Commit Graph

574 Commits

Author SHA1 Message Date
Copilot 3980b9e580 Fix IDOR in exports by adding token verification (Issue #31637) (#32883)
* Fix IDOR in exports by adding token verification

Implement jdleesmiller's suggested fix for Issue #31637:
- V1: Return export token in create response
- V1: Verify token in get_export using secure_compare
- Web: Pass token through fetchExport and fetchDownload
- Web: Return token from exportProject to frontend
- Frontend: Pass token as query param on status/download requests
- Add tests for both services

Agent-Logs-Url: https://github.com/overleaf/internal/sessions/7ba5f535-fba2-49a8-91d4-c87bd332d3a0

Co-authored-by: briangough <7457354+briangough@users.noreply.github.com>

Fix window.location.pathname to .href to preserve query params

Code review correctly identified that window.location.pathname strips
query parameters. Switch to window.location.href so the token query
parameter is preserved in download URLs.

Agent-Logs-Url: https://github.com/overleaf/internal/sessions/7ba5f535-fba2-49a8-91d4-c87bd332d3a0

Co-authored-by: briangough <7457354+briangough@users.noreply.github.com>

Fix test mocks to include token in POST responses

Agent-Logs-Url: https://github.com/overleaf/internal/sessions/0350c6ef-0fff-4e98-8464-812cd92c523f

Co-authored-by: briangough <7457354+briangough@users.noreply.github.com>

fix formatting

Fix token assignment in initiateExport to use pollResponse token if available

Add requireExportToken config setting and tests for invalid/missing token cases

Agent-Logs-Url: https://github.com/overleaf/internal/sessions/059bdba2-4f7a-4407-a5a5-cfcffd888739

Co-authored-by: briangough <7457354+briangough@users.noreply.github.com>

fix formatting

Add tests for export status and token validation in ExportsController and MockV1Api

Co-authored-by: Copilot <copilot@github.com>

* Update services/v1/main/app/controllers/api/v1/overleaf/exports_controller.rb

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fix linting

* fix fetchString response handling in ExportsHandler tests

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Brian Gough <briangough@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Brian Gough <brian.gough@overleaf.com>
GitOrigin-RevId: 399aef8eaa15ab3655f0905482f3a31fe94e2251
2026-05-15 08:08:04 +00:00
Jakob Ackermann 7c50dc9990 [history-v1] add endpoint for downloading latest zip (#33181)
* [history-v1] add endpoint for downloading latest zip

* [web] address review feedback

* [web] tests: do not overwrite db.projects.overleaf, extend it

* [web] set includeReferer flag from downloading zip

GitOrigin-RevId: e63e549f004230086f82eccf03b43fd62bde6071
2026-05-13 08:06:53 +00:00
Jakob Ackermann b1931d0b3b [web] cleanup archived split-test assignments from user record on login (#33365)
* [web] cleanup archived split-test assignments from user record on login

Co-authored-by: Anna Claire Fields <anna.fields@overleaf.com>

* [migrations] purge archived split tests from all users

Co-authored-by: Anna Claire Fields <anna.fields@overleaf.com>

* [web] add missing mock and update snapshot test

* [web] gracefully access db.users.splitTests

---------

Co-authored-by: Anna Claire Fields <anna.fields@overleaf.com>
GitOrigin-RevId: bd185074a402556d7b7c812208cf834dd52b27a5
2026-05-13 08:06:49 +00:00
Jakob Ackermann 1df98c028d [web] add includeReferer flag to SplitTestHandler.getAssignment (#33235)
* [web] add includeReferer flag to SplitTestHandler.getAssignment

* [web] tests: migrate User.getSplitTestAssignment to async/await

I don't want to fight with callbacks and optional arguments. Just move
it to async/await. New tests should use async/await, so there is no
point in making this work in callback-hell.

