02dd2a511c
[dsmp] Add resolve and reopen comment endpoints ( #28093 )
...
* [dsmp] Add resolve and reopen comment endpoints
* remove try/catch
GitOrigin-RevId: b2982de064e81a8fd7c19edbe114ae397e5f51d5
2025-08-27 08:05:35 +00:00
511d2d104b
Add support for handling deleted root document in RestoreManager ( #28008 )
...
* Skip opening root document if delete originated from a file-restore
* handle project-restore origin
* Refactor isFileRestore logic
* Add support for handling deleted root document in RestoreManager
GitOrigin-RevId: 837144aa6e269cbffebf82624f58e8219fe654c4
2025-08-27 08:05:30 +00:00
b2df393bbb
Merge pull request #28098 from overleaf/em-dsmp-chat-event
...
Send a DSMP event when a chat message is sent
GitOrigin-RevId: 062476676c91a4edf3d6f837d60ad16c7f912771
2025-08-26 08:05:36 +00:00
aa8bef1e8d
Merge pull request #28089 from overleaf/dk-dsmp-post-chat-message
...
Add support for posting chat messages
GitOrigin-RevId: 817d723abf6309716c4cfa61e2c260cb7ace0bda
2025-08-26 08:05:32 +00:00
4308881738
[web] change the order when creating a memebers list in permissions checks ( #28063 )
...
GitOrigin-RevId: 73fd9218841d189dc95edec86f09d451005e6189
2025-08-26 08:05:13 +00:00
7c811fef11
Merge pull request #28077 from overleaf/em-promisify-chat-controller
...
Promisify ChatController
GitOrigin-RevId: c2af5f7bc24b1e6c682bb1dfd1146c3dcc90ae25
2025-08-25 08:05:42 +00:00
13d5c40cde
Add getThread in Chat service and use it in AuthorizationMiddleware ( #28041 )
...
* Add getThread in Chat service and use it in AuthorizationMiddleware
* ensure user_id is a string, not ObjectId
* fix tests
GitOrigin-RevId: 42d63366b9b9350d7cdbcbc3b9f4761d9f55b49a
2025-08-25 08:05:25 +00:00
d06b4d2bcc
Merge pull request #27859 from overleaf/jel-domain-capture-create-new-user
...
[web] Create new group user via domain capture
GitOrigin-RevId: 2b8740edcfde05cf065564e87f50a9f84d14950a
2025-08-21 08:06:00 +00:00
2853e7762e
[web] Add admin permission modify-group-manager ( #27642 )
...
* Add capacity `modify-group-manager`
* Check `modify-group-manager` (backend)
* Check `modify-group-manager` (frontend)
* Update tests
* Rename AdminPermissions to mjs
* Add `ol-adminCapabilities` in frontend tests
* Allow modifying group managers if `adminRolesEnabled` is false
* Add `adminPrivilegeAvailable` check
* Update: set `ol-canModify` boolean instead of `ol-adminCapabilities`
* Mock `hasAnyAccess`
* Use `hasAdminCapability` helper
* Add `ol-canModify` to types
* Remove `isAdminMiddleware` as we don't want to relax the permissions for now
* Fix: pass `res` to `hasAnyAccess` (!!)
* * Check `hasWriteAccess` (`hasAdminCapability('modify-group-manager')` or `staffAccess.groupManagement`) in the Pug file
* Fix: Check `hasWriteAccess` in the publisher and institution pug files (!)
* Revert `hasAnyAccess` changes
* Rename `ol-canModify` to `ol-hasWriteAccess` for consistency with other variables
* Remove redundant file AdminPermissions.mjs
* Update unit test
* Revert changes to UserMembershipController.test.mjs
* Rename to `requireGroupManagersWriteAccess`
GitOrigin-RevId: f3f0b1b17abd1d2f0c363688e87d9063de886e3c
2025-08-21 08:05:07 +00:00
949eb9745c
Merge pull request #27998 from overleaf/mf-improve-plan-not-found-error-stripe
...
[web] Return user-readable error message if user visits stripe-based payment page with invalid plan code
GitOrigin-RevId: ad88a7d6698227867874fa0a724142e563d1377c
2025-08-20 08:06:29 +00:00
a3a7b0ea18
Merge pull request #27894 from overleaf/ii-domain-capture-join-button
...
[web] Domain capture join button
GitOrigin-RevId: aec6033f6776e9384c77fe0ef609c65b13a90f87
2025-08-20 08:06:21 +00:00
c1c5b0d0ce
Merge pull request #27834 from overleaf/ii-domain-capture-not-in-group-redirect
...
