Migrate kolibri-oidc-client-plugin into the Python monorepo

[rtibbles]

❌ This issue is not open for contribution. Visit Contributing guidelines to learn about the contributing process and how to find suitable issues.

Overview

Migrate kolibri-oidc-client-plugin from its standalone repo into python_packages/ as a workspace member.

It has frontend code (OIDCLogin.vue) alongside Python. Resolving its JS deps against the local pnpm workspace requires adding python_packages/* to pnpm-workspace.yaml — the first migration to do so. That glob change also pulls kolibri-sentry-plugin into the workspace. So this issue also finishes sentry's frontend wiring and adds the publish-workflow entry #14666 missed.

Per-plugin migration under #13720, following #14663 (setup), #14666 (sentry), and the Python-only sync-extras migration.

Complexity: Medium
Target branch: develop

Context

kolibri-oidc-client-plugin lets Kolibri act as an OpenID Connect client (SSO login). Its standalone repo contains:

• Python module (kolibri_oidc_client_plugin/): kolibri_plugin.py, auth.py, options.py, root_urls.py, settings.py, buildConfig.js.
• Frontend: assets/src/views/OIDCLogin.vue.
• package.json (private: true) with stale pins: kolibri ^0.15.4, KDS via a #v1.3.1-beta0 git URL, vue 2.6.14, kolibri-tools 0.16.0-dev.3.
• External Python dep mozilla-django-oidc==1.2.4 (old pin), plus kolibri>=0.15.
• setup.cfg/setup.py, Makefile, MANIFEST.in, CONTRIBUTING.rst, .flake8, standalone CI, yarn.lock.

The Change

Code migration

• Move learningequality/kolibri-oidc-client-plugin contents into python_packages/kolibri-oidc-client-plugin/ (Python module + package.json).
• Replace setup.cfg/setup.py with a pyproject.toml per Set up Kolibri as a Python monorepo #14663 conventions: static version field, mozilla-django-oidc declared as a dependency.
• Drop standalone-only / root-duplicative files (.github/, Makefile, MANIFEST.in, LICENSE, AUTHORS.rst, CONTRIBUTING.rst, .flake8, setup.cfg, setup.py, yarn.lock); keep the plugin-specific README.
• Conform the code to monorepo pre-commit (ruff etc.).

Git history

• Preserve via git filter-repo --to-subdirectory-filter python_packages/kolibri-oidc-client-plugin on a fresh clone, then git merge --allow-unrelated-histories (procedure from Set up Kolibri as a Python monorepo #14663). git blame traces to original commits.

Frontend workspace integration

• Add python_packages/* to pnpm-workspace.yaml (general infrastructure — retroactively makes sentry a workspace member).
• kolibri → workspace:*.
• kolibri-design-system → pnpm catalog (drop the #v1.3.1-beta0 git URL).
• vue → 2.7.16.
• kolibri-tools devDep → kolibri-build at workspace:*.

Python workspace integration

• Picked up by the python_packages/* uv glob; uv sync --group dev resolves it. Add its import name to known-first-party in root pyproject.toml's ruff isort config.

Sentry catch-up (enabled by the glob change above)

• Convert sentry's package.json deps to workspace:*/catalog (same kolibri-tools → kolibri-build swap) and record it in pnpm-lock.yaml — finishing the frontend wiring Migrate kolibri-sentry-plugin into the Python monorepo #14666 intended.
• Add kolibri-sentry-plugin to pypi_packages_publish.yml (missed in Migrate kolibri-sentry-plugin into the Python monorepo #14666).

Publishing / CI

• Add kolibri-oidc-client-plugin to pypi_packages_publish.yml (paths filter + workflow_dispatch options).
• If the plugin has Python tests, add a Stage 2 per-member-package job (modelled on sync_extras_plugin_tests) and wire it into stage2_required_checks's needs:.

Build / runtime

• kolibri-build prod --plugins kolibri_oidc_client_plugin produces the JS bundle.
• Wheel from the migrated dir installs into a fresh venv alongside Kolibri; OIDC login exercised against a test provider before merge.

Out of Scope

• Migrating other external plugins — separate per-plugin tasks under Kolibri Monorepo #13720.
• Publishing sentry/oidc-client to PyPI or archiving their source repos — publishing wiring lands here; the release action itself is a separate step.
• Behavioural changes to the OIDC client — like-for-like migration (bumping mozilla-django-oidc is allowed where needed for the migration to work).

