* github-sync: only swallow permanent revocation failures during unlink
404 (token gone) and 422 (token issued under a mismatched client_id,
the confirmed cause of #35108) are treated as safe to proceed past;
any other revocation error now aborts the unlink instead of silently
deleting the local credential row, so a token that might still be
live isn't orphaned by a transient GitHub failure.
* web: surface genuine github-sync unlink failures instead of a 500
When GithubSyncApiHandler.unlink rejects for a reason other than the
permanent 404/422 cases now handled by github-sync, show an error
notification on the settings page instead of crashing the request,
mirroring the existing projectSyncSuccessMessage session-flash pattern.
* github-sync: detect expired credentials in user status check
getStatus now validates a stored token against GitHub (GET /user)
before reporting it as linked. A GithubInvalidCredentialsError (401)
now surfaces as expired: true alongside enabled: true, distinguishing
a dead token from a genuinely working link. Any other validation
failure fails open and reports enabled: true as before.
* web: propagate github-sync expired status through to the client
Thread the new expired field from github-sync's status endpoint
through GithubSyncController.getUserStatus and the settings-page
injectUserSettings middleware, and extend the corresponding
TypeScript types on both the app and frontend side.
* web: show a re-link path on the settings widget when github credentials expire
The widget now checks expired status: it shows an error indicator
with a "connection expired" message and renders the Link action
instead of a dead-end Unlink button, since relinking upserts a fresh
token regardless of the stale row.
* web: keep unlink available for expired github credentials
Some users just want to remove an expired connection rather than
relink it. Keep Unlink as the primary action regardless of expired
status, and surface the relink path as an inline link next to the
expired message instead of replacing the primary action.
* web: correct the github unlink confirmation warning
Unlinking never touches a project's githubSyncProjectStates row,
regardless of whether the credential was healthy or expired -
verified by tracing unlinkAccount/deleteUser and confirming no other
code path deletes project sync state on account unlink. Sync pauses
until relink, but no project loses its GitHub connection, so the
warning text was simply wrong; corrected rather than adding a
separate expired-specific message.
* web: add Storybook story for expired github-sync credentials
Covers the new expired state alongside the existing NoFeature,
Unlinked, Linked and Error stories for the settings widget.
* simplify: collapse duplicated branches and extract session-flash helper
- Merge the near-identical 404/422 checks in _revokeToken into one
status-set check.
- Use optional chaining instead of null-guard ternaries in
GithubSyncMiddleware.
- Extract popSessionValue() in UserPagesController to de-duplicate the
read-then-delete session flash-message pattern, now used 3 times.
* review-self: close test coverage gaps found in self-review
- AuthenticationController: cover 401/403 revocation responses and a
plain network error with no .response, alongside existing 404/422/500.
- GithubSyncController: assert projectSyncErrorMessage stays unset on
the unlink success path.
- UserPagesController: cover projectSyncErrorMessage set-then-cleared
and absent-stays-undefined cases.
- Add GithubSyncMiddleware.test.mjs (previously untested): not-logged-in,
successful status fetch, and callback-error branches.
- Cypress: cover cancelling the unlink confirmation modal while expired.
- Storybook: add ErrorWhileUnlinked story for the disabled-Link +
error-indicator combination.
* review-self: fix audit-log ordering, cache getStatus validation safely
- GithubSyncApiHandler: write the link-github/unlink-github audit log
entry only after the corresponding github-sync API call succeeds,
instead of before (resolves the discrepancy tracked in issue 3354).
- UserController/UserManager: cache getStatus's live token-validation
result for 5 minutes to cut down on redundant GitHub API calls,
with an optimistic-lock write (matched against the encrypted token
that was actually validated) so a relink can never be overwritten by
a stale in-flight validation of the old token.
- github-integration-linking-widget: dedupe the relink href against
the linkPath already passed to IntegrationLinkingWidget.
* web: surface expired github credentials proactively in the sync modal
The modal previously only showed the reauthorize prompt after a real
GitHub API call failed with 401 mid-action. It now also checks the
expired field already returned by the status endpoint and shows the
same prompt immediately on open, before ever rendering the export
form against a token known to be dead. Extracted the existing
reauthorize markup into GithubCredentialsExpired so both call sites
share it.