* [web] remove unused URL import

GitOrigin-RevId: 6251001e6ba7354f704fa663be8ef365ca0b9d23
2026-05-12 08:06:21 +00:00
Brian Gough 3940f8c2a7 Merge pull request #33504 from overleaf/bg-upgrade-yauzl
Upgrade yauzl library in web to version 3.3.0

GitOrigin-RevId: 82b4158db7a432f4257bd48402840f07801c6d07
2026-05-11 08:05:47 +00:00
Eric Mc Sween 2bb35fafb8 Merge pull request #33490 from overleaf/em-parse-req-errors-2
Reintroduce custom error types in request validation

GitOrigin-RevId: 1985ca04c8fe693fb836b042517d94700343bc46
2026-05-08 08:10:13 +00:00
Brian Gough a6c8ce32c3 Merge pull request #33312 from overleaf/copilot/send-clear-site-data-header
Send `Clear-Site-Data` header on account deletion

GitOrigin-RevId: c3f0b5f27cc80a1927518c56436c3a808b144fb7
2026-05-07 08:07:20 +00:00
Eric Mc Sween 3da2d53acb Merge pull request #33413 from overleaf/revert-33040-em-parse-req-errors
Revert "Replace isZodErrorLike with custom error types in request validation"

GitOrigin-RevId: 1f51fe9e14ffabf283f1229552d3887136420f8f
2026-05-06 08:06:41 +00:00
Eric Mc Sween 98def949ec Merge pull request #33040 from overleaf/em-parse-req-errors
Replace isZodErrorLike with custom error types in request validation

GitOrigin-RevId: 9cb453a2cde595a00f5049e4829ea9e3dbe17b28
2026-05-06 08:06:37 +00:00
Jakob Ackermann d61e3f5521 [web] fix caching of session.analyticsId (#33300)
* [web] fix caching of session.analyticsId

* [web] disable analyticsIdMiddleware tests for Server Pro/CE

GitOrigin-RevId: 2acf76f937adabd62b1e9f876a858211ef7a13c6
2026-05-05 08:06:09 +00:00
Jakob Ackermann 37cc65ec7e [web] consolidate clsi downloads and add zod validation (#33069)
* [web] consolidate clsi downloads and add zod validation

* [validation-tools] make prettier happy

* [web] make clsiServerId optional

* [web] fix type of buildId

* [web] gracefully handle ObjectId

* [web] fix type of buildId

* [monorepo] address review feedback

- cjs export
- update module path in comments
- skip adding ?clsiserverid if not set
- allow nested output file download for submissions and add tests

* [web] address review feedback

* [web] cache one more zod schema

* [web] fix unit tests

GitOrigin-RevId: 0a1e618955983e035defd6d3c0528b81e0e85c95
2026-05-05 08:06:05 +00:00
Brian Gough 8a8679eb78 Merge pull request #33297 from overleaf/bg-fix-acceptance-tests-in-dev-env
fix: update migration commands to use yarn instead of east
GitOrigin-RevId: 9cfcc393cfc1855e1edba6ba90ebb7b3a76ecb6b
2026-05-01 08:06:01 +00:00
Jakob Ackermann 50abfe8f0c [migrations] add migration for back filling db.users.analyticsId (#33115)
* [migrations] add migration for back filling db.users.analyticsId

Co-authored-by: Davinder Singh <davinder.singh@overleaf.com>

* [web] add acceptance test for backfilling db.users.analyticsId

---------

Co-authored-by: Davinder Singh <davinder.singh@overleaf.com>
GitOrigin-RevId: a0840969ac0c4c84e874c6f00cf0a78857a4bb06
2026-04-30 08:06:38 +00:00
Jimmy Domagala-Tang 994932b8e3 [Web + Doc-Updater] Add track changes accepted notification (#32752)
* feat: update doc manager to return a list of contributors to the accepted change

* feat: add new notification type for accepting a tracked change

* update email with tracked changes accepted

* feat: update tests

* fix: feedback on consistent api and returns

* feat: adding new tests

* feat: self accepted changes shouldnt trigger notification, and using existing changesAccepted hook

