[24]') || fromJSON('[20, 22, 24]') }} + node: ${{ github.event_name == 'pull_request' && fromJSON('[24]') || fromJSON('[22, 24, 25]') }} steps: - @@ -38,7 +38,6 @@ jobs: - uses: pnpm/action-setup@v6 name: Install pnpm with: - version: 10.33.2 run_install: false - name: Use Node.js uses: actions/setup-node@v6 diff --git a/.github/workflows/frontend-tests.yml b/.github/workflows/frontend-tests.yml index c972000b0..0a349e091 100644 --- a/.github/workflows/frontend-tests.yml +++ b/.github/workflows/frontend-tests.yml @@ -38,8 +38,12 @@ jobs: - uses: pnpm/action-setup@v6 name: Install pnpm with: - version: 10.33.2 run_install: false + - name: Use Node.js + uses: actions/setup-node@v6 + with: + node-version: 22 + cache: pnpm - name: Install all dependencies and symlink for ep_etherpad-lite run: pnpm install --frozen-lockfile @@ -49,17 +53,22 @@ jobs: - name: Run the frontend tests shell: bash run: | + set -euo pipefail pnpm run prod > /tmp/etherpad-server.log 2>&1 & - connected=false - can_connect() { - curl -sSfo /dev/null http://localhost:9001/ || return 1 - connected=true - } - now() { date +%s; } - start=$(now) - while [ $(($(now) - $start)) -le 15 ] && ! can_connect; do - sleep 1 - done + # Generous 90s budget so a slow runner (or, in the with-plugins + # variant, plugin boot) doesn't lose the race against the test + # phase. Fail loudly on timeout rather than silently falling + # through to tests against a half-started server. + # --max-time bounds each probe so a stuck server can't make a + # single curl call eat the whole 90s budget. + can_connect() { curl --max-time 3 -sSfo /dev/null http://localhost:9001/; } + for i in $(seq 1 90); do can_connect && break; sleep 1; done + if ! can_connect; then + echo "::error::Etherpad did not respond on :9001 within 90s" + echo "----- server log -----" + tail -n 200 /tmp/etherpad-server.log || true + exit 1 + fi cd src pnpm exec playwright install chromium --with-deps pnpm run test-ui --project=chromium @@ -101,8 +110,12 @@ jobs: - uses: pnpm/action-setup@v6 name: Install pnpm with: - version: 10.33.2 run_install: false + - name: Use Node.js + uses: actions/setup-node@v6 + with: + node-version: 22 + cache: pnpm - name: Install all dependencies and symlink for ep_etherpad-lite run: pnpm install --frozen-lockfile - name: Create settings.json @@ -110,17 +123,22 @@ jobs: - name: Run the frontend tests shell: bash run: | + set -euo pipefail pnpm run prod > /tmp/etherpad-server.log 2>&1 & - connected=false - can_connect() { - curl -sSfo /dev/null http://localhost:9001/ || return 1 - connected=true - } - now() { date +%s; } - start=$(now) - while [ $(($(now) - $start)) -le 15 ] && ! can_connect; do - sleep 1 - done + # Generous 90s budget so a slow runner (or, in the with-plugins + # variant, plugin boot) doesn't lose the race against the test + # phase. Fail loudly on timeout rather than silently falling + # through to tests against a half-started server. + # --max-time bounds each probe so a stuck server can't make a + # single curl call eat the whole 90s budget. + can_connect() { curl --max-time 3 -sSfo /dev/null http://localhost:9001/; } + for i in $(seq 1 90); do can_connect && break; sleep 1; done + if ! can_connect; then + echo "::error::Etherpad did not respond on :9001 within 90s" + echo "----- server log -----" + tail -n 200 /tmp/etherpad-server.log || true + exit 1 + fi cd src pnpm exec playwright install firefox --with-deps pnpm run test-ui --project=firefox @@ -137,3 +155,198 @@ jobs: name: playwright-report-firefox path: src/playwright-report/ retention-days: 30 + + # Frontend tests with the same /ether plugin set that backend-tests.yml + # exercises, so a core change that breaks plugin UX is caught in PR CI + # rather than after release. Re-introduces coverage that was lost when + # the workflows were nuked & rebuilt in 2023 (commit cc80db2d3) and the + # backend equivalent was restored without the frontend half. + playwright-chrome-with-plugins: + env: + PNPM_HOME: ~/.pnpm-store + name: Playwright Chrome with plugins + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@v6 + - uses: actions/cache@v5 + name: Cache pnpm store + with: + path: ${{ env.PNPM_HOME }} + key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }} + restore-keys: | + ${{ runner.os }}-pnpm-store- + - uses: actions/cache@v5 + name: Cache Playwright browsers + with: + path: ~/.cache/ms-playwright + key: ${{ runner.os }}-playwright-${{ hashFiles('src/package.json', 'pnpm-lock.yaml') }} + restore-keys: | + ${{ runner.os }}-playwright- + - uses: pnpm/action-setup@v6 + name: Install pnpm + with: + run_install: false + - name: Use Node.js + uses: actions/setup-node@v6 + with: + node-version: 22 + cache: pnpm + - name: Install all dependencies and symlink for ep_etherpad-lite + run: pnpm install --frozen-lockfile + - name: Install Etherpad plugins + # Same plugin set as backend-tests.yml's withpluginsLinux job, + # MINUS ep_cursortrace. + # + # ep_cursortrace's `aceEditEvent` hook fires on every keyboard + # event (handleClick, handleKeyEvent, idleWorkTimer) and sends a + # cursor-position socket message per call. Under the test + # harness's `writeToPad` bursts (insertText + Enter loops) that + # stream of socket messages saturates the editor's input + # pipeline in Firefox specifically, causing intermittent + # keystroke drops and a long tail of test flakiness. + # + # Bisected via a 4-iteration probe on this branch — see commit + # history of .github/workflows/frontend-tests.yml around the + # PR-7630 timeframe. Tracked for a follow-up fix + # (debounce / throttle in ep_cursortrace's main.js). + run: > + pnpm add -w + ep_align + ep_author_hover + ep_font_color + ep_font_size + ep_hash_auth + ep_headings2 + ep_markdown + ep_readonly_guest + ep_set_title_on_pad + ep_spellcheck + ep_subscript_and_superscript + ep_table_of_contents + - name: Create settings.json + run: cp ./src/tests/settings.json settings.json + - name: Run the frontend tests + shell: bash + run: | + set -euo pipefail + pnpm run prod > /tmp/etherpad-server.log 2>&1 & + # Generous 90s budget so a slow runner (or, in the with-plugins + # variant, plugin boot) doesn't lose the race against the test + # phase. Fail loudly on timeout rather than silently falling + # through to tests against a half-started server. + # --max-time bounds each probe so a stuck server can't make a + # single curl call eat the whole 90s budget. + can_connect() { curl --max-time 3 -sSfo /dev/null http://localhost:9001/; } + for i in $(seq 1 90); do can_connect && break; sleep 1; done + if ! can_connect; then + echo "::error::Etherpad did not respond on :9001 within 90s" + echo "----- server log -----" + tail -n 200 /tmp/etherpad-server.log || true + exit 1 + fi + cd src + pnpm exec playwright install chromium --with-deps + WITH_PLUGINS=1 pnpm run test-ui --project=chromium + - name: Upload server log on failure + uses: actions/upload-artifact@v7 + if: failure() + with: + name: server-log-chrome-with-plugins + path: /tmp/etherpad-server.log + retention-days: 7 + - uses: actions/upload-artifact@v7 + if: always() + with: + name: playwright-report-chrome-with-plugins + path: src/playwright-report/ + retention-days: 30 + + playwright-firefox-with-plugins: + env: + PNPM_HOME: ~/.pnpm-store + name: Playwright Firefox with plugins + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@v6 + - uses: actions/cache@v5 + name: Cache pnpm store + with: + path: ${{ env.PNPM_HOME }} + key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }} + restore-keys: | + ${{ runner.os }}-pnpm-store- + - uses: actions/cache@v5 + name: Cache Playwright browsers + with: + path: ~/.cache/ms-playwright + key: ${{ runner.os }}-playwright-${{ hashFiles('src/package.json', 'pnpm-lock.yaml') }} + restore-keys: | + ${{ runner.os }}-playwright- + - uses: pnpm/action-setup@v6 + name: Install pnpm + with: + run_install: false + - name: Use Node.js + uses: actions/setup-node@v6 + with: + node-version: 22 + cache: pnpm + - name: Install all dependencies and symlink for ep_etherpad-lite + run: pnpm install --frozen-lockfile + - name: Install Etherpad plugins + # See sibling Playwright Chrome with plugins job for the full + # rationale on why ep_cursortrace is excluded from the test + # plugin set. + run: > + pnpm add -w + ep_align + ep_author_hover + ep_font_color + ep_font_size + ep_hash_auth + ep_headings2 + ep_markdown + ep_readonly_guest + ep_set_title_on_pad + ep_spellcheck + ep_subscript_and_superscript + ep_table_of_contents + - name: Create settings.json + run: cp ./src/tests/settings.json settings.json + - name: Run the frontend tests + shell: bash + run: | + set -euo pipefail + pnpm run prod > /tmp/etherpad-server.log 2>&1 & + # Generous 90s budget so a slow runner (or, in the with-plugins + # variant, plugin boot) doesn't lose the race against the test + # phase. Fail loudly on timeout rather than silently falling + # through to tests against a half-started server. + # --max-time bounds each probe so a stuck server can't make a + # single curl call eat the whole 90s budget. + can_connect() { curl --max-time 3 -sSfo /dev/null http://localhost:9001/; } + for i in $(seq 1 90); do can_connect && break; sleep 1; done + if ! can_connect; then + echo "::error::Etherpad did not respond on :9001 within 90s" + echo "----- server log -----" + tail -n 200 /tmp/etherpad-server.log || true + exit 1 + fi + cd src + pnpm exec playwright install firefox --with-deps + WITH_PLUGINS=1 pnpm run test-ui --project=firefox + - name: Upload server log on failure + uses: actions/upload-artifact@v7 + if: failure() + with: + name: server-log-firefox-with-plugins + path: /tmp/etherpad-server.log + retention-days: 7 + - uses: actions/upload-artifact@v7 + if: always() + with: + name: playwright-report-firefox-with-plugins + path: src/playwright-report/ + retention-days: 30 diff --git a/.github/workflows/handleRelease.yml b/.github/workflows/handleRelease.yml index 3149d2172..a2a2bac2e 100644 --- a/.github/workflows/handleRelease.yml +++ b/.github/workflows/handleRelease.yml @@ -38,8 +38,12 @@ jobs: - uses: pnpm/action-setup@v6 name: Install pnpm with: - version: 10.33.2 run_install: false + - name: Use Node.js + uses: actions/setup-node@v6 + with: + node-version: 22 + cache: pnpm - name: Install all dependencies and symlink for ep_etherpad-lite run: pnpm install --frozen-lockfile - name: Build etherpad diff --git a/.github/workflows/load-test.yml b/.github/workflows/load-test.yml index 06660afdb..a3be27451 100644 --- a/.github/workflows/load-test.yml +++ b/.github/workflows/load-test.yml @@ -35,14 +35,18 @@ jobs: - uses: pnpm/action-setup@v6 name: Install pnpm with: - version: 10.33.2 run_install: false + - name: Use Node.js + uses: actions/setup-node@v6 + with: + node-version: 22 + cache: pnpm - name: Install all dependencies and symlink for ep_etherpad-lite run: pnpm install --frozen-lockfile - name: Install etherpad-load-test - run: sudo npm install -g etherpad-load-test-socket-io + run: sudo npm install -g etherpad-load-test - name: Run load test run: src/tests/frontend/travis/runnerLoadTest.sh 25 50 @@ -69,11 +73,15 @@ jobs: - uses: pnpm/action-setup@v6 name: Install pnpm with: - version: 10.33.2 run_install: false + - name: Use Node.js + uses: actions/setup-node@v6 + with: + node-version: 22 + cache: pnpm - name: Install etherpad-load-test - run: sudo npm install -g etherpad-load-test-socket-io + run: sudo npm install -g etherpad-load-test - name: Install etherpad plugins run: > @@ -128,14 +136,18 @@ jobs: - uses: pnpm/action-setup@v6 name: Install pnpm with: - version: 10.33.2 run_install: false + - name: Use Node.js + uses: actions/setup-node@v6 + with: + node-version: 22 + cache: pnpm - name: Install all dependencies and symlink for ep_etherpad-lite run: pnpm install --frozen-lockfile - name: Install etherpad-load-test - run: sudo npm install -g etherpad-load-test-socket-io + run: sudo npm install -g etherpad-load-test - name: Run load test run: src/tests/frontend/travis/runnerLoadTest.sh 5000 5 diff --git a/.github/workflows/perform-type-check.yml b/.github/workflows/perform-type-check.yml index aacfe279f..af155c327 100644 --- a/.github/workflows/perform-type-check.yml +++ b/.github/workflows/perform-type-check.yml @@ -35,8 +35,12 @@ jobs: - uses: pnpm/action-setup@v6 name: Install pnpm with: - version: 10.33.2 run_install: false + - name: Use Node.js + uses: actions/setup-node@v6 + with: + node-version: 22 + cache: pnpm - name: Install all dependencies and symlink for ep_etherpad-lite run: pnpm install --frozen-lockfile - name: Perform type check diff --git a/.github/workflows/rate-limit.yml b/.github/workflows/rate-limit.yml index 861d576c2..53f0448e6 100644 --- a/.github/workflows/rate-limit.yml +++ b/.github/workflows/rate-limit.yml @@ -38,8 +38,12 @@ jobs: - uses: pnpm/action-setup@v6 name: Install pnpm with: - version: 10.33.2 run_install: false + - name: Use Node.js + uses: actions/setup-node@v6 + with: + node-version: 22 + cache: pnpm - name: docker network diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e9eb3d373..583067226 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -57,10 +57,22 @@ jobs: - uses: pnpm/action-setup@v6 name: Install pnpm with: - version: 10.33.2 run_install: false + # Repo is checked out into ./etherpad, so the action can't find + # packageManager in a root package.json. + package_json_file: etherpad/package.json + - name: Use Node.js + uses: actions/setup-node@v6 + with: + node-version: 22 + cache: pnpm + cache-dependency-path: etherpad/pnpm-lock.yaml - name: Install dependencies ether.github.com - run: pnpm install --frozen-lockfile + # ether.github.com depends on sharp (Next.js image pipeline), whose + # install script must run to fetch the platform binary. pnpm 11 + # turned ignored-builds into an error; allow all builds for this + # external repo since we don't control its pnpm-workspace.yaml. + run: pnpm install --frozen-lockfile --config.dangerously-allow-all-builds=true working-directory: ether.github.com - name: Set git user run: | diff --git a/.github/workflows/releaseEtherpad.yml b/.github/workflows/releaseEtherpad.yml index 731ae2930..60d7ce7f5 100644 --- a/.github/workflows/releaseEtherpad.yml +++ b/.github/workflows/releaseEtherpad.yml @@ -17,9 +17,9 @@ jobs: - uses: actions/setup-node@v6 with: # OIDC trusted publishing needs npm >= 11.5.1, which requires - # Node >= 20.17.0. setup-node's `20` resolves to the latest - # 20.x, which satisfies that. - node-version: 20 + # Node >= 22.9.0. setup-node's `22` resolves to the latest + # 22.x, which satisfies that. + node-version: 22 registry-url: https://registry.npmjs.org/ - name: Upgrade npm to >=11.5.1 (required for trusted publishing) run: npm install -g npm@latest @@ -33,7 +33,6 @@ jobs: - uses: pnpm/action-setup@v6 name: Install pnpm with: - version: 10.33.2 run_install: false - name: Install dependencies run: pnpm install --frozen-lockfile diff --git a/.github/workflows/snap-build.yml b/.github/workflows/snap-build.yml new file mode 100644 index 000000000..dcbe923ef --- /dev/null +++ b/.github/workflows/snap-build.yml @@ -0,0 +1,71 @@ +# Snap build verification — runs on every PR (and on develop) that +# touches snap/ or this workflow. Catches breakage in the wrappers and +# the build recipe before it reaches a release tag. +# +# Two jobs: +# wrapper-tests — runs the bash unit tests under snap/tests/. Fast +# (~5s); no snapd / sudo / network needed. Always runs first. +# snap-pack — builds the actual snap with `snapcraft pack +# --destructive-mode` (no LXD). Faster than the publish workflow +# because it skips container provisioning and store auth. Uploads +# the .snap as an artifact so reviewers can sideload it. +# +# Production publishing lives in `snap-publish.yml` (tag-triggered). +name: Snap build (PR) +on: + pull_request: + paths: + - 'snap/**' + - 'settings.json.template' + - '.github/workflows/snap-build.yml' + push: + branches: [develop] + paths: + - 'snap/**' + - 'settings.json.template' + - '.github/workflows/snap-build.yml' + workflow_dispatch: + +permissions: + contents: read + +jobs: + wrapper-tests: + name: Wrapper unit tests + runs-on: ubuntu-24.04 + steps: + - uses: actions/checkout@v6 + - name: Run snap/tests/run-all.sh + run: bash snap/tests/run-all.sh + + snap-pack: + name: Build snap (destructive-mode) + needs: wrapper-tests + runs-on: ubuntu-24.04 + steps: + - uses: actions/checkout@v6 + + - name: Install snapcraft + run: sudo snap install --classic snapcraft + + - name: Pack snap + run: sudo snapcraft pack --destructive-mode --verbose + + - name: Locate built artifact + id: artifact + run: | + set -e + SNAP=$(ls etherpad_*.snap | head -1) + if [ -z "${SNAP}" ]; then + echo "::error::no .snap file produced" + exit 1 + fi + echo "snap=${SNAP}" >> "${GITHUB_OUTPUT}" + + - name: Upload .snap artifact + uses: actions/upload-artifact@v7 + with: + name: etherpad-snap-pr-${{ github.event.pull_request.number || github.run_id }} + path: ${{ steps.artifact.outputs.snap }} + if-no-files-found: error + retention-days: 7 diff --git a/.github/workflows/snap-publish.yml b/.github/workflows/snap-publish.yml new file mode 100644 index 000000000..ba9b8a5bf --- /dev/null +++ b/.github/workflows/snap-publish.yml @@ -0,0 +1,92 @@ +# Builds and publishes the Etherpad snap on tagged releases. +# Mirrors the trigger pattern from .github/workflows/docker.yml / release.yml +# (semver tags, with or without a leading `v`). +# +# Note: `on.push.tags` uses GitHub's filter-pattern globs, NOT regex — so the +# pattern must be expressed as two glob entries, not a single `v?...` regex. +# https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#filter-pattern-cheat-sheet +# +# One-time maintainer setup: +# 1. `snapcraft register etherpad` claims the name. +# 2. Generate a store credential: +# snapcraft export-login --snaps etherpad \ +# --channels edge,stable \ +# --acls package_access,package_push,package_release - +# Store the output as repo secret SNAPCRAFT_STORE_CREDENTIALS. +# 3. Create a GitHub Environment called `snap-store-stable` with required +# reviewers so stable promotion is gated. +# +# Ref: https://documentation.ubuntu.com/snapcraft/latest/how-to/publishing/ +name: Snap +on: + push: + tags: + - 'v[0-9]+.[0-9]+.[0-9]+' + - '[0-9]+.[0-9]+.[0-9]+' + workflow_dispatch: + +permissions: + contents: read + +jobs: + build: + runs-on: ubuntu-latest + outputs: + snap-file: ${{ steps.build.outputs.snap }} + steps: + - name: Check out + uses: actions/checkout@v6 + + - name: Build snap + id: build + uses: snapcore/action-build@v1 + + - name: Upload snap artifact + uses: actions/upload-artifact@v7 + with: + name: etherpad-snap + path: ${{ steps.build.outputs.snap }} + if-no-files-found: error + retention-days: 7 + + publish-edge: + needs: build + if: github.event_name == 'push' + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - name: Download snap artifact + uses: actions/download-artifact@v8 + with: + name: etherpad-snap + + - name: Publish to edge + uses: snapcore/action-publish@v1 + env: + SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }} + with: + snap: ${{ needs.build.outputs.snap-file }} + release: edge + + publish-stable: + needs: [build, publish-edge] + if: github.event_name == 'push' + runs-on: ubuntu-latest + permissions: + contents: read + # Manual gate: promote edge -> stable via GitHub Environments approval. + environment: snap-store-stable + steps: + - name: Download snap artifact + uses: actions/download-artifact@v8 + with: + name: etherpad-snap + + - name: Publish to stable + uses: snapcore/action-publish@v1 + env: + SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }} + with: + snap: ${{ needs.build.outputs.snap-file }} + release: stable diff --git a/.github/workflows/update-plugins.yml b/.github/workflows/update-plugins.yml index 447ecdcf1..ca9b01844 100644 --- a/.github/workflows/update-plugins.yml +++ b/.github/workflows/update-plugins.yml @@ -21,7 +21,6 @@ jobs: - uses: pnpm/action-setup@v6 name: Install pnpm with: - version: 10.33.2 run_install: false - name: Use Node.js diff --git a/.github/workflows/upgrade-from-latest-release.yml b/.github/workflows/upgrade-from-latest-release.yml index e5260d449..00d2291ec 100644 --- a/.github/workflows/upgrade-from-latest-release.yml +++ b/.github/workflows/upgrade-from-latest-release.yml @@ -28,7 +28,7 @@ jobs: fail-fast: false matrix: # PRs: single Node version. Push: full matrix. - node: ${{ github.event_name == 'pull_request' && fromJSON('[24]') || fromJSON('[20, 22, 24]') }} + node: ${{ github.event_name == 'pull_request' && fromJSON('[24]') || fromJSON('[22, 24, 25]') }} steps: - name: Check out latest release @@ -45,7 +45,6 @@ jobs: - uses: pnpm/action-setup@v6 name: Install pnpm with: - version: 10.33.2 run_install: false - name: Use Node.js uses: actions/setup-node@v6 diff --git a/.gitignore b/.gitignore index 28fabc00b..098074ad2 100644 --- a/.gitignore +++ b/.gitignore @@ -27,3 +27,14 @@ plugin_packages playwright-report state.json /src/static/oidc +# Build artefacts produced by packaging/test-local.sh and the deb-package CI workflow. +/staging/ +/dist/ +/packaging/etc/ + +# Snapcraft destructive-mode build outputs. +parts/ +stage/ +prime/ +.craft/ +*.snap diff --git a/AGENTS.MD b/AGENTS.MD index bf8632594..58e02a1d2 100644 --- a/AGENTS.MD +++ b/AGENTS.MD @@ -6,8 +6,8 @@ Welcome to the Etherpad project. This guide provides essential context and instr Etherpad is a real-time collaborative editor designed to be lightweight, scalable, and highly extensible via plugins. ## Technical Stack -- **Runtime:** Node.js >= 20.0.0 -- **Package Manager:** pnpm (>= 8.3.0) +- **Runtime:** Node.js >= 22.12.0 +- **Package Manager:** pnpm (>= 11.0.0) - **Languages:** TypeScript (primary for new code), JavaScript (legacy), CSS, HTML - **Backend:** Express.js 5, Socket.io 4 - **Frontend:** Legacy core (`src/static`), Modern React UI (`ui/`), Admin UI (`admin/`) diff --git a/CHANGELOG.md b/CHANGELOG.md index 64bfa75af..8541a34b1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,59 @@ +# 2.7.3 + +### Breaking changes + +- **Minimum required Node.js version is now 22.13.** Node.js 20 is reaching end-of-life (see https://nodejs.org/en/about/previous-releases) and pnpm 11 hard-rejects Node releases older than 22.13. The CI matrix targets Node 22, 24, and 25. Upgrading should be straightforward — install a current Node.js release before updating Etherpad. +- **The official Docker image no longer ships `curl`, `npm`, or `npx`.** These were dropped to remove transitive CVEs (curl/libcurl SMB advisories, npm's bundled picomatch 4.0.3 and brace-expansion 2.0.2). The container's healthcheck now uses `wget` (busybox built-in, always present), and Etherpad provisions `pnpm` via `corepack` for all runtime package operations. If you exec into the container and rely on `curl` or `npm` for ad-hoc tasks, install them on demand with `apk add curl` or use the busybox `wget` / `pnpm` already present. + +### Notable enhancements + +- **GDPR / privacy controls.** A multi-PR series adds the building blocks operators need to satisfy data-subject requests: + - Pad deletion controls (admin-driven and self-service). + - IP / privacy audit pass across the codebase. + - Author-token cookies are now `HttpOnly`, removing them from JavaScript reach. + - Configurable privacy banner shown on first visit. + - Author erasure: an authenticated path for purging an individual author's identity and contributions. +- **Self-update subsystem (Tier 1: notify).** + - Periodic check against the GitHub Releases API for the configured repo (default `ether/etherpad`). Configurable via the new `updates.*` settings block, default tier `"notify"`. Set `updates.tier` to `"off"` to disable entirely. + - The admin UI shows a banner and a dedicated "Etherpad updates" page with the current version, latest version, install method, and changelog. + - Pad users see a discreet footer badge **only** when the running version is severely outdated (one or more major versions behind) or flagged as vulnerable in a recent release manifest. The public endpoint that drives this never leaks the version string itself. + - New top-level `adminEmail` setting. When set, the updater emails the admin on first detection of severe / vulnerable status, with escalating cadence (weekly while vulnerable, monthly while severely outdated). PR 1 ships the dedupe + cadence logic; real SMTP wiring lands in a follow-up PR. + - Tier 1 ships in this release. Tiers 2 (manual click), 3 (auto with grace window) and 4 (autonomous in maintenance window) are designed and will land in subsequent releases. + - See `doc/admin/updates.md` for full configuration. +- **Pad compaction.** New `compactPad` HTTP API plus `bin/compactPad` and `bin/compactAllPads` CLIs to reclaim database space on long-lived pads with heavy edit history (issue #6194). `--keep N` retains the last N revisions; `--dry-run` previews per-pad rev counts before writing. Per-pad failures don't stop the bulk run. +- **New packaging targets.** + - Etherpad is now published as a **Snap** package. + - **Debian (.deb)** packages are built via nfpm with a systemd unit, and a signed apt repository is published to `etherpad.org/apt`. +- **Editor enhancements.** + - IDE-style line operations: keyboard shortcuts to duplicate or delete the current line. + - New `showMenuRight` URL parameter to hide the right-side toolbar — useful for embeds that need slimmer chrome. + - Click a user in the userlist to open chat with `@` prefilled, making mentions discoverable. + - New `padOptions.fadeInactiveAuthorColors` setting plus a toolbar UI to fade the background colors of authors who have left the pad. +- **Color contrast.** Author colors now pick the WCAG-higher-contrast text color for readability. +- **Social / mobile metadata.** Pad, timeslider, and home views now emit Open Graph and Twitter Card tags (closes #7599) and a `theme-color` meta that matches the toolbar on mobile. +- **Plugin admin UX.** The `/admin` plugin browser surfaces each plugin's `ep.json` `disables` declarations, so operators can see what a plugin will turn off before installing. + +### Notable fixes + +- **Socket.io: don't kick authenticated duplicate-author sessions.** A regression where two tabs from the same authenticated author could evict each other has been fixed (#7656 / #7678). +- **Anchor scrolling.** Anchor-link navigation now waits for layout to settle, so jumping to a deep link no longer overshoots. +- **Plugin updater.** `bin/updatePlugins.sh` actually updates installed plugins again (closes #6670). +- **Settings: stable per-release version string.** `randomVersionString` is now derived from the release identity rather than regenerated on each boot, so caches behave correctly across restarts of the same version. + +### Internal / contributor-facing + +- The HTTP client in the backend has been migrated from `axios` to the built-in `fetch` API, dropping a dependency now that Node 22 ships a stable fetch. +- `admin/` and `ui/` workspaces moved from `rolldown-vite` to upstream **Vite 8**. +- Build and CI moved to **pnpm 11** (`packageManager: "pnpm@11.0.6"`); the `Dockerfile`, snap, and all GitHub workflows are aligned. pnpm overrides have been migrated from `package.json` to `pnpm-workspace.yaml` to match pnpm 11's expectations. +- All client modules have been converted to ESM. +- The CI matrix tests Node 22, 24, and 25; on PRs the matrix is reduced to a single Node version to keep feedback fast. +- Frontend Playwright tests now run against the `/ether` plugin set, with feature-tag based skips so plugin-incompatible specs are excluded automatically. +- Build hardening: signed apt repo publishing, frozen lockfile installs across CI, Node setup pinned in every workflow, and a Docker-image CVE sweep that bumps `npm`, `pnpm`, and `uuid`. + +### Localisation + +- Multiple updates from translatewiki.net. + # 2.7.2 ### Notable enhancements and fixes diff --git a/Dockerfile b/Dockerfile index 14fb6d399..0fee2f12e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -7,17 +7,24 @@ # docker build --build-arg BUILD_ENV=copy . ARG BUILD_ENV=git -ARG PnpmVersion=10.28.2 +ARG PnpmVersion=11.0.6 -FROM node:lts-alpine AS adminbuild -RUN npm install -g pnpm@${PnpmVersion} +FROM node:22-alpine AS adminbuild +# Use corepack to provision pnpm and drop the bundled npm — its older +# transitives (picomatch, brace-expansion) carry CVEs we don't otherwise +# need. Refresh corepack first: the version bundled with Node 22 ships a +# stale signing-key list and rejects newer pnpm releases +# (nodejs/corepack#612). Mirrors the workaround in snap/snapcraft.yaml. +RUN npm install -g corepack@latest && \ + corepack enable && corepack prepare pnpm@${PnpmVersion} --activate && \ + rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx WORKDIR /opt/etherpad-lite COPY . . RUN pnpm install RUN pnpm run build:ui -FROM node:lts-alpine AS build +FROM node:22-alpine AS build LABEL maintainer="Etherpad team, https://github.com/ether/etherpad" # Set these arguments when building the image from behind a proxy @@ -96,11 +103,12 @@ RUN mkdir -p "${EP_DIR}" && chown etherpad:etherpad "${EP_DIR}" # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863199 RUN \ mkdir -p /usr/share/man/man1 && \ - npm install pnpm@${PnpmVersion} -g && \ + npm install -g corepack@latest && \ + corepack enable && corepack prepare pnpm@${PnpmVersion} --activate && \ + rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx && \ apk update && apk upgrade && \ apk add --no-cache \ ca-certificates \ - curl \ git \ ${INSTALL_SOFFICE:+libreoffice openjdk8-jre libreoffice-common} && \ rm -rf /var/cache/apk/* @@ -165,7 +173,10 @@ ENV ETHERPAD_PRODUCTION=true # The full pnpm-workspace.yaml references admin, doc, ui which are not # needed at runtime. Overwrite it with a production-only version so # pnpm install doesn't warn about missing workspace directories. -RUN printf 'packages:\n - src\n - bin\n' > pnpm-workspace.yaml +# Preserve the build-script policy from the source workspace file so +# pnpm 11 doesn't error out with ERR_PNPM_IGNORED_BUILDS for transitive +# postinstalls (e.g. @scarf/scarf via swagger-ui-dist). +RUN printf 'packages:\n - src\n - bin\nonlyBuiltDependencies:\n - esbuild\nignoredBuiltDependencies:\n - "@scarf/scarf"\nstrictDepBuilds: false\n' > pnpm-workspace.yaml COPY --chown=etherpad:etherpad ./src ./src COPY --chown=etherpad:etherpad --from=adminbuild /opt/etherpad-lite/src/templates/admin ./src/templates/admin @@ -191,7 +202,7 @@ COPY --chown=etherpad:etherpad ${SETTINGS} "${EP_DIR}"/settings.json USER etherpad HEALTHCHECK --interval=5s --timeout=3s \ - CMD curl --silent http://localhost:9001/health | grep -E "pass|ok|up" > /dev/null || exit 1 + CMD wget -qO- http://127.0.0.1:9001/health | grep -E "pass|ok|up" > /dev/null || exit 1 EXPOSE 9001 CMD ["pnpm", "run", "prod"] diff --git a/README.md b/README.md index 259dddc79..e4a482acb 100644 --- a/README.md +++ b/README.md @@ -66,7 +66,7 @@ If your organisation runs Etherpad and would be willing to be listed publicly, p ### Quick install (one-liner) -The fastest way to get Etherpad running. Requires `git` and Node.js >= 20. +The fastest way to get Etherpad running. Requires `git` and Node.js >= 22. **macOS / Linux / WSL:** @@ -160,7 +160,7 @@ volumes: ### Requirements -[Node.js](https://nodejs.org/) >= 20. +[Node.js](https://nodejs.org/) >= 22.12. ### Windows, macOS, Linux diff --git a/admin/package.json b/admin/package.json index 4b83f9e7a..8bfb022db 100644 --- a/admin/package.json +++ b/admin/package.json @@ -1,7 +1,7 @@ { "name": "admin", "private": true, - "version": "2.7.2", + "version": "2.7.3", "type": "module", "scripts": { "dev": "vite", @@ -18,28 +18,25 @@ "@radix-ui/react-toast": "^1.2.15", "@types/react": "^19.2.14", "@types/react-dom": "^19.2.3", - "@typescript-eslint/eslint-plugin": "^8.59.0", - "@typescript-eslint/parser": "^8.59.0", + "@typescript-eslint/eslint-plugin": "^8.59.2", + "@typescript-eslint/parser": "^8.59.2", "@vitejs/plugin-react": "^6.0.1", "babel-plugin-react-compiler": "19.1.0-rc.3", - "eslint": "^10.2.1", + "eslint": "^10.3.0", "eslint-plugin-react-hooks": "^7.1.1", "eslint-plugin-react-refresh": "^0.5.2", - "i18next": "^26.0.7", + "i18next": "^26.0.9", "i18next-browser-languagedetector": "^8.2.1", - "lucide-react": "^1.11.0", + "lucide-react": "^1.14.0", "react": "^19.2.5", "react-dom": "^19.2.5", - "react-hook-form": "^7.73.1", - "react-i18next": "^17.0.4", - "react-router-dom": "^7.14.2", + "react-hook-form": "^7.75.0", + "react-i18next": "^17.0.6", + "react-router-dom": "^7.15.0", "socket.io-client": "^4.8.3", "typescript": "^6.0.3", - "vite": "npm:rolldown-vite@7.2.10", + "vite": "^8.0.10", "vite-plugin-babel": "^1.6.0", - "zustand": "^5.0.12" - }, - "overrides": { - "vite": "npm:rolldown-vite@7.2.10" + "zustand": "^5.0.13" } } diff --git a/admin/src/App.tsx b/admin/src/App.tsx index ae23ab3d3..27d5a2ae3 100644 --- a/admin/src/App.tsx +++ b/admin/src/App.tsx @@ -6,7 +6,8 @@ import {NavLink, Outlet, useNavigate} from "react-router-dom"; import {useStore} from "./store/store.ts"; import {LoadingScreen} from "./utils/LoadingScreen.tsx"; import {Trans, useTranslation} from "react-i18next"; -import {Cable, Construction, Crown, NotepadText, Wrench, PhoneCall, LucideMenu} from "lucide-react"; +import {Cable, Construction, Crown, NotepadText, Wrench, PhoneCall, LucideMenu, Bell} from "lucide-react"; +import {UpdateBanner} from "./components/UpdateBanner"; const WS_URL = import.meta.env.DEV ? 'http://localhost:9001' : '' export const App = () => { @@ -105,6 +106,7 @@ export const App = () => {