* github-sync: avoid double-fetching the credential doc in getStatus
getStatus called UserManager.getUser, then getAuthToken which
internally fetched the same document again. Add getAuthTokenFromUser
to decrypt from an already-fetched doc and use it in getStatus,
removing the redundant Mongo query and the now-unreachable
GithubUserNotLinkedError handling (the user doc's existence was
already confirmed by the first fetch).
* github-sync: make expired-token handling reactive, drop proactive getStatus validation
Reverts getStatus in the github-sync service to a pure DB check — no live
GitHub API call, no 5-minute cache, no token_expired/token_validated_at
fields. The expired state is already surfaced reactively: the unmerged-commits
fetch on modal open returns 401 when the token is dead (handled by the existing
case 401 branch), and ExportToGithub handles 401 from the orgs call. The
proactive check added complexity (caching, optimistic-lock writes) without a
meaningful UX gain over the reactive paths.
Removes the expired indicator from the settings widget and the proactive
GithubCredentialsExpired screen from the modal's pre-flight check. The
github_sync_expired locale key is removed as it is no longer referenced.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* github-sync: show reauthorize prompt when push/pull fails with expired credentials
When a merge (push or pull) returns 401, GithubSyncMergeAction now renders
GithubCredentialsExpired with the Reauthorize button instead of the raw
"GithubInvalidCredentialsError" string that was previously falling through
to the default error branch.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* github-sync: wrap all async controller handlers with expressify
Without expressify, an unhandled throw from an async route handler
(e.g. a token decryption failure in the github-sync service producing a
non-4xx error that _reportError re-throws) becomes an unhandled rejection.
Express never sends a response and the modal is left stuck on loading.
expressify catches the error and passes it to next(), so Express's error
handler sends a 500 and the frontend can surface it.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* removing redundant tests
* removing getAuthTokenFromUser function
* removing redundant key
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: 0d9a314bf70bea9e6037593f2a6f8b8d1f2c6e71
* filtering out venv directories
* also exclude .venv directories and sync all pattern copies
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: 6634d9780da44f90c6777347d52def9a854bd29f
* Throwing 429 errors when ref manager responds with 429
* respecting the APIs retry-after first
* Handle 429 on linked file refresh path
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Show rate-limited message on linked file refresh
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Consolidate backoff helpers into ProviderBackoffStore
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Fix EX 0 crash, null guard, BackoffProvider type, test fixes
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Add unit tests for rate limiting implementation
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* update ZoteroProviderTests for new signedGet return shape
getCollections now returns { collections, backoff, retryAfter } instead
of a bare array. getUsersItemsChanges reads backoff/retryAfter from the
signedGet return tuple, not from response.headers (extraction moved to
the transport layer in OAuth1Transport).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix tpr-webmodule unit test regressions
ZoteroSyncClient: collectionsResponseSchema now requires backoff/retryAfter
as number|null; stub responses were missing these fields causing ZodError.
Assertions updated since getCollections returns CollectionsResult (object)
not a bare array.