* Add better subject and activity list for track change accepted (#33094)

* feat: add better activity list entry and subject header for accepted changes, to match other notifications

* feat: updating tests

* feat: updating accepting_user_id to just user_id

* fix: adding users in emailBuilder test to userCache

GitOrigin-RevId: 6114f77916b5f503b7bbbb5ca8fed99e58edc31b
2026-04-30 08:06:19 +00:00
Jakob Ackermann da11cf2669 [monorepo] fix running tests locally (#33186)
* [monorepo] fix running tests locally

* [web] fix east invocation

* [web] move corepack into entrypoint

* [web] fix running module acceptance tests locally

* [web] fix merged module targets

* [web] remove spurious change

GitOrigin-RevId: 84cf7f8d768d3429c8a98c789acf76f6cecd6e3e
2026-04-29 08:05:42 +00:00
Jakob Ackermann d56477565c [web] deduplicate getting the project when loading the editor (#32762)
* [web] enable async local storage on all the endpoints

Co-authored-by: Brian Gough <brian.gough@overleaf.com>

* [web] deduplicate getting the project when loading the editor

Co-authored-by: Brian Gough <brian.gough@overleaf.com>

* [web] use ProjectAccess state for computing analytics segmentation

Co-authored-by: Brian Gough <brian.gough@overleaf.com>

* [web] restore ownership of active flag and deferredTpdsFlushCounter

* [web] add missing await

* [web] update unit tests

* [web] add metrics for project access caching

* [web] add missing test mock

* [web] invalidate async local storage when changing project access

* [web] deduplicate project lookup when checking for token access

* [web] add helper function for getting cached ProjectAccess

* [web] add acceptance test for caching of ProjectAccess

* [web] account for saas-only project access in tests

* Revert "[web] enable async local storage on all the endpoints"

This reverts commit 1b82f3b935040e8cfd180d1f6bf4183a655580e2.

* [web] add async local storage to project endpoints in top-50

* [web] invalidate async local storage for project access from modules

Co-authored-by: Jessica Lawshe <jessica.lawshe@overleaf.com>

---------

Co-authored-by: Brian Gough <brian.gough@overleaf.com>
Co-authored-by: Jessica Lawshe <jessica.lawshe@overleaf.com>
GitOrigin-RevId: 3eea7956b24e6f937dc1c17948681063d4dca3ea
2026-04-17 08:07:08 +00:00
Jessica Lawshe c483994a63 Merge pull request #32115 from overleaf/jel-web-combine-domain-v1-v2
[web] Combine v1 and v2 domains data for groups with domain capture

GitOrigin-RevId: d718ff3dbceeaad792a618b9d5dd6f3196ebca30
2026-03-26 09:07:13 +00:00
Jessica Lawshe bdbff7c3f6 Merge pull request #28814 from overleaf/jel-v1api-promisify
[web] v1 API decaf cleanup and remove unused code

GitOrigin-RevId: 706506ca12df20be74c7c3b35bec4d74baa7f130
2026-03-20 09:06:49 +00:00
Andrew Rumble a92bf982b0 Merge pull request #31889 from overleaf/ar-remove-web-smoke-test
[web] remove smoke test

GitOrigin-RevId: 7911b5e800ef466c59131fd739f95b11a587359f
2026-03-06 09:11:30 +00:00
Jakob Ackermann 17e01526b4 [web] fix typo in i18n key (#31713)
* [web] fix typo in i18n key

* [web] sort locales

GitOrigin-RevId: 9736eae24cdbd7aabd995087de368c667b25b849
2026-02-24 09:07:18 +00:00
Jakob Ackermann 6c6e8d9a97 [monorepo] switch all output file reads to clsi-nginx (#31691)
* [monorepo] switch all output file reads to clsi-nginx

* [clsi-lb] allow gallery download requests

* [terraform] clsi: use nginx.conf from clsi service

* [clsi] fix flakey tests

* [clsi] replace alias with rewrite and root in nginx config

* [k8s] clsi-lb: expose download port on internal service

* [web] add explicit endpoint for downloading all output files

Serve the output.zip endpoint from clsi.

