* [web] read a linked project file's source from history
Behind the `linked-file-from-history` flag, a linked `project_file` import reads
the source out of the source project's latest history snapshot rather than out of
its file tree in mongo, where docs and files are two kinds of thing.
- `ProjectFileAgent` gains `_importFromHistory` alongside the existing
`_importFromProject`, and the flag picks between them. The snapshot only holds
what has reached history, so the source project is flushed through
document-updater and project-history first. A file that is editable is loaded
eagerly, which applies the edit operations sitting on top of its blob; one that
is not keeps its hash and is streamed. The file is promisified on the way.
- `History/HistoryOTContentManager.mjs` reads the latest chunk and rolls its
changes into a snapshot, retrying the read. `History/HistoryBlobStore.mjs` is
the blob store overleaf-editor-core asks for while loading a file.
- `LinkedFilesController` resolves the flag, including from the referer: the
import endpoints have no query string of their own. Every agent takes the
assignment so that the ones that do not read it still pass it along.
- `linked-file-from-history.spec.ts` drives the flag from the editor url, over
three imports from another project: a file uploaded to the source project and
then refreshed from it, an edit the source project has only made in its editor,
and a binary file. Both sources produce the same file, so which one was read is
asserted in the acceptance tests rather than here.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* [saas-e2e] add test coverage for tracked-delete in linked file source
* Apply suggestions from code review
Co-authored-by: Mathias Jakobsen <mathias.jakobsen@overleaf.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Mathias Jakobsen <mathias.jakobsen@overleaf.com>
GitOrigin-RevId: 3907d6d399e4b5315e68bf833663c06bc72f4011
* [docstore] use more realistic test stubs for ranges
* [monorepo] define ranges schemas in @overleaf/ranges-tracker
* [ranges-tracker] add legacy orderedRejections field in tracked-changes
* [monorepo] resolve @overleaf/ranges-tracker subpath imports in typescript
* [real-time] validate comment thread ids and tracked change id seeds
* [ranges-tracker] require ObjectId ids and tracked change metadata in ranges
* [monorepo] require ObjectId tracked change ids on the accept routes
* [web] use ObjectId comment thread ids in the DocumentController tests
GitOrigin-RevId: 58b20dec311d85b917ef63f9efbe745a265a2de6
* Cache Stripe prices and products in StripeClient
* Note the Stripe price cache in the price scripts and dev manual
* Add tests for the Stripe price and product cache
* Simplify the not-found guard in getProductsByIds
GitOrigin-RevId: eb2a270a3abe0e9bf53ca2ebee1f0ad02b1a4cc4
* [web] add preview payload to track-change notification types
* [doc-updater] pass accepted/rejected change data through to web for previews
* [web] snapshot change preview onto accepted/rejected notifications
* [web] render resolved change previews instead of accepted/rejected count lines
* [web] add unit coverage for accepted/rejected change preview flow
* fix: notification carries multiple previews per accept/reject batch; extract shared group helper
* fix: one preview per accept/reject action, drop adjacency grouping
* fix: move buildResolvedChangePreviews out of the email builder class
* fix: type error, make tests more explicit
* fix: render resolver below preview
* fix: overflow text, alignment
* fix: test error
* fix: resolved count
* [document-updater/web] send sparse change preview instead of full doc lines
* fix: store sparse preview, hydrate at render, drop CE gate
* fix: advance slice cursor past tracked-delete text in sparse preview
* fix: inline buildChangeGroupPreview
* fix: changePreviewBuilder -> sparseChangePreview
* fix: rm change_contributors
* fix: copilot flagged testing issues
* fix: hydrate and truncate change preview at write time
* fix: avoid materializing full doc text when slicing preview window
* fix: update reject preview test to hydrated shape
