add new @login endpoint to return available external login options

[erral]

This PR adds a generic GET /@login endpoint that would expose links to additional login providers in a Plone site.

This way the endpoints added in packages like pas.plugins.authomatic and pas.plugins.oidc could be exchanged with adapter registrations and allow both products to be installed in the same Plone site for its use.

I am open to discuss whether the adapter needs to adapt just the IPloneSiteRoot object or perhaps may be a multiadapter including the request (perhaps to register the adapter for a given IThemeSpecific interface) or any other things.

[mister-roboto]

@erral thanks for creating this Pull Request and helping to improve Plone!

TL;DR: Finish pushing changes, pass all other checks, then paste a comment:

@jenkins-plone-org please run jobs

To ensure that these changes do not break other parts of Plone, the Plone test suite matrix needs to pass, but it takes 30-60 min. Other CI checks are usually much faster and the Plone Jenkins resources are limited, so when done pushing changes and all other checks pass either start all Jenkins PR jobs yourself, or simply add the comment above in this PR to start all the jobs automatically.

Happy hacking!

[netlify]

✅ Deploy Preview for plone-restapi canceled.

Name	Link
🔨 Latest commit	f52a73d
🔍 Latest deploy log	https://app.netlify.com/sites/plone-restapi/deploys/65f4b29ed1a9c2000846c1d8

[erral]

@jenkins-plone-org please run jobs

[stevepiercy]

This needs tests and documentation, similar to other endpoints. https://6.docs.plone.org/plone.restapi/docs/source/endpoints/index.html

[erral]

This needs tests and documentation, similar to other endpoints. https://6.docs.plone.org/plone.restapi/docs/source/endpoints/index.html

Yes, I am preparing that.

[erral]

@jenkins-plone-org please run jobs

[stevepiercy]

I decided it would be faster, easier, and less frustrating to make the changes directly instead of a proper review. I hope that is OK.

[erral]

I decided it would be faster, easier, and less frustrating to make the changes directly instead of a proper review. I hope that is OK.

Thanks! ❤️

[erral]

I am investigating why the output for the documentation is empty.

[erral]

It's not an issue with the docs, because the docs only pull from this file:

https://github.com/plone/plone.restapi/blob/erral-login-options/src/plone/restapi/tests/http-examples/external_authentication_links.resp

Can you show what the content of that file should be?

I have already fixed this. There was a bug in my code 😈

[erral]

@jenkins-plone-org please run jobs

[stevepiercy]

Preview of docs with update look good: https://deploy-preview-1757--plone-restapi.netlify.app/endpoints/login.html

[erral]

@jenkins-plone-org please run jobs

[erral]

@jenkins-plone-org please run jobs

[erral]

@jenkins-plone-org please run jobs

[erral]

@jenkins-plone-org please run jobs

[stevepiercy]

@erral is there any reason not to merge this PR?

[davisagli]

@erral @stevepiercy Is there any prototype of using this API from a frontend? That would provide some confidence that we've implemented the right API. It's easier to make changes before we release something.

I'm not sure if you plan to update Volto to use this, or just use it in specific projects. If Volto will use it, then we also need to coordinate with @robgietema to support it in Nick.

[erral]

Right know this GET operation over the @login endpoint is implemented by pas.plugins.authomatic but only returns the plugins available there (see https://github.com/collective/pas.plugins.authomatic/blob/main/src/pas/plugins/authomatic/services/login.py).

The endpoint is consumed by volto-authomatic to list the login options.

But this implementation works only with pas.plugins.authomatic.

I had the requirement to use pas.plugins.authomatic and pas.plugins.oidc in the same site. Moreover I had the requirement to use 2 different oidc plugins.

So first I generalized pas.plugins.oidc to support multiple oidc based plugins.

Then I needed volto-authomatic to support both plugins, so I brought the @login endpoint implementation here, and prepare PRs for both pas.plugins.authomatic and pas.plugins.oidc to support the adapter lookup implemented here (see collective/pas.plugins.authomatic#73 and collective/pas.plugins.oidc#47).

So, the idea is:

• plone.restapi to provide a way for other add-ons to regiser external login services, as a central point.
• volto-authomatic is the consumers of such endpoint

[davisagli]

@erral Thanks for the explanation and pointers. It makes sense to me.

I could imagine that in the future, maybe Volto itself could check this endpoint and show the login providers on the default login page. But it's good enough to be able to use it in add-ons for now.

I don't see a problem with Nick support. Nick doesn't support external auth providers yet, so it should be very easy to implement the endpoint which returns an empty list :)

I'll add a review with a couple minor comments.