ReferencesApiController: vi.doMock for @overleaf/fetch-utils was missing
RequestFailedError; the three 429 propagation tests inline-import it from
the mocked module.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* address PR review comments
- ReferencesApiController: add fallback 500 status and optional-chain
response in all catch blocks where err.response may be absent
- OAuth1Transport: guard Number(header) with Number.isFinite to prevent
NaN propagating as backoff/retryAfter when header value is non-numeric
- ZoteroProvider: same Number.isFinite guard for lastModifiedVersion
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix prettier formatting in ZoteroSyncManager.test.mjs
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* show rate-limited message in groups modal and Write & Cite
use-provider-groups: detect 429/rateLimited response and set error to
'rate_limited' instead of generic 'loading_groups'
file-tree-import-bibliography: add rate_limited key to all three
providers' translation maps so the import modal renders the rate-limited
message when groups loading is blocked
reference-manager-source: add RateLimitedError, throw it on 429 from
search, block further searches and show a toast notification
toasts: add write-and-cite:rate-limited toast and showRateLimitedToast()
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fixup! fix tpr-webmodule unit test regressions
* fixing CI failures
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: 158c2b92c557caacef337b89f68c91c47569151f
* Migration and index setup script
* Helper script to clear linked library
* Pull users collections
* Implementing get items from users zotero library
* Initial zotero sync client
* Pulling users overleaf collection
* Pulling users overleaf collection
* Initial sync pull from Zotero to Library
* Sync and import workflow from Zotero into Library
* Using user getter and setter for updating user library info
* Using new collection for library sync states
* Adding tests for new sync functionality
* Harden Zotero sync route
* Simplify Zotero sync state read and skip accounting
Fold the ensure+get double round-trip in sync-state discovery into one
findOneAndUpdate, and derive itemsSkipped from items.length - itemsInserted
instead of a running counter.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Redact URL-encoded token secret from OAuth1 request logs
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fixing type failure
* Rename upsertZoteroReferences to importZoteroReferences
The method is insert-only; the bulkWrite upsert just makes re-runs
idempotent rather than updating, so the name now reflects that.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Validate librarySyncStates reads with zod
Replace the `as` / `as unknown as` casts in getLibrarySyncState and
ensureLibrarySyncState with a zod schema parse, matching
LibraryReferenceRepository. Types are now derived from the schema.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Defer Zotero sync watermark until pagination exists
Don't record lastSyncedVersion after a single-page sync: committing the
page-1 version before pagination (#34286) lands would let incremental
sync (#34282) skip items beyond the first page. Drops the commitSyncState
call and toVersion from SyncResult; the version envelope is left for the
follow-ups. commitSyncState stays in the repository for #34282.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Extract OAuth1Transport from OAuth1Handler
Lift the OAuth1 client/config registry, getAccessToken, redactSecret and
classifyOAuth1Error into oauth1/OAuth1Transport.js, plus a signedGet
helper for provider modules to reuse. OAuth1Handler now imports them; its
method bodies are unchanged. Test mocks move to esmock's global scope so
they reach the transport, with Errors pinned for instanceof checks.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Move Zotero collections/items into a per-provider ZoteroProvider
Carve the Zotero-only operations out of the generic OAuth1 handler into
providers/ZoteroProvider.js, dispatched via providers/ProviderRegistry.js.
ReferenceProviderHandler now resolves the provider from the registry and
throws UnsupportedOperationError (mapped to 501) for providers without the
operation, instead of bolting Zotero-only methods onto OAuth1Handler.
Zotero's collectionsUri/itemsTopUri are read from settings by ZoteroProvider
rather than copied into the shared OAuth1 registry. Removes getCollections/
getUsersItemsChanges (and their tests) from OAuth1Handler.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Add ZoteroProvider unit tests and unsupported-provider coverage
Cover ZoteroProvider collections/items parsing, header envelope and
malformed-payload rejection, and assert ReferenceProviderHandler throws
UnsupportedOperationError for providers without a sync implementation.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Make addSyncedCollection idempotent
Only push a synced collection when its key isn't already recorded, so a
repeat sync can't create duplicate syncedCollections entries regardless of
the caller-side guard. Adds a sequential test asserting no duplicate.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Hardcode Zotero library endpoint paths, derive host from site
Move the collections/items-top endpoints out of settings and into
ZoteroProvider as path constants, taking only the host from the
provider's `site`. Aligns Zotero `site` with the other providers