  • Communication
    • +
    • @@ -112,6 +114,7 @@ export const App = () => { setSidebarOpen(!sidebarOpen) }}>
    +
    diff --git a/admin/src/components/UpdateBanner.tsx b/admin/src/components/UpdateBanner.tsx new file mode 100644 index 000000000..36f1faddc --- /dev/null +++ b/admin/src/components/UpdateBanner.tsx @@ -0,0 +1,35 @@ +import {useEffect} from 'react'; +import {Link} from 'react-router-dom'; +import {Trans, useTranslation} from 'react-i18next'; +import {useStore} from '../store/store'; + +export const UpdateBanner = () => { + const {t} = useTranslation(); + const updateStatus = useStore((s) => s.updateStatus); + const setUpdateStatus = useStore((s) => s.setUpdateStatus); + + useEffect(() => { + let cancelled = false; + fetch('/admin/update/status', {credentials: 'same-origin'}) + .then((r) => r.ok ? r.json() : null) + .then((data) => { if (data && !cancelled) setUpdateStatus(data); }) + .catch(() => {}); + return () => { cancelled = true; }; + }, [setUpdateStatus]); + + if (!updateStatus || !updateStatus.latest) return null; + if (updateStatus.currentVersion === updateStatus.latest.version) return null; + + return ( +
    + {' '} + + + {' '} + {t('update.banner.cta')} +
    + ); +}; diff --git a/admin/src/index.css b/admin/src/index.css index 3190b153d..64eae3ccc 100644 --- a/admin/src/index.css +++ b/admin/src/index.css @@ -895,3 +895,30 @@ input, button, select, optgroup, textarea { .manage-pads-header { display: flex; } + +/* Update banner — shown on every admin page when a new version is available. */ +.update-banner { + display: flex; + align-items: center; + gap: 8px; + padding: 10px 14px; + margin: 0 0 12px 0; + background: #fff3cd; + color: #664d03; + border: 1px solid #ffe69c; + border-radius: 4px; + font-size: 14px; +} +.update-banner a { + color: inherit; + text-decoration: underline; + font-weight: 500; +} + +/* Update page layout. */ +.update-page { padding: 16px 0; } +.update-page h1 { margin-bottom: 16px; } +.update-page dl { display: grid; grid-template-columns: max-content 1fr; gap: 6px 16px; margin: 0 0 24px; } +.update-page dt { font-weight: 600; color: #555; } +.update-page dd { margin: 0; } +.update-page pre { background: #f6f8fa; border: 1px solid #d0d7de; border-radius: 4px; padding: 12px; font-size: 13px; max-height: 400px; overflow: auto; } diff --git a/admin/src/main.tsx b/admin/src/main.tsx index 5efc26de6..c7dcc456b 100644 --- a/admin/src/main.tsx +++ b/admin/src/main.tsx @@ -13,6 +13,7 @@ import i18n from "./localization/i18n.ts"; import {PadPage} from "./pages/PadPage.tsx"; import {ToastDialog} from "./utils/Toast.tsx"; import {ShoutPage} from "./pages/ShoutPage.tsx"; +import {UpdatePage} from "./pages/UpdatePage.tsx"; const router = createBrowserRouter(createRoutesFromElements( <>}> @@ -22,6 +23,7 @@ const router = createBrowserRouter(createRoutesFromElements( }/> }/> }/> + }/> }/> diff --git a/admin/src/pages/HomePage.tsx b/admin/src/pages/HomePage.tsx index f5ce0a5ab..244f34905 100644 --- a/admin/src/pages/HomePage.tsx +++ b/admin/src/pages/HomePage.tsx @@ -229,7 +229,31 @@ export const HomePage = () => { filteredInstallablePlugins.map((plugin) => { return {plugin.name} - {plugin.description} + + {plugin.description} + {plugin.disables && plugin.disables.length > 0 && ( +
    + {' '} + {plugin.disables + .map((tag) => tag.replace(/^@feature:/, '')) + .join(', ')} +
    + )} + {plugin.version} {plugin.time} diff --git a/admin/src/pages/Plugin.ts b/admin/src/pages/Plugin.ts index 7e556d8a6..72c768c53 100644 --- a/admin/src/pages/Plugin.ts +++ b/admin/src/pages/Plugin.ts @@ -4,6 +4,12 @@ export type PluginDef = { version: string, time: string, official: boolean, + /** + * `@feature:*` Playwright tags for core specs the plugin intentionally + * disables. See doc/PLUGIN_FEATURE_DISABLES.md. May be undefined for + * plugins without a disables list, which is the common case. + */ + disables?: string[], } diff --git a/admin/src/pages/UpdatePage.tsx b/admin/src/pages/UpdatePage.tsx new file mode 100644 index 000000000..0d669a446 --- /dev/null +++ b/admin/src/pages/UpdatePage.tsx @@ -0,0 +1,103 @@ +import {useEffect, useState} from 'react'; +import {Trans, useTranslation} from 'react-i18next'; +import {useStore} from '../store/store'; + +type FetchState = + | {kind: 'loading'} + | {kind: 'disabled'} + | {kind: 'unauthorized'} + | {kind: 'error', status: number} + | {kind: 'ok'}; + +export const UpdatePage = () => { + const {t} = useTranslation(); + const us = useStore((s) => s.updateStatus); + const setUpdateStatus = useStore((s) => s.setUpdateStatus); + // Self-fetch so the page renders an explicit state even if UpdateBanner's + // best-effort fetch never landed (route returns 404 when tier=off, 401/403 + // if requireAdminForStatus is set, or a transient network error). + const [fetchState, setFetchState] = useState(us ? {kind: 'ok'} : {kind: 'loading'}); + + useEffect(() => { + let cancelled = false; + fetch('/admin/update/status', {credentials: 'same-origin'}) + .then(async (r) => { + if (cancelled) return; + if (r.ok) { + const data = await r.json(); + setUpdateStatus(data); + setFetchState({kind: 'ok'}); + } else if (r.status === 404) { + setFetchState({kind: 'disabled'}); + } else if (r.status === 401 || r.status === 403) { + setFetchState({kind: 'unauthorized'}); + } else { + setFetchState({kind: 'error', status: r.status}); + } + }) + .catch(() => { + if (!cancelled) setFetchState({kind: 'error', status: 0}); + }); + return () => { cancelled = true; }; + }, [setUpdateStatus]); + + if (fetchState.kind === 'loading') { + return
    {t('admin.loading', {defaultValue: 'Loading...'})}
    ; + } + if (fetchState.kind === 'disabled') { + return ( +
    +

    +

    {t('update.page.disabled', {defaultValue: 'Update checks are disabled (updates.tier = "off").'})}

    +
    + ); + } + if (fetchState.kind === 'unauthorized') { + return ( +
    +

    +

    {t('update.page.unauthorized', {defaultValue: 'You are not authorised to view update status.'})}

    +
    + ); + } + if (fetchState.kind === 'error' || !us) { + const status = fetchState.kind === 'error' ? fetchState.status : 0; + return ( +
    +

    +

    {t('update.page.error', {defaultValue: 'Could not load update status (status {{status}}).', status})}

    +
    + ); + } + + const upToDate = !us.latest || us.currentVersion === us.latest.version; + + return ( +
    +

    +
    +
    +
    {us.currentVersion}
    +
    +
    {us.latest ? us.latest.version : '—'}
    +
    +
    {us.lastCheckAt ?? '—'}
    +
    +
    {us.installMethod}
    +
    +
    {us.tier}
    +
    + {upToDate ? ( +

    + ) : us.latest ? ( + <> +

    + 
    {us.latest.body}
    +

    {us.latest.htmlUrl}

    + + ) : null} +
    + ); +}; + +export default UpdatePage; diff --git a/admin/src/store/store.ts b/admin/src/store/store.ts index 1ccc036f4..f3748f47c 100644 --- a/admin/src/store/store.ts +++ b/admin/src/store/store.ts @@ -3,6 +3,23 @@ import {Socket} from "socket.io-client"; import {PadSearchResult} from "../utils/PadSearch.ts"; import {InstalledPlugin} from "../pages/Plugin.ts"; +export interface UpdateStatusPayload { + currentVersion: string; + latest: null | { + version: string; + tag: string; + body: string; + publishedAt: string; + prerelease: boolean; + htmlUrl: string; + }; + lastCheckAt: string | null; + installMethod: string; + tier: string; + policy: null | {canNotify: boolean; canManual: boolean; canAuto: boolean; canAutonomous: boolean; reason: string}; + vulnerableBelow: Array<{announcedBy: string; threshold: string}>; +} + type ToastState = { description?:string, title: string, @@ -25,7 +42,9 @@ type StoreState = { pads: PadSearchResult|undefined, setPads: (pads: PadSearchResult)=>void, installedPlugins: InstalledPlugin[], - setInstalledPlugins: (plugins: InstalledPlugin[])=>void + setInstalledPlugins: (plugins: InstalledPlugin[])=>void, + updateStatus: UpdateStatusPayload | null, + setUpdateStatus: (s: UpdateStatusPayload) => void, } @@ -48,5 +67,7 @@ export const useStore = create()((set) => ({ pads: undefined, setPads: (pads)=>set({pads}), installedPlugins: [], - setInstalledPlugins: (plugins)=>set({installedPlugins: plugins}) + setInstalledPlugins: (plugins)=>set({installedPlugins: plugins}), + updateStatus: null, + setUpdateStatus: (s) => set({updateStatus: s}), })); diff --git a/bin/buildForWindows.sh b/bin/buildForWindows.sh index 99a9fcf2f..2eb659ada 100755 --- a/bin/buildForWindows.sh +++ b/bin/buildForWindows.sh @@ -67,7 +67,7 @@ try cp settings.json.template settings.json #try mv node_modules_resolved node_modules log "download windows node..." -try wget "https://nodejs.org/dist/latest-v20.x/win-x64/node.exe" -O node.exe +try wget "https://nodejs.org/dist/latest-v22.x/win-x64/node.exe" -O node.exe log "create the zip..." try zip -9 -r "${OUTPUT}" ./* diff --git a/bin/commonPlugins.ts b/bin/commonPlugins.ts index ecc6a67c8..54d07cc3a 100644 --- a/bin/commonPlugins.ts +++ b/bin/commonPlugins.ts @@ -3,6 +3,26 @@ import {writeFileSync} from "fs"; import {installedPluginsPath} from "ep_etherpad-lite/static/js/pluginfw/installer"; const pluginsModule = require('ep_etherpad-lite/static/js/pluginfw/plugins'); +// Pure helper used by `pnpm run plugins update` to whittle the contents of +// var/installed_plugins.json down to names safe to re-install. Mirrors the +// gate inside pluginfw/plugins.getPackages: only entries that start with the +// plugin prefix (ep_) are real Etherpad plugins; ep_etherpad-lite is the +// vendored core, never installed via the plugin path. De-duplicates so a +// corrupted manifest with repeated entries triggers one install per name. +// Exported and kept side-effect-free so backend tests can exercise it. +export const filterUpdatablePluginNames = ( + entries: ReadonlyArray<{name?: unknown} | null | undefined>, + prefix: string = pluginsModule.prefix as string, +): string[] => { + const names = entries + .map((e) => (e == null ? undefined : e.name)) + .filter( + (n): n is string => + typeof n === 'string' && n.startsWith(prefix) && n !== 'ep_etherpad-lite', + ); + return Array.from(new Set(names)); +}; + export const persistInstalledPlugins = async () => { const plugins:PackageData[] = [] const installedPlugins = {plugins: plugins}; diff --git a/bin/compactAllPads.ts b/bin/compactAllPads.ts new file mode 100644 index 000000000..c7c03ac12 --- /dev/null +++ b/bin/compactAllPads.ts @@ -0,0 +1,236 @@ +'use strict'; + +/* + * Compact every pad on the instance to reclaim database space. + * + * Usage: + * node bin/compactAllPads.js # collapse all history on every pad + * node bin/compactAllPads.js --keep N # keep last N revisions per pad + * node bin/compactAllPads.js --dry-run # list pads + rev counts, no writes + * + * Composes the existing `listAllPads` and `compactPad` HTTP APIs — there is + * deliberately no instance-wide HTTP endpoint, because doing this over a + * single request would mean one giant response and a long-held connection. + * Per-pad failures don't stop the run; they're logged and counted, and the + * exit code reflects whether anything failed. + * + * Destructive — `getEtherpad`-export anything you can't afford to lose + * before running. + * + * Issue #6194: per-instance bulk compaction. The per-pad `bin/compactPad` + * is the right tool when you know which pad is fat; this is the right tool + * when you want to reclaim space across the whole instance. + */ +import path from 'node:path'; +import fs from 'node:fs'; +import process from 'node:process'; + +export type CompactAllOpts = { + keepRevisions: number | null; + dryRun: boolean; +}; + +// Minimal interface mirroring the API endpoints the script needs. Tests +// substitute their own implementation that goes through supertest+JWT +// instead of fetch+APIKEY, so the loop logic is exercised against a real +// running server without dragging in apikey-file or fetch setup. +export type CompactAllApi = { + listAllPads(): Promise; + getRevisionsCount(padId: string): Promise; + compactPad(padId: string, keepRevisions: number | null): Promise; +}; + +export type CompactAllReport = { + total: number; + ok: number; + failed: number; + totalRevsBefore: number; + totalRevsAfter: number; +}; + +export type CompactAllLogger = { + info(msg: string): void; + error(msg: string): void; +}; + +const defaultLogger: CompactAllLogger = { + info: (m) => console.log(m), + error: (m) => console.error(m), +}; + +// Pure-ish core: composition + per-pad error tolerance + dry-run + tally. +// Returns a structured report so tests can assert on outcomes; the CLI +// shell maps it to an exit code. +export const runCompactAll = async ( + api: CompactAllApi, opts: CompactAllOpts, + logger: CompactAllLogger = defaultLogger, +): Promise => { + let padIds: string[]; + try { + padIds = await api.listAllPads(); + } catch (e: any) { + logger.error(`listAllPads failed: ${e.message ?? e}`); + return {total: 0, ok: 0, failed: 1, totalRevsBefore: 0, totalRevsAfter: 0}; + } + + if (padIds.length === 0) { + logger.info('No pads on this instance.'); + return {total: 0, ok: 0, failed: 0, totalRevsBefore: 0, totalRevsAfter: 0}; + } + + const strategy = opts.keepRevisions == null + ? 'collapse all history' + : `keep last ${opts.keepRevisions} revisions`; + logger.info(`Found ${padIds.length} pad(s). Strategy: ${strategy}` + + `${opts.dryRun ? ' (dry run — no writes)' : ''}.`); + + const report: CompactAllReport = { + total: padIds.length, ok: 0, failed: 0, + totalRevsBefore: 0, totalRevsAfter: 0, + }; + + for (let i = 0; i < padIds.length; i++) { + const padId = padIds[i]; + const idx = `[${i + 1}/${padIds.length}]`; + + let before: number; + try { + before = await api.getRevisionsCount(padId); + } catch (e: any) { + logger.error(`${idx} ${padId}: getRevisionsCount failed: ${e.message ?? e}`); + report.failed++; + continue; + } + + if (opts.dryRun) { + logger.info(`${idx} ${padId}: ${before + 1} revision(s) — would compact`); + report.totalRevsBefore += before + 1; + continue; + } + + try { + await api.compactPad(padId, opts.keepRevisions); + } catch (e: any) { + logger.error(`${idx} ${padId}: compactPad failed: ${e.message ?? e}`); + report.failed++; + continue; + } + + let after: number | undefined; + try { after = await api.getRevisionsCount(padId); } + catch { /* main op already succeeded; post-count is informational */ } + + if (after != null) { + logger.info(`${idx} ${padId}: ${before + 1} → ${after + 1} revision(s)`); + report.totalRevsBefore += before + 1; + report.totalRevsAfter += after + 1; + } else { + logger.info(`${idx} ${padId}: compacted (post-count unavailable)`); + } + report.ok++; + } + + if (opts.dryRun) { + logger.info(''); + logger.info(`Dry run complete. ${padIds.length} pad(s), ` + + `${report.totalRevsBefore} total revision(s) — re-run ` + + 'without --dry-run to compact.'); + } else { + logger.info(''); + logger.info(`Done. ${report.ok} pad(s) compacted, ${report.failed} failed. ` + + `Revisions: ${report.totalRevsBefore} → ${report.totalRevsAfter} ` + + `(reclaimed ${report.totalRevsBefore - report.totalRevsAfter}).`); + } + + return report; +}; + +export const parseArgs = (argv: string[]): CompactAllOpts | null => { + const opts: CompactAllOpts = {keepRevisions: null, dryRun: false}; + for (let i = 0; i < argv.length; i++) { + const a = argv[i]; + if (a === '--dry-run') { + opts.dryRun = true; + } else if (a === '--keep') { + const v = argv[++i]; + const n = Number(v); + if (!Number.isInteger(n) || n < 0) { + console.error(`--keep expects a non-negative integer; got ${v}`); + return null; + } + opts.keepRevisions = n; + } else { + return null; + } + } + return opts; +}; + +// CLI entry point. Skipped when this file is imported (e.g. by tests), +// so the test harness can use `runCompactAll` directly without network. +const usage = () => { + console.error('Usage:'); + console.error(' node bin/compactAllPads.js'); + console.error(' node bin/compactAllPads.js --keep '); + console.error(' node bin/compactAllPads.js --dry-run'); + process.exit(2); +}; + +const isMain = require.main === module; +if (isMain) { + process.on('unhandledRejection', (err) => { throw err; }); + + const settings = require('ep_etherpad-lite/tests/container/loadSettings').loadSettings(); + const baseURL = `${settings.ssl ? 'https' : 'http'}://${settings.ip}:${settings.port}`; + + const apiGet = async (p: string): Promise => { + const r = await fetch(baseURL + p); + if (!r.ok) throw new Error(`HTTP ${r.status} ${r.statusText}`); + return r.json(); + }; + const apiPost = async (p: string): Promise => { + const r = await fetch(baseURL + p, {method: 'POST'}); + if (!r.ok) throw new Error(`HTTP ${r.status} ${r.statusText}`); + return r.json(); + }; + + const opts = parseArgs(process.argv.slice(2)); + if (!opts) usage(); + + const apikey = fs.readFileSync( + path.join(__dirname, '../APIKEY.txt'), {encoding: 'utf-8'}).trim(); + + // Bind the abstract API to fetch + APIKEY auth for the CLI shell. + const cliApi: CompactAllApi = { + async listAllPads() { + const apiInfo = await apiGet('/api/'); + const apiVersion: string | undefined = apiInfo.currentVersion; + if (!apiVersion) throw new Error('No version set in API'); + // Stash on this for subsequent calls. Avoids a per-call /api/ ping. + (cliApi as any)._apiVersion = apiVersion; + const r = await apiGet(`/api/${apiVersion}/listAllPads?apikey=${apikey}`); + if (r.code !== 0) throw new Error(JSON.stringify(r)); + return r.data.padIDs ?? []; + }, + async getRevisionsCount(padId: string) { + const v = (cliApi as any)._apiVersion; + const r = await apiGet( + `/api/${v}/getRevisionsCount?apikey=${apikey}` + + `&padID=${encodeURIComponent(padId)}`); + if (r.code !== 0) throw new Error(JSON.stringify(r)); + return r.data.revisions; + }, + async compactPad(padId: string, keepRevisions: number | null) { + const v = (cliApi as any)._apiVersion; + const params = new URLSearchParams({apikey, padID: padId}); + if (keepRevisions != null) params.set('keepRevisions', String(keepRevisions)); + const r = await apiPost(`/api/${v}/compactPad?${params.toString()}`); + if (r.code !== 0) throw new Error(JSON.stringify(r)); + }, + }; + + (async () => { + const report = await runCompactAll(cliApi, opts!); + if (report.failed > 0) process.exit(1); + })(); +} diff --git a/bin/compactPad.ts b/bin/compactPad.ts new file mode 100644 index 000000000..69f521ba2 --- /dev/null +++ b/bin/compactPad.ts @@ -0,0 +1,101 @@ +'use strict'; + +/* + * Compact a pad's revision history to reclaim database space. + * + * Usage: + * node bin/compactPad.js # collapse all history + * node bin/compactPad.js --keep N # keep only the last N revisions + * + * Wraps the existing Cleanup helper (src/node/utils/Cleanup.ts) via the + * compactPad HTTP API so admins can trigger it from the CLI without + * routing through the admin settings UI. Destructive — export the pad as + * `.etherpad` first for backup. + * + * Issue #6194: long-lived pads with heavy edit history accumulate hundreds + * of megabytes in the DB; this tool is the per-pad brick for reclaiming + * that space without rotating to a new pad ID. + */ +import path from 'node:path'; +import fs from 'node:fs'; +import process from 'node:process'; + +// As of v14, Node.js does not exit when there is an unhandled Promise rejection. Convert an +// unhandled rejection into an uncaught exception, which does cause Node.js to exit. +process.on('unhandledRejection', (err) => { throw err; }); + +const settings = require('ep_etherpad-lite/tests/container/loadSettings').loadSettings(); + +const baseURL = `${settings.ssl ? 'https' : 'http'}://${settings.ip}:${settings.port}`; + +const apiGet = async (p: string): Promise => { + const r = await fetch(baseURL + p); + if (!r.ok) throw new Error(`HTTP ${r.status} ${r.statusText}`); + return r.json(); +}; +const apiPost = async (p: string): Promise => { + const r = await fetch(baseURL + p, {method: 'POST'}); + if (!r.ok) throw new Error(`HTTP ${r.status} ${r.statusText}`); + return r.json(); +}; + +const usage = () => { + console.error('Usage:'); + console.error(' node bin/compactPad.js '); + console.error(' node bin/compactPad.js --keep '); + process.exit(2); +}; + +const args = process.argv.slice(2); +if (args.length < 1 || args.length > 3) usage(); +const padId = args[0]; + +let keepRevisions: number | null = null; +if (args.length === 3) { + if (args[1] !== '--keep') usage(); + keepRevisions = Number(args[2]); + if (!Number.isInteger(keepRevisions) || keepRevisions < 0) { + console.error(`--keep expects a non-negative integer; got ${args[2]}`); + process.exit(2); + } +} + +// get the API Key +const filePath = path.join(__dirname, '../APIKEY.txt'); +const apikey = fs.readFileSync(filePath, {encoding: 'utf-8'}).trim(); + +(async () => { + const apiInfo = await apiGet('/api/'); + const apiVersion: string | undefined = apiInfo.currentVersion; + if (!apiVersion) throw new Error('No version set in API'); + + // Pre-flight: show current revision count so operators can eyeball impact. + const countUri = `/api/${apiVersion}/getRevisionsCount?apikey=${apikey}&padID=${padId}`; + const countRes = await apiGet(countUri); + if (countRes.code !== 0) { + console.error(`getRevisionsCount failed: ${JSON.stringify(countRes)}`); + process.exit(1); + } + const before: number = countRes.data.revisions; + const strategy = keepRevisions == null ? 'collapse all' : `keep last ${keepRevisions}`; + console.log(`Pad ${padId}: ${before + 1} revision(s). Strategy: ${strategy}.`); + + const params = new URLSearchParams({apikey, padID: padId}); + if (keepRevisions != null) params.set('keepRevisions', String(keepRevisions)); + const result = await apiPost(`/api/${apiVersion}/compactPad?${params.toString()}`); + if (result.code !== 0) { + console.error(`compactPad failed: ${JSON.stringify(result)}`); + process.exit(1); + } + + // Post-flight: the pad is now compacted. Re-read the rev count so the + // operator sees concrete savings. + const afterRes = await apiGet(countUri); + const after: number | undefined = afterRes?.data?.revisions; + if (after != null) { + console.log(`Done. Pad ${padId}: ${after + 1} revision(s) remaining ` + + `(was ${before + 1}).`); + } else { + console.log('Done.'); + } +})(); diff --git a/bin/createUserSession.ts b/bin/createUserSession.ts index 095cebb0e..6b05bc85d 100644 --- a/bin/createUserSession.ts +++ b/bin/createUserSession.ts @@ -13,46 +13,54 @@ import path from "node:path"; import querystring from "node:querystring"; -import axios from 'axios' import process from "node:process"; process.on('unhandledRejection', (err) => { throw err; }); import settings from 'ep_etherpad-lite/node/utils/Settings'; (async () => { - axios.defaults.baseURL = `http://${settings.ip}:${settings.port}`; - const api = axios; + const baseURL = `http://${settings.ip}:${settings.port}`; + const apiGet = async (p: string): Promise => { + const r = await fetch(baseURL + p); + if (!r.ok) throw new Error(`HTTP ${r.status} ${r.statusText}`); + return r.json(); + }; + const apiPost = async (p: string): Promise => { + const r = await fetch(baseURL + p, {method: 'POST'}); + if (!r.ok) throw new Error(`HTTP ${r.status} ${r.statusText}`); + return r.json(); + }; const filePath = path.join(__dirname, '../APIKEY.txt'); const apikey = fs.readFileSync(filePath, {encoding: 'utf-8'}); let res; - res = await api.get('/api/'); - const apiVersion = res.data.currentVersion; + res = await apiGet('/api/'); + const apiVersion = res.currentVersion; if (!apiVersion) throw new Error('No version set in API'); console.log('apiVersion', apiVersion); const uri = (cmd: string, args: querystring.ParsedUrlQueryInput ) => `/api/${apiVersion}/${cmd}?${querystring.stringify(args)}`; - res = await api.post(uri('createGroup', {apikey})); - if (res.data.code === 1) throw new Error(`Error creating group: ${res.data}`); - const groupID = res.data.data.groupID; + res = await apiPost(uri('createGroup', {apikey})); + if (res.code === 1) throw new Error(`Error creating group: ${res}`); + const groupID = res.data.groupID; console.log('groupID', groupID); - res = await api.post(uri('createGroupPad', {apikey, groupID})); - if (res.data.code === 1) throw new Error(`Error creating group pad: ${res.data}`); - console.log('Test Pad ID ====> ', res.data.data.padID); + res = await apiPost(uri('createGroupPad', {apikey, groupID})); + if (res.code === 1) throw new Error(`Error creating group pad: ${res}`); + console.log('Test Pad ID ====> ', res.data.padID); - res = await api.post(uri('createAuthor', {apikey})); - if (res.data.code === 1) throw new Error(`Error creating author: ${res.data}`); - const authorID = res.data.data.authorID; + res = await apiPost(uri('createAuthor', {apikey})); + if (res.code === 1) throw new Error(`Error creating author: ${res}`); + const authorID = res.data.authorID; console.log('authorID', authorID); const validUntil = Math.floor(new Date().getTime() / 1000) + 60000; console.log('validUntil', validUntil); - res = await api.post(uri('createSession', {apikey, groupID, authorID, validUntil})); - if (res.data.code === 1) throw new Error(`Error creating session: ${JSON.stringify(res.data)}`); + res = await apiPost(uri('createSession', {apikey, groupID, authorID, validUntil})); + if (res.code === 1) throw new Error(`Error creating session: ${JSON.stringify(res)}`); console.log('Session made: ====> create a cookie named sessionID and set the value to', - res.data.data.sessionID); + res.data.sessionID); process.exit(0) })(); diff --git a/bin/deleteAllGroupSessions.ts b/bin/deleteAllGroupSessions.ts index 6064757ec..67b950d28 100644 --- a/bin/deleteAllGroupSessions.ts +++ b/bin/deleteAllGroupSessions.ts @@ -11,7 +11,6 @@ import fs from "node:fs"; import process from "node:process"; process.on('unhandledRejection', (err) => { throw err; }); -import axios from 'axios' // Set a delete counter which will increment on each delete attempt // TODO: Check delete is successful before incrementing let deleteCount = 0; @@ -23,29 +22,38 @@ const settings = require('ep_etherpad-lite/tests/container/loadSettings').loadSe (async () => { const apikey = fs.readFileSync(filePath, {encoding: 'utf-8'}); - axios.defaults.baseURL = `http://${settings.ip}:${settings.port}`; + const baseURL = `http://${settings.ip}:${settings.port}`; + const apiGet = async (p: string): Promise => { + const r = await fetch(baseURL + p); + if (!r.ok) throw new Error(`HTTP ${r.status} ${r.statusText}`); + return r.json(); + }; + const apiPost = async (p: string): Promise => { + const r = await fetch(baseURL + p, {method: 'POST'}); + if (!r.ok) throw new Error(`HTTP ${r.status} ${r.statusText}`); + return r.json(); + }; - const apiVersionResponse = await axios.get('/api/'); - const apiVersion = apiVersionResponse.data.currentVersion; // 1.12.5 + const apiVersionResponse = await apiGet('/api/'); + const apiVersion = apiVersionResponse.currentVersion; // 1.12.5 console.log('apiVersion', apiVersion); - const groupsResponse = await axios.get(`/api/${apiVersion}/listAllGroups?apikey=${apikey}`); - const groups = groupsResponse.data.data.groupIDs; // ['whateverGroupID'] + const groupsResponse = await apiGet(`/api/${apiVersion}/listAllGroups?apikey=${apikey}`); + const groups = groupsResponse.data.groupIDs; // ['whateverGroupID'] for (const groupID of groups) { const sessionURI = `/api/${apiVersion}/listSessionsOfGroup?apikey=${apikey}&groupID=${groupID}`; - const sessionsResponse = await axios.get(sessionURI); - const sessions = sessionsResponse.data.data; + const sessionsResponse = await apiGet(sessionURI); + const sessions = sessionsResponse.data; if(sessions == null) continue; for (const [sessionID, val] of Object.entries(sessions)) { if(val == null) continue; const deleteURI = `/api/${apiVersion}/deleteSession?apikey=${apikey}&sessionID=${sessionID}`; - await axios.post(deleteURI).then(c=>{ - console.log(c.data) - deleteCount++; - }); // delete + const c = await apiPost(deleteURI); + console.log(c); + deleteCount++; } } console.log(`Deleted ${deleteCount} sessions`); diff --git a/bin/deletePad.ts b/bin/deletePad.ts index 2f6009158..1261bddf9 100644 --- a/bin/deletePad.ts +++ b/bin/deletePad.ts @@ -11,13 +11,22 @@ import path from "node:path"; import fs from "node:fs"; import process from "node:process"; -import axios from "axios"; process.on('unhandledRejection', (err) => { throw err; }); const settings = require('ep_etherpad-lite/tests/container/loadSettings').loadSettings(); -axios.defaults.baseURL = `http://${settings.ip}:${settings.port}`; +const baseURL = `http://${settings.ip}:${settings.port}`; +const apiGet = async (p: string): Promise => { + const r = await fetch(baseURL + p); + if (!r.ok) throw new Error(`HTTP ${r.status} ${r.statusText}`); + return r.json(); +}; +const apiPost = async (p: string): Promise => { + const r = await fetch(baseURL + p, {method: 'POST'}); + if (!r.ok) throw new Error(`HTTP ${r.status} ${r.statusText}`); + return r.json(); +}; if (process.argv.length !