* feat(zotero-sync): implement persistent sync state management and user notifications
* fix tests
* fix(sync): add accessOk flag to sync status recording
GitOrigin-RevId: 2da17038ad21691e7b184bb1494cf97fff8234f9
* github-sync: only swallow permanent revocation failures during unlink
404 (token gone) and 422 (token issued under a mismatched client_id,
the confirmed cause of #35108) are treated as safe to proceed past;
any other revocation error now aborts the unlink instead of silently
deleting the local credential row, so a token that might still be
live isn't orphaned by a transient GitHub failure.
* web: surface genuine github-sync unlink failures instead of a 500
When GithubSyncApiHandler.unlink rejects for a reason other than the
permanent 404/422 cases now handled by github-sync, show an error
notification on the settings page instead of crashing the request,
mirroring the existing projectSyncSuccessMessage session-flash pattern.
* github-sync: detect expired credentials in user status check
getStatus now validates a stored token against GitHub (GET /user)
before reporting it as linked. A GithubInvalidCredentialsError (401)
now surfaces as expired: true alongside enabled: true, distinguishing
a dead token from a genuinely working link. Any other validation
failure fails open and reports enabled: true as before.
* web: propagate github-sync expired status through to the client
Thread the new expired field from github-sync's status endpoint
through GithubSyncController.getUserStatus and the settings-page
injectUserSettings middleware, and extend the corresponding
TypeScript types on both the app and frontend side.
* web: show a re-link path on the settings widget when github credentials expire
The widget now checks expired status: it shows an error indicator
with a "connection expired" message and renders the Link action
instead of a dead-end Unlink button, since relinking upserts a fresh
token regardless of the stale row.
* web: keep unlink available for expired github credentials
Some users just want to remove an expired connection rather than
relink it. Keep Unlink as the primary action regardless of expired
status, and surface the relink path as an inline link next to the
expired message instead of replacing the primary action.
* web: correct the github unlink confirmation warning
Unlinking never touches a project's githubSyncProjectStates row,
regardless of whether the credential was healthy or expired -
verified by tracing unlinkAccount/deleteUser and confirming no other
code path deletes project sync state on account unlink. Sync pauses
until relink, but no project loses its GitHub connection, so the
warning text was simply wrong; corrected rather than adding a
separate expired-specific message.
* web: add Storybook story for expired github-sync credentials
Covers the new expired state alongside the existing NoFeature,
Unlinked, Linked and Error stories for the settings widget.
* simplify: collapse duplicated branches and extract session-flash helper
- Merge the near-identical 404/422 checks in _revokeToken into one
status-set check.
- Use optional chaining instead of null-guard ternaries in
GithubSyncMiddleware.
- Extract popSessionValue() in UserPagesController to de-duplicate the
read-then-delete session flash-message pattern, now used 3 times.
* review-self: close test coverage gaps found in self-review
- AuthenticationController: cover 401/403 revocation responses and a
plain network error with no .response, alongside existing 404/422/500.
- GithubSyncController: assert projectSyncErrorMessage stays unset on
the unlink success path.
- UserPagesController: cover projectSyncErrorMessage set-then-cleared
and absent-stays-undefined cases.
- Add GithubSyncMiddleware.test.mjs (previously untested): not-logged-in,
successful status fetch, and callback-error branches.
- Cypress: cover cancelling the unlink confirmation modal while expired.
- Storybook: add ErrorWhileUnlinked story for the disabled-Link +
error-indicator combination.
* review-self: fix audit-log ordering, cache getStatus validation safely
- GithubSyncApiHandler: write the link-github/unlink-github audit log
entry only after the corresponding github-sync API call succeeds,
instead of before (resolves the discrepancy tracked in issue 3354).
- UserController/UserManager: cache getStatus's live token-validation
result for 5 minutes to cut down on redundant GitHub API calls,
with an optimistic-lock write (matched against the encrypted token
that was actually validated) so a relink can never be overwritten by
a stale in-flight validation of the old token.
- github-integration-linking-widget: dedupe the relink href against
the linkPath already passed to IntegrationLinkingWidget.
* web: surface expired github credentials proactively in the sync modal
The modal previously only showed the reauthorize prompt after a real
GitHub API call failed with 401 mid-action. It now also checks the
expired field already returned by the status endpoint and shows the
same prompt immediately on open, before ever rendering the export
form against a token known to be dead. Extracted the existing
reauthorize markup into GithubCredentialsExpired so both call sites
share it.
* github-sync: avoid double-fetching the credential doc in getStatus
getStatus called UserManager.getUser, then getAuthToken which
internally fetched the same document again. Add getAuthTokenFromUser
to decrypt from an already-fetched doc and use it in getStatus,
removing the redundant Mongo query and the now-unreachable
GithubUserNotLinkedError handling (the user doc's existence was
already confirmed by the first fetch).
* github-sync: make expired-token handling reactive, drop proactive getStatus validation
Reverts getStatus in the github-sync service to a pure DB check — no live
GitHub API call, no 5-minute cache, no token_expired/token_validated_at
fields. The expired state is already surfaced reactively: the unmerged-commits
fetch on modal open returns 401 when the token is dead (handled by the existing
case 401 branch), and ExportToGithub handles 401 from the orgs call. The
proactive check added complexity (caching, optimistic-lock writes) without a
meaningful UX gain over the reactive paths.
