Commit Graph
28263 Commits
Author SHA1 Message Date
yu-i-i 2a2fd56c1a passport-saml was updated to v5.1.0 2026-06-21 06:13:29 +02:00
yu-i-i e3dba94e52 Fix: always include repository prefix in sandboxed compiles image name 2026-06-21 06:13:29 +02:00
yu-i-i 94d97c53bc Fix template publishing to align with upstream project context changes 2026-06-21 06:13:29 +02:00
yu-i-i 8c7e06eb30 Remove LDAP admin check via group search in ldap-passport 2026-06-21 06:13:29 +02:00
yu-i-i 266148be57 toggleSymbolPalette now in useEditorPropertiesContext 2026-06-21 06:13:28 +02:00
yu-i-i b431eec658 Set use-ai capability to false 2026-06-21 06:13:28 +02:00
yu-i-i 468ac4f487 Track changes: convert to mjs 2026-06-21 06:13:28 +02:00
yu-i-i b74e46df45 Track changes: use getTrackedChangesUserIds introduced in the mainstream 2026-06-21 06:13:28 +02:00
yu-i-i d468614e0d Remove OVERLEAF_OIDC_DISABLE_JIT_ACCOUNT_CREATION in favor of OVERLEAF_OIDC_ALLOWED_EMAIL_DOMAINS 2026-06-21 06:13:28 +02:00
Synésio Neto 67ae1841bc Introduce an environment variable to allow JIT OIDC users creation based on their email address domain. 2026-06-21 06:13:28 +02:00
yu-i-i e42db6638d Introduce an environment variable to control user creation in OIDC authentication, closes #47 2026-06-21 06:13:28 +02:00
David Rotermund 01017f419e I need the --network=host settings for building the container 2026-06-21 06:13:28 +02:00
yu-i-i cc58958ff8 Avoid DEP0174 by removing async from callback-based getGroupPolicyForUser 2026-06-21 06:13:27 +02:00
yu-i-i c3d176849c Fix login page 2026-06-21 06:13:27 +02:00
yu-i-i ce589b0a7d Symbol Palette: make close button visible 2026-06-21 06:13:27 +02:00
yu-i-i da5b2e4bd8 Template Gallery: replace markdown-it with marked 2026-06-21 06:13:27 +02:00
yu-i-i 1910826b4f Refactor Template Gallery; resolves #38 and #39
- Replace free-text license input with a select box
- Improve visual presentation of modals and enhance keyboard interaction
2026-06-21 06:13:27 +02:00
yu-i-i 8f65f6f01a Refactor Sandboxed Compiles 2026-06-21 06:13:27 +02:00
yu-i-i d8ef55fb2f Symbol Palette: improve keyboard input experience 2026-06-21 06:13:27 +02:00
yu-i-i b96e2bbb2d Symbol Palette: get rid of @reach/tabs 2026-06-21 06:13:26 +02:00
yu-i-i 33886c63a1 Add 'poll' to clsi seccomp profile, fixes minted. Thanks, David. 2026-06-21 06:13:26 +02:00
yu-i-i 77f3dcc3d8 Make Template Gallery optional; rename environment variables 2026-06-21 06:13:26 +02:00
yu-i-i a0e1c653cb Add Template Gallery support 2026-06-21 06:13:13 +02:00
yu-i-i f203e59820 Track changes / comments: update backend to support frontend changes 2026-06-20 16:20:22 +02:00
yu-i-i f8d23a8396 Allow EXTERNAL_AUTH to be undefined, fixes #26 2026-06-20 16:20:21 +02:00
yu-i-i 7915f411a6 Symbol palette: switch to 'OL' UI components and apply minor cosmetic changes 2026-06-20 16:20:21 +02:00
yu-i-i f2e4daab62 Make OVERLEAF_OIDC_USER_ID_FIELD support 'email' as a value 2026-06-20 16:20:21 +02:00
yu-i-i 8e222d107f See upstream commit 42ee56e 2026-06-20 16:20:21 +02:00
yu-i-i d35581fc1d Fix glitches in symbol palette after switching to Bootstrap 5 2026-06-20 16:20:21 +02:00
yu-i-i 4059c2142f Whitelist /oidc/login endpoint, fixes #21 2026-06-20 16:20:21 +02:00
yu-i-i 9bb70c57ab Add ENV variables to control SAML signature validation 2026-06-20 16:20:21 +02:00
yu-i-i 2c9a30aaf4 Re-export doLogout (was removed from exports in commit b9fb636). 2026-06-20 16:20:21 +02:00
yu-i-i 352f309632 Refactor authentication code; add OIDC support 2026-06-20 16:20:11 +02:00
yu-i-i 2365631ad3 Allow adding extra flags to LaTeX compiler through environment variable 2026-06-20 16:18:52 +02:00
yu-i-i 11c911f047 Enable LDAP and SAML authentication support 2026-06-20 16:18:52 +02:00
yu-i-i 6bbb6cd436 Enable Symbol Palette 2026-06-20 16:18:44 +02:00
yu-i-i 4688380b92 Allow selecting a TeX Live image for a project 2026-06-20 16:17:01 +02:00
Sam Van den Vonder 6ee70cb7c2 Enable Sandboxed Compiles feature 2026-06-20 16:17:01 +02:00
yu-i-i daaabcd259 Enable autocomplete of reference keys feature 2026-06-20 16:17:00 +02:00
yu-i-i e106b71b7d Enable track changes and comments feature 2026-06-20 16:17:00 +02:00
yu-i-i 88e9a70e2e Redirect non-existing links to Overleaf page 2026-06-20 16:17:00 +02:00
Mathias Jakobsen ef05288f81 Merge pull request #34714 from overleaf/mj-tracked-change-merges
[overleaf-editor-core+ranges-tracker] Pick lower timestamp when merging tracking info