* [clsi] fix regex for latexqc submission ids

Previously, we only handled template submission ids.

GitOrigin-RevId: 6c3b21b01ec41ae767530b14aac31fbe3d640dd5
2026-02-24 09:07:12 +00:00
Jakob Ackermann 03fd89fd77 [web] validate and parse email using EmailHelper when ratelimiting (#31622)
* [web] validate and parse email using EmailHelper when ratelimiting

* [web] use a fake email for rate-limiting ldap logins in Server Pro

GitOrigin-RevId: 27ea7724319e06c4d64ac81e1155dcab558da99c
2026-02-19 09:06:18 +00:00
Jakob Ackermann 7c70b749d4 [monorepo] remove PII and variables from error messages (#31508)
* [monorepo] remove PII and variables from error messages

Exclusions:
- scripts
- tests
- fuzzing
- SplitTestManager (messages are sent to admin frontend)
- Group setup (we may want an error per unique tuple)
- sharejs (unused types; text type errors are shadowed already)
- history-v1 error messages that are used by the ErrorRecorder
- errors that flag issues with configuration/call signatures

I've used these search terms for finding unwanted error messages:
- new Error(`
- new Error\(\n\s+` (regex search)
- new OError(`
- new OError\(\n\s+` (regex search)

* [web] throw NotFoundError from ProjectLocator

* [github-sync] fix OError.tag call in script

Co-authored-by: Jessica Lawshe <jessica.lawshe@overleaf.com>

* [templates] revert changes to test client

---------

Co-authored-by: Jessica Lawshe <jessica.lawshe@overleaf.com>
GitOrigin-RevId: 736857a4fc5d9bfb0f8cb03e0f004eda87e5a220
2026-02-17 09:05:04 +00:00
Jessica Lawshe 9d625fc834 Merge pull request #30964 from overleaf/jel-commons-migrate-email-not-primary
[web] Check all emails instead of just primary on group SSO callbacks

GitOrigin-RevId: 52ac46e04134772025ca1812d25aad2e68fa44ea
2026-01-29 09:06:26 +00:00
Alf Eaton 461acef756 [workbench] Add voice input to the prompt form (#30086)
GitOrigin-RevId: cecb613f8d204a68287e93deb6c62d071a039a8d
2026-01-28 09:07:19 +00:00
Andrew Rumble 2dfcfd1804 Merge pull request #30916 from overleaf/ar-allow-read-only-institution-access-for-admins-with-no-modify-capability
[web] Add view-only version of institution managers page

GitOrigin-RevId: 65d19e42220932fe268d595ea13d0ba0b18c4398
2026-01-22 09:06:49 +00:00
Anna Claire Fields ff8f77d85c replace staff access with role based sytem (#30004)
- remove references to staff access

GitOrigin-RevId: 5d7df3ae8bc78aa02b65ec0dac0a323520c3df15
2026-01-19 09:06:59 +00:00
Antoine Clausse 379788a8a6 [web] Promisify RegistrationTests and SessionTests (#30646)
* Promisify RegistrationTests.mjs

* Re-add `await this.user.request.get('/login')` and remove comment

* Promisify SessionTests.mjs

* Remove callback versions of RedisHelper

* Re-add `await this.user.request.get('/login')`

GitOrigin-RevId: 9d0e21336f348c6aff99cb262738163e611f5712
2026-01-19 09:06:06 +00:00
Tim Down 2b39beab80 Merge pull request #29697 from overleaf/ac-td-user-audit-log-index
Add migration to improve index on userAuditLogEntries

GitOrigin-RevId: c4a606e1ab7299008baa3b05ac1fb8ca18036fae
2026-01-14 09:05:31 +00:00
Jakob Ackermann 425e7b1e5b [web] enable mongo notablescan in CI (#29501)
* [monorepo] record ERROR/FATAL log messages in junit report

* [web] put SaaS specific code behind feature flag

* [web] use split test cache for getting user assignments

The unit tests needed updating as they did not replicate any of the
 mongo filtering. The acceptance tests cover this logic.