Acceptance Criteria

Code migration

• Plugin code lives at python_packages/kolibri-oidc-client-plugin/ (Python module + package.json).
• pyproject.toml replaces setup.cfg/setup.py, follows Set up Kolibri as a Python monorepo #14663 conventions, declares a static version and mozilla-django-oidc.
• Standalone-only files (.github/, Makefile, MANIFEST.in, LICENSE, AUTHORS.rst, CONTRIBUTING.rst, .flake8, setup.cfg, setup.py, yarn.lock) absent from the migrated directory.
• Migrated code passes monorepo pre-commit without per-file ignores.
• History preserved via git filter-repo --to-subdirectory-filter; git blame traces to original commits.

Frontend workspace integration

• pnpm-workspace.yaml includes python_packages/*.
• oidc-client package.json: kolibri at workspace:*, KDS from catalog (no git URL), vue 2.7.16, kolibri-build at workspace:* replacing kolibri-tools.
• pnpm install records oidc-client in pnpm-lock.yaml with deps resolved to local workspace packages.

Python workspace integration

• Appears as a uv workspace member; uv sync --group dev includes it.
• Import name added to known-first-party.

Sentry catch-up

• Sentry package.json deps converted to workspace:*/catalog; sentry recorded in pnpm-lock.yaml.
• pypi_packages_publish.yml lists kolibri-sentry-plugin.

Publishing / CI

• pypi_packages_publish.yml lists kolibri-oidc-client-plugin (paths filter + workflow_dispatch options).
• If the plugin has tests, a Stage 2 job runs them and is in stage2_required_checks's needs:.

Build and runtime

• kolibri-build prod --plugins kolibri_oidc_client_plugin produces the JS bundle in the expected location.
• A wheel built from the migrated directory installs into a fresh virtualenv alongside Kolibri.
• After installation, Kolibri loads the plugin and OIDC login completes against a test OIDC provider (verified manually).

References

• Source repository: https://github.com/learningequality/kolibri-oidc-client-plugin
• Prior migrations: Set up Kolibri as a Python monorepo #14663 (setup), Migrate kolibri-sentry-plugin into the Python monorepo #14666 (sentry, with frontend), sync-extras (Python-only)
• pnpm workspaces: https://pnpm.io/workspaces
• uv workspaces: https://docs.astral.sh/uv/concepts/projects/workspaces/

AI usage

Used Claude Code to draft this issue iteratively. I drove scope and decisions throughout — the workspace-vs-published dependency approach, modernising the JS deps as acceptance criteria, the kolibri-tools → kolibri-build rename, and folding the sentry fixes in here. Claude reviewed the source repo and the current monorepo state and surfaced two gaps not visible from #14666: sentry's package.json still uses published pins and isn't in pnpm-lock.yaml, and sentry was never added to pypi_packages_publish.yml.

[rtibblesbot]

Watching for resolution on behalf of #14949.

[rtibblesbot]

Plan: Move kolibri-oidc-client-plugin from its standalone repo into python_packages/kolibri-oidc-client-plugin/ as a uv + pnpm workspace member (with history preserved), finish the pnpm/CI wiring kolibri-sentry-plugin's migration (#14666) left undone, and wire both packages into publishing and Stage 2 CI.

• Clone and inspect the source repo
• Merge source history into python_packages/kolibri-oidc-client-plugin/
• Remove standalone-only files
• Write pyproject.toml, fix __init__.py versioning, register workspace membership
• Add python_packages/* to pnpm-workspace.yaml and fix oidc's package.json
• Verify pnpm install resolves oidc against the local workspace
• Fix kolibri-sentry-plugin/package.json to workspace/catalog conventions
• Register both packages in pypi_packages_publish.yml
• Add a Stage 2 test job for oidc (conditional) and wire it into stage2_required_checks
• Build the oidc frontend bundle and a wheel; install into a fresh venv
• Manually verify OIDC login against a test provider

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

• Implemented code following the pre-approved plan using test-driven development (red-green-refactor)
• Ran the project's full test suite and linter before committing
• For UI changes: captured live screenshots to verify rendering
• For backend changes: verified with example API/CLI output

[rtibblesbot]

The bot has been waiting for a response for 2 hour(s). It will resume automatically when someone replies.