* [migrations] only apply non-blocking migrations in CI
* [migrations] use "yarn run migrations" instead of "npm run migrations"
GitOrigin-RevId: d9f96db398adf2febcd82333295fb8d5eab741bb
* [web] split-tests: add helpers to using an already fetched mongo user
* [web] split-tests: add ignoreOverrides option to getAssignment
* [web] split-tests: reuse already fetched mongo users where possible
* [web] notifications: fetch users in bulk for split-test assignment
* [web] split-tests: use session for assignment where possible
* [web] split-tests: pass req/res down into domain-capture hook
* [web] split-tests: explicitly throw early
* [web] split-tests: refine jsdoc types
* [web] mark analyticsId and labsProgram as required in user model
* [web] split-tests: refine jsdoc types
* Revert "[web] split-tests: pass req/res down into domain-capture hook"
This reverts commit 897a158384cd2b3e416fc34495b20d1e2a0e68f0.
GitOrigin-RevId: ea4afd15c2506f369827b5193fd16d220d3c7d0e
* [web] throw early in UserCreator.createNewUser with missing analyticsId
* [migrations] rerun back-fill of db.users.analyticsId
GitOrigin-RevId: eabf16326192fca4dbea00ad643cee4315c426c6
* Add StripeClient mock-target support and Stripe test settings
Co-Authored-By: M Fahru <m.fahru@overleaf.com>
* Add Stripe payment page acceptance tests
Co-Authored-By: M Fahru <m.fahru@overleaf.com>
* Add MockStripeApi for stateful Stripe acceptance tests
Co-Authored-By: M Fahru <m.fahru@overleaf.com>
* Add Stripe subscription acceptance tests
* Add Stripe webhook acceptance tests
* Use a helper for setting the subscription status
---------
Co-authored-by: M Fahru <m.fahru@overleaf.com>
GitOrigin-RevId: b9bc50c914369da646ddb42ade1a02fd7baeb96b
* add script for uploading a file to a project
* fix default source name in script
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* reject folders as an upload destination
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* validate destination path when normalizing
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
GitOrigin-RevId: 4a6ce79652074475fc2065156718a23156e8b0bd
* Replace token-link email with 6-digit code on SSO registration
Unverified SSO emails previously received a long-lived token link
(90-day TTL) via UserEmailsConfirmationHandler. This replaces that
flow with the same 6-digit code verification used for password
registration, redirecting through /registration/confirm-email.
- SSOManager.registerSSO now always confirms email (caller must
verify first); removes sendConfirmationEmail / _finishRegistration
- SSOController._signUp sends confirmation code and stores
pendingSSORegistration in session when IdP email_verified is false
- New SSOConfirmEmailHandler completes registration after code check
via completeSSOEmailConfirmation module hook
- OnboardingController confirm-email handlers accept
pendingSSORegistration alongside pendingUserRegistration
confirmEmailFromToken (POST /user/emails/confirm) removal is deferred
to a follow-up PR to avoid breaking in-flight 90-day tokens.
Closes#28607
* Fix unverified-email edge cases; Add ORCID e2e tests;
* Rename `confirmEmail` parameter to `emailVerifiedByIdP` in _signUp function
* Remove `sendConfirmationEmail`
* Mock getUserByAnyEmail in tests
* Extract _finishSSORegistration helper to deduplicate the register →
set session flags → allocate referral → finishSaasLogin → finishLogin
sequence shared by both the direct and deferred (code-confirmed) paths.
* Stop duplicating session data in pendingSSORegistration
analyticsId, splitTests, and referal_* are already in the session at
confirmation time — no need to copy them into pendingSSORegistration.
Re-fetch splitTests fresh on completion instead.
* Simplify the code
* Remove dead confirmEmail template
No callers remain after sendConfirmationEmail was deleted. The token-link
flow (confirmEmailFromToken) only validates tokens, never sends email.
* Remove dead reconfirmEmail template
* Address comments from Copilot
* Clear stale pending registration when starting a new flow
* Add unit tests for completeSSOEmailConfirmation
* Add `verificationMethod` param
* Fix camelcase issues
* Extract _createSSOUser and _registerAndFinish helpers to deduplicate registration logic
* Remove obscure "registration_error"
* Prevent FormTextIcon from shrinking
* Enable "email_already_registered_sso" error
* Misc. improvements to confirm-email-form.tsx
* Remove `UserEmailsConfirmationHandler` mock
Co-authored-by: Olzhas Askar <olzhas.askar@overleaf.com>
* Add info on sso_email.pug page
---------
Co-authored-by: Olzhas Askar <olzhas.askar@overleaf.com>
GitOrigin-RevId: d0196ebc6d81ff61bcd27726d0b899b743d08d64
* [history-v1] add endpoint for downloading latest zip
* [web] address review feedback
* [web] tests: do not overwrite db.projects.overleaf, extend it
* [web] set includeReferer flag from downloading zip
GitOrigin-RevId: e63e549f004230086f82eccf03b43fd62bde6071
* [web] cleanup archived split-test assignments from user record on login
Co-authored-by: Anna Claire Fields <anna.fields@overleaf.com>
* [migrations] purge archived split tests from all users
Co-authored-by: Anna Claire Fields <anna.fields@overleaf.com>
* [web] add missing mock and update snapshot test
* [web] gracefully access db.users.splitTests
---------
Co-authored-by: Anna Claire Fields <anna.fields@overleaf.com>
GitOrigin-RevId: bd185074a402556d7b7c812208cf834dd52b27a5
* [web] add includeReferer flag to SplitTestHandler.getAssignment
* [web] tests: migrate User.getSplitTestAssignment to async/await
I don't want to fight with callbacks and optional arguments. Just move
it to async/await. New tests should use async/await, so there is no
point in making this work in callback-hell.