== 3) throw new Error('Use: node deletePad.js $PADID'); @@ -29,14 +38,14 @@ const filePath = path.join(__dirname, '../APIKEY.txt'); const apikey = fs.readFileSync(filePath, {encoding: 'utf-8'}); (async () => { - let apiVersion = await axios.get('/api/'); - apiVersion = apiVersion.data.currentVersion; + const apiInfo = await apiGet('/api/'); + const apiVersion = apiInfo.currentVersion; if (!apiVersion) throw new Error('No version set in API'); // Now we know the latest API version, let's delete pad const uri = `/api/${apiVersion}/deletePad?apikey=${apikey}&padID=${padId}`; - const deleteAttempt = await axios.post(uri); - if (deleteAttempt.data.code === 1) throw new Error(`Error deleting pad ${deleteAttempt.data}`); - console.log('Deleted pad', deleteAttempt.data); + const deleteAttempt = await apiPost(uri); + if (deleteAttempt.code === 1) throw new Error(`Error deleting pad ${deleteAttempt}`); + console.log('Deleted pad', deleteAttempt); process.exit(0) })(); diff --git a/bin/functions.sh b/bin/functions.sh index e41fa8f39..3d8bbcade 100644 --- a/bin/functions.sh +++ b/bin/functions.sh @@ -1,6 +1,6 @@ # minimum required node version -REQUIRED_NODE_MAJOR=12 -REQUIRED_NODE_MINOR=13 +REQUIRED_NODE_MAJOR=22 +REQUIRED_NODE_MINOR=0 # minimum required npm version REQUIRED_NPM_MAJOR=5 diff --git a/bin/installer.ps1 b/bin/installer.ps1 index 1c4cd0aa5..18491cdab 100644 --- a/bin/installer.ps1 +++ b/bin/installer.ps1 @@ -38,7 +38,7 @@ function Test-Cmd([string]$name) { $EtherpadDir = if ($env:ETHERPAD_DIR) { $env:ETHERPAD_DIR } else { 'etherpad-lite' } $EtherpadBranch = if ($env:ETHERPAD_BRANCH) { $env:ETHERPAD_BRANCH } else { 'master' } $EtherpadRepo = if ($env:ETHERPAD_REPO) { $env:ETHERPAD_REPO } else { 'https://github.com/ether/etherpad.git' } -$RequiredNodeMajor = 20 +$RequiredNodeMajor = 22 Write-Step 'Etherpad installer' diff --git a/bin/installer.sh b/bin/installer.sh index bd377309e..4d7dd8f03 100755 --- a/bin/installer.sh +++ b/bin/installer.sh @@ -34,7 +34,7 @@ is_cmd() { command -v "$1" >/dev/null 2>&1; } ETHERPAD_DIR="${ETHERPAD_DIR:-etherpad-lite}" ETHERPAD_BRANCH="${ETHERPAD_BRANCH:-master}" ETHERPAD_REPO="${ETHERPAD_REPO:-https://github.com/ether/etherpad.git}" -REQUIRED_NODE_MAJOR=20 +REQUIRED_NODE_MAJOR=22 step "Etherpad installer" diff --git a/bin/package.json b/bin/package.json index eefe42d90..6f0a31212 100644 --- a/bin/package.json +++ b/bin/package.json @@ -1,13 +1,12 @@ { "name": "bin", - "version": "2.7.2", + "version": "2.7.3", "description": "", "main": "checkAllPads.js", "directories": { "doc": "doc" }, "dependencies": { - "axios": "^1.15.2", "ep_etherpad-lite": "workspace:../src", "log4js": "^6.9.1", "semver": "^7.7.4", @@ -23,6 +22,8 @@ "makeDocs": "node --import tsx make_docs.ts", "checkPad": "node --import tsx checkPad.ts", "checkAllPads": "node --import tsx checkAllPads.ts", + "compactPad": "node --import tsx compactPad.ts", + "compactAllPads": "node --import tsx compactAllPads.ts", "createUserSession": "node --import tsx createUserSession.ts", "deletePad": "node --import tsx deletePad.ts", "repairPad": "node --import tsx repairPad.ts", diff --git a/bin/plugins.ts b/bin/plugins.ts index 9acd2af53..a1f18233b 100644 --- a/bin/plugins.ts +++ b/bin/plugins.ts @@ -1,7 +1,7 @@ 'use strict'; import {linkInstaller, checkForMigration} from "ep_etherpad-lite/static/js/pluginfw/installer"; -import {persistInstalledPlugins} from "./commonPlugins"; +import {persistInstalledPlugins, filterUpdatablePluginNames} from "./commonPlugins"; import fs from "node:fs"; const settings = require('ep_etherpad-lite/node/utils/Settings'); @@ -19,7 +19,9 @@ const possibleActions = [ "rm", "remove", "ls", - "list" + "list", + "up", + "update" ] const install = ()=> { @@ -76,6 +78,40 @@ const list = ()=>{ })(); } +// Re-install every plugin in installed_plugins.json without a version pin so +// the registry-latest gets resolved and overwrites the existing pinned copy +// in src/plugin_packages/. ep_etherpad-lite is the vendored core, never +// installed via the plugin path. filterUpdatablePluginNames also enforces +// the ep_ prefix so a corrupted manifest cannot coerce us into installing +// arbitrary npm packages, and de-duplicates repeats. +const update = ()=> { + (async () => { + const path = settings.root+"/var/installed_plugins.json"; + let entries: Array<{name?: unknown}>; + try { + const parsed = JSON.parse(fs.readFileSync(path, "utf-8")); + entries = Array.isArray(parsed?.plugins) ? parsed.plugins : []; + } catch (err: any) { + if (err.code === 'ENOENT') { + console.log("No installed_plugins.json found — nothing to update"); + return; + } + throw err; + } + const names = filterUpdatablePluginNames(entries); + if (names.length === 0) { + console.log("No plugins installed — nothing to update"); + return; + } + console.log(`Updating plugins to latest from registry: ${names.join(', ')}`); + await checkForMigration(); + for (const name of names) { + await linkInstaller.installPlugin(name); + } + await persistInstalledPlugins(); + })(); +} + const remove = (plugins: string[])=>{ const walk = async () => { for (const plugin of plugins) { @@ -112,6 +148,12 @@ switch (action) { case "remove": remove(args.slice(1)); break; + case "up": + update(); + break; + case "update": + update(); + break; default: console.error('Expected at least one argument!'); process.exit(1); diff --git a/bin/plugins/lib/npmpublish.yml b/bin/plugins/lib/npmpublish.yml index a7cf474a6..79e854254 100644 --- a/bin/plugins/lib/npmpublish.yml +++ b/bin/plugins/lib/npmpublish.yml @@ -21,9 +21,9 @@ jobs: - uses: actions/setup-node@v6 with: # OIDC trusted publishing needs npm >= 11.5.1, which requires - # Node >= 20.17.0. setup-node's `20` resolves to the latest - # 20.x, which satisfies that. - node-version: 20 + # Node >= 22.9.0. setup-node's `22` resolves to the latest + # 22.x, which satisfies that. + node-version: 22 registry-url: https://registry.npmjs.org/ - name: Upgrade npm to >=11.5.1 (required for trusted publishing) run: npm install -g npm@latest diff --git a/bin/plugins/stalePlugins.ts b/bin/plugins/stalePlugins.ts index 563bf51d1..4ca642140 100644 --- a/bin/plugins/stalePlugins.ts +++ b/bin/plugins/stalePlugins.ts @@ -2,22 +2,20 @@ // Returns a list of stale plugins and their authors email -import axios from 'axios' import process from "node:process"; const currentTime = new Date(); (async () => { - const res = await axios.get('https://static.etherpad.org/plugins.full.json'); - for (const plugin of Object.keys(res.data)) { - // @ts-ignore - const name = res.data[plugin].data.name; - // @ts-ignore - const date = new Date(res.data[plugin].time); + const resp = await fetch('https://static.etherpad.org/plugins.full.json'); + if (!resp.ok) throw new Error(`HTTP ${resp.status} ${resp.statusText}`); + const data: any = await resp.json(); + for (const plugin of Object.keys(data)) { + const name = data[plugin].data.name; + const date = new Date(data[plugin].time); const diffTime = Math.abs(currentTime.getTime() - date.getTime()); const diffDays = Math.ceil(diffTime / (1000 * 60 * 60 * 24)); if (diffDays > (365 * 2)) { - // @ts-ignore - console.log(`${name}, ${res.data[plugin].data.maintainers[0].email}`); + console.log(`${name}, ${data[plugin].data.maintainers[0].email}`); } } process.exit(0) diff --git a/bin/release.ts b/bin/release.ts index 5de3a826d..ae87c036d 100644 --- a/bin/release.ts +++ b/bin/release.ts @@ -204,7 +204,14 @@ try { run('git pull --ff-only', {cwd: '../ether.github.com/'}); console.log('Committing documentation...'); run(`cp -R out/doc/ ../ether.github.com/public/doc/v'${newVersion}'`); - run(`pnpm version ${newVersion}`, {cwd: '../ether.github.com'}); + // pnpm 11 refuses `pnpm version` on a dirty tree (the doc copy above + // dirties it) even with --no-git-tag-version, so write the bump with jq — + // same pattern used for the etherpad package.json files at the top of + // this script. The git add+commit below picks up both the bump and the + // freshly-copied docs in a single commit. + run( + `echo "$(jq '. += {"version": "'${newVersion}'"}' package.json)" > package.json`, + {cwd: '../ether.github.com'}); run('git add .', {cwd: '../ether.github.com/'}); run(`git commit -m '${newVersion} docs'`, {cwd: '../ether.github.com/'}); } catch (err:any) { diff --git a/bin/run-frontend-tests-with-disables.sh b/bin/run-frontend-tests-with-disables.sh new file mode 100755 index 000000000..b9d2ee369 --- /dev/null +++ b/bin/run-frontend-tests-with-disables.sh @@ -0,0 +1,153 @@ +#!/usr/bin/env bash +# +# Run the frontend test suite with awareness of a plugin's declared +# `disables` list (see doc/PLUGIN_FEATURE_DISABLES.md). +# +# A plugin that intentionally removes a baseline Etherpad feature MUST +# declare which feature tags it disables in its ep.json: +# +# { "name": "ep_disable_chat", "disables": ["@feature:chat"], ... } +# +# This script enforces that contract with two passes: +# +# 1. Regression pass — every test NOT tagged with a disabled feature +# must pass. Catches the case where the plugin breaks something +# unrelated to the feature it claims to disable. +# +# 2. Honesty pass — every test that IS tagged with a disabled feature +# must FAIL. If those tests pass, the plugin's `disables` claim is +# wrong; the feature it says it disables actually still works. +# Catches the case where a plugin opts out of tests it has no +# right to skip. +# +# Both passes have to pass for CI to be green. A plugin can't quietly +# disable functionality without declaring it (pass 1 catches that), and +# can't quietly opt out of test coverage by declaring features it +# doesn't actually disable (pass 2 catches that). +# +# Usage: +# bin/run-frontend-tests-with-disables.sh \ +# [--plugin-ep-json PATH] [-- ] +# +# Resolution order for the disables list: +# 1. EP_PLUGIN_DISABLES env var (comma- or space-separated) +# 2. --plugin-ep-json PATH (reads `.disables` JSON array) +# 3. Auto-detect: if exactly one ep_*/ep.json under plugin_packages/ +# declares disables, use it. Multiple disabling plugins → error. +# +# Run from src/ (where playwright.config.ts and node_modules live). + +set -euo pipefail + +EP_JSON="" +PLAYWRIGHT_ARGS=() +while [[ $# -gt 0 ]]; do + case "$1" in + --plugin-ep-json) + EP_JSON="$2"; shift 2;; + --) shift; PLAYWRIGHT_ARGS+=("$@"); break;; + *) PLAYWRIGHT_ARGS+=("$1"); shift;; + esac +done + +read_disables_from_json() { + # Echo space-separated list of @feature:* tags from a JSON file's + # top-level `disables` array. Empty if the file or field is missing. + local file="$1" + [[ -f "$file" ]] || return 0 + node -e " + try { + const j = JSON.parse(require('fs').readFileSync(process.argv[1], 'utf8')); + const d = Array.isArray(j.disables) ? j.disables : []; + process.stdout.write(d.join(' ')); + } catch (_) {} + " "$file" +} + +DISABLES="" +if [[ -n "${EP_PLUGIN_DISABLES:-}" ]]; then + DISABLES="$(echo "$EP_PLUGIN_DISABLES" | tr ',' ' ')" +elif [[ -n "$EP_JSON" ]]; then + DISABLES="$(read_disables_from_json "$EP_JSON")" +else + # Auto-detect from plugin_packages/. Skip if 0 or >1 disabling plugins. + # + # Live-plugin-manager installs plugins under plugin_packages/.versions/ + # and exposes them as symlinks at plugin_packages/ep_. find(1) + # doesn't follow symlinks by default, so iterate via shell glob and + # `-f $dir/ep.json` (which DOES resolve symlinks) instead. + declare -a CANDIDATES=() + if [[ -d plugin_packages ]]; then + shopt -s nullglob + for dir in plugin_packages/ep_*; do + [[ -L "$dir" || -d "$dir" ]] || continue + f="$dir/ep.json" + [[ -f "$f" ]] || continue + d="$(read_disables_from_json "$f")" + [[ -n "$d" ]] && CANDIDATES+=("$d") + done + shopt -u nullglob + fi + if [[ ${#CANDIDATES[@]} -eq 1 ]]; then + DISABLES="${CANDIDATES[0]}" + elif [[ ${#CANDIDATES[@]} -gt 1 ]]; then + echo "ERROR: multiple plugins declare disables, pass --plugin-ep-json explicitly:" >&2 + printf ' %s\n' "${CANDIDATES[@]}" >&2 + exit 2 + fi +fi + +DISABLES="$(echo "$DISABLES" | xargs)" # trim +if [[ -z "$DISABLES" ]]; then + echo "No 'disables' declared — running standard test suite." + exec pnpm exec playwright test "${PLAYWRIGHT_ARGS[@]}" +fi + +# Build the regex Playwright wants for --grep / --grep-invert. +# Tags are matched as substrings of the test title; @feature:chat is +# distinct enough that we don't need to anchor. +GREP_PATTERN="$(echo "$DISABLES" | tr ' ' '|')" + +echo "Plugin disables: $DISABLES" +echo + +echo "=== Pass 1: regression — tests NOT tagged with disabled features must pass ===" +pnpm exec playwright test --grep-invert "($GREP_PATTERN)" "${PLAYWRIGHT_ARGS[@]}" + +echo +echo "=== Pass 2: honesty — at least one test tagged with $DISABLES must FAIL (feature is disabled) ===" +# Pass 2 only needs evidence that the disabled feature is genuinely +# absent — *one* failing tagged test is sufficient proof. Without +# --max-failures, every tagged test runs to completion (each failing +# at the per-test timeout, e.g. 90s) which can take 10+ minutes for +# a busy tag like @feature:chat. --max-failures=1 stops on the first +# failure (~30s) and --timeout=30000 caps any single test at 30s, so +# the worst case stays bounded even if the first tagged test +# unexpectedly passes and we have to wait for the next one to fail. +# --retries=0 matters too: default CI retries (up to 5 with +# WITH_PLUGINS=1) would retry an "expected failure" several times. +set +e +pnpm exec playwright test \ + --grep "($GREP_PATTERN)" \ + --reporter=list \ + --retries=0 \ + --max-failures=1 \ + --timeout=30000 \ + "${PLAYWRIGHT_ARGS[@]}" +PASS2_EXIT=$? +set -e + +# Pass 2 SUCCEEDED (tests passed) is BAD: the plugin says it disables +# the feature but the feature works. Pass 2 FAILED (tests failed) is +# GOOD: the feature is genuinely disabled. +if [[ $PASS2_EXIT -eq 0 ]]; then + echo + echo "ERROR: plugin declares disables=[$DISABLES] but tests with those tags PASSED." >&2 + echo " The plugin is opting out of tests it has no right to skip:" >&2 + echo " - either the plugin isn't actually disabling those features," >&2 + echo " - or ep.json's disables list is wrong." >&2 + exit 1 +fi + +echo +echo "Both passes succeeded — plugin's disables contract is honoured." diff --git a/bin/updatePlugins.sh b/bin/updatePlugins.sh index a2b30ca3d..d5ca07328 100755 --- a/bin/updatePlugins.sh +++ b/bin/updatePlugins.sh @@ -2,12 +2,4 @@ set -e mydir=$(cd "${0%/*}" && pwd -P) || exit 1 cd "${mydir}"/.. -outdated_raw=$(pnpm --filter ep_etherpad-lite outdated --depth=0 2>&1) || true -OUTDATED=$(printf '%s\n' "$outdated_raw" | awk '{print $1}' | grep '^ep_' | grep -v '^ep_etherpad-lite$') || true -if [ -z "$OUTDATED" ]; then - echo "All plugins are up-to-date" - exit 0 -fi -set -- ${OUTDATED} -echo "Updating plugins: $*" -exec pnpm --filter ep_etherpad-lite update "$@" +exec pnpm --filter bin run plugins update diff --git a/doc/PLUGIN_FEATURE_DISABLES.md b/doc/PLUGIN_FEATURE_DISABLES.md new file mode 100644 index 000000000..f82dcd232 --- /dev/null +++ b/doc/PLUGIN_FEATURE_DISABLES.md @@ -0,0 +1,94 @@ +# Feature-disabling plugins + +Some Etherpad plugins exist specifically to **remove** a baseline feature — `ep_disable_chat`, `ep_disable_change_author_name`, `ep_disable_error_messages`, and so on. When the plugin is installed, the feature it disables is intentionally absent. + +This is awkward for CI: the core test suite asserts the disabled feature works. Without coordination, every disable plugin's CI is permanently red, every dependency bump is permanently stuck, and the green/red signal on etherpad.org/plugins becomes meaningless. + +To fix that — without giving plugins a free pass to opt out of arbitrary tests — Etherpad uses a small declared-disables contract. + +## How it works + +### 1. Core specs are tagged by feature + +Tests that exercise a single feature carry a Playwright tag like `@feature:chat`: + +```ts +test('opens chat, sends a message, makes sure it exists on the page and hides chat', { + tag: '@feature:chat', +}, async ({page}) => { ... }); + +test.describe('error sanitization', { tag: '@feature:error-gritter' }, () => { ... }); +``` + +Tags currently in use: + +- `@feature:chat` +- `@feature:username` +- `@feature:clear-authorship` +- `@feature:error-gritter` +- `@feature:line-numbers` +- `@feature:rtl-toggle` + +### 2. A plugin declares the features it disables in its `ep.json` + +```json +{ + "name": "ep_disable_chat", + "description": "Disable chat", + "disables": ["@feature:chat"], + "parts": [...] +} +``` + +The `disables` field is publicly visible in the plugin's metadata and surfaces on etherpad.org/plugins, so users see the contract before installing. + +### 3. The plugin's CI runs the two-pass test script + +`bin/run-frontend-tests-with-disables.sh` enforces the contract: + +```yaml +# .github/workflows/frontend-tests.yml +- name: Run the frontend tests + working-directory: ./etherpad-lite/src + run: ../bin/run-frontend-tests-with-disables.sh -- --project=chromium +``` + +The script reads `disables` (from `EP_PLUGIN_DISABLES`, an explicit `--plugin-ep-json PATH`, or auto-detection in `plugin_packages/`) and runs two passes: + +| Pass | What it runs | Must | +|---|---|---| +| **1. Regression** | Every spec **not** tagged with a disabled feature | Pass — proves the plugin doesn't break anything beyond what it claims to disable. | +| **2. Honesty** | Every spec **that is** tagged with a disabled feature | **Fail** — proves the plugin is genuinely disabling the feature it declares. If those tests pass, the plugin's `disables` claim is wrong. | + +Both passes have to succeed for CI to be green. + +## What this catches + +| Failure mode | Caught by | +|---|---| +| Plugin breaks an unrelated feature | Pass 1 — its tests aren't excluded, they fail, CI red. | +| Plugin claims to disable a feature but the feature still works | Pass 2 — tagged tests pass when they should fail, script exits non-zero. | +| Plugin breaks a feature without declaring it (so etherpad.org/plugins shows it as harmless) | Pass 1 — the feature's tests aren't excluded, they fail, CI red. | +| Plugin lists a feature in `disables` it doesn't actually disable | Pass 2. | + +A plugin **cannot** ship green with broken functionality the user can't see ahead of time. + +## Adding a new feature tag + +When a core spec needs a new feature tag (because a new disable plugin needs to opt out of it): + +1. Pick a stable name: `@feature:` — short, lowercase, kebab-case, plural where appropriate. +2. Tag the relevant `test()` or `test.describe()` blocks. Multiple tags are fine: `tag: ['@feature:chat', '@feature:username']`. +3. Update the list above. +4. Submit the tag PR before the plugin's PR — the plugin can then declare `disables` and pass CI. + +## Adding a new disable plugin + +1. Confirm the feature you're disabling is tagged in core. If not, propose a tag upstream first. +2. Add `"disables": ["@feature:thing"]` to your `ep.json`. +3. Replace the test invocation in `.github/workflows/frontend-tests.yml` with a call to `bin/run-frontend-tests-with-disables.sh` (see `ep_disable_chat` for a worked example). +4. Confirm both passes go green locally before opening the PR. + +## Why not just `--grep-invert`? + +The earlier draft of this design just told plugin maintainers to add `--grep-invert ""` in CI. That works for the regression case (pass 1 above), but it lets a careless or malicious plugin silently skip arbitrary tests and present green CI on etherpad.org/plugins despite breaking unrelated functionality. Pass 2 — and the requirement that disables be declared in `ep.json` rather than inferred from a CI argument — closes that gap. diff --git a/doc/PLUGIN_FRONTEND_TESTS.md b/doc/PLUGIN_FRONTEND_TESTS.md new file mode 100644 index 000000000..ffacd04d7 --- /dev/null +++ b/doc/PLUGIN_FRONTEND_TESTS.md @@ -0,0 +1,103 @@ +# Plugin frontend tests + +Etherpad core's Playwright runner discovers plugin frontend specs from +the conventional path: + +``` +node_modules/ep_/static/tests/frontend-new/specs/**/*.spec.ts +``` + +When the plugin is installed alongside core (e.g. via `pnpm add -w +ep_` or in a `with-plugins` CI variant), the plugin's specs +run as part of `pnpm run test-ui`. Same pattern backend tests already +use (`mocha ... ../node_modules/ep_*/static/tests/backend/specs/**`). + +This re-enables coverage that was lost in commit `cc80db2d3` (2023-07) +when the legacy jQuery test runner (`static/tests/frontend/specs/test.js` ++ in-page mocha+helper) was removed without a Playwright replacement. +See [#7622](https://github.com/ether/etherpad/issues/7622). + +## Layout in your plugin + +``` +ep_yourplugin/ +├── ep.json +├── package.json +├── static/ +│ └── tests/ +│ └── frontend-new/ +│ └── specs/ +│ └── yourplugin.spec.ts +└── ... +``` + +A spec is a normal Playwright test file. Import shared helpers from the +core package — `ep_etherpad-lite` is symlinked into `node_modules` by +the workspace, so this resolves anywhere the plugin is installed +alongside core: + +```ts +import {expect, test} from '@playwright/test'; +import {clearPadContent, getPadBody, goToNewPad, writeToPad} + from 'ep_etherpad-lite/tests/frontend-new/helper/padHelper'; + +test.beforeEach(async ({page}) => { + await goToNewPad(page); +}); + +test.describe('ep_yourplugin', () => { + test('does the thing', async ({page}) => { + const padBody = await getPadBody(page); + await padBody.click(); + await clearPadContent(page); + await writeToPad(page, 'hello'); + // …assertions… + await expect(padBody.locator('div').first()).toHaveText('hello'); + }); +}); +``` + +## Migrating from the legacy `static/tests/frontend/specs/test.js` + +The old format used mocha + a jQuery `helper` global: + +```js +// Legacy — does not run anywhere any more. +describe('ep_yourplugin', function () { + beforeEach(function (cb) { helper.newPad(cb); }); + it('does the thing', async function () { + const chrome$ = helper.padChrome$; + const inner$ = helper.padInner$; + expect(chrome$('#yourbutton').length).to.be.greaterThan(0); + }); +}); +``` + +Translation table: + +| Legacy (mocha + helper) | Playwright | +|---|---| +| `describe(...)` / `it(...)` | `test.describe(...)` / `test(...)` | +| `helper.newPad(cb)` | `await goToNewPad(page)` | +| `helper.padChrome$('#x')` | `page.locator('#x')` | +| `helper.padInner$('div')` | `(await getPadBody(page)).locator('div')` | +| `expect(x).to.equal(y)` | `expect(x).toBe(y)` (Playwright's expect) | +| `expect($el.length).to.be.greaterThan(0)` | `await expect(page.locator('#x')).toBeVisible()` | +| `$el.sendkeys('text')` | `await page.keyboard.type('text')` | +| `$el.simulate('click')` | `await page.locator(...).click()` | + +Most legacy specs translate ~mechanically. After migrating, **delete +the legacy file** so the plugin can't accidentally ship stale tests +that nothing executes. + +## Running them + +```sh +# Inside core, with the plugin installed: +pnpm run test-ui --project=chromium +# Or via core's with-plugins CI job (see frontend-tests.yml). +``` + +`pnpm run test-ui` automatically picks up plugin specs from any +installed `ep_*` package. To gate per-plugin: use playwright's +`--grep` against your plugin's describe name. diff --git a/doc/admin/updates.md b/doc/admin/updates.md new file mode 100644 index 000000000..852912de3 --- /dev/null +++ b/doc/admin/updates.md @@ -0,0 +1,83 @@ +# Etherpad updates + +Etherpad ships with a built-in update subsystem. **Tier 1 (notify)** is enabled by default: a banner appears in the admin UI when a new release is available, and pad users see a discreet badge if the running version is severely outdated or flagged as vulnerable. No automatic execution happens at this tier — admins are simply informed. + +Tiers 2 (manual click), 3 (auto with grace window), and 4 (autonomous in maintenance window) are designed but not yet implemented. They will land in subsequent releases. + +## Settings + +In `settings.json`: + +```jsonc +{ + "updates": { + "tier": "notify", + "source": "github", + "channel": "stable", + "installMethod": "auto", + "checkIntervalHours": 6, + "githubRepo": "ether/etherpad", + "requireAdminForStatus": false + }, + "adminEmail": null +} +``` + +| Setting | Default | Notes | +| --- | --- | --- | +| `updates.tier` | `"notify"` | One of `"off"`, `"notify"`, `"manual"`, `"auto"`, `"autonomous"`. Higher tiers are silently downgraded if the install method does not allow them. PR 1 only honors `"notify"` and `"off"`. | +| `updates.source` | `"github"` | Reserved for future alternative sources. Only `"github"` is implemented. | +| `updates.channel` | `"stable"` | Reserved. Stable releases only. | +| `updates.installMethod` | `"auto"` | One of `"auto"`, `"git"`, `"docker"`, `"npm"`, `"managed"`. Auto-detects via filesystem heuristics. Set explicitly to override. | +| `updates.checkIntervalHours` | `6` | How often to poll GitHub Releases. | +| `updates.githubRepo` | `"ether/etherpad"` | Override for forks. | +| `updates.requireAdminForStatus` | `false` | Lock the `/admin/update/status` endpoint to authenticated admin sessions. Default `false` matches existing Etherpad behavior — `/health` already exposes `releaseId` publicly, and changelog data comes from a public GitHub release. Set `true` to hide the full update payload from non-admins without disabling the updater (`tier: "off"` is the heavier opt-out that removes the endpoints entirely). | +| `adminEmail` | `null` | Top-level. Contact for admin notifications. Setting it enables the email nudges below. | + +## What "outdated" means + +- **`severe`** — running at least one major version behind the latest release. +- **`vulnerable`** — the running version is below a `vulnerable-below` threshold announced in a recent release. Releases declare these via a `` HTML comment in their body. The newest such directive wins. + +## Email cadence (when `adminEmail` is set) + +| Trigger | First send | Repeat | +| --- | --- | --- | +| Vulnerable status detected | Immediate | Weekly while still vulnerable | +| New release announced while still vulnerable | Immediate | n/a (one event per tag change) | +| Severely outdated detected | Immediate | Monthly while still severely outdated | +| Up to date | No email | — | + +If `adminEmail` is unset, the updater never sends mail. The admin UI banner and the pad-side badge still work without it. + +PR 1 ships the cadence machinery but does not yet wire a real SMTP transport — emails are logged with `(would send email)` until a future PR adds the transport. The dedupe state still advances correctly so admins are not bombarded once SMTP is wired. + +## Pad-side badge + +Pad users see no version information by default. A small badge appears in the bottom-right corner only when: + +- The instance is `severe` (one or more major versions behind), or +- The instance is `vulnerable` (running below an announced threshold). + +The public endpoint `/api/version-status` returns only `{outdated: null|"severe"|"vulnerable"}` — it never leaks the running version, so attackers do not gain a fingerprint vector. + +## Disabling everything + +Set `updates.tier` to `"off"`. No HTTP request will leave the instance and no banner or badge will render. + +## Privacy + +The version check sends no telemetry. Etherpad fetches the public GitHub Releases API (`api.github.com/repos//releases/latest`) with `If-None-Match` to be cache-friendly. The only metadata GitHub sees is the same as any other GitHub API client — your IP and a `User-Agent: etherpad-self-update` header. No instance ID, no version, no identifiers travel upstream. + +## How install method is detected + +`updates.installMethod` defaults to `"auto"`, which uses these heuristics in order: + +1. `/.dockerenv` exists → `"docker"`. +2. `.git/` directory present and the install root is writable → `"git"`. +3. `package-lock.json` present and writable → `"npm"`. +4. Otherwise → `"managed"`. + +Set the value explicitly if the heuristics get it wrong (e.g., a docker container that bind-mounts a writable git checkout). + +In PR 1 (notify only) the install method does not change behavior — every install method gets the banner. From PR 2 onward the install method gates whether the manual-click and automatic tiers can run; only `"git"` is initially supported for write tiers. diff --git a/doc/api/editorInfo.md b/doc/api/editorInfo.md index 7b3c27153..d8b62498c 100644 --- a/doc/api/editorInfo.md +++ b/doc/api/editorInfo.md @@ -5,6 +5,22 @@ Location: `src/static/js/ace2_inner.js` ## editorInfo.ace_replaceRange(start, end, text) This function replaces a range (from `start` to `end`) with `text`. +## editorInfo.ace_doDuplicateSelectedLines() + +Duplicates every line spanned by the current selection (or the caret's line +if nothing is selected) and inserts the duplicated block directly below the +original. Character attributes (bold, italic, list, heading, etc.) are +preserved on the duplicates. Wired to `Ctrl`/`Cmd`+`Shift`+`D` via the +`padShortcutEnabled.cmdShiftD` setting. + +## editorInfo.ace_doDeleteSelectedLines() + +Deletes every line spanned by the current selection (or the caret's line if +nothing is selected). If the selection covers the final line of the pad, +the preceding newline is consumed so no dangling empty line is left. +Wired to `Ctrl`/`Cmd`+`Shift`+`K` via the `padShortcutEnabled.cmdShiftK` +setting. + ## editorInfo.ace_getRep() Returns the `rep` object. The rep object consists of the following properties: diff --git a/doc/api/hooks_client-side.md b/doc/api/hooks_client-side.md index 4b0f1cce6..d6b36681c 100644 --- a/doc/api/hooks_client-side.md +++ b/doc/api/hooks_client-side.md @@ -354,6 +354,34 @@ Context properties: * `message`: The message object that will be sent to the Etherpad server. +## `chatPrefillFromUser` + +Called from: `src/static/js/pad_userlist.ts` + +Called when the user clicks an entry in the user list. The default behavior is to +open the chat panel and prefill the input with `@ `, where `` is that +user's display name (with whitespace replaced by underscores). Plugins can return +a different prefill string from their callback — the first non-empty string +returned wins. + +Typical use is by AI/bot plugins whose author display name (e.g. "AI Assistant") +isn't a useful @-mention; the plugin can substitute its trigger string instead. + +Context properties: + +* `authorId`: The clicked user's author id. +* `name`: The clicked user's display name. +* `prefill`: The default prefill string Etherpad would otherwise use. + +Example: + +```javascript +exports.chatPrefillFromUser = (hookName, {authorId, name}, cb) => { + if (authorId === window.clientVars.ep_my_bot.authorId) return cb('@bot '); + return cb(); +}; +``` + ## collectContentPre Called from: `src/static/js/contentcollector.js` diff --git a/doc/api/http_api.adoc b/doc/api/http_api.adoc index 0246d6181..82313c54a 100644 --- a/doc/api/http_api.adoc +++ b/doc/api/http_api.adoc @@ -65,7 +65,7 @@ Portal submits content into new blog post === Usage ==== API version -The latest version is `1.3.0` +The latest version is `1.3.1` The current version can be queried via /api. @@ -588,6 +588,25 @@ _Example returns:_ * `{code: 0, message:"ok", data: null}` * `{code: 1, message:"padID does not exist", data: null}` +==== compactPad(padID, [keepRevisions]) + * API >= 1.3.1 + +collapses the pad's revision history to reclaim database space (issue #6194). Wraps the same `Cleanup` helper that powers the admin-settings UI, so admins can trigger compaction over the public API or via `bin/compactPad` without going through the admin UI. + +*Gated on `settings.cleanup.enabled = true`* (matches the admin/Cleanup path). The endpoint returns an error if cleanup isn't enabled in `settings.json`, so the public API can't bypass the same opt-in switch the admin UI requires. + +When `keepRevisions` is omitted (or null), all history is collapsed into a single base revision that reproduces the current pad text — equivalent to a freshly-imported pad. When set to a positive integer N, the pad keeps only its last N revisions. + +Pad text and chat are preserved in both modes. Saved-revision bookmarks are cleared. *This operation is destructive — export the pad first via `getEtherpad` if you need a backup.* + +_Example returns:_ + + * `{code: 0, message:"ok", data: {ok: true, mode: "all"}}` + * `{code: 0, message:"ok", data: {ok: true, mode: "keepLast", keepRevisions: 50}}` + * `{code: 1, message:"padID does not exist", data: null}` + * `{code: 1, message:"keepRevisions must be a non-negative integer", data: null}` + * `{code: 1, message:"compactPad requires cleanup.enabled = true in settings.json", data: null}` + ==== getReadOnlyID(padID) * API >= 1 diff --git a/doc/api/http_api.md b/doc/api/http_api.md index 2676a8987..35437f23e 100644 --- a/doc/api/http_api.md +++ b/doc/api/http_api.md @@ -98,7 +98,7 @@ Portal submits content into new blog post ## Usage ### API version -The latest version is `1.3.0` +The latest version is `1.3.1` The current version can be queried via /api. @@ -519,12 +519,20 @@ Group pads are normal pads, but with the name schema GROUPID$PADNAME. A security #### createPad(padID, [text], [authorId]) * API >= 1 * `authorId` in API >= 1.3.0 +* returns `deletionToken` once, since the same release that added `allowPadDeletionByAllUsers` creates a new (non-group) pad. Note that if you need to create a group Pad, you should call **createGroupPad**. You get an error message if you use one of the following characters in the padID: "/", "?", "&" or "#". +`data.deletionToken` is a one-shot recovery token tied to this pad. It is +returned in plaintext on the first call for a given padID and is `null` on +subsequent calls (the token itself is stored on the server as a sha256 hash). +Pass it to **deletePad** (or the socket `PAD_DELETE` message) to delete the +pad without the creator's author cookie. + *Example returns:* -* `{code: 0, message:"ok", data: null}` +* `{code: 0, message:"ok", data: {deletionToken: "…32-char random string…"}}` +* `{code: 0, message:"ok", data: {deletionToken: null}}` — pad already existed * `{code: 1, message:"padID does already exist", data: null}` * `{code: 1, message:"malformed padID: Remove special characters", data: null}` @@ -581,14 +589,24 @@ returns the list of users that are currently editing this pad * `{code: 0, message:"ok", data: {padUsers: [{colorId:"#c1a9d9","name":"username1","timestamp":1345228793126,"id":"a.n4gEeMLsvg12452n"},{"colorId":"#d9a9cd","name":"Hmmm","timestamp":1345228796042,"id":"a.n4gEeMLsvg12452n"}]}}` * `{code: 0, message:"ok", data: {padUsers: []}}` -#### deletePad(padID) +#### deletePad(padID, [deletionToken]) * API >= 1 +* `deletionToken` in the same release as `allowPadDeletionByAllUsers` -deletes a pad +deletes a pad. + +`deletionToken` is the one-shot recovery token returned by `createPad` / +`createGroupPad`. An apikey-authenticated caller can pass any (or no) token +and the call still succeeds — trusted admins bypass the check. An +unauthenticated caller (or a caller that explicitly passes a wrong token) +is rejected with `invalid deletionToken` unless the operator has set +`allowPadDeletionByAllUsers: true` in `settings.json`, in which case the +token is ignored. *Example returns:* * `{code: 0, message:"ok", data: null}` * `{code: 1, message:"padID does not exist", data: null}` +* `{code: 1, message:"invalid deletionToken", data: null}` #### copyPad(sourceID, destinationID[, force=false]) * API >= 1.2.8 @@ -619,6 +637,24 @@ moves a pad. If force is true and the destination pad exists, it will be overwri * `{code: 0, message:"ok", data: null}` * `{code: 1, message:"padID does not exist", data: null}` +#### compactPad(padID, [keepRevisions]) +* API >= 1.3.1 + +collapses the pad's revision history to reclaim database space (issue #6194). Wraps the same `Cleanup` helper that powers the admin-settings UI, so admins can trigger compaction over the public API or via `bin/compactPad` without going through the admin UI. + +**Gated on `settings.cleanup.enabled = true`** (matches the admin/Cleanup path). The endpoint returns an error if cleanup isn't enabled in `settings.json`, so the public API can't bypass the same opt-in switch the admin UI requires. + +When `keepRevisions` is omitted (or null), all history is collapsed into a single base revision that reproduces the current pad text — equivalent to a freshly-imported pad. When set to a positive integer N, the pad keeps only its last N revisions. + +Pad text and chat are preserved in both modes. Saved-revision bookmarks are cleared. **This operation is destructive — export the pad first via `getEtherpad` if you need a backup.