fix(API): hide SYSTEM_AUTHOR_ID from listAuthorsOfPad by JohnMcLear · Pull Request #7793 · ether/etherpad

JohnMcLear · 2026-05-17T12:07:43Z

Summary

Pad.SYSTEM_AUTHOR_ID ('a.etherpad-system') is the synthetic author Etherpad attributes inserts to whenever the HTTP API or an internal flow inserts content without supplying an authorId — setText/setHTML/appendText without authorId, server-side imports, plugins like ep_post_data. The reason is that the changeset's text and attribs must stay in sync; without any author attribute, pad.atext drifts and clients fail setDocAText reconciliation when loading the pad. See Pad.ts:96-105 for the full rationale.

That implementation detail was leaking through listAuthorsOfPad. A pad whose only "contributor" is the system author was reporting one authorID, which the existing tests in pad.ts and appendTextAuthor.ts (and presumably any external caller using listAuthorsOfPad to count real users) treat as a real participant.

Fix: filter SYSTEM_AUTHOR_ID at the public API surface. getAllAuthors() and downstream callers (copy, anonymize, atext verification) keep seeing the synthetic id — this only narrows the listAuthorsOfPad response.

Why filter, not change attribution

I considered changing Pad.appendCoreMsg / appendText / setText to skip attribution when no authorId is supplied. That would break the changeset's text/attribs invariant — Pad.ts:96-105 is explicit that the system author exists precisely to avoid that drift. The bug is in exposing the synthetic id, not in attributing to it.

Test plan

Full backend sweep on a fresh develop clone (Node 24.14.0):

Before: 6 failing (appendTextAuthor ×1, importexportGetPost ×2, pad.ts ×3).
After: 4 failing (the 4 are Failing backend test: setHTML returns code:1 on complex nested lists #7786, Failing backend test: copyPadWithoutHistory produces empty/wrong body for nested lists #7787, Failing backend test: non-numeric :rev export returns 500 without 'rev is not a number' body #7788 — tracked separately).
The two author-count failures are now green:
- pad.ts > Get Authors of the Pad
- appendTextAuthor.ts > appendText without authorId does not attribute to any author
1438 passing, 21 pending. No regressions in any other spec.

Note: these failures are invisible in CI today because of the broken backend-test glob — see #7789. Merging that is what makes CI actually run the affected tests.

Fixes #7785
Fixes #7790

🤖 Generated with Claude Code

Pad.SYSTEM_AUTHOR_ID ('a.etherpad-system') is the synthetic author Etherpad attributes inserts to when the HTTP API receives a call without authorId (setText, setHTML, appendText, the server-side import flows, and plugins like ep_post_data). It exists so the changeset's text and attribs stay in sync — without ANY author attribute, pad.atext drifts and clients fail setDocAText reconciliation when loading the pad. See Pad.ts:96-105 for the full rationale. That bookkeeping detail was leaking through listAuthorsOfPad: a pad whose only "contributor" is the system author still reported one authorID, which the existing tests in pad.ts and appendTextAuthor.ts (and presumably any caller that uses listAuthorsOfPad to count real users) treat as a real participant. Filter SYSTEM_AUTHOR_ID at the API surface so internal attribution stays internal. getAllAuthors() and downstream callers (copy, anonymize, atext verification) keep seeing the synthetic id — this only narrows the public listAuthorsOfPad response. Fixes #7785 Fixes #7790 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

qodo-code-review · 2026-05-17T12:07:47Z

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

qodo-free-for-open-source-projects · 2026-05-17T12:07:54Z

Review Summary by Qodo

Exclude SYSTEM_AUTHOR_ID from listAuthorsOfPad API response

🐞 Bug fix

Walkthroughs

Description

• Filter synthetic SYSTEM_AUTHOR_ID from listAuthorsOfPad API response
• Prevents internal bookkeeping detail from leaking to public API
• Maintains SYSTEM_AUTHOR_ID visibility in internal attribution flows
• Fixes test failures in pad.ts and appendTextAuthor.ts

Diagram

flowchart LR
  A["listAuthorsOfPad API"] --> B["pad.getAllAuthors"]
  B --> C["Filter SYSTEM_AUTHOR_ID"]
  C --> D["Return real authors only"]
  E["Internal flows"] --> F["Keep SYSTEM_AUTHOR_ID"]