* [web] remove unused URL import
GitOrigin-RevId: 6251001e6ba7354f704fa663be8ef365ca0b9d23
* feat: update doc manager to return a list of contributors to the accepted change
* feat: add new notification type for accepting a tracked change
* update email with tracked changes accepted
* feat: update tests
* fix: feedback on consistent api and returns
* feat: adding new tests
* feat: self accepted changes shouldnt trigger notification, and using existing changesAccepted hook
* Add better subject and activity list for track change accepted (#33094)
* feat: add better activity list entry and subject header for accepted changes, to match other notifications
* feat: updating tests
* feat: updating accepting_user_id to just user_id
* fix: adding users in emailBuilder test to userCache
GitOrigin-RevId: 6114f77916b5f503b7bbbb5ca8fed99e58edc31b
* [web] enable async local storage on all the endpoints
Co-authored-by: Brian Gough <brian.gough@overleaf.com>
* [web] deduplicate getting the project when loading the editor
Co-authored-by: Brian Gough <brian.gough@overleaf.com>
* [web] use ProjectAccess state for computing analytics segmentation
Co-authored-by: Brian Gough <brian.gough@overleaf.com>
* [web] restore ownership of active flag and deferredTpdsFlushCounter
* [web] add missing await
* [web] update unit tests
* [web] add metrics for project access caching
* [web] add missing test mock
* [web] invalidate async local storage when changing project access
* [web] deduplicate project lookup when checking for token access
* [web] add helper function for getting cached ProjectAccess
* [web] add acceptance test for caching of ProjectAccess
* [web] account for saas-only project access in tests
* Revert "[web] enable async local storage on all the endpoints"
This reverts commit 1b82f3b935040e8cfd180d1f6bf4183a655580e2.
* [web] add async local storage to project endpoints in top-50
* [web] invalidate async local storage for project access from modules
Co-authored-by: Jessica Lawshe <jessica.lawshe@overleaf.com>
---------
Co-authored-by: Brian Gough <brian.gough@overleaf.com>
Co-authored-by: Jessica Lawshe <jessica.lawshe@overleaf.com>
GitOrigin-RevId: 3eea7956b24e6f937dc1c17948681063d4dca3ea
* [monorepo] switch all output file reads to clsi-nginx
* [clsi-lb] allow gallery download requests
* [terraform] clsi: use nginx.conf from clsi service
* [clsi] fix flakey tests
* [clsi] replace alias with rewrite and root in nginx config
* [k8s] clsi-lb: expose download port on internal service
* [web] add explicit endpoint for downloading all output files
Serve the output.zip endpoint from clsi.
* [clsi] fix regex for latexqc submission ids
Previously, we only handled template submission ids.
GitOrigin-RevId: 6c3b21b01ec41ae767530b14aac31fbe3d640dd5
* feat: migrate from aiErrorAssist naming for disabling AI features to aiFeatures.enabled to avoid confusion
feat: keep aiErrorAssistant as setting on user object until migration is run
* feat: migrate writefull.enabled unset to instead use promotionSet false
* feat: updating to use quota based system for AI usage
* feat: hide relevant sections of quota system behind split test
* feat: ship onAiFreeTrial instead of free quota amount to project meta
* fix: renaming splitTestEnabledForUser to featureFlagEnabledForUser
* fix: v1_personal should have free trial amount of ai quota
* fix: onAiFreeTrial in projectController should account for anonymous users with no features
* feat: fixing marketing exports for ai quotas
* feat: update features epoch
* feat: move to quota tiers, and map tier to numeric allowance within rateLimiters
GitOrigin-RevId: 17763447965aae5777053b783d2601517bfe6b12
* [web] validate and parse email using EmailHelper when ratelimiting
* [web] use a fake email for rate-limiting ldap logins in Server Pro
GitOrigin-RevId: 27ea7724319e06c4d64ac81e1155dcab558da99c
* [monorepo] remove PII and variables from error messages
Exclusions:
- scripts
- tests
- fuzzing
- SplitTestManager (messages are sent to admin frontend)
- Group setup (we may want an error per unique tuple)
- sharejs (unused types; text type errors are shadowed already)
- history-v1 error messages that are used by the ErrorRecorder
- errors that flag issues with configuration/call signatures
I've used these search terms for finding unwanted error messages:
- new Error(`
- new Error\(\n\s+` (regex search)
- new OError(`
- new OError\(\n\s+` (regex search)
* [web] throw NotFoundError from ProjectLocator
* [github-sync] fix OError.tag call in script
Co-authored-by: Jessica Lawshe <jessica.lawshe@overleaf.com>
* [templates] revert changes to test client
---------
Co-authored-by: Jessica Lawshe <jessica.lawshe@overleaf.com>
GitOrigin-RevId: 736857a4fc5d9bfb0f8cb03e0f004eda87e5a220
ilkin-overleaf