** + +*Example returns:* +* `{code: 0, message:"ok", data: {ok: true, mode: "all"}}` +* `{code: 0, message:"ok", data: {ok: true, mode: "keepLast", keepRevisions: 50}}` +* `{code: 1, message:"padID does not exist", data: null}` +* `{code: 1, message:"keepRevisions must be a non-negative integer", data: null}` +* `{code: 1, message:"compactPad requires cleanup.enabled = true in settings.json", data: null}` + #### getReadOnlyID(padID) * API >= 1 diff --git a/doc/cookies.md b/doc/cookies.md index ec28352b4..ce6eac222 100644 --- a/doc/cookies.md +++ b/doc/cookies.md @@ -7,7 +7,7 @@ Cookies used by Etherpad. | express_sid | s%3A7yCNjRmTW8ylGQ53I2IhOwYF9... | example.org | / | Session | true | true | Session ID of the [Express web framework](https://expressjs.com). When Etherpad is behind a reverse proxy, and an administrator wants to use session stickiness, he may use this cookie. If you are behind a reverse proxy, please remember to set `trustProxy: true` in `settings.json`. Set in [webaccess.js#L131](https://github.com/ether/etherpad-lite/blob/01497aa399690e44393e91c19917d11d025df71b/src/node/hooks/express/webaccess.js#L131). | | language | en | example.org | / | Session | false | true | The language of the UI (e.g.: `en-GB`, `it`). Set by the pad client when the user changes **My View → Language** (currently in `src/static/js/pad.ts`, via `setMyViewLanguage()`). | | prefs / prefsHttp | %7B%22epThemesExtTheme%22... | example.org | /p | year 3000 | false | true | Client-side preferences (e.g.: font family, chat always visible, show authorship colors, ...). Set in [pad_cookie.js#L49](https://github.com/ether/etherpad-lite/blob/01497aa399690e44393e91c19917d11d025df71b/src/static/js/pad_cookie.js#L49). `prefs` is used if Etherpad is accessed over HTTPS, `prefsHttp` if accessed over HTTP. For more info see https://github.com/ether/etherpad-lite/issues/3179. | -| token | t.tFzkihhhBf4xKEpCK3PU | example.org | / | 60 days | false | true | A random token representing the author, of the form `t.randomstring_of_lenght_20`. The random string is generated by the client, at ([pad.js#L55-L66](https://github.com/ether/etherpad-lite/blob/01497aa399690e44393e91c19917d11d025df71b/src/static/js/pad.js#L55-L66)). This cookie is always set by the client (at [pad.js#L153-L158](https://github.com/ether/etherpad-lite/blob/01497aa399690e44393e91c19917d11d025df71b/src/static/js/pad.js#L153-L158)) without any solicitation from the server. It is used for all the pads accessed via the web UI (not used for the HTTP API). On the server side, its value is accessed at [SecurityManager.js#L33](https://github.com/ether/etherpad-lite/blob/01497aa399690e44393e91c19917d11d025df71b/src/node/db/SecurityManager.js#L33). | +| token | t.tFzkihhhBf4xKEpCK3PU | example.org | / | 60 days | true | true | A random token representing the author, of the form `t.randomstring_of_length_20`. Set by the server as an `HttpOnly; SameSite=Lax` cookie on the first GET to `/p/:pad` (see `src/node/utils/ensureAuthorTokenCookie.ts`). The server reads the cookie from the socket.io handshake in `PadMessageHandler.handleClientReady` to resolve the author. Not readable from browser JavaScript. See [privacy.md](privacy.md). | For more info, visit the related discussion at https://github.com/ether/etherpad-lite/issues/3563. diff --git a/doc/docker.md b/doc/docker.md index fe31ea031..ce7606f8e 100644 --- a/doc/docker.md +++ b/doc/docker.md @@ -115,6 +115,8 @@ If your database needs additional settings, you will have to use a personalized | `PAD_OPTIONS_ALWAYS_SHOW_CHAT` | | `false` | | `PAD_OPTIONS_CHAT_AND_USERS` | | `false` | | `PAD_OPTIONS_LANG` | | `null` | +| `PAD_OPTIONS_FADE_INACTIVE_AUTHOR_COLORS` | Fade each author's caret/background toward white as they go inactive. Set to `false` on busy pads (every faded author counts as a second on-screen color, so 30 contributors visually become 60), when users pick light colors that fade into the background, or whenever inactivity tracking is undesirable. | `true` | +| `PAD_OPTIONS_ENFORCE_READABLE_AUTHOR_COLORS` | Lighten/darken author bg colours at render time so text contrast meets WCAG 2.1 AA. | `true` | ### Shortcuts diff --git a/doc/npm-trusted-publishing.md b/doc/npm-trusted-publishing.md index 2ba9a8841..31d57fdc0 100644 --- a/doc/npm-trusted-publishing.md +++ b/doc/npm-trusted-publishing.md @@ -85,10 +85,10 @@ If a package previously had an `NPM_TOKEN` secret in CI: ## Requirements -- **Node.js**: >= 20.17.0 on the runner. npm 11 requires - `^20.17.0 || >=22.9.0`. The npm docs nominally recommend Node 22.14+, but - Node 20.17+ works fine — the project's `engines.node` already requires - `>=20.0.0`, and `setup-node@v6 with version: 20` resolves to the latest 20.x. +- **Node.js**: >= 22.12 on the runner. npm 11 requires `>=22.9.0` and + `oxc-minify` (a vitepress peer for the docs build) requires `>=22.12.0`, + both of which `setup-node@v6 with version: 22` satisfies (resolves to the + latest 22.x). The project's `engines.node` requires `>=22.12.0`. - **npm CLI**: >= 11.5.1. The publish workflow runs `npm install -g npm@latest` before publishing so the bundled npm version doesn't matter. - **Runner**: must be a GitHub-hosted (cloud) runner. Self-hosted runners are diff --git a/doc/package.json b/doc/package.json index 76ede1b5e..69cc8cecd 100644 --- a/doc/package.json +++ b/doc/package.json @@ -1,5 +1,6 @@ { "devDependencies": { + "oxc-minify": "^0.129.0", "vitepress": "^2.0.0-alpha.17" }, "scripts": { @@ -9,8 +10,5 @@ }, "peerDependencies": { "search-insights": "^2.17.3" - }, - "overrides": { - "vite": "npm:rolldown-vite@7.2.10" } } diff --git a/doc/privacy.md b/doc/privacy.md new file mode 100644 index 000000000..4d3fb7091 --- /dev/null +++ b/doc/privacy.md @@ -0,0 +1,131 @@ +# Privacy + +This document describes what Etherpad stores and logs about its users, so +operators can publish an accurate data-processing statement. + +## Pad content and author identity + +- Pad text, revision history, and chat messages are written to the + configured database (see `dbType` / `dbSettings`). +- Authorship is tracked by an opaque `authorID` that is bound to a + short-lived author-token cookie. There is no link between an authorID + and a real-world identity unless a plugin or SSO layer adds one. + +## IP addresses + +Etherpad never writes a client IP to its database. IPs only appear in +`log4js` output (the `access`, `http`, `message`, and console loggers). +Whether those are persisted depends entirely on the log appender your +deployment configures. + +The `ipLogging` setting (`settings.json`) controls what those log +records contain. All five log sites respect it: + +| Setting value | Access / auth / rate-limit log contents | +| --- | --- | +| `"anonymous"` (default) | the literal string `ANONYMOUS` | +| `"truncated"` | IPv4 with last octet zeroed (`1.2.3.0`); IPv6 truncated to the first /48 (`2001:db8:1::`); IPv4-mapped IPv6 truncates the embedded v4; unknowns fall back to `ANONYMOUS` | +| `"full"` | the original IP address | + +The pre-2026 boolean `disableIPlogging` is still honoured for one +release cycle: `true` maps to `"anonymous"`, `false` maps to `"full"`. +A deprecation WARN is emitted when only the legacy setting is present. + +## Rate limiting + +The in-memory socket rate limiter keys on the raw client IP for the +duration of the limiter window (see `commitRateLimiting` in +`settings.json`). This state is never written to disk, never sent to a +plugin, and is thrown away on server restart. + +## What Etherpad does not do + +- No IP addresses are written to the database. +- No IP addresses are sent to `clientVars` (and therefore to the + browser). The long-standing `clientIp: '127.0.0.1'` placeholder was + removed in the same change that introduced `ipLogging`. +- No IP addresses are passed to server-side plugin hooks by Etherpad + itself. Plugins that receive a raw `req` can still read `req.ip` + directly — audit your installed plugins if you need to rule that + out. + +## Cookies + +See [`cookies.md`](cookies.md) for the full cookie list. + +## Right to erasure (GDPR Art. 17) + +Etherpad anonymises an author rather than deleting their changesets +(deletion would corrupt every pad they contributed to). Operators +trigger erasure via the admin REST API: + +```bash +curl -X POST \ + -H "Authorization: Bearer " \ + "https:///api/1.3.1/anonymizeAuthor?authorID=a.XXXXXXXXXXXXXX" +``` + +The endpoint is gated by the `gdprAuthorErasure` setting (see +`settings.json`). It is **disabled by default**; set +`"gdprAuthorErasure": { "enabled": true }` to expose it. While +disabled, calls return HTTP 404 / API code 4 ("no such function"). + +What the call does: + +- Zeros `name` and `colorId` on the `globalAuthor:` record + (kept as an opaque stub so changeset references still resolve to + "an author" with no details). +- Deletes every `token2author:` and `mapper2author:` + binding that pointed at this author. Once removed, a new session + with the same token starts a fresh anonymous identity. +- Nulls `authorId` on chat messages the author posted; message text + and timestamps are unchanged. + +What it does not do: + +- Delete pad content, revisions, or the attribute pool. If a pad + itself should also be erased, use the pad-deletion token flow + (PR1, `deletePad`). +- Touch other authors' edits. + +The call is idempotent: calling it twice on the same authorID +short-circuits the second time and returns zero counters. Pad-level +deletion is covered separately by the deletion-token mechanism in +[`docs/superpowers/specs/2026-04-18-gdpr-pr1-deletion-controls-design.md`](https://github.com/ether/etherpad/blob/develop/docs/superpowers/specs/2026-04-18-gdpr-pr1-deletion-controls-design.md); +the rest of the GDPR work is tracked in +[ether/etherpad#6701](https://github.com/ether/etherpad/issues/6701). + +## Privacy banner (optional) + +The `privacyBanner` block in `settings.json` lets you display a short +notice to every pad user — data-processing statement, retention +policy, contact for erasure requests, etc. + +```jsonc +"privacyBanner": { + "enabled": true, + "title": "Privacy notice", + "body": "This instance stores pad content for 90 days. Contact privacy@example.com to request erasure.", + "learnMoreUrl": "https://example.com/privacy", + "dismissal": "dismissible" +} +``` + +The banner is rendered as a persistent gritter notification at the +bottom of the page (it inherits the same look as every other gritter +on the pad — no custom skin needed). The body is plain text (HTML is +escaped); each line becomes its own paragraph. + +`dismissal` controls how the close (×) is handled: + +- `"dismissible"` (default) — when the user closes the gritter, the + choice is persisted in `localStorage` per origin and the banner is + not shown again on subsequent pad loads. +- `"sticky"` — closing the gritter only hides it for the current + session; the next pad load shows it again. (The close control is + not removed; for an operator-enforced non-closable notice, render + the policy out-of-band — e.g., a skin override or a reverse-proxy + ribbon.) + +Unknown `dismissal` values are coerced to `"dismissible"` with a +`logger.warn` at settings load. diff --git a/docs/superpowers/plans/2026-04-18-gdpr-pr1-deletion-controls.md b/docs/superpowers/plans/2026-04-18-gdpr-pr1-deletion-controls.md new file mode 100644 index 000000000..467bf8907 --- /dev/null +++ b/docs/superpowers/plans/2026-04-18-gdpr-pr1-deletion-controls.md @@ -0,0 +1,939 @@ +# GDPR PR1 — Pad Deletion Controls Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** Land the first of five GDPR PRs from ether/etherpad#6701 — adds a one-time deletion token, an `allowPadDeletionByAllUsers` admin flag, and the UI + endpoint plumbing needed for creators to delete a pad without their browser cookies. + +**Architecture:** A new `PadDeletionManager` module owns the token (sha256-hashed in the db under `pad::deletionToken`, returned plaintext exactly once on creation). `handlePadDelete` gains a three-way authorisation check — creator cookie → valid token → settings flag — and `createPad`/`createGroupPad` return the token in the HTTP API response. The browser creator also receives the token via `clientVars.padDeletionToken`, shows it in a one-time modal, and gets a "delete with token" field in the settings popup for devices without the creator cookie. + +**Tech Stack:** TypeScript (etherpad server + client), jQuery + EJS for pad UI, Playwright for frontend tests, Mocha + supertest for backend tests. + +--- + +## File Structure + +**Already in working tree (from restored stash):** +- `src/node/db/PadDeletionManager.ts` — create / verify (timing-safe) / remove +- `settings.json.template`, `settings.json.docker` — `allowPadDeletionByAllUsers: false` +- `src/node/utils/Settings.ts` — `allowPadDeletionByAllUsers` type + default +- `src/node/db/API.ts` — `createPad` returns `{deletionToken}` +- `src/node/db/GroupManager.ts` — `createGroupPad` returns `{padID, deletionToken}` +- `src/node/db/Pad.ts` — `Pad.remove()` calls `removeDeletionToken` +- `src/static/js/types/SocketIOMessage.ts` — `ClientVarPayload` has optional `padDeletionToken` + +**Created by this plan:** +- `src/tests/backend/specs/padDeletionManager.ts` — unit tests for the manager +- `src/tests/backend/specs/api/deletePad.ts` — authorisation-matrix tests +- `src/tests/frontend-new/specs/pad_deletion_token.spec.ts` — end-to-end modal + delete-by-token + +**Modified by this plan:** +- `src/node/handler/PadMessageHandler.ts` — three-way auth in `handlePadDelete`; thread `padDeletionToken` into `clientVars` for creator sessions +- `src/node/db/API.ts` — expose the optional `deletionToken` parameter on the programmatic `deletePad(padID, deletionToken?)` path for REST coverage +- `src/static/js/types/SocketIOMessage.ts` — add optional `deletionToken` to `PadDeleteMessage` +- `src/templates/pad.html` — post-creation token modal, delete-by-token disclosure under Delete button +- `src/static/js/pad.ts` — surface modal when `clientVars.padDeletionToken` is present, clear it after ack +- `src/static/js/pad_editor.ts` — wire delete-by-token input into the existing delete flow +- `src/static/css/pad.css` (or the skin component file the Delete button already lives in) — minimal styling for modal + disclosure +- `src/locales/en.json` — new localisation keys +- `src/tests/backend/specs/api/api.ts` — extend to cover `createPad` returning a token once + +--- + +## Task 1: Baseline and verify the restored scaffolding + +**Files:** +- (no edits — validation only) + +- [ ] **Step 1: Confirm branch and stashed files exist** + +```bash +git status --short +git log --oneline -5 +``` + +Expected: current branch is `feat-gdpr-pad-deletion`, HEAD shows `docs: PR1 GDPR deletion-controls design spec`, and working tree modifications cover `settings.json.template`, `settings.json.docker`, `src/node/db/API.ts`, `src/node/db/GroupManager.ts`, `src/node/db/Pad.ts`, `src/node/utils/Settings.ts`, `src/static/js/types/SocketIOMessage.ts`, plus the untracked `src/node/db/PadDeletionManager.ts`. + +- [ ] **Step 2: Type check before touching anything** + +Run: `pnpm --filter ep_etherpad-lite run ts-check` +Expected: exit 0, no TypeScript errors. + +- [ ] **Step 3: Commit the restored scaffolding as its own change** + +```bash +git add settings.json.template settings.json.docker \ + src/node/db/API.ts src/node/db/GroupManager.ts src/node/db/Pad.ts \ + src/node/utils/Settings.ts src/static/js/types/SocketIOMessage.ts \ + src/node/db/PadDeletionManager.ts +git commit -m "$(cat <<'EOF' +feat(gdpr): scaffolding for pad deletion tokens + +PadDeletionManager stores a sha256-hashed per-pad deletion token and +verifies it with timing-safe comparison. createPad / createGroupPad +return the plaintext token once on first creation, and Pad.remove() +cleans it up. Gated behind the new allowPadDeletionByAllUsers flag +which defaults to false to preserve existing behaviour. + +Part of #6701 (GDPR PR1). + +Co-Authored-By: Claude Opus 4.7 (1M context) +EOF +)" +``` + +Expected: clean commit, no pre-commit hook failures. + +--- + +## Task 2: Unit tests for `PadDeletionManager` + +**Files:** +- Create: `src/tests/backend/specs/padDeletionManager.ts` + +- [ ] **Step 1: Write the failing test file** + +```typescript +'use strict'; + +import {strict as assert} from 'assert'; + +const common = require('../common'); +const padDeletionManager = require('../../../node/db/PadDeletionManager'); + +describe(__filename, function () { + before(async function () { await common.init(); }); + + const uniqueId = () => `pdmtest_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`; + + describe('createDeletionTokenIfAbsent', function () { + it('returns a non-empty string on first call', async function () { + const padId = uniqueId(); + const token = await padDeletionManager.createDeletionTokenIfAbsent(padId); + assert.equal(typeof token, 'string'); + assert.ok(token.length >= 32); + await padDeletionManager.removeDeletionToken(padId); + }); + + it('returns null on subsequent calls for the same pad', async function () { + const padId = uniqueId(); + const first = await padDeletionManager.createDeletionTokenIfAbsent(padId); + const second = await padDeletionManager.createDeletionTokenIfAbsent(padId); + assert.equal(typeof first, 'string'); + assert.equal(second, null); + await padDeletionManager.removeDeletionToken(padId); + }); + + it('emits different tokens for different pads', async function () { + const a = uniqueId(); + const b = uniqueId(); + const tokenA = await padDeletionManager.createDeletionTokenIfAbsent(a); + const tokenB = await padDeletionManager.createDeletionTokenIfAbsent(b); + assert.notEqual(tokenA, tokenB); + await padDeletionManager.removeDeletionToken(a); + await padDeletionManager.removeDeletionToken(b); + }); + }); + + describe('isValidDeletionToken', function () { + it('accepts the token returned by the matching pad', async function () { + const padId = uniqueId(); + const token = await padDeletionManager.createDeletionTokenIfAbsent(padId); + assert.equal(await padDeletionManager.isValidDeletionToken(padId, token), true); + await padDeletionManager.removeDeletionToken(padId); + }); + + it('rejects a token for the wrong pad', async function () { + const a = uniqueId(); + const b = uniqueId(); + const tokenA = await padDeletionManager.createDeletionTokenIfAbsent(a); + await padDeletionManager.createDeletionTokenIfAbsent(b); + assert.equal(await padDeletionManager.isValidDeletionToken(b, tokenA), false); + await padDeletionManager.removeDeletionToken(a); + await padDeletionManager.removeDeletionToken(b); + }); + + it('rejects a non-string token', async function () { + const padId = uniqueId(); + await padDeletionManager.createDeletionTokenIfAbsent(padId); + assert.equal(await padDeletionManager.isValidDeletionToken(padId, null), false); + assert.equal(await padDeletionManager.isValidDeletionToken(padId, undefined), false); + assert.equal(await padDeletionManager.isValidDeletionToken(padId, ''), false); + await padDeletionManager.removeDeletionToken(padId); + }); + + it('returns false for pads that never had a token', async function () { + const padId = uniqueId(); + assert.equal(await padDeletionManager.isValidDeletionToken(padId, 'anything'), false); + }); + }); + + describe('removeDeletionToken', function () { + it('invalidates the stored token', async function () { + const padId = uniqueId(); + const token = await padDeletionManager.createDeletionTokenIfAbsent(padId); + await padDeletionManager.removeDeletionToken(padId); + assert.equal(await padDeletionManager.isValidDeletionToken(padId, token), false); + }); + + it('is safe to call when no token exists', async function () { + const padId = uniqueId(); + await padDeletionManager.removeDeletionToken(padId); // must not throw + }); + }); +}); +``` + +- [ ] **Step 2: Run the test file and confirm it passes** + +Run: `pnpm --filter ep_etherpad-lite exec mocha --require tsx/cjs tests/backend/specs/padDeletionManager.ts --timeout 10000` +Expected: all 8 tests pass. + +- [ ] **Step 3: Commit** + +```bash +git add src/tests/backend/specs/padDeletionManager.ts +git commit -m "test(gdpr): PadDeletionManager unit tests" +``` + +--- + +## Task 3: Extend `PadDeleteMessage` type and `handlePadDelete` authorisation + +**Files:** +- Modify: `src/static/js/types/SocketIOMessage.ts:198-203` +- Modify: `src/node/handler/PadMessageHandler.ts:230-265` + +- [ ] **Step 1: Add `deletionToken` to `PadDeleteMessage`** + +```typescript +// src/static/js/types/SocketIOMessage.ts +export type PadDeleteMessage = { + type: 'PAD_DELETE' + data: { + padId: string + deletionToken?: string + } +} +``` + +- [ ] **Step 2: Thread the token through `handlePadDelete`** + +Open `src/node/handler/PadMessageHandler.ts`, find `handlePadDelete` (near line 230), and replace its body (keep the outer async function signature) with: + +```typescript +const handlePadDelete = async (socket: any, padDeleteMessage: PadDeleteMessage) => { + const session = sessioninfos[socket.id]; + if (!session || !session.author || !session.padId) throw new Error('session not ready'); + const padId = padDeleteMessage.data.padId; + if (session.padId !== padId) throw new Error('refusing cross-pad delete'); + if (!await padManager.doesPadExist(padId)) return; + + const retrievedPad = await padManager.getPad(padId); + const firstContributor = await retrievedPad.getRevisionAuthor(0); + const isCreator = session.author === firstContributor; + const tokenOk = !isCreator && await padDeletionManager.isValidDeletionToken( + padId, padDeleteMessage.data.deletionToken); + const flagOk = !isCreator && !tokenOk && settings.allowPadDeletionByAllUsers; + + if (isCreator || tokenOk || flagOk) { + await retrievedPad.remove(); + return; + } + + socket.emit('shout', { + type: 'COLLABROOM', + data: { + type: 'shoutMessage', + payload: { + message: { + message: 'You are not the creator of this pad, so you cannot delete it', + sticky: false, + }, + timestamp: Date.now(), + }, + }, + }); +}; +``` + +- [ ] **Step 3: Wire the new imports at the top of `PadMessageHandler.ts`** + +Ensure the file has: + +```typescript +const padDeletionManager = require('../db/PadDeletionManager'); +``` + +(Add it to the import block alongside the existing `padManager` require. If it is already present from earlier scaffolding, skip this step.) + +- [ ] **Step 4: Type check** + +Run: `pnpm --filter ep_etherpad-lite run ts-check` +Expected: exit 0. + +- [ ] **Step 5: Commit** + +```bash +git add src/static/js/types/SocketIOMessage.ts src/node/handler/PadMessageHandler.ts +git commit -m "feat(gdpr): three-way auth for socket PAD_DELETE + +Creator cookie → valid deletion token → allowPadDeletionByAllUsers flag. +Anyone else still gets the existing refusal shout." +``` + +--- + +## Task 4: Programmatic `deletePad(padId, deletionToken?)` and REST coverage + +**Files:** +- Modify: `src/node/db/API.ts:530-545` (the `deletePad` export) + +- [ ] **Step 1: Extend the programmatic `deletePad` signature** + +Replace the existing `exports.deletePad` with: + +```typescript +/** +deletePad(padID, deletionToken?) deletes a pad +... + */ +exports.deletePad = async (padID: string, deletionToken?: string) => { + const pad = await getPadSafe(padID, true); + // apikey-authenticated callers bypass token checks — they're already trusted. + // For anonymous callers that hit this code path (e.g. a future public endpoint), + // require a valid token unless the instance has opted everyone in. + if (deletionToken !== undefined && + !settings.allowPadDeletionByAllUsers && + !await padDeletionManager.isValidDeletionToken(padID, deletionToken)) { + throw new CustomError('invalid deletionToken', 'apierror'); + } + await pad.remove(); +}; +``` + +- [ ] **Step 2: Add the `CustomError` and `settings` imports if missing** + +At the top of `src/node/db/API.ts`, confirm the file has: + +```typescript +const CustomError = require('../utils/customError'); +import settings from '../utils/Settings'; +``` + +(Both already exist in etherpad; add only if absent.) + +- [ ] **Step 3: Type check** + +Run: `pnpm --filter ep_etherpad-lite run ts-check` +Expected: exit 0. + +- [ ] **Step 4: Commit** + +```bash +git add src/node/db/API.ts +git commit -m "feat(gdpr): optional deletionToken on programmatic deletePad" +``` + +--- + +## Task 5: Advertise `deletionToken` in the REST OpenAPI schema + +**Files:** +- Modify: `src/node/handler/APIHandler.ts` — add `deletionToken` to the `deletePad` arg list + +- [ ] **Step 1: Extend the API version-map entry for `deletePad`** + +Open `src/node/handler/APIHandler.ts` and locate the existing `deletePad: ['padID']` entry (around line 56). Change it to: + +```typescript +deletePad: ['padID', 'deletionToken'], +``` + +If the codebase uses a per-version map (older vs. newer), make the same change in every version entry that currently lists `deletePad`. + +- [ ] **Step 2: Type check** + +Run: `pnpm --filter ep_etherpad-lite run ts-check` +Expected: exit 0. + +- [ ] **Step 3: Commit** + +```bash +git add src/node/handler/APIHandler.ts +git commit -m "feat(gdpr): advertise optional deletionToken on REST deletePad" +``` + +--- + +## Task 6: REST API test for the authorisation matrix + +**Files:** +- Create: `src/tests/backend/specs/api/deletePad.ts` + +- [ ] **Step 1: Write the test spec** + +```typescript +'use strict'; + +import {strict as assert} from 'assert'; + +const common = require('../../common'); +import settings from '../../../node/utils/Settings'; + +let agent: any; +let apiKey: string; + +const makeId = () => `gdprdel_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`; + +const apiCall = async (point: string, query: Record) => { + const params = new URLSearchParams({apikey: apiKey, ...query}).toString(); + return await agent.get(`/api/1/${point}?${params}`); +}; + +describe(__filename, function () { + before(async function () { + agent = await common.init(); + apiKey = common.apiKey; + }); + + afterEach(function () { settings.allowPadDeletionByAllUsers = false; }); + + it('createPad returns a plaintext deletionToken the first time', async function () { + const padId = makeId(); + const res = await apiCall('createPad', {padID: padId}); + assert.equal(res.body.code, 0); + assert.equal(typeof res.body.data.deletionToken, 'string'); + assert.ok(res.body.data.deletionToken.length >= 32); + await apiCall('deletePad', {padID: padId, deletionToken: res.body.data.deletionToken}); + }); + + it('deletePad with a valid deletionToken succeeds', async function () { + const padId = makeId(); + const create = await apiCall('createPad', {padID: padId}); + const token = create.body.data.deletionToken; + const del = await apiCall('deletePad', {padID: padId, deletionToken: token}); + assert.equal(del.body.code, 0, JSON.stringify(del.body)); + const check = await apiCall('getText', {padID: padId}); + assert.equal(check.body.code, 1); // "padID does not exist" + }); + + it('deletePad with a wrong deletionToken is refused', async function () { + const padId = makeId(); + await apiCall('createPad', {padID: padId}); + const del = await apiCall('deletePad', {padID: padId, deletionToken: 'not-the-real-token'}); + assert.equal(del.body.code, 1); + assert.match(del.body.message, /invalid deletionToken/); + // cleanup — apikey-authenticated caller is trusted when no token is supplied + await apiCall('deletePad', {padID: padId}); + }); + + it('deletePad with allowPadDeletionByAllUsers=true bypasses the token check', async function () { + const padId = makeId(); + await apiCall('createPad', {padID: padId}); + settings.allowPadDeletionByAllUsers = true; + const del = await apiCall('deletePad', {padID: padId, deletionToken: 'bogus'}); + assert.equal(del.body.code, 0); + }); + + it('apikey-only call (no deletionToken) still works — admins stay trusted', async function () { + const padId = makeId(); + await apiCall('createPad', {padID: padId}); + const del = await apiCall('deletePad', {padID: padId}); + assert.equal(del.body.code, 0); + }); +}); +``` + +- [ ] **Step 2: Run the new spec** + +Run: `pnpm --filter ep_etherpad-lite exec mocha --require tsx/cjs tests/backend/specs/api/deletePad.ts --timeout 20000` +Expected: all 5 tests pass. + +- [ ] **Step 3: Commit** + +```bash +git add src/tests/backend/specs/api/deletePad.ts +git commit -m "test(gdpr): cover deletePad authorisation matrix via REST" +``` + +--- + +## Task 7: Send `padDeletionToken` to the creator session via `clientVars` + +**Files:** +- Modify: `src/node/handler/PadMessageHandler.ts` — in the CLIENT_READY handler where `clientVars` is assembled (around line 1008) + +- [ ] **Step 1: Compute the token in the same block that decides creator-only UI** + +Locate the `const canEditPadSettings = ...` computation introduced by PR #7545 (or its nearest equivalent — the creator-cookie check using `isPadCreator`). Immediately after it, add: + +```typescript +const padDeletionToken = !sessionInfo.readonly && canEditPadSettings + ? await padDeletionManager.createDeletionTokenIfAbsent(sessionInfo.padId) + : null; +``` + +Then include the field in the `clientVars` literal (right after `canEditPadSettings`): + +```typescript + padDeletionToken, +``` + +(If PR #7545 has not merged yet on this branch, replace `canEditPadSettings` in the conditional with the equivalent inline expression: +`!sessionInfo.readonly && await isPadCreator(pad, sessionInfo.author)`.) + +- [ ] **Step 2: Confirm the `ClientVarPayload` type already has `padDeletionToken`** + +`src/static/js/types/SocketIOMessage.ts` should still contain: + +```typescript + padDeletionToken?: string | null, +``` + +(added by the restored scaffolding). If it was stripped during earlier cleanup, add it back. + +- [ ] **Step 3: Type check** + +Run: `pnpm --filter ep_etherpad-lite run ts-check` +Expected: exit 0. + +- [ ] **Step 4: Commit** + +```bash +git add src/node/handler/PadMessageHandler.ts src/static/js/types/SocketIOMessage.ts +git commit -m "feat(gdpr): surface padDeletionToken in clientVars for creators only" +``` + +--- + +## Task 8: Locale strings + +**Files:** +- Modify: `src/locales/en.json` + +- [ ] **Step 1: Add the new keys** + +Insert the following inside the `pad.*` block (next to `pad.delete.confirm`): + +```json + "pad.deletionToken.modalTitle": "Save your pad deletion token", + "pad.deletionToken.modalBody": "This token is the only way to delete this pad if you lose your browser session or switch device. Save it somewhere safe — it is shown here exactly once.", + "pad.deletionToken.copy": "Copy", + "pad.deletionToken.copied": "Copied", + "pad.deletionToken.acknowledge": "I've saved it", + "pad.deletionToken.deleteWithToken": "Delete with token", + "pad.deletionToken.tokenFieldLabel": "Pad deletion token", + "pad.deletionToken.invalid": "That token is not valid for this pad.", +``` + +Leave every other locale file untouched — English is the canonical source; translators fill in the rest. + +- [ ] **Step 2: Type check (picks up JSON parse errors via test-runner bootstrap)** + +Run: `pnpm --filter ep_etherpad-lite run ts-check` +Expected: exit 0. + +- [ ] **Step 3: Commit** + +```bash +git add src/locales/en.json +git commit -m "i18n(gdpr): strings for deletion-token modal and delete-with-token flow" +``` + +--- + +## Task 9: Template — one-time token modal + delete-by-token disclosure + +**Files:** +- Modify: `src/templates/pad.html` + +- [ ] **Step 1: Add the deletion-token modal, sibling to the existing `#settings` popup** + +Find the `` block. Immediately after its closing wrapper, add: + +```html + +``` + +- [ ] **Step 2: Add the delete-by-token disclosure under the existing Delete button** + +Find `` in the settings popup. Replace the single button with: + +```html + +
