Collection of Etherpad-side improvements that would help this Plugin.
Top tier — would only work with changes
nothing
Mid tier
- Per-app / per-tenant API keys, with rotation. Today there's one shared key; any NC admin who can read settings can act as god across the entire Etherpad install.
- Stable author identity for external systems —
createOrGetAuthorByExternalId(namespace, externalId) so NC's (plugin, uid) tuple maps to a stable Etherpad author across requests. Today we maintain a local mapping.
- Push events for pad changes (webhook or SSE). We currently poll
getLastEdited to know if a .pad snapshot is stale.
- Embed token in URL as an alternative to the session-cookie dance — Safari ITP / cross-site cookie restrictions make the current
Set-Cookie-via-iframe path brittle.
createPadIfNotExists idempotent API to avoid the existence-then-create race.deletePad idempotent on a missing pad (today it throws).- Bulk metadata read (
getPadInfoBatch or similar) to make our consistency-check N→1 round-trips.
setText that preserves attributes so a plain-text refresh doesn't wipe headings / lists / bold (we hit this during the templates work).
Low tier / nice-to-haves
- HTML round-trip lossless improvements (
setHTML → getHTML rewrites markup).
/p/<id>/export/txt returning a structured error code instead of 404 when the admin restricted exports — we currently surface remote_export_unavailable based on the bare 404.- CSP /
X-Frame-Options config exposed from Etherpad's own admin instead of requiring webserver-level config for embed.
Collection of Etherpad-side improvements that would help this Plugin.
Top tier — would only work with changes
nothing
Mid tier
createOrGetAuthorByExternalId(namespace, externalId)so NC's(plugin, uid)tuple maps to a stable Etherpad author across requests. Today we maintain a local mapping.getLastEditedto know if a.padsnapshot is stale.Set-Cookie-via-iframe path brittle.createPadIfNotExistsidempotent API to avoid the existence-then-create race.deletePadidempotent on a missing pad (today it throws).getPadInfoBatchor similar) to make our consistency-check N→1 round-trips.setTextthat preserves attributes so a plain-text refresh doesn't wipe headings / lists / bold (we hit this during the templates work).Low tier / nice-to-haves
setHTML→getHTMLrewrites markup)./p/<id>/export/txtreturning a structured error code instead of 404 when the admin restricted exports — we currently surfaceremote_export_unavailablebased on the bare 404.X-Frame-Optionsconfig exposed from Etherpad's own admin instead of requiring webserver-level config for embed.