[web] Redirect to domain capture page
GitOrigin-RevId: 15d2b8046beb5a40fc4937c337ee9655abaed8fd
2025-08-20 08:06:16 +00:00
8e1c2d27d7
Merge pull request #27677 from overleaf/as-compile-timeout-enforcement
...
[web] 10s Compile Timeout - Enforcement Phase
GitOrigin-RevId: 3930eb376cc1293409259e073032218e09d5270e
2025-08-20 08:06:01 +00:00
8647424f14
Merge pull request #27848 from overleaf/as-compile-warning-teardown
...
[web] Tear down 10s-timeout-warning split test
GitOrigin-RevId: ca8faf77bc73073e9fc126d9d722fe568921c1c3
2025-08-20 08:05:57 +00:00
2c44d65785
[web] Add requireAdminRoles param to hasAdminCapability ( #28006 )
...
* Add `requireAdminRoles` param to `hasAdminCapability`
https://github.com/overleaf/internal/pull/27965#discussion_r2284808889
Co-authored-by: Andrew Rumble <andrew.rumble@overleaf.com >
* Update test
---------
Co-authored-by: Andrew Rumble <andrew.rumble@overleaf.com >
GitOrigin-RevId: 83f8af84debc70c7a2e294638747369c786be22f
2025-08-20 08:05:52 +00:00
f183a1dfbc
add option to disable link sharing ( #27626 )
...
* add option to remove link-sharing from backend
* restrict make link-sharing in the frontend based on capability
* extend e2e project-sharing tests to cover OVERLEAF_DISABLE_LINK_SHARING=true
* throw an error when link sharing is disabled in TokenAccessHandler
* throw errors when attempting to add users to projects with link sharing disabled
* Update server-ce/test/project-sharing.spec.ts
Co-authored-by: Jakob Ackermann <jakob.ackermann@overleaf.com >
* add tests for existing access when link sharing is disabled
* update tests to specify access restrictions for read-only and read-write link shared projects
* [web] block access to legacy public project with link-sharing disabled
---------
Co-authored-by: Jakob Ackermann <jakob.ackermann@overleaf.com >
GitOrigin-RevId: 5f194dbcb790e973e427c58a3a4a738a5dd74cb4
2025-08-20 08:05:33 +00:00
4edf4b2d42
Show Recurly's line items breakdown in subscription change preview ( #27809 )
...
* Show Recurly's line items breakdown in subscription change preview
* fix rounding, filter items that cancel each other out
GitOrigin-RevId: 0f5d71b3917ce8a52ff36608a6ec6280fe7d38ce
2025-08-19 08:05:02 +00:00
ba97b96815
[web] Add admin permissions modify-group-member and modify-managed-group-member ( #27665 )
...
* Add capability `modify-managed-group-member` & `modify-group-member`
* Check `modify-managed-group-member` & `modify-group-member` (backend)
* Check `modify-managed-group-member` & `modify-group-member` (frontend)
* Update tests
* Update with `ol-hasWriteAccess` flag
* Update tests
* Move functions to AdminAuthorizationHelper.js
* Update import to fix build error
* Add `ol-hasWriteAccess` to types
* Use `hasAdminAccess()` instead of `req?.user?.isAdmin`
* Add tests on `/manage/groups/:id/invites` depending on admin roles
* Reuse `UserMembershipAuthorization.hasAdminCapability`
* Fix: Add entityAccess check
* Update unit test
* Rename `hasAdminGroupMemberCapability` to `hasModifyGroupMemberCapability`
* Remove useless and redundant `hasWriteAccess` check
* Restore stub in afterEach
GitOrigin-RevId: 4b6d83751121b43d4c19d0dbd82a4833cf7a6f24
2025-08-15 08:05:57 +00:00
fcd6c44dc3
[web] Add admin permission modify-group-setting ( #27657 )
...
* Add capacity `modify-group-setting`
* Check `modify-group-setting` (backend)
* Check `modify-group-setting` (frontend)
* Update tests
* Fix: Add entityAccess check
* Update unit test
GitOrigin-RevId: 7702fe34762ecb8bd050c2fa2b6e95a9baf90be3
2025-08-15 08:05:52 +00:00
1acb68f41c
Merge pull request #27800 from overleaf/ls-support-create-stripe-customer-from-admin-panel
...
Support creating Stripe customer from admin panel
GitOrigin-RevId: 3e23008e1f4690e6f3737b5689e20958bf468f82
2025-08-15 08:05:34 +00:00
fa892b336d
Add endpoint to retrieve document with history ranges and use it in dsmp API ( #27564 )
...