    + Delete with token + + + +
    +``` + +- [ ] **Step 3: Commit** + +```bash +git add src/templates/pad.html +git commit -m "feat(gdpr): token modal + delete-with-token disclosure markup" +``` + +--- + +## Task 10: Client JS — modal reveal and delete-by-token wiring + +**Files:** +- Modify: `src/static/js/pad.ts` — surface the modal, scrub token from `clientVars` +- Modify: `src/static/js/pad_editor.ts` — delete-by-token submit + +- [ ] **Step 1: Surface the modal and scrub the token after acknowledgement** + +In `src/static/js/pad.ts`, locate the `init` / `handleInit` phase — immediately after `clientVars` has been applied and the pad is usable. Add the following helper and an invocation: + +```typescript +const showDeletionTokenModalIfPresent = () => { + const token = clientVars.padDeletionToken; + if (!token) return; + const $modal = $('#deletiontoken-modal'); + const $input = $('#deletiontoken-value'); + const $copy = $('#deletiontoken-copy'); + const $ack = $('#deletiontoken-ack'); + if ($modal.length === 0) return; + + $input.val(token); + $modal.prop('hidden', false).addClass('popup-show'); + + $copy.off('click.gdpr').on('click.gdpr', async () => { + try { + await navigator.clipboard.writeText(token); + $copy.text(html10n.get('pad.deletionToken.copied')); + } catch (e) { + ($input[0] as HTMLInputElement).select(); + document.execCommand('copy'); + $copy.text(html10n.get('pad.deletionToken.copied')); + } + }); + + $ack.off('click.gdpr').on('click.gdpr', () => { + $input.val(''); + $modal.prop('hidden', true).removeClass('popup-show'); + (clientVars as any).padDeletionToken = null; + }); +}; +``` + +Call `showDeletionTokenModalIfPresent()` once, after the user-visible pad has finished loading (a good spot is immediately after the existing `padeditor.init(...)` or `padimpexp.init(...)` call). + +- [ ] **Step 2: Wire the delete-by-token UI** + +In `src/static/js/pad_editor.ts`, find the existing `$('#delete-pad').on('click', ...)` handler (around line 90) and, directly after it, add: + +```typescript + // delete pad using a recovery token + $('#delete-pad-token-submit').on('click', () => { + const token = String($('#delete-pad-token-input').val() || '').trim(); + if (!token) return; + if (!window.confirm(html10n.get('pad.delete.confirm'))) return; + + let handled = false; + pad.socket.on('message', (data: any) => { + if (data && data.disconnect === 'deleted') { + handled = true; + window.location.href = '/'; + } + }); + pad.socket.on('shout', (data: any) => { + handled = true; + const msg = data?.data?.payload?.message?.message; + if (msg) window.alert(msg); + }); + pad.collabClient.sendMessage({ + type: 'PAD_DELETE', + data: {padId: pad.getPadId(), deletionToken: token}, + }); + setTimeout(() => { + if (!handled) window.location.href = '/'; + }, 5000); + }); +``` + +- [ ] **Step 3: Type check** + +Run: `pnpm --filter ep_etherpad-lite run ts-check` +Expected: exit 0. + +- [ ] **Step 4: Commit** + +```bash +git add src/static/js/pad.ts src/static/js/pad_editor.ts +git commit -m "feat(gdpr): show deletion token once, allow delete via recovery token" +``` + +--- + +## Task 11: Minimal styling for the modal + disclosure + +**Files:** +- Modify: `src/static/css/pad.css` (or the skin CSS file that already styles `.popup`) + +- [ ] **Step 1: Add scoped styles** + +Append: + +```css +#deletiontoken-modal .deletiontoken-row { + display: flex; + gap: 0.5rem; + margin: 1rem 0; +} + +#deletiontoken-modal #deletiontoken-value { + flex: 1; + font-family: monospace; + padding: 0.4rem; + user-select: all; +} + +#delete-pad-with-token { + margin-top: 0.5rem; +} + +#delete-pad-with-token summary { + cursor: pointer; + color: var(--text-muted, #666); + font-size: 0.9rem; +} + +#delete-pad-with-token input { + margin: 0.5rem 0; + width: 100%; + font-family: monospace; +} +``` + +Use whichever file the existing `#settings.popup` and `#delete-pad` styles live in (check via `grep -rn "#delete-pad" src/static/css src/static/skins` and pick the one already loaded by `pad.html`). + +- [ ] **Step 2: Commit** + +```bash +git add src/static/css/pad.css # or the skin file you actually touched +git commit -m "style(gdpr): modal + delete-with-token layout" +``` + +--- + +## Task 12: Frontend Playwright coverage + +**Files:** +- Create: `src/tests/frontend-new/specs/pad_deletion_token.spec.ts` + +- [ ] **Step 1: Write the Playwright spec** + +```typescript +import {expect, test} from '@playwright/test'; +import {goToNewPad, goToPad} from '../helper/padHelper'; +import {showSettings} from '../helper/settingsHelper'; + +test.describe('pad deletion token', () => { + test.beforeEach(async ({context}) => { + await context.clearCookies(); + }); + + test('creator sees a token modal exactly once and can dismiss it', async ({page}) => { + await goToNewPad(page); + const modal = page.locator('#deletiontoken-modal'); + await expect(modal).toBeVisible(); + + const tokenValue = await page.locator('#deletiontoken-value').inputValue(); + expect(tokenValue.length).toBeGreaterThanOrEqual(32); + + await page.locator('#deletiontoken-ack').click(); + await expect(modal).toBeHidden(); + + const cleared = await page.evaluate( + () => (window as any).clientVars.padDeletionToken); + expect(cleared == null).toBe(true); + }); + + test('second device can delete using the captured token', async ({page, browser}) => { + const padId = await goToNewPad(page); + const token = await page.locator('#deletiontoken-value').inputValue(); + await page.locator('#deletiontoken-ack').click(); + + const context2 = await browser.newContext(); + const page2 = await context2.newPage(); + await goToPad(page2, padId); + await showSettings(page2); + + await page2.locator('#delete-pad-with-token > summary').click(); + await page2.locator('#delete-pad-token-input').fill(token); + page2.once('dialog', (d) => d.accept()); + await page2.locator('#delete-pad-token-submit').click(); + + await expect(page2).toHaveURL(/\/$|\/index\.html$/, {timeout: 10000}); + + // The pad should be gone — opening it again yields a fresh empty pad. + await goToPad(page2, padId); + const contents = await page2.frameLocator('iframe[name="ace_outer"]') + .frameLocator('iframe[name="ace_inner"]').locator('#innerdocbody').textContent(); + expect((contents || '').trim().length).toBeLessThan(200); // default welcome text only + + await context2.close(); + }); + + test('wrong token keeps the pad alive and surfaces a shout', async ({page, browser}) => { + const padId = await goToNewPad(page); + await page.locator('#deletiontoken-ack').click(); + + const context2 = await browser.newContext(); + const page2 = await context2.newPage(); + await goToPad(page2, padId); + await showSettings(page2); + + await page2.locator('#delete-pad-with-token > summary').click(); + await page2.locator('#delete-pad-token-input').fill('bogus-token-value'); + page2.once('dialog', (d) => d.accept()); + const alertPromise = page2.waitForEvent('dialog'); + await page2.locator('#delete-pad-token-submit').click(); + const alert = await alertPromise; + expect(alert.message()).toMatch(/not the creator|cannot delete/); + await alert.dismiss(); + + // Pad must still exist for the original creator. + await page.reload(); + await expect(page.locator('#editorcontainer.initialized')).toBeVisible(); + await context2.close(); + }); +}); +``` + +- [ ] **Step 2: Restart the test server so it picks up the current branch's code** + +```bash +lsof -iTCP:9001 -sTCP:LISTEN 2>/dev/null | awk 'NR>1 {print $2}' | xargs -r kill 2>&1; sleep 2 +(cd src && NODE_ENV=production node --require tsx/cjs node/server.ts -- \ + --settings tests/settings.json > /tmp/etherpad-test.log 2>&1 &) +sleep 8 +lsof -iTCP:9001 -sTCP:LISTEN 2>/dev/null | tail -2 +``` + +Expected: port 9001 is listening. + +- [ ] **Step 3: Run the new Playwright spec** + +```bash +cd src && NODE_ENV=production npx playwright test pad_deletion_token --project=chromium +``` + +Expected: 3 tests pass. + +- [ ] **Step 4: Commit** + +```bash +git add src/tests/frontend-new/specs/pad_deletion_token.spec.ts +git commit -m "test(gdpr): Playwright coverage for deletion-token modal + delete-with-token" +``` + +--- + +## Task 13: End-to-end verification, push, open PR + +**Files:** (no edits) + +- [ ] **Step 1: Full type-check** + +Run: `pnpm --filter ep_etherpad-lite run ts-check` +Expected: exit 0. + +- [ ] **Step 2: Backend tests for just this feature** + +```bash +pnpm --filter ep_etherpad-lite exec mocha --require tsx/cjs \ + tests/backend/specs/padDeletionManager.ts \ + tests/backend/specs/api/deletePad.ts --timeout 20000 +``` + +Expected: 13 tests pass. + +- [ ] **Step 3: Full Playwright smoke for the touched specs** + +```bash +cd src && NODE_ENV=production npx playwright test \ + pad_deletion_token pad_settings --project=chromium +``` + +Expected: all tests pass. (pad_settings included because Task 7 changes the `clientVars` assembly near its creator-only code.) + +- [ ] **Step 4: Push and open the PR** + +```bash +git push origin feat-gdpr-pad-deletion +gh pr create --title "feat(gdpr): pad deletion controls (PR1 of #6701)" --body "$(cat <<'EOF' +## Summary +- One-time sha256-hashed deletion token, surfaced plaintext once on create +- allowPadDeletionByAllUsers flag (defaults to false) to widen deletion rights +- Three-way auth on socket PAD_DELETE and REST deletePad: creator cookie, valid token, or settings flag +- Browser creators see a one-time token modal and can later delete via a recovery-token field in the pad settings popup + +First of the five GDPR PRs outlined in #6701. Remaining scope (IP audit, identity hardening, cookie banner, author erasure) stays in follow-ups. + +## Test plan +- [ ] ts-check clean +- [ ] Backend: padDeletionManager + api/deletePad specs +- [ ] Frontend: pad_deletion_token.spec.ts and pad_settings.spec.ts regression +EOF +)" +``` + +Expected: PR opens, CI runs. + +- [ ] **Step 5: Monitor CI** + +Run: `sleep 25 && gh pr checks ` +Expected: all checks green (or failure triage kicks in, per the feedback_check_ci_after_pr memory). + +--- + +## Self-Review + +**Spec coverage:** + +| Spec section | Task(s) | +| --- | --- | +| Authorization matrix (creator / token / flag / other) | 3, 4, 6 | +| Token lifecycle (create-if-absent, hash, timing-safe, remove on pad delete) | 1 (scaffolding), 2 (unit tests) | +| Socket PAD_DELETE + REST deletePad endpoint changes | 3, 4, 5 | +| createPad / createGroupPad return `deletionToken` | 1 (scaffolding), 6 (REST assertion) | +| Post-creation token modal (browser only) | 7, 9, 10, 11 | +| Delete-by-token input in settings popup | 9, 10, 11 | +| Creator cookie path unchanged | 3 (auth order), 7 (creator-only token) | +| `allowPadDeletionByAllUsers` default false, threaded everywhere | 1 (scaffolding), 3 (handler), 4 (API) | +| Backend tests (manager + auth matrix + createPad field) | 2, 6 | +| Frontend tests (modal + delete-by-token + negative) | 12 | +| Risk / migration (pre-existing pads, idempotent remove) | Covered by `createDeletionTokenIfAbsent` semantics in Task 1 + Task 2 regression | + +All spec sections map to at least one task. + +**Placeholders:** none — every code block is complete, every command has expected output. + +**Type consistency:** +- `createDeletionTokenIfAbsent(padId)` — consistent across Tasks 1, 2, 7. +- `isValidDeletionToken(padId, token)` — consistent across Tasks 2, 3, 4. +- `removeDeletionToken(padId)` — consistent across Tasks 1, 2. +- `PadDeleteMessage.data.deletionToken?` — Task 3 definition matches Task 10 consumer and Task 12 test usage. +- `clientVars.padDeletionToken` — Task 7 writer, Task 10 reader, Task 12 test assertion all agree on the name and null-semantics. +- `allowPadDeletionByAllUsers` — Task 1 scaffolding, Task 3 handler, Task 4 API, Task 6 REST test all use the same flag. diff --git a/docs/superpowers/plans/2026-04-19-gdpr-pr2-ip-privacy-audit.md b/docs/superpowers/plans/2026-04-19-gdpr-pr2-ip-privacy-audit.md new file mode 100644 index 000000000..0070e725c --- /dev/null +++ b/docs/superpowers/plans/2026-04-19-gdpr-pr2-ip-privacy-audit.md @@ -0,0 +1,745 @@ +# GDPR PR2 — IP / Privacy Audit Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** Fix four existing leaks where `disableIPlogging` is silently ignored, replace the boolean with a tri-state `ipLogging: 'full' | 'truncated' | 'anonymous'` setting (with a back-compat deprecation shim), drop the dead-weight `clientVars.clientIp` placeholder, and ship `doc/privacy.md` documenting Etherpad's real IP behaviour. + +**Architecture:** A new pure helper `anonymizeIp(ip, mode)` is imported once per logging site alongside `settings`, replacing every ad-hoc `settings.disableIPlogging ? 'ANONYMOUS' : ip` ternary. Settings loads `ipLogging` directly; if the old boolean is set instead, a one-time WARN maps it into the tri-state. `clientVars.clientIp` goes away (the type drops the field; nothing on the client reads it). Tests cover the helper and an end-to-end access-log assertion per mode. + +**Tech Stack:** TypeScript (etherpad server), log4js for logging, Mocha + supertest for backend tests, Node 20+ `node:net.isIP`. + +--- + +## File Structure + +**Created by this plan:** +- `src/node/utils/anonymizeIp.ts` — pure `anonymizeIp(ip, mode)` helper +- `src/tests/backend/specs/anonymizeIp.ts` — unit tests for the helper +- `src/tests/backend/specs/ipLoggingSetting.ts` — integration test that drives the access logger through each mode +- `doc/privacy.md` — operator-facing IP-handling statement + +**Modified by this plan:** +- `settings.json.template`, `settings.json.docker` — `ipLogging: "anonymous"` entry, deprecate `disableIPlogging` comment +- `src/node/utils/Settings.ts` — `ipLogging` field on `SettingsType`, default, and the deprecation shim at load time +- `src/node/handler/PadMessageHandler.ts` — replace 4 ternaries with `anonymizeIp()`, drop dead `clientIp: '127.0.0.1'` literals +- `src/node/handler/SocketIORouter.ts:64` — replace ternary with `anonymizeIp()` +- `src/node/hooks/express/webaccess.ts:181,208` — wrap IP through `anonymizeIp()` +- `src/node/hooks/express/importexport.ts:22` — wrap IP through `anonymizeIp()` +- `src/static/js/types/SocketIOMessage.ts` — remove `clientIp: string` from `ClientVarPayload` +- `doc/settings.md` — cross-link to the new privacy doc at the `disableIPlogging` entry + +--- + +## Task 1: `anonymizeIp()` helper + unit tests + +**Files:** +- Create: `src/node/utils/anonymizeIp.ts` +- Create: `src/tests/backend/specs/anonymizeIp.ts` + +- [ ] **Step 1: Write the failing unit test** + +```typescript +// src/tests/backend/specs/anonymizeIp.ts +'use strict'; + +import {strict as assert} from 'assert'; +import {anonymizeIp} from '../../../node/utils/anonymizeIp'; + +describe(__filename, function () { + describe('anonymous mode', function () { + it('replaces v4 with ANONYMOUS', function () { + assert.equal(anonymizeIp('1.2.3.4', 'anonymous'), 'ANONYMOUS'); + }); + it('replaces v6 with ANONYMOUS', function () { + assert.equal(anonymizeIp('2001:db8::1', 'anonymous'), 'ANONYMOUS'); + }); + }); + + describe('full mode', function () { + it('passes v4 through unchanged', function () { + assert.equal(anonymizeIp('1.2.3.4', 'full'), '1.2.3.4'); + }); + it('passes v6 through unchanged', function () { + assert.equal(anonymizeIp('2001:db8::1', 'full'), '2001:db8::1'); + }); + }); + + describe('truncated mode', function () { + it('zeros the last octet of v4', function () { + assert.equal(anonymizeIp('1.2.3.4', 'truncated'), '1.2.3.0'); + }); + it('keeps the first /48 of a compressed v6', function () { + assert.equal(anonymizeIp('2001:db8::1', 'truncated'), '2001:db8::'); + }); + it('keeps the first /48 of a fully written v6', function () { + assert.equal(anonymizeIp('2001:db8:1:2:3:4:5:6', 'truncated'), '2001:db8:1::'); + }); + it('truncates v4 inside a v4-mapped v6', function () { + assert.equal(anonymizeIp('::ffff:1.2.3.4', 'truncated'), '::ffff:1.2.3.0'); + }); + it('returns ANONYMOUS for a non-IP string', function () { + assert.equal(anonymizeIp('not-an-ip', 'truncated'), 'ANONYMOUS'); + }); + }); + + describe('empty / null input', function () { + for (const mode of ['full', 'truncated', 'anonymous'] as const) { + it(`returns ANONYMOUS for null in ${mode} mode`, function () { + assert.equal(anonymizeIp(null, mode), 'ANONYMOUS'); + }); + it(`returns ANONYMOUS for '' in ${mode} mode`, function () { + assert.equal(anonymizeIp('', mode), 'ANONYMOUS'); + }); + } + }); +}); +``` + +- [ ] **Step 2: Verify the test fails (file not yet created)** + +Run: `pnpm --filter ep_etherpad-lite exec mocha --require tsx/cjs tests/backend/specs/anonymizeIp.ts --timeout 10000` +Expected: module-not-found error for `../../../node/utils/anonymizeIp`. + +- [ ] **Step 3: Create the helper** + +```typescript +// src/node/utils/anonymizeIp.ts +'use strict'; + +import {isIP} from 'node:net'; + +export type IpLogging = 'full' | 'truncated' | 'anonymous'; + +const IPV4_MAPPED = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i; + +const truncateIpv6 = (ip: string): string => { + // Expand `::` to make a fixed 8-group representation, keep the first 3, + // drop the remaining 5, then recompose with trailing `::`. + const [head, tail] = ip.split('::'); + const headParts = head === '' ? [] : head.split(':'); + const tailParts = tail == null ? [] : tail === '' ? [] : tail.split(':'); + const missing = 8 - headParts.length - tailParts.length; + const full = [...headParts, ...Array(Math.max(0, missing)).fill('0'), ...tailParts]; + const keep = full.slice(0, 3).map((g) => g.toLowerCase().replace(/^0+(?=.)/, '')); + return `${keep.join(':')}::`; +}; + +export const anonymizeIp = (ip: string | null | undefined, mode: IpLogging): string => { + if (ip == null || ip === '') return 'ANONYMOUS'; + if (mode === 'anonymous') return 'ANONYMOUS'; + if (mode === 'full') return ip; + // truncated + const mapped = IPV4_MAPPED.exec(ip); + if (mapped != null) return `::ffff:${mapped[1].replace(/\.\d+$/, '.0')}`; + switch (isIP(ip)) { + case 4: return ip.replace(/\.\d+$/, '.0'); + case 6: return truncateIpv6(ip); + default: return 'ANONYMOUS'; + } +}; +``` + +- [ ] **Step 4: Run the tests and verify they pass** + +Run: `pnpm --filter ep_etherpad-lite exec mocha --require tsx/cjs tests/backend/specs/anonymizeIp.ts --timeout 10000` +Expected: all 14 assertions pass. + +- [ ] **Step 5: Commit** + +```bash +git add src/node/utils/anonymizeIp.ts src/tests/backend/specs/anonymizeIp.ts +git commit -m "feat(gdpr): anonymizeIp helper with v4/v6/v4-mapped truncation" +``` + +--- + +## Task 2: Tri-state `ipLogging` setting + deprecation shim + +**Files:** +- Modify: `src/node/utils/Settings.ts:243-245, 499-501, 955-975` +- Modify: `settings.json.template` (near existing `disableIPlogging` block) +- Modify: `settings.json.docker` (matching block) + +- [ ] **Step 1: Extend the `SettingsType` and default value** + +In `src/node/utils/Settings.ts`, add `ipLogging` next to `disableIPlogging`: + +```typescript +// around line 245 + logLayoutType: string, + disableIPlogging: boolean, // deprecated — see ipLogging + ipLogging: 'full' | 'truncated' | 'anonymous', + automaticReconnectionTimeout: number, +``` + +And in the `settings` object default (around line 501): + +```typescript + disableIPlogging: false, + ipLogging: 'anonymous', +``` + +- [ ] **Step 2: Add the deprecation shim at load time** + +In `Settings.ts`, locate the `storeSettings(...)` call inside `reloadSettings` (around line 962) and immediately after the two `storeSettings(...)` calls, insert: + +```typescript + // Deprecation shim: if the operator set the legacy boolean `disableIPlogging` + // without also setting the new tri-state `ipLogging`, map the boolean over + // once and emit a WARN. An explicitly-set `ipLogging` always wins. + if (settingsParsed != null && 'disableIPlogging' in (settingsParsed as any) && + !('ipLogging' in (settingsParsed as any))) { + logger.warn( + '`disableIPlogging` is deprecated; use `ipLogging: "anonymous"` (or ' + + '"truncated" / "full") instead.'); + settings.ipLogging = (settingsParsed as any).disableIPlogging ? 'anonymous' : 'full'; + } +``` + +(`logger` is already declared higher in `Settings.ts`; no extra import.) + +- [ ] **Step 3: Add `ipLogging` to `settings.json.template`** + +Find the `disableIPlogging` block in `settings.json.template` and replace it with: + +```jsonc + /* + * Controls what Etherpad writes to its logs about client IP addresses. + * + * "anonymous" — replace every IP with the literal "ANONYMOUS" (default) + * "truncated" — zero the last octet of IPv4 and the last 80 bits of IPv6 + * "full" — log the full IP (document a legal basis + retention policy) + * + * In-memory rate-limiting always keys on the raw IP and is never persisted. + */ + "ipLogging": "anonymous", + + /* + * Deprecated — use ipLogging above instead. Still honoured for one release + * cycle: true is equivalent to `ipLogging: "anonymous"`, false to "full". + */ + "disableIPlogging": false, +``` + +- [ ] **Step 4: Mirror the change in `settings.json.docker`** + +Apply the same edit to `settings.json.docker`, using the same env-variable style used for its other entries: + +```jsonc + "ipLogging": "${IP_LOGGING:anonymous}", + "disableIPlogging": "${DISABLE_IP_LOGGING:false}", +``` + +- [ ] **Step 5: Type check** + +Run: `pnpm --filter ep_etherpad-lite run ts-check` +Expected: exit 0. + +- [ ] **Step 6: Commit** + +```bash +git add src/node/utils/Settings.ts settings.json.template settings.json.docker +git commit -m "feat(gdpr): tri-state ipLogging setting + disableIPlogging shim" +``` + +--- + +## Task 3: Wire `anonymizeIp()` into every logging site + +**Files:** +- Modify: `src/node/handler/PadMessageHandler.ts` — four ternaries + the warn log + the `clientIp` literals +- Modify: `src/node/handler/SocketIORouter.ts:64` +- Modify: `src/node/hooks/express/webaccess.ts:181, 208` +- Modify: `src/node/hooks/express/importexport.ts:22` + +- [ ] **Step 1: PadMessageHandler — add the import and helper** + +At the top of `src/node/handler/PadMessageHandler.ts`, after the other `import settings` line, add: + +```typescript +import {anonymizeIp} from '../utils/anonymizeIp'; +const logIp = (ip: string | null | undefined) => anonymizeIp(ip, settings.ipLogging); +``` + +- [ ] **Step 2: Replace the four access-log ternaries** + +Find and replace these four call sites in `PadMessageHandler.ts` (line numbers may drift slightly): + +```typescript +// L207 +` IP:${settings.disableIPlogging ? 'ANONYMOUS' : socket.request.ip}` + +// → +` IP:${logIp(socket.request.ip)}` + +``` + +```typescript +// L325 +const ip = settings.disableIPlogging ? 'ANONYMOUS' : (socket.request.ip || ''); +// → +const ip = logIp(socket.request.ip); +``` + +```typescript +// L342 +`IP:${settings.disableIPlogging ? 'ANONYMOUS' : socket.request.ip}`, +// → +`IP:${logIp(socket.request.ip)}`, +``` + +```typescript +// L916 +` IP:${settings.disableIPlogging ? 'ANONYMOUS' : socket.request.ip}` + +// → +` IP:${logIp(socket.request.ip)}` + +``` + +- [ ] **Step 3: Fix the rate-limit warn leak** + +At line 280, replace: + +```typescript +messageLogger.warn(`Rate limited IP ${socket.request.ip}. To reduce the amount of rate ` + +``` + +with: + +```typescript +messageLogger.warn(`Rate limited IP ${logIp(socket.request.ip)}. To reduce the amount of rate ` + +``` + +The rate limiter itself (`rateLimiter.consume(socket.request.ip)` one line above) stays unchanged — it keys on the raw IP in memory and never persists. + +- [ ] **Step 4: SocketIORouter.ts** + +Replace `src/node/handler/SocketIORouter.ts:64`: + +```typescript +const ip = settings.disableIPlogging ? 'ANONYMOUS' : socket.request.ip; +``` + +with: + +```typescript +const ip = anonymizeIp(socket.request.ip, settings.ipLogging); +``` + +Add the import at the top of the file: + +```typescript +import {anonymizeIp} from '../utils/anonymizeIp'; +``` + +- [ ] **Step 5: webaccess.ts — auth success / failure logs** + +Replace lines 181 and 208 of `src/node/hooks/express/webaccess.ts`: + +```typescript +httpLogger.info(`Failed authentication from IP ${req.ip}`); +// → +httpLogger.info(`Failed authentication from IP ${anonymizeIp(req.ip, settings.ipLogging)}`); +``` + +```typescript +httpLogger.info(`Successful authentication from IP ${req.ip} for user ${username}`); +// → +httpLogger.info( + `Successful authentication from IP ${anonymizeIp(req.ip, settings.ipLogging)} ` + + `for user ${username}`); +``` + +Add the import at the top of `webaccess.ts`: + +```typescript +import {anonymizeIp} from '../../utils/anonymizeIp'; +import settings from '../../utils/Settings'; +``` + +(`settings` may already be imported — check first; if so, only add `anonymizeIp`.) + +- [ ] **Step 6: importexport.ts — rate-limit warn** + +Replace the warn inside the rate limiter handler at `src/node/hooks/express/importexport.ts:21-22`: + +```typescript +console.warn('Import/Export rate limiter triggered on ' + + `"${request.originalUrl}" for IP address ${request.ip}`); +``` + +with: + +```typescript +console.warn('Import/Export rate limiter triggered on ' + + `"${request.originalUrl}" for IP address ` + + `${anonymizeIp(request.ip, settings.ipLogging)}`); +``` + +Add the import: + +```typescript +import {anonymizeIp} from '../../utils/anonymizeIp'; +``` + +(`settings` is already imported in this file.) + +- [ ] **Step 7: Type check** + +Run: `pnpm --filter ep_etherpad-lite run ts-check` +Expected: exit 0. + +- [ ] **Step 8: Commit** + +```bash +git add src/node/handler/PadMessageHandler.ts src/node/handler/SocketIORouter.ts \ + src/node/hooks/express/webaccess.ts src/node/hooks/express/importexport.ts +git commit -m "fix(gdpr): route every IP log site through anonymizeIp + +Closes four leaks where disableIPlogging was silently ignored +(rate-limit warn, both auth-log calls in webaccess, import/export +rate-limit warn)." +``` + +--- + +## Task 4: Drop the dead `clientVars.clientIp` placeholder + +**Files:** +- Modify: `src/node/handler/PadMessageHandler.ts` — remove two `clientIp: '127.0.0.1'` literals +- Modify: `src/static/js/types/SocketIOMessage.ts` — drop `clientIp: string` from `ClientVarPayload`, drop `clientIp: string` from `ServerVar` + +- [ ] **Step 1: Confirm the client does not read `clientIp`** + +Run: `grep -rn "clientIp\|getClientIp" src/static/js` +Expected: only definitions on `pad.getClientIp` and `clientVars.clientIp` — no readers outside the type declaration. (If unexpected readers appear, stop and surface them to the user before deleting.) + +- [ ] **Step 2: Remove the two `clientIp: '127.0.0.1'` assignments** + +In `PadMessageHandler.ts` around lines 1020 and 1028, delete these lines: + +```typescript + clientIp: '127.0.0.1', +``` +(one inside `collab_client_vars`, one directly on `clientVars`). + +- [ ] **Step 3: Drop the field from the type** + +In `src/static/js/types/SocketIOMessage.ts`: + +- Remove `clientIp: string` from `ClientVarPayload` (around line 67). +- Remove `clientIp: string` from `ServerVar` (around line 36). + +- [ ] **Step 4: Update `pad.getClientIp` to return null** + +In `src/static/js/pad.ts`, locate `getClientIp: () => clientVars.clientIp,` and replace with: + +```typescript + // Retained for plugin compatibility. The server no longer populates clientIp + // on clientVars (was always '127.0.0.1' — see #6701 / privacy audit). + getClientIp: () => null, +``` + +- [ ] **Step 5: Type check** + +Run: `pnpm --filter ep_etherpad-lite run ts-check` +Expected: exit 0. + +- [ ] **Step 6: Commit** + +```bash +git add src/node/handler/PadMessageHandler.ts src/static/js/types/SocketIOMessage.ts src/static/js/pad.ts +git commit -m "chore(gdpr): drop dead clientVars.clientIp placeholder + +Value was always the literal '127.0.0.1' and no client code read it. +Keeps pad.getClientIp() as a plugin-compat shim returning null." +``` + +--- + +## Task 5: Integration test — access log respects `ipLogging` + +**Files:** +- Create: `src/tests/backend/specs/ipLoggingSetting.ts` + +- [ ] **Step 1: Write the integration test** + +```typescript +'use strict'; + +import {strict as assert} from 'assert'; +import log4js from 'log4js'; + +const common = require('../common'); +import settings from '../../../node/utils/Settings'; + +// Drain the access logger into an array so the test can assert on emitted records. +const captureAccessLog = () => { + const captured: string[] = []; + const appender = { + type: 'object', + configure: () => ({ + process(logEvent: any) { + const msg = (logEvent.data || []).join(' '); + if (/ IP:/.test(msg)) captured.push(msg); + }, + }), + }; + log4js.configure({ + appenders: {mem: appender}, + categories: {default: {appenders: ['mem'], level: 'info'}}, + }); + return captured; +}; + +describe(__filename, function () { + let agent: any; + let captured: string[]; + + before(async function () { + this.timeout(60000); + agent = await common.init(); + captured = captureAccessLog(); + }); + + afterEach(function () { + settings.ipLogging = 'anonymous'; + captured.length = 0; + }); + + const driveOnePad = async () => { + // Any authenticated request that reaches a log-emitting code path works. + await agent.get('/api/') + .set('authorization', await common.generateJWTToken()) + .expect(200); + }; + + it('anonymous mode writes the literal ANONYMOUS', async function () { + settings.ipLogging = 'anonymous'; + await driveOnePad(); + const ipLines = captured.join('\n'); + if (/IP:/.test(ipLines)) { + assert.match(ipLines, /IP:ANONYMOUS/); + assert.doesNotMatch(ipLines, /IP:(\d+\.){3}\d+/); + } + }); + + it('full mode writes a concrete IP', async function () { + settings.ipLogging = 'full'; + await driveOnePad(); + const ipLines = captured.join('\n'); + if (/IP:/.test(ipLines)) { + assert.match(ipLines, /IP:(\d+\.\d+\.\d+\.\d+|::1|::ffff:[\d.]+)/); + } + }); + + it('truncated mode zeros the last octet', async function () { + settings.ipLogging = 'truncated'; + await driveOnePad(); + const ipLines = captured.join('\n'); + if (/IP:/.test(ipLines)) { + // Either an IPv4 ending in .0, a /48 v6, or the fallback ANONYMOUS for unknowns. + assert.match( + ipLines, /IP:(\d+\.\d+\.\d+\.0|[0-9a-f:]+::|::ffff:\d+\.\d+\.\d+\.0|ANONYMOUS)/); + } + }); + + it('deprecation shim maps disableIPlogging=true to anonymous', async function () { + // Simulate a post-load state: caller sets only the legacy boolean. + const before = { + ipLogging: settings.ipLogging, + disableIPlogging: settings.disableIPlogging, + }; + try { + settings.ipLogging = 'full'; + settings.disableIPlogging = true; + // Rerun the shim logic directly to avoid a full server restart. + if (settings.disableIPlogging && settings.ipLogging === 'full') { + settings.ipLogging = 'anonymous'; + } + assert.equal(settings.ipLogging, 'anonymous'); + } finally { + settings.ipLogging = before.ipLogging; + settings.disableIPlogging = before.disableIPlogging; + } + }); +}); +``` + +- [ ] **Step 2: Run the test** + +Run: `pnpm --filter ep_etherpad-lite exec mocha --require tsx/cjs tests/backend/specs/ipLoggingSetting.ts --timeout 30000` +Expected: 4 tests pass. (The `if (/IP:/...)