Merge pull request #35312 from overleaf/ii-anonymous-project-access

[web] Restore anonymous read-only access for "Anyone with the link" sharing

GitOrigin-RevId: b17e30259f73d43f0febffeea8908eb47c98b7ee

services/web/app/src/Features/Authorization/AuthorizationManager.mjs

@@ -3,6 +3,7 @@ import mongodb from 'mongodb-legacy'
 import Features from '../../infrastructure/Features.mjs'
 import CollaboratorsGetter from '../Collaborators/CollaboratorsGetter.mjs'
 import CollaboratorsHandler from '../Collaborators/CollaboratorsHandler.mjs'
+import CollaboratorsInviteGetter from '../Collaborators/CollaboratorsInviteGetter.mjs'
 import ProjectGetter from '../Project/ProjectGetter.mjs'
 import { User } from '../../models/User.mjs'
 import PrivilegeLevels from './PrivilegeLevels.mjs'
@@ -232,10 +233,23 @@ async function _getPrivilegeLevelForProjectWithoutUserWithPublicAccessLevel(
     return await getPrivilegeLevelForProjectWithToken(projectId, token)
   }
 
+  if (!opts.ignorePublicAccess && token) {
+    return await getAnonymousSharingLinkPrivilegeLevel(projectId, token)
+  }
+
   // Deny anonymous user access
   return PrivilegeLevels.NONE
 }
 
+async function getAnonymousSharingLinkPrivilegeLevel(projectId, token) {
+  const invite =
+    await CollaboratorsInviteGetter.promises.getUsableAnonymousSharingLinkInvite(
+      projectId,
+      token
+    )
+  return invite ? PrivilegeLevels.READ_ONLY : PrivilegeLevels.NONE
+}
+
 async function getPrivilegeLevelForProjectWithToken(projectId, token) {
   // Anonymous users can have read-only access to token-based projects,
   // while read-write access must be logged in,

services/web/app/src/Features/Collaborators/CollaboratorsInviteController.mjs

@@ -23,6 +23,7 @@ import PrivilegeLevels, {
 import SplitTestHandler from '../SplitTests/SplitTestHandler.mjs'
 import SubscriptionGroupHandler from '../Subscription/SubscriptionGroupHandler.mjs'
 import SubscriptionLocator from '../Subscription/SubscriptionLocator.mjs'
+import TokenAccessHandler from '../TokenAccess/TokenAccessHandler.mjs'
 
 // This rate limiter allows a different number of requests depending on the
 // number of callaborators a user is allowed. This is implemented by providing
@@ -374,8 +375,17 @@ async function viewSharingLink(req, res) {
 
   const currentUser = SessionManager.getSessionUser(req.session)
   if (!currentUser) {
-    AuthenticationController.setRedirectInSession(req)
-    return res.redirect('/register')
+    const invite =
+      await CollaboratorsInviteGetter.promises.getSharingLinkInvite(projectId)
+    const isPublicSharingLink =
+      invite != null &&
+      invite.privileges !== PrivilegeLevels.NONE &&
+      !invite.subscriptionId
+
+    if (!isPublicSharingLink) {
+      AuthenticationController.setRedirectInSession(req)
+      return res.redirect('/register')
+    }
   }
 
   // cleanup if set for register page
@@ -645,7 +655,19 @@ async function validateSharingLink(req, res) {
 
   const currentUser = SessionManager.getSessionUser(req.session)
 
-  if (invite == null || !currentUser) {
+  if (invite == null) {
+    return res.json({ valid: false })
+  }
+
+  if (!currentUser) {
+    if (
+      invite.reusable &&
+      invite.privileges !== PrivilegeLevels.NONE &&
+      !invite.subscriptionId
+    ) {
+      TokenAccessHandler.grantSessionTokenAccess(req, projectId, token)
+      return res.json({ valid: true, redirect: true })
+    }
     return res.json({ valid: false })
   }
 

services/web/app/src/Features/Collaborators/CollaboratorsInviteGetter.mjs

@@ -58,11 +58,23 @@ async function getSharingLinkInvite(projectId) {
   return invite
 }
 
+async function getUsableAnonymousSharingLinkInvite(projectId, tokenString) {
+  const invite = await ProjectInvite.findOne({
+    projectId,
+    reusable: true,
+    tokenHmac: CollaboratorsInviteHelper.hashInviteToken(tokenString),
+    subscriptionId: null,
+    privileges: { $ne: PrivilegeLevels.NONE },
+  }).exec()
+  return invite
+}
+
 export default {
   promises: {
     getAllInvites,
     getEditInviteCount,
     getInviteByToken,
     getSharingLinkInvite,
+    getUsableAnonymousSharingLinkInvite,
   },
 }

services/web/app/src/Features/Collaborators/CollaboratorsRouter.mjs

@@ -155,7 +155,6 @@ export default {
         'collaboration',
         'project-invite'
       ),
-      AuthenticationController.requireLogin(),
       RateLimiterMiddleware.rateLimit(rateLimiters.viewProjectInvite),
       CollaboratorsInviteController.viewSharingLink,
       AnalyticsRegistrationSourceMiddleware.clearSource()
@@ -179,7 +178,6 @@ export default {
         'collaboration',
         'project-invite'
       ),
-      AuthenticationController.requireLogin(),
       RateLimiterMiddleware.rateLimit(rateLimiters.validateSharingLink),
       CollaboratorsInviteController.validateSharingLink,
       AnalyticsRegistrationSourceMiddleware.clearSource()