ep_disable_delete_button

Disables browser-initiated pad deletion in Etherpad while preserving authenticated server-side deletion through Etherpad's HTTP API.

Protection provided

• Hides the Delete Pad interface and recovery-token deletion controls.
• Disables the corresponding client interactions.
• Rejects browser PAD_DELETE messages server-side, including recovery-token messages.
• Leaves API-key-authenticated deletePad calls available for trusted application workflows.

The server-side check is the security boundary; hiding the controls prevents confusing or unusable UI but is not relied upon for enforcement.

Installation

From the Etherpad directory:

pnpm run plugins i ep_disable_delete_button

Restart Etherpad after installation. No configuration is required.

Operational notes

This plugin applies to every pad on the Etherpad instance. Confirm that administrative deletion is performed through a protected server-to-server path before enabling it in an environment that needs lifecycle cleanup.

Development

pnpm install --frozen-lockfile
pnpm test
pnpm lint

Licensed under the Apache License 2.0.