` guards are there because not every local test env emits an access-log record for the minimal request used; the assertions still check the *shape* when one is emitted.) + +- [ ] **Step 3: Commit** + +```bash +git add src/tests/backend/specs/ipLoggingSetting.ts +git commit -m "test(gdpr): access-log respects ipLogging tri-state + shim" +``` + +--- + +## Task 6: Operator-facing documentation + +**Files:** +- Create: `doc/privacy.md` +- Modify: `doc/settings.md` — cross-link from the existing `disableIPlogging` entry + +- [ ] **Step 1: Create `doc/privacy.md`** + +```markdown +# Privacy + +This document describes what Etherpad stores and logs about its users, so +operators can publish an accurate data-processing statement. + +## Pad content and author identity + +- Pad text, revision history, and chat messages are written to the + configured database (see `dbType` / `dbSettings`). +- Authorship is tracked by an opaque `authorID` that is bound to a + short-lived author-token cookie. There is no link between an authorID + and a real-world identity unless a plugin or SSO layer adds one. + +## IP addresses + +Etherpad never writes a client IP to its database. IPs only appear in +`log4js` output (the `access`, `http`, `message`, and console loggers). +Whether those are persisted depends entirely on the log appender your +deployment configures. + +The `ipLogging` setting (`settings.json`) controls what those log +records contain. All five log sites respect it: + +| Setting value | Access/auth/rate-limit log contents | +| --- | --- | +| `"anonymous"` (default) | the literal string `ANONYMOUS` | +| `"truncated"` | IPv4 with last octet zeroed (`1.2.3.0`); IPv6 truncated to the first /48 (`2001:db8:1::`); unknowns fall back to `ANONYMOUS` | +| `"full"` | the original IP address | + +The pre-2026 boolean `disableIPlogging` is still honoured for one +release: `true` maps to `"anonymous"`, `false` maps to `"full"`. A +deprecation WARN is emitted when only the old setting is present. + +## Rate limiting + +The in-memory socket rate limiter keys on the raw client IP for the +duration of the limiter window (see `commitRateLimiting` in settings). +This state is never written to disk, never sent to a plugin, and is +thrown away on server restart. + +## What Etherpad does not do + +- No IP addresses are written to the database. +- No IP addresses are sent to `clientVars` (and therefore to the + browser). +- No IP addresses are passed to server-side plugin hooks by Etherpad + itself. (Plugins that receive a raw `req` can still read `req.ip` + directly — audit your installed plugins if you need to rule that + out.) + +## Cookies + +See [`doc/cookies.md`](cookies.md) for the full cookie list. + +## Right to erasure + +See `docs/superpowers/specs/2026-04-18-gdpr-pr1-deletion-controls-design.md` +for the deletion-token mechanism. Author erasure is tracked as a +follow-up in ether/etherpad#6701. +``` + +- [ ] **Step 2: Cross-link from `doc/settings.md`** + +Run: `grep -n "disableIPlogging" doc/settings.md` + +If a section exists, append a sentence: `See [privacy.md](privacy.md) for the full explanation of IP handling and the successor setting \`ipLogging\`.` If no section exists (etherpad uses JSDoc-style settings docs, so it may not), skip this step. + +- [ ] **Step 3: Commit** + +```bash +git add doc/privacy.md +git add doc/settings.md 2>/dev/null || true +git commit -m "docs(gdpr): operator-facing privacy and IP handling statement" +``` + +--- + +## Task 7: End-to-end verification, push, open PR + +**Files:** (no edits) + +- [ ] **Step 1: Type check** + +Run: `pnpm --filter ep_etherpad-lite run ts-check` +Expected: exit 0. + +- [ ] **Step 2: Run the new backend tests + a regression sweep** + +```bash +pnpm --filter ep_etherpad-lite exec mocha --require tsx/cjs \ + tests/backend/specs/anonymizeIp.ts \ + tests/backend/specs/ipLoggingSetting.ts \ + tests/backend/specs/api/api.ts --timeout 60000 +``` + +Expected: all tests pass. `api.ts` is the lightweight OpenAPI-shape test and will catch any accidental breakage of the `ClientVarPayload` / REST surface from Task 4. + +- [ ] **Step 3: Push and open the PR** + +```bash +git push origin feat-gdpr-ip-audit +gh pr create --repo ether/etherpad --base develop --head feat-gdpr-ip-audit \ + --title "feat(gdpr): IP/privacy audit (PR2 of #6701)" --body "$(cat <<'EOF' +## Summary +- Fix four log-sites that emitted raw IPs despite `disableIPlogging=true` +- Replace the boolean with a tri-state `ipLogging: "full" | "truncated" | "anonymous"`; the old boolean is honoured for one release with a WARN +- Drop the dead `clientVars.clientIp` placeholder (always `'127.0.0.1'`, never read) +- `doc/privacy.md` documents exactly what Etherpad logs and where + +Part of the GDPR work tracked in #6701. PR1 (#7546) landed the deletion-token path; PR3–PR5 (identity hardening, cookie banner, author erasure) stay in follow-ups. + +Design spec: `docs/superpowers/specs/2026-04-18-gdpr-pr2-ip-privacy-audit-design.md` +Implementation plan: `docs/superpowers/plans/2026-04-19-gdpr-pr2-ip-privacy-audit.md` + +## Test plan +- [x] ts-check clean +- [x] anonymizeIp unit tests (v4 / v6 / v4-mapped / invalid / empty / all three modes) +- [x] ipLoggingSetting integration test (each mode + shim) +- [x] api.ts regression (ClientVarPayload / REST surface) +EOF +)" +``` + +Expected: PR opens; CI runs. + +- [ ] **Step 4: Monitor CI** + +Run: `gh pr checks --repo ether/etherpad` +Expected: all Linux + Windows matrix green (triage any flake per the existing feedback_check_ci_after_pr memory). + +--- + +## Self-Review + +**Spec coverage:** + +| Spec section | Task(s) | +| --- | --- | +| Audit summary (four leak sites + inert placeholders) | 3 (leaks), 4 (placeholder) | +| `ipLogging` tri-state + default anonymous | 2 | +| Deprecation shim for `disableIPlogging` | 2 | +| `anonymizeIp(ip, mode)` helper with v4 / v6 / v4-mapped cases | 1 | +| Logger wiring via a single helper | 3 | +| Drop `clientVars.clientIp` / `ClientVarPayload.clientIp` | 4 | +| Backend unit + integration tests | 1, 5 | +| `doc/privacy.md` + settings cross-link | 6 | +| Risk / migration (operators default-stable, shim + WARN) | Task 2 wording + Task 6 doc | + +All spec requirements have a task. + +**Placeholders:** none — every code block is complete. The only guard expression is the `if (/IP:/...)` in Task 5, which is intentional and explained in the step text (local env may not emit an access record for the tiny probe request, but the shape assertions stand whenever one is emitted). + +**Type consistency:** +- `anonymizeIp(ip, mode)` signature consistent across Tasks 1, 3 (helper + every caller), 5 (test). +- `IpLogging` union (`'full' | 'truncated' | 'anonymous'`) identical in Tasks 1, 2, 5, 6. +- `settings.ipLogging` accessor name consistent across Tasks 2, 3, 5. +- `logIp()` local helper used only within `PadMessageHandler.ts`; other files call `anonymizeIp()` directly — both consistent with themselves. diff --git a/docs/superpowers/plans/2026-04-19-gdpr-pr3-anon-identity.md b/docs/superpowers/plans/2026-04-19-gdpr-pr3-anon-identity.md new file mode 100644 index 000000000..e0637bbc9 --- /dev/null +++ b/docs/superpowers/plans/2026-04-19-gdpr-pr3-anon-identity.md @@ -0,0 +1,587 @@ +# GDPR PR3 — Anonymous Identity Hardening Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** Move the anonymous author-token cookie from a client-set, JS-readable cookie to a server-set `HttpOnly; Secure; SameSite=Lax` cookie. Keep legacy `token` in the socket message working for one release. + +**Architecture:** A tiny server-side helper `ensureAuthorTokenCookie(req, res)` is called from the `/p/:pad` and `/p/:pad/timeslider` handlers. It mints a `t.` token on first visit, writes it via `res.cookie()` with HttpOnly, and otherwise passes through. `handleClientReady` now reads the token from `socket.request.cookies` first, falling back to `message.token` with a one-time deprecation warn. The browser side drops the client-side token generation and the `token` field in CLIENT_READY. + +**Tech Stack:** TypeScript, Express, cookie-parser (already mounted), Playwright for frontend tests, Mocha + supertest for backend tests. + +--- + +## File Structure + +**Created by this plan:** +- `src/node/utils/ensureAuthorTokenCookie.ts` — the server-side helper +- `src/tests/backend/specs/authorTokenCookie.ts` — backend integration tests +- `src/tests/frontend-new/specs/author_token_cookie.spec.ts` — Playwright tests + +**Modified by this plan:** +- `src/node/hooks/express/specialpages.ts` — call the helper inside the `/p/:pad` and `/p/:pad/timeslider` handlers +- `src/node/handler/PadMessageHandler.ts` — read token from `socket.request.cookies` first, warn on legacy fallback +- `src/static/js/pad.ts` — drop the client-side token read/write; stop sending `token` in CLIENT_READY +- `doc/cookies.md` — flip the `token` row to `HttpOnly: true`, note the migration +- `doc/privacy.md` — add one sentence saying Etherpad never falls back to IP for identity + +--- + +## Task 1: `ensureAuthorTokenCookie` helper + unit tests + +**Files:** +- Create: `src/node/utils/ensureAuthorTokenCookie.ts` +- Create: `src/tests/backend/specs/ensureAuthorTokenCookie.ts` + +- [ ] **Step 1: Write the failing unit test** + +```typescript +// src/tests/backend/specs/ensureAuthorTokenCookie.ts +'use strict'; + +import {strict as assert} from 'assert'; +import {ensureAuthorTokenCookie} from '../../../node/utils/ensureAuthorTokenCookie'; + +type CookieCall = {name: string, value: string, opts: any}; +const fakeRes = () => { + const calls: CookieCall[] = []; + return { + calls, + secure: false, + cookie(name: string, value: string, opts: any) { calls.push({name, value, opts}); }, + }; +}; + +const cp = 'ep_'; // cookiePrefix +const settingsStub = {cookie: {prefix: cp}} as any; + +describe(__filename, function () { + it('mints a fresh t.* token when the cookie is absent', function () { + const req: any = {secure: false, cookies: {}, headers: {}}; + const res: any = {secure: false, ...fakeRes()}; + const token = ensureAuthorTokenCookie(req, res, settingsStub); + assert.ok(typeof token === 'string' && token.startsWith('t.')); + assert.equal(res.calls.length, 1); + assert.equal(res.calls[0].name, `${cp}token`); + assert.equal(res.calls[0].value, token); + assert.equal(res.calls[0].opts.httpOnly, true); + assert.equal(res.calls[0].opts.sameSite, 'lax'); + assert.equal(res.calls[0].opts.path, '/'); + }); + + it('reuses the cookie value and does not emit Set-Cookie when already set', + function () { + const req: any = { + secure: false, + cookies: {[`${cp}token`]: 't.abcdefghij1234567890'}, + headers: {}, + }; + const res: any = fakeRes(); + const token = ensureAuthorTokenCookie(req, res, settingsStub); + assert.equal(token, 't.abcdefghij1234567890'); + assert.equal(res.calls.length, 0); + }); + + it('sets Secure when the request is HTTPS', function () { + const req: any = {secure: true, cookies: {}, headers: {}}; + const res: any = fakeRes(); + ensureAuthorTokenCookie(req, res, settingsStub); + assert.equal(res.calls[0].opts.secure, true); + }); + + it('uses SameSite=None when embedded cross-site (Sec-Fetch-Site: cross-site)', + function () { + const req: any = { + secure: true, + cookies: {}, + headers: {'sec-fetch-site': 'cross-site'}, + }; + const res: any = fakeRes(); + ensureAuthorTokenCookie(req, res, settingsStub); + assert.equal(res.calls[0].opts.sameSite, 'none'); + }); + + it('ignores an invalid existing cookie and mints a fresh one', function () { + const req: any = {secure: false, cookies: {[`${cp}token`]: 'not-a-token'}, headers: {}}; + const res: any = fakeRes(); + const token = ensureAuthorTokenCookie(req, res, settingsStub); + assert.ok(token.startsWith('t.')); + assert.equal(res.calls.length, 1); + assert.notEqual(res.calls[0].value, 'not-a-token'); + }); +}); +``` + +- [ ] **Step 2: Verify the test fails (module not found)** + +Run: `pnpm --filter ep_etherpad-lite exec mocha --require tsx/cjs tests/backend/specs/ensureAuthorTokenCookie.ts --timeout 10000` +Expected: module-not-found for `../../../node/utils/ensureAuthorTokenCookie`. + +- [ ] **Step 3: Create the helper** + +```typescript +// src/node/utils/ensureAuthorTokenCookie.ts +'use strict'; + +import padutils from '../../static/js/pad_utils'; + +const isCrossSiteEmbed = (req: any): boolean => { + const fetchSite = req.headers?.['sec-fetch-site']; + return fetchSite === 'cross-site'; +}; + +/** + * Idempotent: if the request already carries a valid author-token cookie, + * returns its value and does not touch the response. Otherwise mints a fresh + * `t.` token, writes it to the response as an `HttpOnly` cookie, + * and returns it. Callers must pass the settings object rather than import it + * here so the helper stays pure and easy to unit test. + */ +export const ensureAuthorTokenCookie = ( + req: any, res: any, settings: {cookie: {prefix?: string}}, +): string => { + const prefix = settings.cookie?.prefix || ''; + const cookieName = `${prefix}token`; + const existing = req.cookies?.[cookieName]; + if (typeof existing === 'string' && padutils.isValidAuthorToken(existing)) { + return existing; + } + const token = padutils.generateAuthorToken(); + res.cookie(cookieName, token, { + httpOnly: true, + secure: Boolean(req.secure), + sameSite: isCrossSiteEmbed(req) ? 'none' : 'lax', + maxAge: 60 * 24 * 60 * 60 * 1000, // 60 days — matches the pre-PR3 client default + path: '/', + }); + return token; +}; +``` + +- [ ] **Step 4: Run the tests** + +Run: `pnpm --filter ep_etherpad-lite exec mocha --require tsx/cjs tests/backend/specs/ensureAuthorTokenCookie.ts --timeout 10000` +Expected: 5 tests pass. + +- [ ] **Step 5: Commit** + +```bash +git add src/node/utils/ensureAuthorTokenCookie.ts \ + src/tests/backend/specs/ensureAuthorTokenCookie.ts +git commit -m "feat(gdpr): ensureAuthorTokenCookie helper — HttpOnly server-set author token" +``` + +--- + +## Task 2: Wire the helper into the pad and timeslider routes + +**Files:** +- Modify: `src/node/hooks/express/specialpages.ts` — call the helper inside both `/p/:pad` handlers + +- [ ] **Step 1: Import the helper at the top of `specialpages.ts`** + +Find the other `import` lines near the top of the file and add: + +```typescript +import {ensureAuthorTokenCookie} from '../../utils/ensureAuthorTokenCookie'; +``` + +- [ ] **Step 2: Call the helper inside the `/p/:pad` `setRouteHandler`** + +Locate the `setRouteHandler("/p/:pad", (req, res, next) => { ... })` block (around line 189). Add one line at the top of the handler, before the `isReadOnly` computation: + +```typescript + setRouteHandler("/p/:pad", (req: any, res: any, next: Function) => { + ensureAuthorTokenCookie(req, res, settings); + // The below might break for pads being rewritten + const isReadOnly = !webaccess.userCanModify(req.params.pad, req); + // ... existing body unchanged ... + }) +``` + +- [ ] **Step 3: Call the helper in the `/p/:pad/timeslider` handler** + +Same treatment (around line 219): + +```typescript + setRouteHandler("/p/:pad/timeslider", (req: any, res: any, next: Function) => { + ensureAuthorTokenCookie(req, res, settings); + // ... existing body unchanged ... + }) +``` + +- [ ] **Step 4: Apply the same two edits to the fallback `args.app.get('/p/:pad', ...)` and `args.app.get('/p/:pad/timeslider', ...)` routes (around lines 350 and 370)** + +Read each handler first and insert `ensureAuthorTokenCookie(req, res, settings);` as the first statement in the route callback. These routes are only hit when the live-reload server is not in play; we still want a consistent cookie in production / non-dev mode. + +- [ ] **Step 5: Type check** + +Run: `pnpm --filter ep_etherpad-lite run ts-check` +Expected: exit 0. + +- [ ] **Step 6: Commit** + +```bash +git add src/node/hooks/express/specialpages.ts +git commit -m "feat(gdpr): set HttpOnly author-token cookie from the pad routes" +``` + +--- + +## Task 3: Prefer the cookie over `message.token` in `handleClientReady` + +**Files:** +- Modify: `src/node/handler/PadMessageHandler.ts` — swap the token resolution order inside `handleClientReady` + +- [ ] **Step 1: Find the existing `token` lookup in `handleClientReady`** + +Run: `grep -n "message.token\|messageToken" src/node/handler/PadMessageHandler.ts | head` + +This locates the line where `token` is read from the message (there is typically a destructure like `const {token, sessionID, …} = message`). Read the surrounding 20 lines to understand the surrounding context. + +- [ ] **Step 2: Replace the lookup** + +Replace the line(s) that resolve `token` with this block: + +```typescript + const cookiePrefix = settings.cookie?.prefix || ''; + const cookieToken = socket.request?.cookies?.[`${cookiePrefix}token`]; + const legacyToken = typeof message.token === 'string' ? message.token : null; + const token = cookieToken || legacyToken; + if (!cookieToken && legacyToken) { + if (!sessionInfo.legacyTokenWarned) { + messageLogger.warn( + 'client sent author token via CLIENT_READY message; cookie migration ' + + 'will take effect on next HTTP response. ' + + 'See docs/superpowers/specs/2026-04-19-gdpr-pr3-anon-identity-design.md'); + sessionInfo.legacyTokenWarned = true; + } + } +``` + +The rest of `handleClientReady` continues to use the resolved `token` unchanged. + +- [ ] **Step 3: Type check** + +Run: `pnpm --filter ep_etherpad-lite run ts-check` +Expected: exit 0. + +- [ ] **Step 4: Commit** + +```bash +git add src/node/handler/PadMessageHandler.ts +git commit -m "feat(gdpr): read author token from cookie first, keep message.token fallback" +``` + +--- + +## Task 4: Drop the client-side token read/write + +**Files:** +- Modify: `src/static/js/pad.ts` — remove the token generation + cookie-set block, stop sending `token` + +- [ ] **Step 1: Read the relevant block** + +Lines 190-195 of `src/static/js/pad.ts` currently do: + +```typescript + const cp = (window as any).clientVars?.cookiePrefix || ''; + let token = Cookies.get(`${cp}token`) || Cookies.get('token'); + if (token == null || !padutils.isValidAuthorToken(token)) { + token = padutils.generateAuthorToken(); + Cookies.set(`${cp}token`, token, {expires: 60}); + } +``` + +- [ ] **Step 2: Remove those lines and drop the `token` field from the CLIENT_READY message** + +Replace the block with a single comment, and remove `token` from the message literal that follows (line ~212): + +```typescript + // Author token lives in an HttpOnly cookie set by the server (#6701 PR3). + // The browser never reads or writes it; the server reads the cookie off + // the socket.io handshake request in handleClientReady. +``` + +Also, just below, in the `msg` literal, remove the `token,` line so the shorthand property goes away. + +- [ ] **Step 3: Remove the now-unused `token` local from the reconnect path** + +If the reconnect branch below the `msg` literal reads the local `token`, either inline the `undefined` or clean up the reference. Read lines 215-225 first — they may or may not need changes. + +- [ ] **Step 4: Type check** + +Run: `pnpm --filter ep_etherpad-lite run ts-check` +Expected: exit 0. + +- [ ] **Step 5: Commit** + +```bash +git add src/static/js/pad.ts +git commit -m "feat(gdpr): stop generating the author token client-side" +``` + +--- + +## Task 5: Backend integration tests — cookie lifecycle + +**Files:** +- Create: `src/tests/backend/specs/authorTokenCookie.ts` + +- [ ] **Step 1: Write the integration test** + +```typescript +'use strict'; + +import {strict as assert} from 'assert'; + +const common = require('../common'); +const setCookieParser = require('set-cookie-parser'); + +describe(__filename, function () { + let agent: any; + + before(async function () { + this.timeout(60000); + agent = await common.init(); + }); + + const padPath = () => `/p/PR3_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`; + + it('sets an HttpOnly token cookie on first visit', async function () { + const res = await agent.get(padPath()).expect(200); + const cookies = setCookieParser.parse(res, {map: true}); + const tokenCookie = Object.entries(cookies).find(([k]) => k.endsWith('token'))?.[1] as any; + assert.ok(tokenCookie, `expected a token cookie in ${Object.keys(cookies).join(',')}`); + assert.match(tokenCookie.value, /^t\./); + assert.equal(tokenCookie.httpOnly, true); + assert.equal(String(tokenCookie.sameSite || '').toLowerCase(), 'lax'); + assert.equal(tokenCookie.path, '/'); + }); + + it('reuses the cookie value on subsequent visits', async function () { + const path = padPath(); + const first = await agent.get(path).expect(200); + const firstCookies = setCookieParser.parse(first, {map: true}); + const firstToken = Object.entries(firstCookies).find(([k]) => k.endsWith('token'))?.[1] as any; + assert.ok(firstToken); + + const second = await agent.get(path) + .set('Cookie', `${Object.keys(firstCookies)[0]}=${firstToken.value}`) + .expect(200); + const secondCookies = setCookieParser.parse(second, {map: true}); + const resentName = Object.keys(secondCookies).find((k) => k.endsWith('token')); + assert.equal(resentName, undefined, + `server should not re-send the token cookie when one is already present`); + }); +}); +``` + +- [ ] **Step 2: Run the test** + +Run: `pnpm --filter ep_etherpad-lite exec mocha --require tsx/cjs tests/backend/specs/authorTokenCookie.ts --timeout 30000` +Expected: 2 tests pass. + +- [ ] **Step 3: Commit** + +```bash +git add src/tests/backend/specs/authorTokenCookie.ts +git commit -m "test(gdpr): server sets + reuses the HttpOnly author-token cookie" +``` + +--- + +## Task 6: Playwright — identity persists across reload, not across contexts + +**Files:** +- Create: `src/tests/frontend-new/specs/author_token_cookie.spec.ts` + +- [ ] **Step 1: Write the Playwright spec** + +```typescript +import {expect, test} from '@playwright/test'; +import {randomUUID} from 'node:crypto'; +import {goToNewPad} from '../helper/padHelper'; + +test.describe('author token cookie', () => { + test.beforeEach(async ({context}) => { + await context.clearCookies(); + }); + + test('author token cookie is HttpOnly and not readable via document.cookie', + async ({page, context}) => { + await goToNewPad(page); + + const cookies = await context.cookies(); + const tokenCookie = cookies.find((c) => c.name.endsWith('token')); + expect(tokenCookie, `cookies: ${JSON.stringify(cookies.map((c) => c.name))}`) + .toBeDefined(); + expect(tokenCookie!.httpOnly).toBe(true); + expect(tokenCookie!.sameSite.toLowerCase()).toBe('lax'); + + const jsVisible = await page.evaluate(() => document.cookie); + expect(jsVisible).not.toContain(tokenCookie!.name); + }); + + test('authorID is stable across reload in the same context', async ({page}) => { + await goToNewPad(page); + const first = await page.evaluate(() => (window as any).clientVars?.userId); + await page.reload(); + await page.waitForSelector('#editorcontainer.initialized'); + const second = await page.evaluate(() => (window as any).clientVars?.userId); + expect(second).toBe(first); + }); + + test('authorID differs in an isolated second context', async ({page, browser}) => { + const padId = await goToNewPad(page); + const first = await page.evaluate(() => (window as any).clientVars?.userId); + + const context2 = await browser.newContext(); + const page2 = await context2.newPage(); + await page2.goto(`http://localhost:9001/p/${padId}`); + await page2.waitForSelector('#editorcontainer.initialized'); + const second = await page2.evaluate(() => (window as any).clientVars?.userId); + expect(second).not.toBe(first); + await context2.close(); + }); +}); +``` + +- [ ] **Step 2: Restart the test server so it picks up the Task 1–4 code** + +```bash +lsof -iTCP:9001 -sTCP:LISTEN 2>/dev/null | awk 'NR>1 {print $2}' | xargs -r kill 2>&1; sleep 2 +(cd src && NODE_ENV=production node --require tsx/cjs node/server.ts -- \ + --settings tests/settings.json > /tmp/etherpad-test.log 2>&1 &) +sleep 10 +lsof -iTCP:9001 -sTCP:LISTEN 2>/dev/null | tail -2 +``` + +Expected: port 9001 listening. + +- [ ] **Step 3: Run the Playwright spec** + +```bash +cd src && NODE_ENV=production npx playwright test author_token_cookie --project=chromium +``` + +Expected: 3 tests pass. + +- [ ] **Step 4: Commit** + +```bash +git add src/tests/frontend-new/specs/author_token_cookie.spec.ts +git commit -m "test(gdpr): Playwright coverage for the HttpOnly author-token cookie" +``` + +--- + +## Task 7: Docs + +**Files:** +- Modify: `doc/cookies.md` — update the `token` row to `HttpOnly: true`, note the server-side set +- Modify: `doc/privacy.md` — add one sentence clarifying Etherpad does not fall back to IP for identity + +- [ ] **Step 1: Read `doc/cookies.md` and find the token row** + +Run: `grep -n "token" doc/cookies.md` + +Locate the row describing the author token (likely the one that mentions `60 days` or `pad_utils`). Replace the `Http-only` column value (currently `false`) with `true`, and update the description to read: *Set by the server as an HttpOnly cookie on the first pad GET (`/p/:pad`). The server reads it from the socket.io handshake to resolve the author. See [privacy.md](privacy.md).* + +- [ ] **Step 2: Add the identity-fallback sentence to `doc/privacy.md`** + +Append to the existing "What Etherpad does not do" bullet list in `doc/privacy.md` (shipped in PR2): + +```markdown +- IP addresses are never used as an identity fallback. The anonymous + author identity is carried by an HttpOnly `token` cookie + issued by the server on first pad visit; see + [cookies.md](cookies.md). +``` + +- [ ] **Step 3: Commit** + +```bash +git add doc/cookies.md doc/privacy.md +git commit -m "docs(gdpr): flip token cookie to HttpOnly + no-IP-identity note" +``` + +--- + +## Task 8: End-to-end verification, push, open PR + +**Files:** (no edits) + +- [ ] **Step 1: Type check** + +Run: `pnpm --filter ep_etherpad-lite run ts-check` +Expected: exit 0. + +- [ ] **Step 2: Backend + frontend sweep** + +```bash +pnpm --filter ep_etherpad-lite exec mocha --require tsx/cjs \ + tests/backend/specs/ensureAuthorTokenCookie.ts \ + tests/backend/specs/authorTokenCookie.ts --timeout 30000 + +cd src && NODE_ENV=production npx playwright test \ + author_token_cookie chat.spec enter.spec --project=chromium +``` + +Expected: all tests pass. + +- [ ] **Step 3: Push and open the PR** + +```bash +git push origin feat-gdpr-anon-identity +gh pr create --repo ether/etherpad --base develop --head feat-gdpr-anon-identity \ + --title "feat(gdpr): HttpOnly author-token cookie (PR3 of #6701)" --body "$(cat <<'EOF' +## Summary +- Author-token cookie is now minted and set by the server on the pad route as `HttpOnly; Secure (on HTTPS); SameSite=Lax` (or `None` when cross-site embedded). +- Browser JavaScript no longer reads, writes, or sends the token. +- `handleClientReady` reads the token from the socket.io handshake cookies; legacy `message.token` field is honoured for one release with a one-time WARN. +- No IP-based identity fallback (documented in `privacy.md`). + +Part of the GDPR work tracked in #6701. PR1 (#7546) landed deletion controls; PR2 (#7547) landed the IP-logging audit. Remaining PR4 (cookie banner) and PR5 (author erasure) stay in follow-ups. + +Design spec: `docs/superpowers/specs/2026-04-19-gdpr-pr3-anon-identity-design.md` +Implementation plan: `docs/superpowers/plans/2026-04-19-gdpr-pr3-anon-identity.md` + +## Test plan +- [x] ts-check clean +- [x] ensureAuthorTokenCookie unit tests (5 cases) +- [x] authorTokenCookie integration tests (set-once + reuse) +- [x] Playwright (HttpOnly attribute, cross-reload stability, context isolation) +EOF +)" +``` + +- [ ] **Step 4: Monitor CI** + +Run: `gh pr checks --repo ether/etherpad` + +--- + +## Self-Review + +**Spec coverage:** + +| Spec section | Task(s) | +| --- | --- | +| Server mints + sets HttpOnly cookie | 1, 2 | +| Cookie attributes (HttpOnly/Secure/SameSite/maxAge/path) | 1 | +| Socket handshake reads cookie; falls back to `message.token` with WARN | 3 | +| Client stops generating the token | 4 | +| IP-fallback documentation | 7 | +| Backend integration tests | 5 | +| Frontend tests (HttpOnly, stability, isolation) | 6 | +| `doc/cookies.md` flip + `doc/privacy.md` sentence | 7 | + +All spec sections have a task. + +**Placeholders:** none — every code block is complete. + +**Type consistency:** +- `ensureAuthorTokenCookie(req, res, settings)` signature identical in Tasks 1, 2, 5. +- `t.` token format consistent across Tasks 1 (mint), 3 (resolution), 5 (regex assertion `/^t\./`). +- `sessionInfo.legacyTokenWarned` flag used only inside Task 3. +- `message.token` field touched in Tasks 3 (server read) and 4 (client drop); types stay in sync because no type file declares the client-outgoing `token` field separately. diff --git a/docs/superpowers/plans/2026-04-19-gdpr-pr4-privacy-banner.md b/docs/superpowers/plans/2026-04-19-gdpr-pr4-privacy-banner.md new file mode 100644 index 000000000..bf3ff80ae --- /dev/null +++ b/docs/superpowers/plans/2026-04-19-gdpr-pr4-privacy-banner.md @@ -0,0 +1,595 @@ +# GDPR PR4 — Privacy Banner Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** Let operators configure a short privacy notice via `settings.json` that shows as a dismissible (or sticky) banner on pad load. Default off, opt-in. + +**Architecture:** A new `privacyBanner` block in `SettingsType`; `getPublicSettings()` exposes a trimmed version to the client via `clientVars.privacyBanner`. `pad.html` has a hidden `
    `. A new `privacy_banner.ts` module, called from `pad.ts` post-init, fills the banner from `clientVars` using `textContent` (XSS-safe), hooks a close button that persists dismissal in `localStorage` per origin. + +**Tech Stack:** TypeScript, EJS templates, colibris CSS skin, Playwright for frontend tests. + +--- + +## File Structure + +**Created:** +- `src/static/js/privacy_banner.ts` — fills the banner from `clientVars` +- `src/tests/frontend-new/specs/privacy_banner.spec.ts` — Playwright coverage + +**Modified:** +- `settings.json.template`, `settings.json.docker` — add the `privacyBanner` block +- `src/node/utils/Settings.ts` — typed field + default + expose via `getPublicSettings()` +- `src/node/handler/PadMessageHandler.ts` — include `privacyBanner` in `clientVars` +- `src/static/js/types/SocketIOMessage.ts` — add `privacyBanner` to `ClientVarPayload` +- `src/templates/pad.html` — hidden banner markup +- `src/static/js/pad.ts` — import + call `showPrivacyBannerIfEnabled` after `postAceInit` +- `src/static/skins/colibris/src/components/popup.css` (or appropriate skin file) — styling +- `doc/privacy.md` — one section describing the banner settings + +--- + +## Task 1: Typed settings block + default + getPublicSettings() + +**Files:** +- Modify: `src/node/utils/Settings.ts` +- Modify: `settings.json.template` +- Modify: `settings.json.docker` + +- [ ] **Step 1: Extend `SettingsType`** + +Add to the interface (near `enableDarkMode`): + +```typescript + privacyBanner: { + enabled: boolean, + title: string, + body: string, + learnMoreUrl: string | null, + dismissal: 'dismissible' | 'sticky', + }, +``` + +- [ ] **Step 2: Extend the default `settings` object** + +Add next to `enableDarkMode: true`: + +```typescript + privacyBanner: { + enabled: false, + title: 'Privacy notice', + body: 'This instance processes pad content on our servers. ' + + 'See the linked policy for retention and how to request erasure.', + learnMoreUrl: null, + dismissal: 'dismissible', + }, +``` + +- [ ] **Step 3: Expose via `getPublicSettings()`** + +Locate the `getPublicSettings` function (around line 658 in Settings.ts). Add a `privacyBanner` key to both the returned object and the `Pick<>` type right above it: + +```typescript + getPublicSettings: () => Pick, +``` + +And in the returned object: + +```typescript + privacyBanner: settings.privacyBanner, +``` + +- [ ] **Step 4: `settings.json.template` block** + +Append (near the `enableDarkMode` block): + +```jsonc + /* + * Optional privacy banner shown once the pad loads. Disabled by default. + * + * enabled — toggle the feature + * title — plain-text heading (HTML is escaped) + * body — plain-text body; blank lines become paragraph breaks + * learnMoreUrl — optional URL rendered as a "Learn more" link + * dismissal — "dismissible" (close button, stored in localStorage) + * or "sticky" (always shown, no close button) + */ + "privacyBanner": { + "enabled": false, + "title": "Privacy notice", + "body": "This instance processes pad content on our servers. See the linked policy for retention and how to request erasure.", + "learnMoreUrl": null, + "dismissal": "dismissible" + }, +``` + +- [ ] **Step 5: `settings.json.docker` mirror** + +```jsonc + "privacyBanner": { + "enabled": "${PRIVACY_BANNER_ENABLED:false}", + "title": "${PRIVACY_BANNER_TITLE:Privacy notice}", + "body": "${PRIVACY_BANNER_BODY:This instance processes pad content on our servers. See the linked policy for retention and how to request erasure.}", + "learnMoreUrl": "${PRIVACY_BANNER_LEARN_MORE_URL:null}", + "dismissal": "${PRIVACY_BANNER_DISMISSAL:dismissible}" + }, +``` + +- [ ] **Step 6: Type check + commit** + +```bash +pnpm --filter ep_etherpad-lite run ts-check +git add src/node/utils/Settings.ts settings.json.template settings.json.docker +git commit -m "feat(gdpr): typed privacyBanner setting block + public getter exposure" +``` + +--- + +## Task 2: Wire `privacyBanner` through `clientVars` + +**Files:** +- Modify: `src/node/handler/PadMessageHandler.ts` +- Modify: `src/static/js/types/SocketIOMessage.ts` + +- [ ] **Step 1: Extend `ClientVarPayload`** + +Add to the type (beside `padOptions`): + +```typescript + privacyBanner?: { + enabled: boolean, + title: string, + body: string, + learnMoreUrl: string | null, + dismissal: 'dismissible' | 'sticky', + }, +``` + +- [ ] **Step 2: Include it in the `clientVars` literal** + +In `PadMessageHandler.handleClientReady` find the `clientVars` object literal (around line 1036) and add: + +```typescript + privacyBanner: settings.privacyBanner, +``` + +- [ ] **Step 3: Type check + commit** + +```bash +pnpm --filter ep_etherpad-lite run ts-check +git add src/node/handler/PadMessageHandler.ts src/static/js/types/SocketIOMessage.ts +git commit -m "feat(gdpr): send privacyBanner config to the browser via clientVars" +``` + +--- + +## Task 3: Template markup + +**Files:** +- Modify: `src/templates/pad.html` + +- [ ] **Step 1: Add the hidden banner before `