* fix: accepted delete removing context
* [document-updater/web] split resolved change previews into one per change cluster
* fix: narrow cluster userIds to string[] for typecheck
* feat: updating to use zod schema for previews
---------
Co-authored-by: Jimmy Domagala-Tang <jimmy.domagala-tang@overleaf.com>
GitOrigin-RevId: 0740713c715a61a220180f353e497b27da6a5b0f
* Record a metric for Stripe API request statuses to monitor rate limiting
* Add on() stub to Stripe mock in StripeClient unit tests
* Record the Stripe rate-limit reason for 429 responses
* Add acceptance test for Stripe rate-limit reason metric
GitOrigin-RevId: 1674b389f5a7fee403f980b6e813a3e2df81063c
[web] Add Stripe wallet payments (Apple Pay / Google Pay) in analytics and remove conversion to "card"
GitOrigin-RevId: f6d404d35eb108d7ddaf8ca1b6c2164cb5100c9c
* feat: cleaning up ai quota leftovers
fix: removing more straggler invos
* fix: featureUpdater still need analyticsId in the user projection
* feat: updating cypress tests to also check for fair usage text
GitOrigin-RevId: 09c1167106c144084c111beea56867f6aa4a0906
* Validate id types in LinkedFiles getSourceProject
Require source_project_id and v1_source_doc_id to be primitives before
querying Mongo, rejecting anything else with BadDataError.
* Validate refreshLinkedFile request params and body
Route refreshLinkedFile through parseReq with a schema requiring
project_id and file_id to be ObjectIds and typing the request body.
* Use well-formed ObjectIds in LinkedFilesController tests
Give the shared test setup valid ObjectId project_id/parent_folder_id
so parseReq passes and the controller logic is actually exercised, and
fail the tests if next is called unexpectedly.
* Use ObjectId file ids in v1 linked-file acceptance fixtures
The refresh route now validates file_id as an ObjectId, so the v1
not-imported fixtures need well-formed ids to reach the refuse-to-refresh
path (409) instead of failing id validation (404).
GitOrigin-RevId: d78b3664e825c6bb25ab2e363e5094b9212db307
* [web] store ObjectIds in addUserToProject acceptance test helper
* [web] optimize project lookup for tpds operations
GitOrigin-RevId: 03db9fc450556072f177d56f640fcc6114b295d4
Ship the new share-project modal (behind sharing-updates) wired to the
legacy token-based link sharing, and hide the new reusable-link
functionality (anyone with the link / group links) behind a new
sharing-updates-new-link split test.
- With the flag off, the modal offers two options, "Only invited people"
and "Via sharing links", both driven by publicAccessLevel; the reusable
-link options, privileges dropdown and copy-sharing-link button are hidden.
- Enable the flag in the acceptance tests that exercise those routes: a
seeded split test in saas, splitTestOverrides in non-saas.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: thomas- <2176518+thomas-@users.noreply.github.com>
GitOrigin-RevId: 3f34a2da5dbdc6f27ed389f9c25eea66143b8160
* [web] add endpoint for resolving a project for writes from tpds
* [web] return historyId from new endpoint for resolving projects
* [web] add zod validation to new endpoint for resolving projects
GitOrigin-RevId: 0e607e56442117a4150a08373169c44b53dd4fdf
* [migrations] only apply non-blocking migrations in CI
* [migrations] use "yarn run migrations" instead of "npm run migrations"
GitOrigin-RevId: d9f96db398adf2febcd82333295fb8d5eab741bb
* [web] split-tests: add helpers to using an already fetched mongo user
* [web] split-tests: add ignoreOverrides option to getAssignment
* [web] split-tests: reuse already fetched mongo users where possible
* [web] notifications: fetch users in bulk for split-test assignment
* [web] split-tests: use session for assignment where possible
* [web] split-tests: pass req/res down into domain-capture hook
* [web] split-tests: explicitly throw early
* [web] split-tests: refine jsdoc types
* [web] mark analyticsId and labsProgram as required in user model
* [web] split-tests: refine jsdoc types
* Revert "[web] split-tests: pass req/res down into domain-capture hook"
This reverts commit 897a158384cd2b3e416fc34495b20d1e2a0e68f0.
