* Replace request by fetch
* Promisify `dropboxDuplicateProjectNames`
* Promisify `dropboxUnlinkedDueToLapsedReconfirmation`
* Promisify `featuresUpgradedByAffiliation`
* Promisify `redundantPersonalSubscription`
* Promisify `projectInvite`
* Promisify `ipMatcherAffiliation`
* Promisify `tpdsFileLimit`
* Promisify `groupInvitation`
* Promisify `personalAndGroupSubscriptions`
* Sanitize URL
* Add default fetch timeout
* Update tests
* Update tests with fetch-utils
* Update external usage
* Import `ObjectId` from `mongodb-legacy`
Co-authored-by: Alf Eaton <alf.eaton@overleaf.com>
* Add `toString()` to userId in `ipMatcherAffiliation` calls
* [v1] Return "200 null" instead of no content in `v2/api/v2/users/:userId/ip_matcher` when there is no data, so it can be read as JSON in the frontend
Can't be 204 because of lint: "Do not specify body content for a response with a non-content status code"
* Temporarily remove `enrolment_ad_html` test to test notifications
* Revert "Temporarily remove `enrolment_ad_html` test to test notifications"
This reverts commit fb8b0c26a3adbbc64053cd3f5f2570ccc97328fb.
* Use `return await`
Co-authored-by: Andrew Rumble <andrew.rumble@overleaf.com>
---------
Co-authored-by: Alf Eaton <alf.eaton@overleaf.com>
Co-authored-by: Andrew Rumble <andrew.rumble@overleaf.com>
GitOrigin-RevId: 17ee861852aa4ac15d3b46b1b28c763fad5333d2
This reverts commit 32bb3c66b61d0de8cbbfe1da08042f06b4f4342a, reversing
changes made to 5e87b704cd90478aedc8d8befa0aa5787a53177b.
Co-authored-by: Eric Mc Sween <5454374+emcsween@users.noreply.github.com>
GitOrigin-RevId: 10b51500e3429a637dc76e3cec7d6b2764708ddb
* [web] Set Subscription pages to have `layout-react`
* [web] import `header-footer-react` in Subscription pages (!!)
* [web] Add `ol-user` meta tag to the subscription pages (!!)
⚠️ invite_logged_out.pug should be updated instead of setting the user as `{}`
* [web] Fix unit test
* [web] Update User types to handle a logged out user, add `LOGGED_OUT_USER` const
* [web] Add type `User` to `getSessionUser`
* [web] Remove `LOGGED_OUT_USER` const
* [web] Just pass `{ id: null }` as the user
* [web] Remove comment in pugs, it breaks things
* [web] Don't pass the full user to the frontend!!!
Co-authored-by: Jakob Ackermann <jakob.ackermann@overleaf.com>
---------
Co-authored-by: Jakob Ackermann <jakob.ackermann@overleaf.com>
GitOrigin-RevId: 1768f1f13de924a18be43c1a08614000500dcbec
* [web] Expose metric for active users in SP
* Removed redundant UserHandler.setupLoginData()
In the past this method was also calling
a now deleted notifyDomainLicence(), but now
this is just an alias for populateTeamInvites()
* Added migration for `lastActive`
* Added secondary read precedence to count active users
GitOrigin-RevId: 86d6db31e1ae74ae40c6599e6acb731d8c4a04bd
* Promisify `AuthenticationController.doPassportLogin`
* Update tests `AuthenticationController.doPassportLogin`
* Add test on error handling for `AuthenticationController.doPassportLogin`
* Add test on error handling for `V1LoginController.doLogin`
* Extract error handling to `getErrorObject` function
* Simplify code
* Add `Metrics` calls
* Add `password is too long` in AuthenticationController
* Make `info` object consistent with the rest of the codebase
* Move error handling to `AuthenticationManager.handleAuthenticateErrors`
* Move `handleAuthenticateErrors` to other file
I moved this solely because I didn't manage to test it otherwise
* Update tests
* Remove `preDoPassportLogin` hook call
* Remove test on `preDoPassportLogin`
* Use try/catch block instead of `.catch()`
* Revert "Use try/catch block instead of `.catch()`"
This reverts commit 3475afa93ce4af7ad55c91bfc1d7ad3317600ea5.
* Replace `.catch` by `try/catch`
GitOrigin-RevId: 3fba65c30a2c5fc6e5abcd5b83c52801852ed462
* Replace `LoginRateLimiter.processLoginRequest` call by use of `RateLimiterMiddleware`
* Lowercase the email to avoid rate-limit bypass
* Remove unit test "when the users rate limit"
* Use `EmailHelper.parseEmail` to normalize email in `processLoginRequest`
This should address the `trim()` bypass
* Use `.trim().toLowerCase()` instead of `EmailHelper.parseEmail`
We can't use `EmailHelper.parseEmail`, else it breaks the test (and feature): "with username that does not look like an email"
* Add acceptance test for rate limit
* Add comment on rate limits
* Rename `rateLimiter` to `rateLimiterLoginEmail` for clarity
* Make the login rate limits configurable from the settings
GitOrigin-RevId: cf1c3a416745f2b007c85014a5084570d4a049a7
* Promisify LdapController
* Update tests LdapControllerTests.js
* Promisify `AuthenticationController.finishLogin`
* Simplify null checks in LdapController
* Fix: don't use spread operator in module.exports
* Make `AuthenticationController.promises.finishLogin` a promise that resolves
* Fixup: `finishLogin` does not call `next` then the promise finishes, it calls it only on errors
* Use `Modules.promises.hooks.fire`
* Revert `processPassportLogin` callback style
* Update error handling: Use `OError.tag` instead of `logger.err`
* Fix unit tests: Rely on callbacks rather than promises
* Fix: Actually call `passport.authenticate` (!!)
* Update test: fixup `passport.authenticate` mocks
This would have caught the bugs that the previous commit is solving
* Remove `.then(() => next())` in `processPassportLogin`
Co-authored-by: Eric Mc Sween <eric.mcsween@overleaf.com>
---------
Co-authored-by: Eric Mc Sween <eric.mcsween@overleaf.com>
GitOrigin-RevId: a7eab5f5289956aeb8f2418408958daef3511ab7
* [web] upgrade @node-oauth/oauth2-server to ^5.1.0,
* Added `expressify` to middleware returned by Authentication.requireOauth()
* Extracted OAuth2 scope transformation to utilities
* Throw an error with undefined SAML scopes
GitOrigin-RevId: 00dfe81c707e9a3fcf9bb10e007c1fc646f7b9dd