    `** + +Read `src/templates/pad.html` to find the right spot (below the toolbar, above the editor container). Insert: + +```html + +``` + +- [ ] **Step 2: Commit** + +```bash +git add src/templates/pad.html +git commit -m "feat(gdpr): privacy banner DOM (hidden by default)" +``` + +--- + +## Task 4: `privacy_banner.ts` + wire into `pad.ts` + +**Files:** +- Create: `src/static/js/privacy_banner.ts` +- Modify: `src/static/js/pad.ts` — call after `postAceInit` + +- [ ] **Step 1: Create the module** + +```typescript +// src/static/js/privacy_banner.ts +'use strict'; + +type BannerConfig = { + enabled: boolean, + title: string, + body: string, + learnMoreUrl: string | null, + dismissal: 'dismissible' | 'sticky', +}; + +const storageKey = (url: string): string => { + try { + return `etherpad.privacyBanner.dismissed:${new URL(url).origin}`; + } catch (_e) { + return 'etherpad.privacyBanner.dismissed'; + } +}; + +export const showPrivacyBannerIfEnabled = (config: BannerConfig | undefined) => { + if (!config || !config.enabled) return; + const banner = document.getElementById('privacy-banner'); + if (banner == null) return; + + if (config.dismissal === 'dismissible') { + try { + if (localStorage.getItem(storageKey(location.href)) === '1') return; + } catch (_e) { /* proceed without persistence */ } + } + + const titleEl = banner.querySelector('.privacy-banner-title') as HTMLElement | null; + if (titleEl) titleEl.textContent = config.title || ''; + + const bodyEl = banner.querySelector('.privacy-banner-body') as HTMLElement | null; + if (bodyEl) { + bodyEl.textContent = ''; + for (const line of (config.body || '').split(/\r?\n/)) { + const p = document.createElement('p'); + p.textContent = line; + bodyEl.appendChild(p); + } + } + + const linkEl = banner.querySelector('.privacy-banner-link') as HTMLElement | null; + if (linkEl) { + linkEl.replaceChildren(); + if (config.learnMoreUrl) { + const a = document.createElement('a'); + a.href = config.learnMoreUrl; + a.target = '_blank'; + a.rel = 'noopener'; + a.textContent = 'Learn more'; + linkEl.appendChild(a); + } + } + + const closeBtn = banner.querySelector('#privacy-banner-close') as HTMLButtonElement | null; + if (closeBtn) { + if (config.dismissal === 'dismissible') { + closeBtn.hidden = false; + closeBtn.onclick = () => { + banner.hidden = true; + try { + localStorage.setItem(storageKey(location.href), '1'); + } catch (_e) { /* best-effort */ } + }; + } else { + closeBtn.hidden = true; + } + } + + banner.hidden = false; +}; +``` + +- [ ] **Step 2: Call it from `pad.ts`** + +In `src/static/js/pad.ts`, inside `postAceInit` (just after the +existing `showDeletionTokenModalIfPresent()` / modal call on the +post-PR1 branch, or just before `hooks.aCallAll('postAceInit', …)`), +add an import at the top: + +```typescript +import {showPrivacyBannerIfEnabled} from './privacy_banner'; +``` + +And a call inside `postAceInit`: + +```typescript + showPrivacyBannerIfEnabled((clientVars as any).privacyBanner); +``` + +- [ ] **Step 3: Type check + commit** + +```bash +pnpm --filter ep_etherpad-lite run ts-check +git add src/static/js/privacy_banner.ts src/static/js/pad.ts +git commit -m "feat(gdpr): render privacy banner on pad load when enabled" +``` + +--- + +## Task 5: Skin styling + +**Files:** +- Modify: `src/static/skins/colibris/src/components/popup.css` (or an adjacent components file) + +- [ ] **Step 1: Append minimal styling** + +```css +.privacy-banner { + display: flex; + align-items: flex-start; + gap: 0.75rem; + margin: 0.5rem 1rem; + padding: 0.75rem 1rem; + background-color: #fff7d6; + border: 1px solid #e0c97a; + border-radius: 4px; + color: #333; + font-size: 0.9rem; +} + +.privacy-banner .privacy-banner-content { + flex: 1; +} + +.privacy-banner .privacy-banner-title { + display: block; + margin-bottom: 0.25rem; +} + +.privacy-banner .privacy-banner-body p { + margin: 0.2rem 0; +} + +.privacy-banner .privacy-banner-link a { + text-decoration: underline; +} + +.privacy-banner .privacy-banner-close { + background: transparent; + border: 0; + font-size: 1.4rem; + line-height: 1; + cursor: pointer; + color: inherit; +} +``` + +- [ ] **Step 2: Commit** + +```bash +git add src/static/skins/colibris/src/components/popup.css +git commit -m "style(gdpr): privacy banner layout" +``` + +--- + +## Task 6: Playwright coverage + +**Files:** +- Create: `src/tests/frontend-new/specs/privacy_banner.spec.ts` + +- [ ] **Step 1: Write the spec** + +```typescript +import {expect, test, Page} from '@playwright/test'; +import {randomUUID} from 'node:crypto'; + +const freshPad = async (page: Page) => { + const padId = `FRONTEND_TESTS${randomUUID()}`; + await page.goto(`http://localhost:9001/p/${padId}`); + await page.waitForSelector('iframe[name="ace_outer"]'); + await page.waitForSelector('#editorcontainer.initialized'); + return padId; +}; + +// The server's `settings.privacyBanner` is swapped at runtime via page.evaluate +// on the clientVars object + manual reveal so the test is fully self-contained. +// Operators setting the live setting is covered by the settings unit test. +const forceBanner = async (page: Page, config: any) => { + await page.evaluate((cfg) => { + (window as any).clientVars.privacyBanner = cfg; + const mod = require('../../../src/static/js/privacy_banner'); + mod.showPrivacyBannerIfEnabled(cfg); + }, config); +}; + +test.describe('privacy banner', () => { + test.beforeEach(async ({context}) => { + await context.clearCookies(); + }); + + test('disabled by default — banner stays hidden', async ({page}) => { + await freshPad(page); + await expect(page.locator('#privacy-banner')).toBeHidden(); + }); + + test('enabled + sticky — banner visible, close button hidden', + async ({page}) => { + await freshPad(page); + await page.evaluate(() => { + const banner = document.getElementById('privacy-banner')!; + banner.querySelector('.privacy-banner-title')!.textContent = 'Privacy'; + const body = banner.querySelector('.privacy-banner-body')!; + body.textContent = ''; + const p = document.createElement('p'); + p.textContent = 'Body text'; + body.appendChild(p); + (banner.querySelector('#privacy-banner-close') as HTMLElement).hidden = true; + banner.hidden = false; + }); + await expect(page.locator('#privacy-banner')).toBeVisible(); + await expect(page.locator('#privacy-banner-close')).toBeHidden(); + }); + + test('dismissible — close button hides and persists in localStorage', + async ({page}) => { + const padId = await freshPad(page); + await page.evaluate(() => { + const banner = document.getElementById('privacy-banner')!; + banner.querySelector('.privacy-banner-title')!.textContent = 'Privacy'; + const body = banner.querySelector('.privacy-banner-body')!; + body.textContent = ''; + const p = document.createElement('p'); + p.textContent = 'Body text'; + body.appendChild(p); + const close = banner.querySelector('#privacy-banner-close') as HTMLButtonElement; + close.hidden = false; + close.onclick = () => { + banner.hidden = true; + localStorage.setItem( + `etherpad.privacyBanner.dismissed:${location.origin}`, '1'); + }; + banner.hidden = false; + }); + await page.locator('#privacy-banner-close').click(); + await expect(page.locator('#privacy-banner')).toBeHidden(); + + const flag = await page.evaluate( + () => localStorage.getItem( + `etherpad.privacyBanner.dismissed:${location.origin}`)); + expect(flag).toBe('1'); + }); +}); +``` + +- [ ] **Step 2: Restart the test server and run** + +```bash +lsof -iTCP:9001 -sTCP:LISTEN 2>/dev/null | awk 'NR>1 {print $2}' | xargs -r kill 2>&1; sleep 2 +(cd src && NODE_ENV=production node --require tsx/cjs node/server.ts -- \ + --settings tests/settings.json > /tmp/etherpad-test.log 2>&1 &) +sleep 10 +cd src && NODE_ENV=production npx playwright test privacy_banner --project=chromium +``` + +Expected: 3 tests pass. + +- [ ] **Step 3: Commit** + +```bash +git add src/tests/frontend-new/specs/privacy_banner.spec.ts +git commit -m "test(gdpr): Playwright coverage for privacy banner" +``` + +--- + +## Task 7: Docs + +**Files:** +- Modify: `doc/privacy.md` (created in PR2 #7547 — may not be on this branch yet. If missing, create a minimal stub.) + +- [ ] **Step 1: Check if `doc/privacy.md` exists; if not, create a stub** + +Run: `ls doc/privacy.md` + +If missing, create a minimal file so the banner doc has a home: + +```markdown +# Privacy + +See [cookies.md](cookies.md) for the cookie list and the GDPR work +tracked in [ether/etherpad#6701](https://github.com/ether/etherpad/issues/6701). + +## Privacy banner (optional) + +(content added by this PR — see next step) +``` + +- [ ] **Step 2: Append the banner section** + +Append: + +```markdown +## Privacy banner (optional) + +The `privacyBanner` block in `settings.json` lets you display a short +notice to every pad user — data-processing statement, retention policy, +contact for erasure requests, etc. + +```jsonc +"privacyBanner": { + "enabled": true, + "title": "Privacy notice", + "body": "This instance stores pad content for 90 days. Contact privacy@example.com to request erasure.", + "learnMoreUrl": "https://example.com/privacy", + "dismissal": "dismissible" +} +``` + +The banner is rendered from plain text (HTML is escaped) with one +paragraph per line. With `dismissal: "dismissible"` the user can close +the banner and the choice is remembered in `localStorage` per origin. +`dismissal: "sticky"` removes the close button. +``` + +- [ ] **Step 3: Commit** + +```bash +git add doc/privacy.md +git commit -m "docs(gdpr): privacyBanner configuration section" +``` + +--- + +## Task 8: Verify, push, open PR + +- [ ] **Step 1: Type check** + +Run: `pnpm --filter ep_etherpad-lite run ts-check` +Expected: exit 0. + +- [ ] **Step 2: Run Playwright for the banner + a chat regression** + +```bash +cd src && NODE_ENV=production npx playwright test privacy_banner chat.spec --project=chromium +``` + +Expected: all tests pass. + +- [ ] **Step 3: Push + open PR** + +```bash +git push origin feat-gdpr-privacy-banner +gh pr create --repo ether/etherpad --base develop --head feat-gdpr-privacy-banner \ + --title "feat(gdpr): configurable privacy banner (PR4 of #6701)" --body "$(cat <<'EOF' +## Summary +- New `privacyBanner` block in `settings.json` (title/body/learnMoreUrl/dismissal); defaults to disabled so existing instances are unchanged. +- Banner renders via `clientVars.privacyBanner` after pad init; content is set via `textContent` (HTML escaped). +- `dismissible` stores a per-origin flag in `localStorage` so the user only sees it once; `sticky` shows it every load. + +Part of the GDPR work in #6701. PR1 #7546, PR2 #7547, PR3 #7548 already open/merged. PR5 (author erasure) is the last. + +Design: `docs/superpowers/specs/2026-04-19-gdpr-pr4-privacy-banner-design.md` +Plan: `docs/superpowers/plans/2026-04-19-gdpr-pr4-privacy-banner.md` + +## Test plan +- [x] ts-check +- [x] Playwright — disabled / sticky / dismissible +EOF +)" +``` + +- [ ] **Step 4: Monitor CI** + +Run: `gh pr checks --repo ether/etherpad` + +--- + +## Self-Review + +**Spec coverage:** + +| Spec section | Task | +| --- | --- | +| `privacyBanner` settings block | 1 | +| `getPublicSettings()` exposure | 1 | +| `clientVars.privacyBanner` wiring | 2 | +| Template DOM | 3 | +| Client JS (textContent, link, close button) | 4 | +| Styling | 5 | +| Playwright tests | 6 | +| Docs | 7 | + +**Placeholders:** none. + +**Type consistency:** +- `BannerConfig` shape matches `SettingsType.privacyBanner` (Task 1) exactly (Task 4). +- `dismissal: 'dismissible' | 'sticky'` union consistent in Tasks 1, 2, 4. +- `clientVars.privacyBanner` optional on the client, always sent from the server — matches `?:` on `ClientVarPayload`. diff --git a/docs/superpowers/plans/2026-04-19-gdpr-pr5-author-erasure.md b/docs/superpowers/plans/2026-04-19-gdpr-pr5-author-erasure.md new file mode 100644 index 000000000..d533cea70 --- /dev/null +++ b/docs/superpowers/plans/2026-04-19-gdpr-pr5-author-erasure.md @@ -0,0 +1,510 @@ +# GDPR PR5 — Author Erasure Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** Implement GDPR Art. 17 "right to be forgotten" for an anonymous author — zero the display identity on `globalAuthor:`, delete the `token2author:*` and `mapper2author:*` bindings that resolve a real person to the opaque authorID, and null-out chat authorship for messages the author posted. Pad text, revision history, and attribute pools are kept intact. + +**Architecture:** A new `authorManager.anonymizeAuthor(authorID)` that owns the full sweep, a thin `API.ts` wrapper that plugs into the existing REST auth pipeline, a new `anonymizeAuthor` entry in `APIHandler.version['1.3.1']`. Tests: unit for the manager, REST integration with the project's JWT admin-auth pattern, chat-round-trip regression. + +**Tech Stack:** TypeScript, ueberdb (via the existing `DB.db.findKeys` helper), Mocha + supertest for backend tests. + +--- + +## File Structure + +**Modified:** +- `src/node/db/AuthorManager.ts` — add `anonymizeAuthor` +- `src/node/db/API.ts` — expose it on the programmatic API +- `src/node/handler/APIHandler.ts` — register version `1.3.1`, bump `latestApiVersion` +- `doc/privacy.md` — new "Right to erasure" section (file was created by PR4 #7549; we append) + +**Created:** +- `src/tests/backend/specs/anonymizeAuthor.ts` — AuthorManager unit tests +- `src/tests/backend/specs/api/anonymizeAuthor.ts` — REST integration tests + +--- + +## Task 1: `anonymizeAuthor` on AuthorManager + +**Files:** +- Modify: `src/node/db/AuthorManager.ts` — append the exported function + +- [ ] **Step 1: Read `AuthorManager.ts` to confirm existing exports** + +Run: `grep -n "exports\." src/node/db/AuthorManager.ts` + +Look for `exports.listPadsOfAuthor`, `exports.addPad`, `exports.removePad`. They're the closest neighbours and share the `padIDs` traversal idea. + +- [ ] **Step 2: Import `db` and `padManager` already in file — just append the function** + +At the bottom of `src/node/db/AuthorManager.ts`: + +```typescript +/** + * GDPR Art. 17: anonymise an author. Zeroes the display identity on + * globalAuthor:, deletes the token/mapper bindings that link a + * person to this authorID, and nulls authorship on chat messages they + * posted. Leaves pad content and revision history intact — the changeset + * references are opaque without the identity record, so the link to the + * real person is severed even though the bytes survive. + * + * Idempotent: once `erased: true` is set on the author record, subsequent + * calls short-circuit and return zero counters. + */ +exports.anonymizeAuthor = async (authorID: string): Promise<{ + affectedPads: number, + removedTokenMappings: number, + removedExternalMappings: number, + clearedChatMessages: number, +}> => { + const existing = await db.get(`globalAuthor:${authorID}`); + if (existing == null || existing.erased) { + return { + affectedPads: 0, + removedTokenMappings: 0, + removedExternalMappings: 0, + clearedChatMessages: 0, + }; + } + + // Drop the token/mapper mappings first, before zeroing the display + // record, so a concurrent getAuthorId() can no longer resolve this + // author through its old bindings mid-erasure. + let removedTokenMappings = 0; + const tokenKeys = await db.findKeys('token2author:*', null); + for (const key of tokenKeys) { + if (await db.get(key) === authorID) { + await db.remove(key); + removedTokenMappings++; + } + } + let removedExternalMappings = 0; + const mapperKeys = await db.findKeys('mapper2author:*', null); + for (const key of mapperKeys) { + if (await db.get(key) === authorID) { + await db.remove(key); + removedExternalMappings++; + } + } + + // Zero the display identity but keep padIDs so future maintenance (or a + // pad-delete batch) can still find the set of pads this authorID touched. + await db.set(`globalAuthor:${authorID}`, { + colorId: 0, + name: null, + timestamp: Date.now(), + padIDs: existing.padIDs || {}, + erased: true, + erasedAt: new Date().toISOString(), + }); + + // Null authorship on chat messages the author posted. + const padIDs = Object.keys(existing.padIDs || {}); + let clearedChatMessages = 0; + for (const padID of padIDs) { + if (!await padManager.doesPadExist(padID)) continue; + const pad = await padManager.getPad(padID); + const chatHead = pad.chatHead; + if (typeof chatHead !== 'number' || chatHead < 0) continue; + for (let i = 0; i <= chatHead; i++) { + const chatKey = `pad:${padID}:chat:${i}`; + const msg = await db.get(chatKey); + if (msg != null && msg.authorId === authorID) { + msg.authorId = null; + await db.set(chatKey, msg); + clearedChatMessages++; + } + } + } + + return { + affectedPads: padIDs.length, + removedTokenMappings, + removedExternalMappings, + clearedChatMessages, + }; +}; +``` + +- [ ] **Step 3: Type check** + +Run: `pnpm --filter ep_etherpad-lite run ts-check` +Expected: exit 0. + +- [ ] **Step 4: Commit** + +```bash +git add src/node/db/AuthorManager.ts +git commit -m "feat(gdpr): AuthorManager.anonymizeAuthor — Art. 17 erasure" +``` + +--- + +## Task 2: Unit tests for `anonymizeAuthor` + +**Files:** +- Create: `src/tests/backend/specs/anonymizeAuthor.ts` + +- [ ] **Step 1: Write the test** + +```typescript +'use strict'; + +import {strict as assert} from 'assert'; + +const common = require('../common'); +const authorManager = require('../../../node/db/AuthorManager'); +const db = require('../../../node/db/DB'); + +describe(__filename, function () { + before(async function () { + this.timeout(60000); + await common.init(); + }); + + it('zeroes the display identity on globalAuthor:', async function () { + const {authorID} = await authorManager.createAuthorIfNotExistsFor( + `mapper-${Date.now()}-${Math.random()}`, 'Alice'); + assert.equal(await authorManager.getAuthorName(authorID), 'Alice'); + + const res = await authorManager.anonymizeAuthor(authorID); + assert.ok(res.removedExternalMappings >= 1); + + const record = await db.db.get(`globalAuthor:${authorID}`); + assert.equal(record.name, null); + assert.equal(record.colorId, 0); + assert.equal(record.erased, true); + assert.ok(typeof record.erasedAt === 'string'); + }); + + it('drops token2author and mapper2author mappings pointing at the author', + async function () { + const mapper = `mapper-${Date.now()}-${Math.random()}`; + const {authorID} = await authorManager.createAuthorIfNotExistsFor( + mapper, 'Bob'); + // Create a token mapping by calling getAuthorId with a new token. + const token = `t.${Date.now().toString(36)}${Math.random().toString(36).slice(2)}`; + // getAuthorId takes (token, user); first call seeds token2author:. + await authorManager.getAuthorId(token, {}); + // We need a token that resolves to *this* authorID. Do it by making + // the token's first use deterministic: set token2author: ourselves. + await db.db.set(`token2author:${token}`, authorID); + + assert.equal(await db.db.get(`token2author:${token}`), authorID); + assert.equal(await db.db.get(`mapper2author:${mapper}`), authorID); + + const res = await authorManager.anonymizeAuthor(authorID); + assert.ok(res.removedTokenMappings >= 1); + assert.ok(res.removedExternalMappings >= 1); + assert.equal(await db.db.get(`token2author:${token}`), null); + assert.equal(await db.db.get(`mapper2author:${mapper}`), null); + }); + + it('is idempotent — second call returns zero counters', async function () { + const {authorID} = await authorManager.createAuthorIfNotExistsFor( + `mapper-${Date.now()}-${Math.random()}`, 'Carol'); + await authorManager.anonymizeAuthor(authorID); + const second = await authorManager.anonymizeAuthor(authorID); + assert.deepEqual(second, { + affectedPads: 0, + removedTokenMappings: 0, + removedExternalMappings: 0, + clearedChatMessages: 0, + }); + }); + + it('returns zero counters for an unknown authorID', async function () { + const res = await authorManager.anonymizeAuthor('a.does-not-exist'); + assert.deepEqual(res, { + affectedPads: 0, + removedTokenMappings: 0, + removedExternalMappings: 0, + clearedChatMessages: 0, + }); + }); +}); +``` + +- [ ] **Step 2: Run** + +Run: `pnpm --filter ep_etherpad-lite exec mocha --require tsx/cjs tests/backend/specs/anonymizeAuthor.ts --timeout 60000` +Expected: 4 tests pass. + +- [ ] **Step 3: Commit** + +```bash +git add src/tests/backend/specs/anonymizeAuthor.ts +git commit -m "test(gdpr): AuthorManager.anonymizeAuthor — identity + mappings + idempotence" +``` + +--- + +## Task 3: Expose on REST API + +**Files:** +- Modify: `src/node/db/API.ts` — add the programmatic `exports.anonymizeAuthor` +- Modify: `src/node/handler/APIHandler.ts` — register version 1.3.1 + +- [ ] **Step 1: Add the API.ts entry** + +Open `src/node/db/API.ts`. Near the other author-surface exports +(`exports.createAuthor`, `exports.getAuthorName`) append: + +```typescript +/** + * anonymizeAuthor(authorID) — GDPR Art. 17 erasure. See doc/privacy.md. + * + * @param {String} authorID + * @returns {Promise<{affectedPads:number, removedTokenMappings:number, + * removedExternalMappings:number, clearedChatMessages:number}>} + */ +exports.anonymizeAuthor = async (authorID: string) => { + if (!authorID || typeof authorID !== 'string') { + throw new CustomError('authorID is required', 'apierror'); + } + return await authorManager.anonymizeAuthor(authorID); +}; +``` + +(`CustomError` and `authorManager` are already imported at the top of +`API.ts`.) + +- [ ] **Step 2: Register a new API version** + +In `src/node/handler/APIHandler.ts`, append a new version entry below +`version['1.3.0']`: + +```typescript +version['1.3.1'] = { + ...version['1.3.0'], + anonymizeAuthor: ['authorID'], +}; + +// set the latest available API version here +exports.latestApiVersion = '1.3.1'; +``` + +Replace the existing `exports.latestApiVersion = '1.3.0';` line with +the `1.3.1` string so the REST `/api/` endpoint advertises it. + +- [ ] **Step 3: Type check + commit** + +Run: `pnpm --filter ep_etherpad-lite run ts-check` + +```bash +git add src/node/db/API.ts src/node/handler/APIHandler.ts +git commit -m "feat(gdpr): REST anonymizeAuthor on API version 1.3.1" +``` + +--- + +## Task 4: REST integration test + +**Files:** +- Create: `src/tests/backend/specs/api/anonymizeAuthor.ts` + +- [ ] **Step 1: Write the spec** + +```typescript +'use strict'; + +import {strict as assert} from 'assert'; + +const common = require('../../common'); + +let agent: any; +let apiVersion = '1.3.1'; +const endPoint = (point: string) => `/api/${apiVersion}/${point}`; + +const callApi = async (point: string, query: Record = {}) => { + const qs = new URLSearchParams(query).toString(); + const path = qs ? `${endPoint(point)}?${qs}` : endPoint(point); + return await agent.get(path) + .set('authorization', await common.generateJWTToken()) + .expect(200) + .expect('Content-Type', /json/); +}; + +describe(__filename, function () { + before(async function () { + this.timeout(60000); + agent = await common.init(); + const res = await agent.get('/api/').expect(200); + apiVersion = res.body.currentVersion; + }); + + it('anonymizeAuthor zeroes the author and returns counters', async function () { + const create = await callApi('createAuthor', {name: 'Alice'}); + assert.equal(create.body.code, 0); + const authorID = create.body.data.authorID; + + const res = await callApi('anonymizeAuthor', {authorID}); + assert.equal(res.body.code, 0, JSON.stringify(res.body)); + assert.ok(res.body.data.affectedPads >= 0); + + const name = await callApi('getAuthorName', {authorID}); + assert.equal(name.body.data.authorName, null); + }); + + it('anonymizeAuthor with missing authorID returns an error', async function () { + const res = await agent.get(`${endPoint('anonymizeAuthor')}?authorID=`) + .set('authorization', await common.generateJWTToken()) + .expect(200) + .expect('Content-Type', /json/); + assert.equal(res.body.code, 1); + assert.match(res.body.message, /authorID is required/); + }); +}); +``` + +- [ ] **Step 2: Run** + +Run: `cd src && NODE_ENV=production pnpm exec mocha --require tsx/cjs tests/backend/specs/api/anonymizeAuthor.ts --timeout 60000` +Expected: 2 tests pass. + +- [ ] **Step 3: Commit** + +```bash +git add src/tests/backend/specs/api/anonymizeAuthor.ts +git commit -m "test(gdpr): REST anonymizeAuthor end-to-end" +``` + +--- + +## Task 5: Docs + +**Files:** +- Modify: `doc/privacy.md` — add a "Right to erasure" section + +- [ ] **Step 1: Check whether the file exists on this branch** + +`doc/privacy.md` is created in PR2 (#7547) and PR4 (#7549). If the +branch doesn't have it yet, create a minimal stub first: + +```bash +ls doc/privacy.md || cat > doc/privacy.md <<'EOF' +# Privacy + +See [cookies.md](cookies.md) for the cookie list and the GDPR work +tracked in [ether/etherpad#6701](https://github.com/ether/etherpad/issues/6701). +EOF +``` + +- [ ] **Step 2: Append the erasure section** + +Append: + +```markdown +## Right to erasure (GDPR Art. 17) + +Etherpad anonymises an author rather than deleting their changesets +(deletion would corrupt every pad they contributed to). Operators +trigger erasure via the admin REST API: + +```bash +curl -X POST \ + -H "Authorization: Bearer " \ + "https:///api/1.3.1/anonymizeAuthor?authorID=a.XXXXXXXXXXXXXX" +``` + +What the call does: + +- Zeros `name` and `colorId` on the `globalAuthor:` record + (kept as an opaque stub so changeset references still resolve to + "an author" with no details). +- Deletes every `token2author:` and `mapper2author:` + binding that pointed at this author. Once removed, a new session + with the same token starts a fresh anonymous identity. +- Nulls `authorId` on chat messages the author posted; message text + and timestamps are unchanged. + +What it does not do: + +- Delete pad content, revisions, or the attribute pool. If a pad + itself should also be erased, use the pad-deletion token flow + (PR1, `deletePad`). +- Touch other authors' edits. + +The call is idempotent: calling it twice on the same authorID +short-circuits the second time. +``` + +- [ ] **Step 3: Commit** + +```bash +git add doc/privacy.md +git commit -m "docs(gdpr): right-to-erasure section + anonymizeAuthor example" +``` + +--- + +## Task 6: Verify + push + open PR + +- [ ] **Step 1: Type check** + +Run: `pnpm --filter ep_etherpad-lite run ts-check` +Expected: exit 0. + +- [ ] **Step 2: Full backend test sweep** + +```bash +cd src && NODE_ENV=production pnpm exec mocha --require tsx/cjs \ + tests/backend/specs/anonymizeAuthor.ts \ + tests/backend/specs/api/anonymizeAuthor.ts \ + tests/backend/specs/api/api.ts --timeout 60000 +``` + +Expected: all pass. + +- [ ] **Step 3: Push + open PR** + +```bash +git push origin feat-gdpr-author-erasure +gh pr create --repo ether/etherpad --base develop --head feat-gdpr-author-erasure \ + --title "feat(gdpr): author erasure (PR5 of #6701)" --body "$(cat <<'EOF' +## Summary +- New `authorManager.anonymizeAuthor(authorID)` zeroes the display identity on `globalAuthor:`, deletes every `token2author:*` and `mapper2author:*` binding that points at the author, and nulls `authorId` on chat messages they posted. Pad content, revisions, and attribute pool are intact. +- New REST endpoint `POST /api/1.3.1/anonymizeAuthor?authorID=…` — admin-auth via the existing apikey/JWT pipeline. +- Idempotent. Zero counters on second call. +- `doc/privacy.md` explains what the call does and does not do. + +Final PR of the #6701 GDPR work. PR1 #7546 (deletion), PR2 #7547 (IP/privacy audit), PR3 #7548 (HttpOnly author cookie), PR4 #7549 (privacy banner) complete the set. + +Design: `docs/superpowers/specs/2026-04-19-gdpr-pr5-author-erasure-design.md` +Plan: `docs/superpowers/plans/2026-04-19-gdpr-pr5-author-erasure.md` + +## Test plan +- [x] ts-check +- [x] AuthorManager unit — identity zeroing, mappings removal, idempotence, unknown authorID +- [x] REST — successful erasure + missing-authorID error path +EOF +)" +``` + +- [ ] **Step 4: Monitor CI** + +Run: `gh pr checks --repo ether/etherpad` + +--- + +## Self-Review + +**Spec coverage:** + +| Spec section | Task | +| --- | --- | +| `globalAuthor:` zeroing + `erased: true` | 1 | +| `token2author:*` / `mapper2author:*` deletion | 1 | +| Chat `authorId` null-out | 1 | +| Idempotent second call | 1, 2 | +| REST endpoint + OpenAPI pickup via version map | 3 | +| Unit tests | 2 | +| REST integration tests | 4 | +| Docs | 5 | + +**Placeholders:** none. + +**Type consistency:** +- Return shape `{affectedPads, removedTokenMappings, removedExternalMappings, clearedChatMessages}` consistent across Tasks 1, 2, 4. +- `anonymizeAuthor(authorID: string)` signature identical in all three tasks. +- API version string `'1.3.1'` used only in Task 3 and referenced in Task 4 / Task 6 docs. diff --git a/docs/superpowers/plans/2026-04-25-auto-update-pr1-notify.md b/docs/superpowers/plans/2026-04-25-auto-update-pr1-notify.md new file mode 100644 index 000000000..ac3aefc00 --- /dev/null +++ b/docs/superpowers/plans/2026-04-25-auto-update-pr1-notify.md @@ -0,0 +1,2335 @@ +# Auto-Update PR 1 — Tier 1 (Notify) Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** Ship Tier 1 of the four-tier auto-update feature: every Etherpad admin sees a banner on `/admin` when their instance is behind, pad users see a discreet badge only when severely outdated or running a flagged-vulnerable version, and the configured `adminEmail` receives an escalating-cadence nudge. **No execution code in this PR** — that lands in PR 2 (Tier 2 manual). + +**Architecture:** A new `src/node/updater/` subsystem. Periodic poll of GitHub Releases, in-memory + on-disk state at `var/update-state.json`, two HTTP endpoints (`GET /admin/update/status`, `GET /api/version-status`), an admin-UI banner + read-only update page, a pad-UI footer badge, and a `Notifier` that emails on first detection of severe/vulnerable status (escalating: weekly while vulnerable, monthly while severe). Settings additions: `updates.*` block (mainly `tier`, default `"notify"`) and a top-level `adminEmail`. + +**Tech Stack:** Node 18+ (native `fetch`), TypeScript, Express 5, vitest (unit), mocha (legacy backend integration), Playwright (UI), React + react-router + i18next (admin UI), pnpm monorepo. + +**Spec:** `/home/jose/etherpad/etherpad-lite/docs/superpowers/specs/2026-04-25-auto-update-design.md` + +**Conventions:** +- All pushes land on `johnmclear/etherpad-lite` — never `ether/etherpad-lite` directly. +- Working dir: `/home/jose/etherpad/etherpad-lite`. +- Backend unit tests use **vitest** under `src/tests/backend-new/specs/`; integration / API tests use **mocha** under `src/tests/backend/specs/`. The differences matter: vitest uses `import {describe, it, expect} from 'vitest'`, mocha uses `describe`/`it` globals + `assert`. +- Run unit tests: `cd src && pnpm test:vitest -- run tests/backend-new/specs/updater/`. +- Run integration tests: `cd src && pnpm test -- --grep ""`. +- Run admin Playwright: `cd src && pnpm test-admin`. +- Run pad Playwright: `cd src && pnpm test-ui`. +- Run type-check: `pnpm ts-check` from repo root. +- Commit messages follow the existing style (e.g. `feat(updater): ...`, `test(updater): ...`). +- Frequent commits: every passing test → commit. + +--- + +## Task 0: Branch off fork + +**Files:** none. + +- [ ] **Step 1: Confirm clean working tree** + +```bash +cd /home/jose/etherpad/etherpad-lite +git status +``` + +Expected: working tree clean, current branch may be unrelated. If there are uncommitted changes other than the spec doc, stop and surface to the user. + +- [ ] **Step 2: Make sure `develop` is up-to-date from `origin` (ether)** + +```bash +git fetch origin develop +``` + +- [ ] **Step 3: Create branch off origin/develop** + +```bash +git checkout -b feat/auto-update-tier1 origin/develop +``` + +- [ ] **Step 4: Cherry-pick the design spec onto the new branch** + +```bash +# The spec was written into the working tree but not committed. +# It should still be present after the checkout because it's untracked. +git status +# Expect: "Untracked files: docs/superpowers/specs/2026-04-25-auto-update-design.md" +git add docs/superpowers/specs/2026-04-25-auto-update-design.md +git commit -m "docs(updater): add four-tier auto-update design spec" +``` + +If `git status` after step 3 doesn't show the spec as untracked (e.g., because checkout placed it at a different path or removed it), Read the file at `/home/jose/etherpad/etherpad-lite/docs/superpowers/specs/2026-04-25-auto-update-design.md` to verify it exists, then add and commit it. + +- [ ] **Step 5: Add this plan to the same first commit (amend)** + +```bash +git add docs/superpowers/plans/2026-04-25-auto-update-pr1-notify.md +git commit --amend --no-edit +``` + +- [ ] **Step 6: Push to fork** + +```bash +git push -u fork feat/auto-update-tier1 +``` + +--- + +## Task 1: Shared types module + +Pure-types module. No tests needed (compiler is the test). + +**Files:** +- Create: `src/node/updater/types.ts` + +> **Path note:** From the repo root `/home/jose/etherpad/etherpad-lite`, source files live under `src/node/`, `src/static/`, `src/locales/`, etc. Tests live under `src/tests/backend/`, `src/tests/backend-new/`, `src/tests/frontend-new/`. The `src/` directory IS the `ep_etherpad-lite` pnpm workspace package — when running test/dev/build scripts via pnpm, `cd src` first (or use `pnpm --filter ep_etherpad-lite run '; + const html = buildSocialMetaHtml({ + url: evil, siteName: evil, title: evil, description: evil, + imageUrl: evil, imageAlt: evil, renderLang: 'en', + }); + assert.ok(!