GitOrigin-RevId: 5b1c8d7c719003df4506014c381f2a525d0a7ff4
2026-06-19 08:07:27 +00:00
Eric Mc Sween 7ee385fe45 Merge pull request #34816 from overleaf/revert-34643-em-library-backend-search
Revert "Library search: make backend search tokens consistent with frontend (follow-up to #34386)"

GitOrigin-RevId: 83328f2ee4a9c3f668325fa4de1ca652e7c718bf
2026-06-19 08:07:19 +00:00
Eric Mc Sween 80218df85e Merge pull request #34643 from overleaf/em-library-backend-search
Library search: make backend search tokens consistent with frontend (follow-up to #34386)

GitOrigin-RevId: 91ef5b5dc81ba8ebda43e746c9b747b7636f3e80
2026-06-19 08:07:12 +00:00
Eric Mc Sween 0371ba46f6 Merge pull request #34693 from overleaf/em-upload-bib
[web] Add "Upload .bib file" option to library

GitOrigin-RevId: 7067a4cb10f0973c0423507836ef13555329942c
2026-06-19 08:07:08 +00:00
Kate Crichton 0883e0fec0 Merge pull request #34513 from overleaf/kc-verify-domain-from-table
[web] verify domain from table

GitOrigin-RevId: 2e41f76be26b81f204208fab714f2e3399071499
2026-06-19 08:06:34 +00:00
Kate Crichton f7b1ccae9a Merge pull request #33852 from overleaf/kc-schedule-domain-verification
[web] schedule domain reverification

GitOrigin-RevId: 08217692960379d0a6f7ce457032b1182fb2bf4e
2026-06-19 08:06:30 +00:00
Liam O'BrienandClaude Opus 4.8 bc9c85019f Lo zotero initial library sync (#34456)
* Migration and index setup script

* Helper script to clear linked library

* Pull users collections

* Implementing get items from users zotero library

* Initial zotero sync client

* Pulling users overleaf collection

* Pulling users overleaf collection

* Initial sync pull from Zotero to Library

* Sync and import workflow from Zotero into Library

* Using user getter and setter for updating user library info

* Using new collection for library sync states

* Adding tests for new sync functionality

* Harden Zotero sync route

* Simplify Zotero sync state read and skip accounting

Fold the ensure+get double round-trip in sync-state discovery into one
findOneAndUpdate, and derive itemsSkipped from items.length - itemsInserted
instead of a running counter.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Redact URL-encoded token secret from OAuth1 request logs

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fixing type failure

* Rename upsertZoteroReferences to importZoteroReferences

The method is insert-only; the bulkWrite upsert just makes re-runs
idempotent rather than updating, so the name now reflects that.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Validate librarySyncStates reads with zod

Replace the `as` / `as unknown as` casts in getLibrarySyncState and
ensureLibrarySyncState with a zod schema parse, matching
LibraryReferenceRepository. Types are now derived from the schema.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Defer Zotero sync watermark until pagination exists