GitOrigin-RevId: ea4afd15c2506f369827b5193fd16d220d3c7d0e
* [web] throw early in UserCreator.createNewUser with missing analyticsId
* [migrations] rerun back-fill of db.users.analyticsId
GitOrigin-RevId: eabf16326192fca4dbea00ad643cee4315c426c6
* Add StripeClient mock-target support and Stripe test settings
Co-Authored-By: M Fahru <m.fahru@overleaf.com>
* Add Stripe payment page acceptance tests
Co-Authored-By: M Fahru <m.fahru@overleaf.com>
* Add MockStripeApi for stateful Stripe acceptance tests
Co-Authored-By: M Fahru <m.fahru@overleaf.com>
* Add Stripe subscription acceptance tests
* Add Stripe webhook acceptance tests
* Use a helper for setting the subscription status
---------
Co-authored-by: M Fahru <m.fahru@overleaf.com>
GitOrigin-RevId: b9bc50c914369da646ddb42ade1a02fd7baeb96b
* add script for uploading a file to a project
* fix default source name in script
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* reject folders as an upload destination
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* validate destination path when normalizing
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
GitOrigin-RevId: 4a6ce79652074475fc2065156718a23156e8b0bd
* Replace token-link email with 6-digit code on SSO registration
Unverified SSO emails previously received a long-lived token link
(90-day TTL) via UserEmailsConfirmationHandler. This replaces that
flow with the same 6-digit code verification used for password
registration, redirecting through /registration/confirm-email.
- SSOManager.registerSSO now always confirms email (caller must
verify first); removes sendConfirmationEmail / _finishRegistration
- SSOController._signUp sends confirmation code and stores
pendingSSORegistration in session when IdP email_verified is false
- New SSOConfirmEmailHandler completes registration after code check
via completeSSOEmailConfirmation module hook
- OnboardingController confirm-email handlers accept
pendingSSORegistration alongside pendingUserRegistration
confirmEmailFromToken (POST /user/emails/confirm) removal is deferred
to a follow-up PR to avoid breaking in-flight 90-day tokens.
Closes#28607
* Fix unverified-email edge cases; Add ORCID e2e tests;
* Rename `confirmEmail` parameter to `emailVerifiedByIdP` in _signUp function
* Remove `sendConfirmationEmail`
* Mock getUserByAnyEmail in tests
* Extract _finishSSORegistration helper to deduplicate the register →
set session flags → allocate referral → finishSaasLogin → finishLogin
sequence shared by both the direct and deferred (code-confirmed) paths.
* Stop duplicating session data in pendingSSORegistration
analyticsId, splitTests, and referal_* are already in the session at
confirmation time — no need to copy them into pendingSSORegistration.
Re-fetch splitTests fresh on completion instead.
* Simplify the code
* Remove dead confirmEmail template
No callers remain after sendConfirmationEmail was deleted. The token-link
flow (confirmEmailFromToken) only validates tokens, never sends email.
* Remove dead reconfirmEmail template
* Address comments from Copilot
* Clear stale pending registration when starting a new flow
* Add unit tests for completeSSOEmailConfirmation
* Add `verificationMethod` param
* Fix camelcase issues
* Extract _createSSOUser and _registerAndFinish helpers to deduplicate registration logic
* Remove obscure "registration_error"
* Prevent FormTextIcon from shrinking
* Enable "email_already_registered_sso" error
* Misc. improvements to confirm-email-form.tsx
* Remove `UserEmailsConfirmationHandler` mock
Co-authored-by: Olzhas Askar <olzhas.askar@overleaf.com>
* Add info on sso_email.pug page
---------
Co-authored-by: Olzhas Askar <olzhas.askar@overleaf.com>
GitOrigin-RevId: d0196ebc6d81ff61bcd27726d0b899b743d08d64
Tim Down