* [web] make better use of existing indexes

* [web] avoid col-scan in tests of notifications module

* [web] remove cleanup of empty feedbacks collection

* [web] add assertion for reason of rejected request in launchpad test

* [web] add missing indexes

* [web] enable mongo notablescan

* [web] make emailNotifications tests compatible with notablescan

GitOrigin-RevId: b888f2feeb3a0e915f068ae1c4ea23ec17821221
2026-01-13 09:06:38 +00:00
Domagoj Kriskovic 7b00e5d9f5 Add routes to save/get project notification preferences (#30114)
* Add routes to save/get project notification preferences

* update route url

* improve zod schema

* remove unused json response

* update schema and fix tests

* add jsdoc types to pass type-check

* remove using zod strict()

GitOrigin-RevId: f3ab5c88b58bd5af71e0504d0efbe03bdf9b243c
2025-12-16 09:07:07 +00:00
ilkin-overleaf 4801174f68 Merge pull request #30188 from overleaf/ii-domain-capture-group-sso-link
[web] Improved `group-sso-link` logs

GitOrigin-RevId: 426dfa46c5c3a236382744fe408f33df81c5a9a0
2025-12-16 09:06:53 +00:00
Andrew Rumble f1e788d9b3 Merge pull request #29967 from overleaf/ar/web-remove-mocha-unit-tests
[web] remove mocha unit tests

GitOrigin-RevId: eda753af3470dbd1f385cb0bc3f06d78ade8a764
2025-12-03 09:05:37 +00:00
Andrew Rumble 07c827e9fd Merge pull request #29928 from overleaf/ar-last-infrastructure-conversions
[web] last infrastructure conversions

GitOrigin-RevId: ad1aff9b7df0610ed0303157d9e2c8032f32c02b
2025-11-28 09:05:56 +00:00
Andrew Rumble 18f44866e5 Merge pull request #29919 from overleaf/revert-29795-ar-last-infrastructure-conversions
Revert "[web] last infrastructure conversions"

GitOrigin-RevId: 48dc64553012afb5d2db4b2eb9c9898489b7e5ef
2025-11-27 09:05:54 +00:00
Andrew Rumble d748d8d606 Merge pull request #29795 from overleaf/ar-last-infrastructure-conversions
[web] last infrastructure conversions

GitOrigin-RevId: 68aa11625a9bc6d0d5324ecd95bb5ac52af8ee96
2025-11-27 09:05:30 +00:00
Simon Gardner 7dce5f0e25 Adds audit log entry for user Logout event
GitOrigin-RevId: 5a305166ba0e017ae7cb3d426cdae541e8db62c3
2025-11-25 09:05:38 +00:00
Malik Glossop 016778295a Merge pull request #29733 from overleaf/mg-transfer-ownership
Fix transfer ownership permissions

GitOrigin-RevId: b6d09704361507085e3eae8dc9240a36ae47c70e
2025-11-24 09:06:50 +00:00
Andrew Rumble beb6f6d484 Merge pull request #29597 from overleaf/ar-last-features-esm-conversion
[web] last features esm conversion

GitOrigin-RevId: a35ab995bf654f1cdfe0e0062d8806761ecccf2d
2025-11-21 09:05:36 +00:00
Andrew Rumble 5a4592b153 Merge pull request #29720 from overleaf/renovate-npm-glob-vulnerability
[Core] Update dependency glob to v11.1.0 [SECURITY] - abandoned

GitOrigin-RevId: 866612e84e2afd3edc97c244e22faeaff22484cf
2025-11-20 09:05:44 +00:00
Antoine Clausse 1447842fbd Remove scripts about unconfirmed emails removal (#29683)
* Remove unconfirmed email deletion scripts