Don't record lastSyncedVersion after a single-page sync: committing the
page-1 version before pagination (#34286) lands would let incremental
sync (#34282) skip items beyond the first page. Drops the commitSyncState
call and toVersion from SyncResult; the version envelope is left for the
follow-ups. commitSyncState stays in the repository for #34282.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Extract OAuth1Transport from OAuth1Handler

Lift the OAuth1 client/config registry, getAccessToken, redactSecret and
classifyOAuth1Error into oauth1/OAuth1Transport.js, plus a signedGet
helper for provider modules to reuse. OAuth1Handler now imports them; its
method bodies are unchanged. Test mocks move to esmock's global scope so
they reach the transport, with Errors pinned for instanceof checks.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Move Zotero collections/items into a per-provider ZoteroProvider

Carve the Zotero-only operations out of the generic OAuth1 handler into
providers/ZoteroProvider.js, dispatched via providers/ProviderRegistry.js.
ReferenceProviderHandler now resolves the provider from the registry and
throws UnsupportedOperationError (mapped to 501) for providers without the
operation, instead of bolting Zotero-only methods onto OAuth1Handler.

Zotero's collectionsUri/itemsTopUri are read from settings by ZoteroProvider
rather than copied into the shared OAuth1 registry. Removes getCollections/
getUsersItemsChanges (and their tests) from OAuth1Handler.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Add ZoteroProvider unit tests and unsupported-provider coverage

Cover ZoteroProvider collections/items parsing, header envelope and
malformed-payload rejection, and assert ReferenceProviderHandler throws
UnsupportedOperationError for providers without a sync implementation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Make addSyncedCollection idempotent

Only push a synced collection when its key isn't already recorded, so a
repeat sync can't create duplicate syncedCollections entries regardless of
the caller-side guard. Adds a sequential test asserting no duplicate.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Hardcode Zotero library endpoint paths, derive host from site

Move the collections/items-top endpoints out of settings and into
ZoteroProvider as path constants, taking only the host from the
provider's `site`. Aligns Zotero `site` with the other providers
(API host) and avoids adding per-endpoint config points.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Make Zotero sync routes explicit, 404 unknown providers

Hardcode the collections/items routes to /zotero rather than a generic
/:ref_provider, so a non-Zotero request 404s on the missing route
instead of returning a misleading 501. Drop the UnsupportedOperationError
501 branch, reverting OAuth2 unsupported ops to their prior 500.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
GitOrigin-RevId: 50e16a9c46f995c2e9db6eed50ef81c3a71ea71d
2026-06-19 08:06:07 +00:00
Antoine ClausseandClaude Opus 4.8 e5f712a857 [web] Cleanup plans-2026-phase-1 - phase 2: pug/backend pricing (#34623)
* Remove `plans2026` from pug files in subscriptions module

* Remove `plans2026` param from `makeGroupPlans`

* Remove `plans2026` param from `makeUISettings` in interstitial-payment.mjs

* Remove `plans2026` param from `makeInterstitialPaymentConfig` in interstitial-payment.mjs

* Remove `plans2026` param from `makeIndividualPlans`

* Remove `plans2026` param from `makeStudentPlans`

* Remove `plans2026` from try-premium page

* Remove `plans2026` from controllers

* Remove unused files

* Update translations

* Update tests

* Update tests

* Remove unused translations

* Rename the collaborator upgrade-mode test to read explicitly as the
Standard-plan replacement for the removed redirect test, and drop the
stale "when plans 2026 is enabled" framing now the controller no longer
branches on the flag.

* Surface controller errors in InterstitialPayment tests

Move assertions out of the res.render callback into render/redirect
helpers that resolve with the captured args and reject on the wrong
path or a controller rejection, so failures show the real error
instead of timing out. Restore the ai-limit-upgrade-copy split-test
assignment for the AI copy tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* format

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
GitOrigin-RevId: f0b055b4d92b494b531766a13b057336d9c2c9af
2026-06-19 08:06:03 +00:00
David d6e55f81ff Merge pull request #34750 from overleaf/dp-cleanup-reference-settings-migration
[web] Remove reference manager settings migration code

GitOrigin-RevId: 1062e1f08a6e6d4547f48c965c342d2ac15e9a4f
2026-06-19 08:05:56 +00:00