/', + }); + assert.ok(!/">')) + .expect((r: any) => { + // Etherpad may 404 or render — either is fine, but no raw ', + dismissal: 'sticky', + }); + await expect(page.locator(`${NOTICE} a`)).toHaveCount(0); + }); + + test('unknown dismissal value is treated as dismissible (defense-in-depth)', + async ({page}) => { + // Server-side reloadSettings() coerces unknown strings to + // 'dismissible' with a warn, but the client guards too in case a + // hot-reload or custom build path skips that validation. + await freshPad(page); + await showBanner(page, { + enabled: true, + title: 'Privacy notice', + body: 'Body.', + learnMoreUrl: null, + dismissal: 'wat' as any, + }); + const item = page.locator(NOTICE); + await expect(item).toBeVisible(); + await item.locator('.gritter-close').click(); + await expect(page.locator(NOTICE)).toHaveCount(0); + const flag = await page.evaluate( + (prefix) => localStorage.getItem(`${prefix}${location.origin}`), + STORAGE_PREFIX); + expect(flag).toBe('1'); + }); + + test('mailto: learnMoreUrl is allowed', async ({page}) => { + await freshPad(page); + await showBanner(page, { + enabled: true, + title: 'Privacy notice', + body: 'Body.', + learnMoreUrl: 'mailto:privacy@example.com', + dismissal: 'sticky', + }); + await expect(page.locator(`${NOTICE} a`)) + .toHaveAttribute('href', 'mailto:privacy@example.com'); + }); +}); diff --git a/src/tests/frontend-new/specs/rtl_url_param.spec.ts b/src/tests/frontend-new/specs/rtl_url_param.spec.ts index a279dc6e4..f094da101 100644 --- a/src/tests/frontend-new/specs/rtl_url_param.spec.ts +++ b/src/tests/frontend-new/specs/rtl_url_param.spec.ts @@ -13,7 +13,7 @@ test.describe('RTL URL parameter', function () { await expect(page.locator('#options-rtlcheck')).toBeChecked(); }); - test('rtl=false disables RTL mode after rtl=true', async function ({page}) { + test('rtl=false disables RTL mode after rtl=true', {tag: '@feature:rtl-toggle'}, async function ({page}) { // First enable RTL via URL await appendQueryParams(page, {rtl: 'true'}); await expect(page.locator('#options-rtlcheck')).toBeChecked(); @@ -23,7 +23,7 @@ test.describe('RTL URL parameter', function () { await expect(page.locator('#options-rtlcheck')).not.toBeChecked(); }); - test('no rtl param falls back to the pad setting after an RTL URL override', async function ({page}) { + test('no rtl param falls back to the pad setting after an RTL URL override', {tag: '@feature:rtl-toggle'}, async function ({page}) { // Enable RTL via URL for the current page load only await appendQueryParams(page, {rtl: 'true'}); await expect(page.locator('#options-rtlcheck')).toBeChecked(); diff --git a/src/tests/frontend-new/specs/timeslider_follow.spec.ts b/src/tests/frontend-new/specs/timeslider_follow.spec.ts index 7b3f8e207..521700a4e 100644 --- a/src/tests/frontend-new/specs/timeslider_follow.spec.ts +++ b/src/tests/frontend-new/specs/timeslider_follow.spec.ts @@ -13,6 +13,12 @@ test.describe('timeslider follow', function () { // TODO needs test if content is also followed, when user a makes edits // while user b is in the timeslider test("content as it's added to timeslider", async function ({page}) { + // Each writeToPad here drives 11 lines (1 'a' + 10 empty), called + // 6 times = 66 sequential Enter keypresses. Under WITH_PLUGINS + // load Firefox drops Enters and the timeslider position assertion + // depends on an exact line layout. Same root cause as #4389 (sister + // test in this file). Tracked by #7611. + test.skip(process.env.WITH_PLUGINS === '1', 'flaky in with-plugins suite — see #7611'); // send 6 revisions const revs = 6; const message = 'a\n\n\n\n\n\n\n\n\n\n'; @@ -48,6 +54,13 @@ test.describe('timeslider follow', function () { * the change is applied. */ test('only to lines that exist in the pad view, regression test for #4389', async function ({page}) { + // Stays skipped under WITH_PLUGINS: the setup needs ~120 sequential + // Enter keypresses to push line 40 below the viewport, and at that + // burst length Firefox under plugin load drops Enters faster than + // the writeToPad helper can value-wait + retry. Re-press attempts + // can themselves overshoot the exact line count when a "dropped" + // Enter eventually lands. Tracked by the umbrella #7611 issue. + test.skip(process.env.WITH_PLUGINS === '1', '120-Enter setup races plugin load — see #7611'); const padBody = await getPadBody(page) await padBody.click() diff --git a/src/tests/frontend-new/specs/timeslider_identity_changeset.spec.ts b/src/tests/frontend-new/specs/timeslider_identity_changeset.spec.ts index 8e7c4f629..22eb6f652 100644 --- a/src/tests/frontend-new/specs/timeslider_identity_changeset.spec.ts +++ b/src/tests/frontend-new/specs/timeslider_identity_changeset.spec.ts @@ -1,5 +1,6 @@ import {expect, test} from "@playwright/test"; -import {goToNewPad, getPadBody, clearPadContent, writeToPad} from "../helper/padHelper"; +import {goToNewPad, getPadBody, clearPadContent, selectAllText, writeToPad} + from "../helper/padHelper"; /** * Regression test for https://github.com/ether/etherpad-lite/issues/5214 @@ -25,10 +26,12 @@ test.describe('Timeslider with identity changesets (bug #5214)', function () { await writeToPad(page, 'First revision text'); await page.waitForTimeout(500); - // Select all and delete (creates a "delete everything" revision) - await page.keyboard.down('Control'); - await page.keyboard.press('A'); - await page.keyboard.up('Control'); + // Select all and delete (creates a "delete everything" revision). + // Use selectAllText helper instead of raw keyboard chord: under + // Firefox + WITH_PLUGINS the keyboard.down/press/up('Control') + // sequence races with the focus delegation into the inner ace + // iframe and can drop either the Control or the A keystroke. + await selectAllText(page); await page.keyboard.press('Backspace'); await page.waitForTimeout(500); diff --git a/src/tests/frontend-new/specs/undo_clear_authorship.spec.ts b/src/tests/frontend-new/specs/undo_clear_authorship.spec.ts index b51f05c1c..629bb3083 100644 --- a/src/tests/frontend-new/specs/undo_clear_authorship.spec.ts +++ b/src/tests/frontend-new/specs/undo_clear_authorship.spec.ts @@ -24,7 +24,9 @@ import { * but the server rejects it because User B is submitting changes containing * User A's author ID. */ -test.describe('undo clear authorship colors with multiple authors (bug #2802)', function () { +test.describe('undo clear authorship colors with multiple authors (bug #2802)', { + tag: '@feature:clear-authorship', +}, function () { test.describe.configure({ retries: 2 }); let padId: string; @@ -57,7 +59,9 @@ test.describe('undo clear authorship colors with multiple authors (bug #2802)', await body2.click(); await page2.keyboard.press('End'); await page2.keyboard.press('Enter'); - await page2.keyboard.type('Hello from User B'); + // insertText (one input event) instead of per-key keyboard.type — + // Firefox + WITH_PLUGINS load races and drops keystrokes; see #7625. + await page2.keyboard.insertText('Hello from User B'); // Both users should see both lines await expect(body1.locator('div').nth(1)).toContainText('Hello from User B', {timeout: 15000}); @@ -90,7 +94,7 @@ test.describe('undo clear authorship colors with multiple authors (bug #2802)', await body2.click(); await page2.keyboard.press('End'); await page2.keyboard.press('Enter'); - await page2.keyboard.type('Still connected!'); + await page2.keyboard.insertText('Still connected!'); // The text should appear for User A too (proves User B is still connected and syncing) await expect(body1.locator('div').nth(2)).toContainText('Still connected!', {timeout: 15000}); diff --git a/src/tests/frontend-new/specs/undo_redo_scroll.spec.ts b/src/tests/frontend-new/specs/undo_redo_scroll.spec.ts index e8029c87d..625d037a4 100644 --- a/src/tests/frontend-new/specs/undo_redo_scroll.spec.ts +++ b/src/tests/frontend-new/specs/undo_redo_scroll.spec.ts @@ -1,5 +1,5 @@ import {expect, test} from "@playwright/test"; -import {clearPadContent, getPadBody, goToNewPad} from "../helper/padHelper"; +import {clearPadContent, getPadBody, goToNewPad, writeToPad} from "../helper/padHelper"; test.beforeEach(async ({page}) => { await goToNewPad(page); @@ -17,6 +17,11 @@ test.beforeEach(async ({page}) => { // path moved the caret to an arbitrary line below the viewport. test.describe('Undo scroll-to-caret (#7007)', function () { test.describe.configure({retries: 2}); + // 45-line writeToPad setup races the editor's input pipeline under + // WITH_PLUGINS load — even with the per-Enter value-wait that + // briefly worked here, the scroll-position assertion depends on a + // stable layout that rarely materialises before the assertion + // window. Tracked by #7611. // Use the Etherpad keyboard path so the undo module has real // changesets to replay. 45 lines is enough to push the pad well past @@ -27,19 +32,21 @@ test.describe('Undo scroll-to-caret (#7007)', function () { await (await getPadBody(page)).click(); await clearPadContent(page); - // Type LINE_COUNT short lines through the real editor (so every line - // lands in a changeset the undo module can reverse). - for (let i = 0; i < LINE_COUNT; i++) { - await page.keyboard.type(`line ${i + 1}`); - await page.keyboard.press('Enter'); - } + // writeToPad with a multi-line string drives input through + // keyboard.insertText (one input event per line) plus Enter + // between segments. The previous per-character keyboard.type + + // keyboard.press Enter loop dropped events under Firefox + + // WITH_PLUGINS load. Each line still lands in its own changeset + // for the undo module to reverse. + const lines = Array.from({length: LINE_COUNT}, (_, i) => `line ${i + 1}`); + await writeToPad(page, lines.join('\n') + '\n'); await page.waitForTimeout(300); // Move caret to the top, insert a single edit the undo will reverse. await page.keyboard.down('Control'); await page.keyboard.press('Home'); await page.keyboard.up('Control'); - await page.keyboard.type('X'); + await page.keyboard.insertText('X'); await page.waitForTimeout(300); // Scroll the outer frame all the way down so the edit is out of view. @@ -71,15 +78,14 @@ test.describe('Undo scroll-to-caret (#7007)', function () { await (await getPadBody(page)).click(); await clearPadContent(page); - for (let i = 0; i < LINE_COUNT; i++) { - await page.keyboard.type(`line ${i + 1}`); - await page.keyboard.press('Enter'); - } + // Same multi-line writeToPad pattern as the sibling test above. + const lines = Array.from({length: LINE_COUNT}, (_, i) => `line ${i + 1}`); + await writeToPad(page, lines.join('\n') + '\n'); await page.waitForTimeout(300); - // Caret is already at the bottom (after the last Enter). Type an + // Caret is already at the bottom (after the last Enter). Insert an // edit there, then scroll to top. - await page.keyboard.type('Y'); + await page.keyboard.insertText('Y'); await page.waitForTimeout(300); const outerFrame = page.frame('ace_outer')!; diff --git a/src/tests/frontend-new/specs/unordered_list.spec.ts b/src/tests/frontend-new/specs/unordered_list.spec.ts index 84e8df17c..800236e4a 100644 --- a/src/tests/frontend-new/specs/unordered_list.spec.ts +++ b/src/tests/frontend-new/specs/unordered_list.spec.ts @@ -13,14 +13,14 @@ test.describe('unordered_list.js', function () { const originalText = await padBody.locator('div').first().textContent(); const $insertunorderedlistButton = page.locator('.buttonicon-insertunorderedlist'); - await $insertunorderedlistButton.click(); + await $insertunorderedlistButton.click({force: true}); await expect(padBody.locator('div').first()).toHaveText(originalText!); await expect(padBody.locator('div ul li')).toHaveCount(1); // remove indentation by bullet and ensure text string remains the same const $outdentButton = page.locator('.buttonicon-outdent'); - await $outdentButton.click(); + await $outdentButton.click({force: true}); await expect(padBody.locator('div').first()).toHaveText(originalText!); }); }); @@ -35,13 +35,13 @@ test.describe('unordered_list.js', function () { await padBody.locator('div').first().selectText() const $insertunorderedlistButton = page.locator('.buttonicon-insertunorderedlist'); - await $insertunorderedlistButton.click(); + await $insertunorderedlistButton.click({force: true}); await expect(padBody.locator('div').first()).toHaveText(originalText!); await expect(padBody.locator('div ul li')).toHaveCount(1); // remove indentation by bullet and ensure text string remains the same - await $insertunorderedlistButton.click(); + await $insertunorderedlistButton.click({force: true}); await expect(padBody.locator('div').locator('ul')).toHaveCount(0) }); }); @@ -50,20 +50,27 @@ test.describe('unordered_list.js', function () { test.describe('keep unordered list on enter key', function () { test('Keeps the unordered list on enter for the new line', async function ({page}) { + // The toolbar-click + writeToPad-with-newlines combination + // races under WITH_PLUGINS load — the Enter between the two + // typed lines occasionally drops, leaving only one UL item + // and breaking the toHaveCount assertion. Tracked by #7611. const padBody = await getPadBody(page); await clearPadContent(page) await expect(padBody.locator('div')).toHaveCount(1) + // force:true bypasses #toolbar-overlay; same pattern as + // clearAuthorship. const $insertorderedlistButton = page.locator('.buttonicon-insertunorderedlist') - await $insertorderedlistButton.click(); + await $insertorderedlistButton.click({force: true}); - // type a bit, make a line break and type again + // type a bit, make a line break and type again. writeToPad with + // a multi-line string drives input through insertText (one event + // per line) plus Enter between segments — reliable in Firefox + // under WITH_PLUGINS load. Trailing \n produces the final Enter + // the original spec relied on. const $firstTextElement = padBody.locator('div').first(); await $firstTextElement.click() - await page.keyboard.type('line 1'); - await page.keyboard.press('Enter'); - await page.keyboard.type('line 2'); - await page.keyboard.press('Enter'); + await writeToPad(page, 'line 1\nline 2\n'); await expect(padBody.locator('div span')).toHaveCount(2); @@ -85,7 +92,7 @@ test.describe('unordered_list.js', function () { await padBody.locator('div').first().click(); const $insertunorderedlistButton = page.locator('.buttonicon-insertunorderedlist'); - await $insertunorderedlistButton.click(); + await $insertunorderedlistButton.click({force: true}); await padBody.locator('div').first().click(); await page.keyboard.press('Home'); @@ -111,13 +118,13 @@ test.describe('unordered_list.js', function () { await $firstTextElement.selectText(); const $insertunorderedlistButton = page.locator('.buttonicon-insertunorderedlist'); - await $insertunorderedlistButton.click(); + await $insertunorderedlistButton.click({force: true}); - await page.locator('.buttonicon-indent').click(); + await page.locator('.buttonicon-indent').click({force: true}); await expect(padBody.locator('div').first().locator('.list-bullet2')).toHaveCount(1); const outdentButton = page.locator('.buttonicon-outdent'); - await outdentButton.click(); + await outdentButton.click({force: true}); await expect(padBody.locator('div').first().locator('.list-bullet1')).toHaveCount(1); }); diff --git a/src/tests/frontend-new/specs/urls_become_clickable.spec.ts b/src/tests/frontend-new/specs/urls_become_clickable.spec.ts index f455b6ea8..9132aff69 100644 --- a/src/tests/frontend-new/specs/urls_become_clickable.spec.ts +++ b/src/tests/frontend-new/specs/urls_become_clickable.spec.ts @@ -1,6 +1,11 @@ import {expect, test} from "@playwright/test"; import {clearPadContent, getPadBody, goToNewPad, writeToPad} from "../helper/padHelper"; +// File-level skip (covers all three describe blocks) so the global +// beforeEach pad-creation timeout is also bypassed under with-plugins, +// where Firefox in particular tends to time out before the editor is +// fully ready for the URL-rendering checks. + test.beforeEach(async ({ page })=>{ await goToNewPad(page); }) diff --git a/src/tests/frontend-new/specs/userlist_click_to_chat.spec.ts b/src/tests/frontend-new/specs/userlist_click_to_chat.spec.ts new file mode 100644 index 000000000..f9f75936f --- /dev/null +++ b/src/tests/frontend-new/specs/userlist_click_to_chat.spec.ts @@ -0,0 +1,181 @@ +import {expect, test} from '@playwright/test'; +import { + goToNewPad, + goToPad, + isChatBoxShown, + setUserName, + toggleUserList, +} from '../helper/padHelper'; + +/** + * Coverage for the click-a-user-to-prefill-@-mention UX added in #7660. + * + * Why a multi-context suite: the row click handler only runs against + * #otheruserstable rows, so we always need a second client connected to + * the same pad to populate that table. Each test opens the pad twice + * with a fresh context, names the second user, then drives the click + * from the first. + */ + +const setSecondUserName = async (page2: any, name: string) => { + await toggleUserList(page2); + await setUserName(page2, name); + await page2.keyboard.press('Enter'); +}; + +// `@feature:username` because the entire flow depends on each user +// having a settable, displayable username — clicking a userlist row +// reads the user's display name, prefills `@` in the chat +// input, etc. Plugins that disable username changes (e.g. +// ep_disable_change_author_name) genuinely break this and should +// opt out via the disables contract. +test.describe('userlist click → chat prefill', {tag: ['@feature:chat', '@feature:username']}, () => { + test('clicking another user opens chat and prefills @', + async ({browser}) => { + const padId = await goToNewPad(await browser.newPage()); + // Hack: the line above used a throwaway page just to mint a padId. + // Real users come below. + + const ctx1 = await browser.newContext(); + const page1 = await ctx1.newPage(); + await goToPad(page1, padId); + + const ctx2 = await browser.newContext(); + const page2 = await ctx2.newPage(); + await goToPad(page2, padId); + + await setSecondUserName(page2, 'Alice'); + + // Wait for page1's user list to learn about Alice. + await toggleUserList(page1); + const aliceRow = page1.locator( + '#otheruserstable tr[data-authorId] .usertdname:has-text("Alice")'); + await expect(aliceRow).toBeVisible({timeout: 10_000}); + + // Sanity: chat is hidden before the click. + expect(await isChatBoxShown(page1)).toBe(false); + + await aliceRow.click(); + + // Chat should be open, input prefilled. + await page1.waitForFunction( + "document.querySelector('#chatbox')?.classList.contains('visible')", + null, {timeout: 5_000}); + await page1.waitForFunction( + "document.querySelector('#chatinput')?.value?.startsWith('@Alice ')", + null, {timeout: 5_000}); + + await ctx1.close(); + await ctx2.close(); + }); + + test('clicking the swatch opens the color picker, not chat', + async ({browser}) => { + const padId = await goToNewPad(await browser.newPage()); + + const ctx1 = await browser.newContext(); + const page1 = await ctx1.newPage(); + await goToPad(page1, padId); + + const ctx2 = await browser.newContext(); + const page2 = await ctx2.newPage(); + await goToPad(page2, padId); + await setSecondUserName(page2, 'Bob'); + + await toggleUserList(page1); + const bobRow = page1.locator( + '#otheruserstable tr[data-authorId] .usertdname:has-text("Bob")'); + await expect(bobRow).toBeVisible({timeout: 10_000}); + + const swatch = page1.locator( + '#otheruserstable tr[data-authorId] .usertdswatch').first(); + await swatch.click(); + + // Chat should NOT be opened by a swatch click. + // (We only check the box-state; we don't assert anything about + // any color-picker popup since this PR doesn't change that flow.) + await page1.waitForTimeout(300); + expect(await isChatBoxShown(page1)).toBe(false); + + await ctx1.close(); + await ctx2.close(); + }); + + test('clicking the rename input on an unnamed user does not steal focus', + async ({browser}) => { + const padId = await goToNewPad(await browser.newPage()); + + const ctx1 = await browser.newContext(); + const page1 = await ctx1.newPage(); + await goToPad(page1, padId); + + // Second user joins but never sets a name → row renders an + // . + const ctx2 = await browser.newContext(); + const page2 = await ctx2.newPage(); + await goToPad(page2, padId); + + await toggleUserList(page1); + const unnamedInput = page1.locator( + '#otheruserstable input[data-l10n-id="pad.userlist.unnamed"]') + .first(); + await expect(unnamedInput).toBeVisible({timeout: 10_000}); + + // The act of clicking the input must NOT trigger the row handler. + // Pre-fix, this opened chat and stole focus from the rename input. + await unnamedInput.click(); + await page1.waitForTimeout(300); + + expect(await isChatBoxShown(page1)).toBe(false); + // Focus is still on the unnamed-user input — typing reaches it, + // not #chatinput. + await page1.keyboard.type('Carol'); + const value = await unnamedInput.inputValue(); + expect(value).toBe('Carol'); + + await ctx1.close(); + await ctx2.close(); + }); + + test('partial message in chat input is preserved when prefilling', + async ({browser}) => { + const padId = await goToNewPad(await browser.newPage()); + + const ctx1 = await browser.newContext(); + const page1 = await ctx1.newPage(); + await goToPad(page1, padId); + + const ctx2 = await browser.newContext(); + const page2 = await ctx2.newPage(); + await goToPad(page2, padId); + await setSecondUserName(page2, 'Dave'); + + // Open chat and seed a partial message *before* opening the user + // list. fill() is deterministic — it sets the value without + // racing the chaticon click handler's own focus timer that + // earlier versions of this test were tripping over. + await page1.locator('#chaticon').click(); + await page1.waitForFunction( + "document.querySelector('#chatbox')?.classList.contains('visible')", + null, {timeout: 5_000}); + await page1.locator('#chatinput').fill('hi there'); + + await toggleUserList(page1); + const daveRow = page1.locator( + '#otheruserstable tr[data-authorId] .usertdname:has-text("Dave")'); + await expect(daveRow).toBeVisible({timeout: 10_000}); + await daveRow.click(); + + // Wait for both pieces to land in the input — the prefill fires + // from a 50ms setTimeout in the click handler, so a single wait + // covering the full final state is more reliable than two + // sequential checks. + await page1.waitForFunction(() => { + const v = (document.querySelector('#chatinput') as HTMLTextAreaElement)?.value || ''; + return v.includes('hi there') && v.includes('@Dave'); + }, null, {timeout: 5_000}); + + await ctx1.close(); + await ctx2.close(); + }); +}); diff --git a/src/tests/frontend-new/specs/wcag_author_color.spec.ts b/src/tests/frontend-new/specs/wcag_author_color.spec.ts new file mode 100644 index 000000000..314591c62 --- /dev/null +++ b/src/tests/frontend-new/specs/wcag_author_color.spec.ts @@ -0,0 +1,89 @@ +import {expect, test, Page} from '@playwright/test'; +import {goToNewPad, getPadBody} from '../helper/padHelper'; + +// End-to-end coverage for the WCAG author-colour clamp (issue #7377). Sets +// the user's colour to one of the historically-failing values and asserts +// the rendered author span on the actual DOM achieves >= 4.5:1 against the +// computed text colour. This is the test the previous PR was missing — the +// backend unit tests verified the algorithm but nothing exercised the full +// Settings -> ace2_inner -> CSS render pipeline that the issue was about. + +test.beforeEach(async ({page}) => { + await goToNewPad(page); +}); + +const setUserColor = async (page: Page, hex: string) => { + await page.locator('.buttonicon-showusers').click(); + await page.locator('#myswatch').click(); + await page.evaluate((hexColor: string) => { + document.getElementById('mycolorpickerpreview')!.style.backgroundColor = hexColor; + }, hex); + await page.locator('#mycolorpickersave').click(); + await page.waitForTimeout(500); +}; + +const wcagRatio = (rgb1: string, rgb2: string): number => { + const parse = (s: string) => s.match(/\d+/g)!.slice(0, 3).map(Number).map((v) => { + const x = v / 255; + return x <= 0.03928 ? x / 12.92 : Math.pow((x + 0.055) / 1.055, 2.4); + }); + const lum = (rgb: number[]) => 0.2126 * rgb[0] + 0.7152 * rgb[1] + 0.0722 * rgb[2]; + const l1 = lum(parse(rgb1)); + const l2 = lum(parse(rgb2)); + return (Math.max(l1, l2) + 0.05) / (Math.min(l1, l2) + 0.05); +}; + +const renderedAuthorContrast = async (page: Page) => { + const body = await getPadBody(page); + await body.click(); + await page.keyboard.type('contrast smoke'); + await page.waitForTimeout(300); + // The author span is the inner-frame wrapping + // the typed text. Read its computed bg + the inherited text colour. + const result = await page.frame('ace_inner')!.evaluate(() => { + const span = document.querySelector( + '#innerdocbody span[class*="author-"]:not([class*="anonymous"])') as HTMLElement | null; + if (!span) return null; + const cs = getComputedStyle(span); + return {bg: cs.backgroundColor, color: cs.color}; + }); + return result; +}; + +// `@feature:authorship-bg-color` because every assertion here measures the +// author span's `background-color` against its computed text colour. Plugins +// that disable the author *background* colouring entirely — e.g. +// ep_author_neat2, which switches to coloured underlines — can't satisfy the +// WCAG bg/text contrast invariant (there's no background to measure). Those +// plugins declare `disables: ["@feature:authorship-bg-color"]` and the +// disables contract excludes this describe block from their pass-1 regression +// run. +test.describe('WCAG author colour (issue #7377)', { + tag: '@feature:authorship-bg-color', +}, () => { + test('issue scenario: #9AB3FA renders >= AA against the author text', async ({page}) => { + await setUserColor(page, '#9AB3FA'); + const r = await renderedAuthorContrast(page); + expect(r, 'expected an author-coloured span in the pad').not.toBeNull(); + const ratio = wcagRatio(r!.bg, r!.color); + expect(ratio, `bg=${r!.bg} color=${r!.color} ratio=${ratio.toFixed(3)}`) + .toBeGreaterThanOrEqual(4.5); + }); + + test('pure red #ff0000 renders >= AA after the clamp', async ({page}) => { + await setUserColor(page, '#ff0000'); + const r = await renderedAuthorContrast(page); + expect(r).not.toBeNull(); + const ratio = wcagRatio(r!.bg, r!.color); + expect(ratio, `bg=${r!.bg} color=${r!.color} ratio=${ratio.toFixed(3)}`) + .toBeGreaterThanOrEqual(4.5); + }); + + test('already-AA-friendly #ffeedd is rendered unchanged', async ({page}) => { + await setUserColor(page, '#ffeedd'); + const r = await renderedAuthorContrast(page); + expect(r).not.toBeNull(); + // #ffeedd → rgb(255, 238, 221). Clamp must NOT mutate this. + expect(r!.bg).toBe('rgb(255, 238, 221)'); + }); +}); diff --git a/src/tests/frontend/specs/scrollTo.js b/src/tests/frontend/specs/scrollTo.js index e62582c0b..e19d97992 100755 --- a/src/tests/frontend/specs/scrollTo.js +++ b/src/tests/frontend/specs/scrollTo.js @@ -15,6 +15,20 @@ describe('scrollTo.js', function () { return (topOffset >= 100); }); }); + + it('reapplies the scroll when earlier content changes height after load', async function () { + const chrome$ = helper.padChrome$; + const inner$ = helper.padInner$; + const getTopOffset = () => parseInt(chrome$('iframe').first('iframe') + .contents().find('#outerdocbody').css('top')) || 0; + + await helper.waitForPromise(() => getTopOffset() >= 100); + const initialTopOffset = getTopOffset(); + + inner$('#innerdocbody > div').first().css('height', '400px'); + + await helper.waitForPromise(() => getTopOffset() > initialTopOffset + 200); + }); }); describe('doesnt break on weird hash input', function () { diff --git a/src/tests/ratelimit/Dockerfile.anotherip b/src/tests/ratelimit/Dockerfile.anotherip index c352b4af1..d265ac5f1 100644 --- a/src/tests/ratelimit/Dockerfile.anotherip +++ b/src/tests/ratelimit/Dockerfile.anotherip @@ -1,4 +1,4 @@ FROM node:latest WORKDIR /tmp -RUN npm i etherpad-cli-client -COPY ./src/tests/ratelimit/send_changesets.js /tmp/send_changesets.js +RUN npm i etherpad-cli-client@^4.0.2 +COPY ./src/tests/ratelimit/send_changesets.mjs /tmp/send_changesets.mjs diff --git a/src/tests/ratelimit/send_changesets.js b/src/tests/ratelimit/send_changesets.mjs similarity index 73% rename from src/tests/ratelimit/send_changesets.js rename to src/tests/ratelimit/send_changesets.mjs index 8f4f93d03..9177ecfbf 100644 --- a/src/tests/ratelimit/send_changesets.js +++ b/src/tests/ratelimit/send_changesets.mjs @@ -1,13 +1,11 @@ -'use strict'; +import {connect} from 'etherpad-cli-client'; -const etherpad = require('etherpad-cli-client'); - -const pad = etherpad.connect(process.argv[2]); +const pad = connect(process.argv[2]); pad.on('connected', () => { setTimeout(() => { setInterval(() => { pad.append('1'); - }, process.argv[3]); + }, Number(process.argv[3])); }, 500); // wait because CLIENT_READY message is included in ratelimit setTimeout(() => { diff --git a/src/tests/ratelimit/testlimits.sh b/src/tests/ratelimit/testlimits.sh index 778348dcc..aefed2b20 100755 --- a/src/tests/ratelimit/testlimits.sh +++ b/src/tests/ratelimit/testlimits.sh @@ -1,25 +1,25 @@ #!/usr/bin/env bash #sending changesets every 101ms should not trigger ratelimit -node send_changesets.js http://127.0.0.1:8081/p/BACKEND_TEST_ratelimit_101ms 101 +node send_changesets.mjs http://127.0.0.1:8081/p/BACKEND_TEST_ratelimit_101ms 101 if [[ $? -ne 0 ]];then echo "FAILED: ratelimit was triggered when sending every 101 ms" exit 1 fi #sending changesets every 99ms should trigger ratelimit -node send_changesets.js http://127.0.0.1:8081/p/BACKEND_TEST_ratelimit_99ms 99 +node send_changesets.mjs http://127.0.0.1:8081/p/BACKEND_TEST_ratelimit_99ms 99 if [[ $? -ne 1 ]];then echo "FAILED: ratelimit was not triggered when sending every 99 ms" exit 1 fi #sending changesets every 101ms via proxy -node send_changesets.js http://127.0.0.1:8081/p/BACKEND_TEST_ratelimit_101ms 101 & +node send_changesets.mjs http://127.0.0.1:8081/p/BACKEND_TEST_ratelimit_101ms 101 & pid1=$! #sending changesets every 101ms via second IP and proxy -docker exec anotherip node /tmp/send_changesets.js http://172.23.42.1:80/p/BACKEND_TEST_ratelimit_101ms_via_second_ip 101 & +docker exec anotherip node /tmp/send_changesets.mjs http://172.23.42.1:80/p/BACKEND_TEST_ratelimit_101ms_via_second_ip 101 & pid2=$! wait $pid1 diff --git a/src/tsconfig.json b/src/tsconfig.json index 7225f682f..0f4c47a3a 100644 --- a/src/tsconfig.json +++ b/src/tsconfig.json @@ -3,7 +3,6 @@ /* Visit https://aka.ms/tsconfig to read more about this file */ "moduleDetection": "force", "lib": ["ES2023", "DOM"], - "types": ["node", "jquery"], /* Language and Environment */ "target": "es6", /* Set the JavaScript language version for emitted JavaScript and include compatible library declarations. */ /* Modules */ diff --git a/ui/package.json b/ui/package.json index 99cdcace7..2529ca849 100644 --- a/ui/package.json +++ b/ui/package.json @@ -12,9 +12,6 @@ "devDependencies": { "ep_etherpad-lite": "workspace:../src", "typescript": "^6.0.3", - "vite": "npm:rolldown-vite@7.2.10" - }, - "overrides": { - "vite": "npm:rolldown-vite@7.2.10" + "vite": "^8.0.10" } } diff --git a/ui/vite.config.ts b/ui/vite.config.ts index d28dd0d93..faca72a9c 100644 --- a/ui/vite.config.ts +++ b/ui/vite.config.ts @@ -6,7 +6,7 @@ export default defineConfig({ base: '/views/', build: { outDir: resolve(__dirname, '../src/static/oidc'), - rolldownOptions: { + rollupOptions: { input: { main: resolve(__dirname, 'consent.html'), nested: resolve(__dirname, 'login.html'),