GitOrigin-RevId: 3d2ac33cdc903a07b8ec67f7fb6f723ae9c81a26
2025-08-15 08:05:17 +00:00
a829949fd2
Merge pull request #27890 from overleaf/jlm-spam-safe-email
...
Apply new spam check to email address
GitOrigin-RevId: 9e204ea75e930455971769a73843d015fc4a9033
2025-08-14 08:06:28 +00:00
ca30fdd95c
Merge pull request #27860 from overleaf/lg-spam-safe
...
Add spam check for incident
GitOrigin-RevId: 752180f7507e32219cc5faaef5d48fdc0003e889
2025-08-13 08:07:10 +00:00
447efbd5b1
Combine implementations of hasAdminCapability
...
GitOrigin-RevId: a847c9182c018524c96726fe30e501763904b82e
2025-08-13 08:06:58 +00:00
811b878eaa
Add view-split-test and modify-split-test capabilities
...
GitOrigin-RevId: 3f0752aec332c386ece72d2447d39126065ddb35
2025-08-13 08:06:53 +00:00
feac1cb27b
Add authorization helper for admin capabilities
...
GitOrigin-RevId: fbf28c89500481e379db6c49512876d867478eb7
2025-08-13 08:06:39 +00:00
cd2fe857ed
Merge pull request #27757 from overleaf/rh-secondary-email-alert
...
Only send security alert email after successful addEmailAddress call
GitOrigin-RevId: 391e613b0f855a5d2187b1da87355e0dbb10044d
2025-08-13 08:06:34 +00:00
9f80a31d85
[web] add config option for project/user hard deletion delay ( #27725 )
...
GitOrigin-RevId: db8030d6c8a3cdf8490edafcfa436cdbcd80fc28
2025-08-13 08:06:17 +00:00
e4b42705c3
[web] add config option for custom maintenance message ( #27618 )
...
GitOrigin-RevId: e01eebecce780af6e9e3f8b82321cb7776d414e2
2025-08-13 08:06:12 +00:00
3147edccfd
Merge pull request #27670 from overleaf/rh-stripe-pause-addons
...
Prevent buying add-on while subscription is paused
GitOrigin-RevId: b8cfbbaa05a1031bedf37edf7b1ded2252eb6906
2025-08-12 08:06:08 +00:00
ece71f0426
Merge pull request #27391 from overleaf/rh-stripe-pause-anchor
...
Reset billing cycle when resuming paused Stripe subscription
GitOrigin-RevId: 44f7aa4d3eeaab7622e97b0178fe7d6c7cccae50
2025-08-12 08:06:04 +00:00
56235da7dd
[web] Clean up group-audit-logs split test ( #27614 )
...
GitOrigin-RevId: e22183820e418cabc83cf2619c2c10cf4f82d3b9
2025-08-12 08:05:39 +00:00
5f020595c4
Merge pull request #27680 from overleaf/ii-domain-capture-get-user-affiliations
...
[web] Get domain capture info when getting user affiliations
GitOrigin-RevId: 475024cda072c45e548407dfdb36a772f845ac2b
2025-08-11 08:06:26 +00:00
da7092bfb9
[dsmp] Add acceptChanges notification ( #27555 )
...
* [dsmp] moved redis functions to RedisStreamManager
* use getEventStream generator function
* [dsmp] moved redis functions to RedisStreamManager
* [dsmp] Add acceptChanges notification
* rename to acceptedChanges
* cleanup after rebasing parent branch
GitOrigin-RevId: c7e100f55503e52b146bcc07deb3e483250b66f8
2025-08-11 08:05:37 +00:00
60f1f9ca5c
[ds-mobile-app] Implement reject changes in document updater ( #27483 )
...
* [ds-mobile-app] Implement reject changes in document updater
* Return rejected change ids
GitOrigin-RevId: 7915170af9164852ce39d783776106e722aaa925
2025-08-11 08:05:29 +00:00
4716bc3114
[web] Map admin capabilities to project PrivilegeLevels ( #27488 )
...