* Remove tests

GitOrigin-RevId: a0ef84207fced135a13074265fe5d3b38400d76f
2025-11-18 09:05:29 +00:00
Andrew Rumble 394c60f2cf Merge pull request #29659 from overleaf/revert-29656-revert-29521-ar-models-es-conversion
Revert "Revert "[web] Convert models and self-referential test files to ESM ""

GitOrigin-RevId: f64000ae31d298b075a8722dfc51f294c71bc021
2025-11-18 09:04:56 +00:00
Andrew Rumble ae6dec9dcb Merge pull request #29656 from overleaf/revert-29521-ar-models-es-conversion
Revert "[web] Convert models and self-referential test files to ESM "

GitOrigin-RevId: 5455cccbb513bd9ca36ce526ff1553065f83d233
2025-11-13 09:06:36 +00:00
Andrew Rumble 7c9fea64ac [web] Convert models and self-referential test files to ESM (#29521)
from overleaf/ar-models-es-conversion

GitOrigin-RevId: a92ab8342c0f3e23155eacc0570458fc910c3d71
2025-11-13 09:06:13 +00:00
Antoine Clausse f028f21e3c [web] Remove the nocdn fallback (#29311)
* Remove the nocdn fallback

Co-authored-by: Tim Down <tim.down@overleaf.com>

* Remove comment about nocdn query string in ExpressLocals.mjs

Co-authored-by: Tim Down <tim.down@overleaf.com>

* Remove `Frontend` global

---------

Co-authored-by: Tim Down <tim.down@overleaf.com>
GitOrigin-RevId: 74160ed4cf8ba17f8bd9b6793c8baa80883d3361
2025-11-12 09:05:31 +00:00
Miguel Serrano fe884195dc [web] Add Project logs to Group Audit Logs view (#29456)
* Add `project-created` audit log only for managed users

* Include project audit logs in group audit logs

* Added details column in Group Audit Logs UI

GitOrigin-RevId: 96c7a31b37270912df1629e27d905b692f28da46
2025-11-12 09:05:18 +00:00
Antoine Clausse f2788868ac [web] Create script to re-add wrongly deleted emails (#29550)
* Allow passing auditLog extra info in addEmailAddress

* Create script re_add_deleted_emails.mjs

* Check email validity when parsing the CSV

* Allow no IP and initiator for the log events

* Add an acceptance test on re_add_deleted_emails

* Fix remove_unconfirmed_emails.mjs

We're not planning to run this again, but this could help if some code from here ever gets copy-pasted

* Fix remove_unconfirmed_emails.mjs

Rename `emailsToRemove` to `emailsToRemoveCandidates`

* Remove console.logs of event logs:

That's unnecessary complexity and we already have the data from the previous script

* Copy `addEmailAddress` into the script

* Handle primary emails correctly

* Ignore a TS error

* Fix async function in createUsers (tests)

* Add assertion for already in use emails in ReAddDeletedEmailsTests

* Add information in admin-panel for add-email audit logs

GitOrigin-RevId: f8480426d7b323f88a268874488d9ae641bc6045
2025-11-07 09:05:17 +00:00
Andrew Rumble 4f02a85aa4 Update paths
GitOrigin-RevId: 399c594dd1bbf739d91874df6be3b70e57fe01e3
2025-11-06 09:05:57 +00:00
Andrew Rumble f02f6475ac Update paths
GitOrigin-RevId: a9474c8f36e8b287de4dd8fda29bc082001444ac
2025-10-23 08:06:10 +00:00
Domagoj Kriskovic 71457d74cb Add notifications web module (#28983)
* Add notifications web module

* implement getThreadMessage in chat

* Save comment mention notification

* check if recipient is a real user

* move commentMentionDelay

* use module-hooks types

* remove router

* updated collection name

GitOrigin-RevId: cf8240c88aac7d7e4de4bf51cfe2608b6b7e7918
2025-10-20 08:05:20 +00:00