(API host) and avoids adding per-endpoint config points.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Make Zotero sync routes explicit, 404 unknown providers
Hardcode the collections/items routes to /zotero rather than a generic
/:ref_provider, so a non-Zotero request 404s on the missing route
instead of returning a misleading 501. Drop the UnsupportedOperationError
501 branch, reverting OAuth2 unsupported ops to their prior 500.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
GitOrigin-RevId: 50e16a9c46f995c2e9db6eed50ef81c3a71ea71d
* Allow admin access to user PATs
* Tests for new screen in admin panel
* Adding error for invalid token and way to parse error for OAuth 2
* Git bridge handles expired PAT
* Script for alerting on close to expiry and expired git tokens
* Refactoring and simplifying
* Updating email templates to match agreed docs
* tweak to email subject to include Overleaf
* Allowing dry run in scripts and general tidy up
* removing redundant tests and dry running script
* Fixing CI errors
* Adding new tab to admin test expectation
* Address PR feedback on oauth2-server changes
- Replace ad-hoc overleafErrorCode prop with a TokenExpiredError subclass
- Collapse listTokens/listTokensForAdmin into a single hook
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* Adding cron definitions for alerting on expiring git pat
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
GitOrigin-RevId: 69b9fd901a201592a580c69abe7bd7d603e85d3a
* Initial working version of library search
draft fetch allowing optional search param
draft debounce search
draft search bar
draft using for search
draft search params
draft data index creation
draft prefix-regex search
draft add fields only on search
draft index setup
draft search tests
draft search tests for extra params
draft using correct display value from bib entry for tokenization
* Library search handles diacritics
* Library styling and refreshing table data without
reloading table
* Updating mongo search query and creating migration
scripts for existing data
* Using Mongo query for sorting results
* Moving copied files into shared directory
* Addressing review comments
* Pulling changes from bibtex-search-token for consistency with migration
* Fixing lint
* Using mongo collation for handling case and diacritics in search queries
* Boosting citation keys with check for tokens
* Removing double foldLatinDigraphs call
* Matching figma designs for Library search component
* Adding cursor for paginated Library search results
* Re-fixing flash after searching library
* Unit test for cursor search
* Using same cursor object for search and get all results
* Data migration moved to manual script
GitOrigin-RevId: b7e6a1f07f775c8450dd97e7269cab3b68ca0eb3
* Correct styling for visual bib elements
* reverting outlined icon
* re-applying padding to optional fields
* citation key not shown on empty form
GitOrigin-RevId: 77c670e6687c6c60acf9f691e4c1d77e3390ac46
* visual updates to optional fields in manual bib entry
* omitting onClose from button auto complete props
GitOrigin-RevId: 922695e8eaec83702b482123dc4b4483fe957b78
* Adding preview panel for bibtex entry
* Removing bibtex-editor module directory and moving tests to library module
* Format fix
* Adding accessibility headers and hardening tests
* Simplfying preview logic for bibtex titles
* Only show author placeholder if no author present
* Fixing build failures
* Fixing broken test
GitOrigin-RevId: 23d2d4ff48fe8135687578cd3efdf8ba9395e411
* Migrating reference settings to mongo and exposing them through code mirror context
* removing undefined optional for reference manager type settings
* allowing partial updates to user settings objects, and remove repeated cypress intercepts
* Zod schema parsing for user reference manager settings
* Splitting ref provider mongoose schema into const
* Persisting local storage reference settings to mongo and deleting from local
* Enforcing ref provider group id to always be type string
* Fixing test and format errors
* Migrated flag for settings to only migrate once
* fixing cypress tests adding migrated flag
* persisting local storage to allow for easy rollback
GitOrigin-RevId: f59522bdee6f0e56efb7d98b9d9373a743619ec8
* Initial working version of auto complete button component
* generalising button auto complete for use in bibtex entry form
* Adding optional fuzzy searching
* Restoring delete optional field
* Removing dropdown specific styling
* Updating item/group interface for autocomplete
* Auto complete allowing full keyboard nav functionality
* Custom class for dropdown-upward
* Adding error validation for duplicate name with standard field
* fixing type errors
* Replacing Fuse with MiniSearch
* Adding clear button and frontend tests for ol-autocomplete
* Adding fuzzysearch option to autocomplete story
* removing unused vars and noddy comment
* Fixing lint failure
* Updating fuzzy search threshold
* Using downshift natural highlight
* Required label for aria compliancy
* changing how create item is handled
* addressing review comments
* Using AutoExpandingTextArea for optional fields and hooking in validation
* Formatting
* Requiring items prop for ol-autocomplete
* Fixing type failure in test
GitOrigin-RevId: 9b8f719fbb2bdd75fc1d5a9076908559040a8a78
* Adding types to github sync export handler and up the stack
* promsifying file and addressing review comments
* reverting tsconfig and updating response type
* importing correct type
* reverting Jenkinsfile to main
GitOrigin-RevId: 96496920b8faf38fc32ffedb6fc4b8d6596d4112
Liam O'Brien