* Add capability `copy-project`
* Check `copy-project` (frontend)
* Update tests
* Suggestion: map `modify-project`-`PrivilegeLevels.OWNER` and `view-project`-`PrivilegeLevels.READ_ONLY`
* Suggestion: remove capability `copy-project`. Use `view-project` instead
* Revert unrelated changes
* Add tests on AuthorizationManager when `adminRolesEnabled`
* Update `Modules.promises.hooks.fire` stubs with `.withArgs('getAdminCapabilities')`
Co-authored-by: Andrew Rumble <andrew.rumble@overleaf.com >
* Use `getAdminCapabilities` from AdminAuthorizationHelper.js
---------
Co-authored-by: Andrew Rumble <andrew.rumble@overleaf.com >
GitOrigin-RevId: 61167509c4a035c99831a5b0346347c2e6b5fae0
2025-08-08 08:07:59 +00:00
a3d842a98d
Merge pull request #27637 from overleaf/jel-remove-unused-group-sso
...
[web] Use `providerId` for group SSO and remove unused `universityId`
GitOrigin-RevId: 0928cdfee78cae5cdede57159b9968c15e26f27c
2025-08-08 08:07:34 +00:00
590416cf0e
Merge pull request #27620 from overleaf/mj-remove-ai-assistant-notification
...
[web] Remove AI Assist notification
GitOrigin-RevId: e3ffcac233eb77d215bff8af7e35f7fdecacf29a
2025-08-08 08:07:00 +00:00
b4c6aa6a7e
Split adminCapabilities middleware into two
...
GitOrigin-RevId: 093e455e33459cae2e3da236958cb991f128299e
2025-08-08 08:05:52 +00:00
488c0ab6e6
Try checking admin access before getting capabilities
...
GitOrigin-RevId: 75ff99aa6b6e94c1b84a99d22d65b327f4d40126
2025-08-08 08:05:47 +00:00
df68be700d
Move hasAdminCapability middleware into helpers
...
This is so that we can test it more easily than embedding it would allow
GitOrigin-RevId: be23d945bc7c816d32b18b4990ecd9e0a6592eb5
2025-08-08 08:05:42 +00:00
73427c1bfc
Add hasAdminCapabilities function to ExpressLocals
...
This will be available in pug to allow admin capabilities to be used.
GitOrigin-RevId: 6bc4e38385b421aa44ee9385e28f3c59b09e3ade
2025-08-08 08:05:37 +00:00
d6d99eff53
removing split test and enforcing WF account creation as winning variant ( #26920 )
...
GitOrigin-RevId: 49d801004a6fced936214e5c08b82284ab771e72
2025-08-06 08:05:30 +00:00
bcbdd0100d
Merge pull request #27215 from overleaf/rh-stripe-pause-status
...
Update features and subscription state when Stripe pause starts and ends
GitOrigin-RevId: 368f5d9b046cfe26e996be336189081b96926713
2025-08-06 08:04:57 +00:00
b070fb88ae
Merge pull request #27413 from overleaf/rh-sp-remove-geoip
...
Only make GeoIP lookup for premium nudge experiment in SaaS environment
GitOrigin-RevId: a0df9186dc957cd5ead6e798266874aebedabee5
2025-08-06 08:04:41 +00:00
0c298a7ee5
Merge pull request #27498 from overleaf/mf-fix-subscriptionX-segmentation-stripe
...
[web] Only send one subscriptionId data in event segmentation for Stripe subscription to follow recurly
GitOrigin-RevId: 9e514d2991df768ea7e77bd5fa5f9d851c4ee8f0
2025-08-05 08:06:26 +00:00
df2e4e7d7e
Merge pull request #27506 from overleaf/slg-improve-add-manager-error
...
Improve error message when attempting to add non-registered manager
GitOrigin-RevId: d098b3640940c6299c279b86c9c7e2631cc73191
2025-08-05 08:06:21 +00:00
3d09f34767
Merge pull request #27445 from overleaf/slg-improve-domain-matcher-error
...
Improve domain matcher error message
GitOrigin-RevId: 8f07a8e27854637cb931f852e6c59d4960caa33b
2025-08-05 08:06:16 +00:00
20c30f6b94
Use AsyncLocalStorage to cache userFullEmails on the request, avoiding duplicated calls to the affiliations endpoint ( #27542 )
...
* Use AsyncLocalStorage to cache userFullEmails
* Rename temporary fakeUser override to avoid conflicts
GitOrigin-RevId: 3a74816f677c1357293b0d46f245b4cfc499f2fa
2025-08-05 08:06:04 +00:00
b80b7f6afe
Merge pull request #27516 from overleaf/slg-hide-enrolment_ad_html
...
hide enrolment_ad_html field from v1 admin form and remove unused usage in web
GitOrigin-RevId: 7cf8eed1a68bbaf2ebbb77069bfd421cd26ef01d
2025-08-05 08:05:41 +00:00
Domagoj Kriskovic