File Changes

1. src/node/db/API.ts 🐞 Bug fix +7/-1

Filter system author ID from public API response

• Added filtering logic to exclude SYSTEM_AUTHOR_ID from listAuthorsOfPad response
• Added explanatory comment documenting why SYSTEM_AUTHOR_ID should not surface in public API
• Requires Pad module to access SYSTEM_AUTHOR_ID constant for comparison
• Preserves internal attribution while hiding implementation detail from API consumers

src/node/db/API.ts

qodo-free-for-open-source-projects · 2026-05-17T12:07:56Z

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

1. listAuthorsOfPad filtering undocumented ✓ Resolved 📘 Rule violation ⚙ Maintainability

Description

listAuthorsOfPad now filters out the synthetic Pad.SYSTEM_AUTHOR_ID from the returned
authorIDs, changing public HTTP API behavior. The HTTP API documentation under
doc/api/http_api.* is not updated to reflect this, risking client confusion and incorrect
integrations.

Code

src/node/db/API.ts[R834-841]

+  // Pad.SYSTEM_AUTHOR_ID is the synthetic author Etherpad attributes inserts to
+  // when no authorId is supplied (HTTP API setText/appendText/setHTML without
+  // authorId, server-side import flows, plugins like ep_post_data). It is an
+  // implementation detail of changeset bookkeeping, not a real contributor, so
+  // it should not surface through this public API.
+  const {Pad} = require('./Pad');
+  const authorIDs = pad.getAllAuthors().filter((id: string) => id !== Pad.SYSTEM_AUTHOR_ID);
return {authorIDs};

Evidence
The implementation of listAuthorsOfPad now explicitly removes Pad.SYSTEM_AUTHOR_ID from the
returned list, which is a user-visible change to the HTTP API response. The documented behavior for
listAuthorsOfPad in doc/api/http_api.md and doc/api/http_api.adoc does not mention this
filtering, so the documentation is no longer accurate for the updated API.
src/node/db/API.ts[834-841]
doc/api/http_api.md[696-704]
doc/api/http_api.adoc[652-661]
Best Practice: Repository guidelines
Best Practice: Repository guidelines

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`listAuthorsOfPad` behavior changed to exclude the synthetic `Pad.SYSTEM_AUTHOR_ID` (`a.etherpad-system`), but the public HTTP API documentation still states it returns authors who contributed to the pad without noting this exclusion.
## Issue Context
This PR intentionally hides the system author from the public API surface by filtering it out in `src/node/db/API.ts`. Documentation in `doc/` should be updated in the same PR to match the new behavior.
## Fix Focus Areas
- doc/api/http_api.md[696-704]
- doc/api/http_api.adoc[652-661]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Match the runtime behaviour from the previous commit — the synthetic 'a.etherpad-system' author used for unattributed inserts is filtered out of the listAuthorsOfPad response. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

qodo-free-for-open-source-projects Bot added the Compliance violation label May 17, 2026

qodo-free-for-open-source-projects Bot reviewed May 17, 2026

View reviewed changes

Comment thread src/node/db/API.ts

JohnMcLear merged commit fba4a17 into develop May 17, 2026
20 checks passed

JohnMcLear deleted the fix/list-authors-filter-system branch May 17, 2026 12:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(API): hide SYSTEM_AUTHOR_ID from listAuthorsOfPad#7793

fix(API): hide SYSTEM_AUTHOR_ID from listAuthorsOfPad#7793
JohnMcLear merged 2 commits into
developfrom
fix/list-authors-filter-system

JohnMcLear commented May 17, 2026

Uh oh!

qodo-code-review Bot commented May 17, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented May 17, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented May 17, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

JohnMcLear commented May 17, 2026

Summary

Why filter, not change attribution

Test plan

Uh oh!

qodo-code-review Bot commented May 17, 2026

Qodo reviews are paused for this user.

Uh oh!

qodo-free-for-open-source-projects Bot commented May 17, 2026

Review Summary by Qodo

Walkthroughs

File Changes

Uh oh!

qodo-free-for-open-source-projects Bot commented May 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

qodo-free-for-open-source-projects Bot commented May 17, 2026 •

edited

Loading