Removes the expired indicator from the settings widget and the proactive
GithubCredentialsExpired screen from the modal's pre-flight check. The
github_sync_expired locale key is removed as it is no longer referenced.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* github-sync: show reauthorize prompt when push/pull fails with expired credentials
When a merge (push or pull) returns 401, GithubSyncMergeAction now renders
GithubCredentialsExpired with the Reauthorize button instead of the raw
"GithubInvalidCredentialsError" string that was previously falling through
to the default error branch.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* github-sync: wrap all async controller handlers with expressify
Without expressify, an unhandled throw from an async route handler
(e.g. a token decryption failure in the github-sync service producing a
non-4xx error that _reportError re-throws) becomes an unhandled rejection.
Express never sends a response and the modal is left stuck on loading.
expressify catches the error and passes it to next(), so Express's error
handler sends a 500 and the frontend can surface it.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* removing redundant tests
* removing getAuthTokenFromUser function
* removing redundant key
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: 0d9a314bf70bea9e6037593f2a6f8b8d1f2c6e71
* [web] Disabled AI state for project collaborators
Displays a disabled state, along with an informative tooltip in Editor AI controls.
GitOrigin-RevId: a749cd25d54f6ef3d7bf4276343400894bc193a4
* Remove stale "You already have a subscription" notification after cancel/plan change
The notification was derived from a server-rendered meta tag set at page load,
so it persisted through cancel and plan-change flows. Now derived directly from
the URL param on the client; the param is stripped on cancel button click
(replaceState) and before plan-change reloads (location.replace via
reloadWithoutHasSubscription helper).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Fix format
* Update services/web/test/frontend/features/subscription/components/dashboard/subscription-dashboard.test.tsx
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Fix change-plan tests after location.reload → location.replace migration
reloadWithoutHasSubscription calls location.replace() not location.reload(),
so update assertions accordingly. Also stub toString() to return the jsdom
origin so FlashMessage's replaceState call doesn't throw a SecurityError.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Guard reloadWithoutHasSubscription against empty URL
When called after component unmount, useLocation's toString() returns '',
causing new URL('') to throw. No-op early to avoid the exception.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Guard against empty URL in history state replacement for subscription cancellation
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
GitOrigin-RevId: 8408ee971adf038e2d819eae5df060ace62a7e14
* Revert "Revert "Adding More Ai Quota Tiers (#32128)" (#32431)"
This reverts commit f0ea19b418da6096c84b42024aea643807347649.
* fix: dont block workbench from users who have access via WF
* fix: simplify workbench access rules and ensure wf premium users can use workbench
GitOrigin-RevId: 7927248eadd906d7f802d55fa5c6bc7df162b141
* feat: adding tiers for free and standard
* feat: updating feature calculation to account for more quota tiers
* feat: rename freeTrialQuota to freeQuota
* feat: add hasAiFreeTier and hasUnlimitedAi to editor, block free tier from using workbench
* fix: updating tests
* fix: updating ordering precedence for quota tiers
* feat: bump unlimited ai fair usage to 300 uses
* fix: update workbench quota usage for unlimited plans
* feat: bump features version for ai quota split
* feat: popover should only show for relevant users on workbench, and adding upgrade notification to ineligible users
GitOrigin-RevId: e3ef38797f267677cad51d7273272623027ca330
* feat: migrate from aiErrorAssist naming for disabling AI features to aiFeatures.enabled to avoid confusion
feat: keep aiErrorAssistant as setting on user object until migration is run
* feat: migrate writefull.enabled unset to instead use promotionSet false
* feat: updating to use quota based system for AI usage
* feat: hide relevant sections of quota system behind split test
* feat: ship onAiFreeTrial instead of free quota amount to project meta
* fix: renaming splitTestEnabledForUser to featureFlagEnabledForUser
* fix: v1_personal should have free trial amount of ai quota
* fix: onAiFreeTrial in projectController should account for anonymous users with no features
* feat: fixing marketing exports for ai quotas
* feat: update features epoch
* feat: move to quota tiers, and map tier to numeric allowance within rateLimiters
GitOrigin-RevId: 17763447965aae5777053b783d2601517bfe6b12
* changing to pug conditional format for admin page conditional render
* feat: update notifications settings page and open BE route
feat: adding new page for notification prefs on user settings, along with updating saving prefs for global preferences
adding error handling and disabling when request is inflight
formatting and adding split test for viewing notification ettings
fix: updating to levels of preferences, and removing global type for preferences as we will now share the same backing settings between global and project preferences
feat: add global mute to user settings for notifications
making params in preferences schema optional
feat: update global settings to only set mute, and remove optional settings
fix: store userId as objectId, and filter based on global mute setting
GitOrigin-RevId: 947a95dc02d12b4a2d8e3cc29bd04c23af2aef25
* refactor PaymentService.getPaymentProviderAdminUrl to be more useful
* display all stripe customer accounts
* mv change segment modal to each account
* stripeSubscriptionData -> stripeCustomerData
GitOrigin-RevId: 4c1a277f5073ee7cb12f4596210ba4f8624451b8
Domagoj Kriskovic