Commit Graph

526 Commits

Author SHA1 Message Date
yu-i-i
976716f607 Template gallery: add template management authorization middleware
- Middleware to enforce template access rules
- Introduce template manager role
- Fix minor issues
2026-05-19 15:51:35 +02:00
yu-i-i
83794e21a8 Remove OVERLEAF_OIDC_DISABLE_JIT_ACCOUNT_CREATION in favor of OVERLEAF_OIDC_ALLOWED_EMAIL_DOMAINS 2026-05-19 15:49:18 +02:00
yu-i-i
ad0b52dfda Introduce an environment variable to control user creation in OIDC authentication, closes #47 2026-05-19 15:49:18 +02:00
yu-i-i
444b277d6c Make Template Gallery optional; rename environment variables 2026-05-19 15:49:16 +02:00
yu-i-i
a321b54502 Add Template Gallery support 2026-05-19 15:49:15 +02:00
yu-i-i
fb3570054e Refactor authentication code; add OIDC support 2026-05-19 15:49:14 +02:00
Jimmy Domagala-Tang
c37e46e1ad Add audit log entries when users max out their AI usage (#32886)
* feat: adding audit log entries when users max out their AI usage

* feat: also log when user hits quota exactly, since support wants to know that

* feat: moving audit logging to the rate limiters themselves

* feat: moving to single quota breach event with tool in info

* feat: adding audit log for ai quota tests

GitOrigin-RevId: 64056632f142a9ea22a703b7621234f93e9f6ec7
2026-05-08 08:10:23 +00:00
Eric Mc Sween
2bb35fafb8 Merge pull request #33490 from overleaf/em-parse-req-errors-2
Reintroduce custom error types in request validation

GitOrigin-RevId: 1985ca04c8fe693fb836b042517d94700343bc46
2026-05-08 08:10:13 +00:00
Eric Mc Sween
3da2d53acb Merge pull request #33413 from overleaf/revert-33040-em-parse-req-errors
Revert "Replace isZodErrorLike with custom error types in request validation"

GitOrigin-RevId: 1f51fe9e14ffabf283f1229552d3887136420f8f
2026-05-06 08:06:41 +00:00
Eric Mc Sween
98def949ec Merge pull request #33040 from overleaf/em-parse-req-errors
Replace isZodErrorLike with custom error types in request validation

GitOrigin-RevId: 9cb453a2cde595a00f5049e4829ea9e3dbe17b28
2026-05-06 08:06:37 +00:00
Andrew Rumble
f434b1fc28 Merge pull request #33149 from overleaf/ar-ja-remove-i18next-additional-packages
[web] remove i18next additional libraries

GitOrigin-RevId: 98fc17b409090db32b02bb66953f1c2e6efee608
2026-05-06 08:05:41 +00:00
Andrew Rumble
30bedf3913 Merge pull request #33278 from overleaf/ar-mixpanel-autocapture
[web] mixpanel autocapture

GitOrigin-RevId: 81f6a11ae968da4c13a28e202dd3ed1113f365d4
2026-05-01 08:07:20 +00:00
Jimmy Domagala-Tang
41b96ec8d6 feat: ai quotas should reset when a new plan purchase is made or upgraded (#33095)
GitOrigin-RevId: 9034800e067426fc22f8f86f9d7309699797d02e
2026-04-30 08:06:30 +00:00
Andrew Rumble
2f51ad5180 Merge pull request #32782 from overleaf/ar-allow-types-to-pass-through-for-parseReq
[web] fix typing of parseReq

GitOrigin-RevId: 6f10ed8682af7c999497e3a9fbd77a9d25bd7c28
2026-04-29 08:06:04 +00:00
Eric Mc Sween
a52c47ebee Merge pull request #33090 from overleaf/em-fix-library-entry-list
Show library entry list on /library page

GitOrigin-RevId: 4336ec6803cca656092c190c3bce9f92d6923a47
2026-04-27 08:06:17 +00:00
Eric Mc Sween
60cc551c4d Merge pull request #33085 from overleaf/revert-32956-em-library-entry-list
Revert "Show library entry list on /library page"

GitOrigin-RevId: c2bb4d240f5e07c5a3ddfca62fc5749a3e5c56ab
2026-04-24 08:07:13 +00:00
Eric Mc Sween
2fdecb5d19 Merge pull request #32956 from overleaf/em-library-entry-list
Show library entry list on /library page

GitOrigin-RevId: 6c1c4e3ef66ea002525e5d5adb7943123f5d2587
2026-04-24 08:07:08 +00:00
Andrew Rumble
54d953cfff Merge pull request #32743 from overleaf/ar-new-v1-api
[web] new v1 api client

GitOrigin-RevId: 7ba0deef0d10526198a2a6ba997c2dcff7b7e5a5
2026-04-24 08:07:03 +00:00
Mathias Jakobsen
32255a4e6f Merge pull request #32936 from overleaf/mj-ce-themes
[web] Enable changing overall themes in SP/CE

GitOrigin-RevId: a6aa35e40826faec1001b658603b9f1cc8b0a50d
2026-04-21 08:06:31 +00:00
Jakob Ackermann
ad79c85cea [web] collect mongo stats on native client (#32909)
* [metrics] mongo: fail when command monitoring is not available

* [metrics] mongo: add optional client label to pool metrics

* [web] collect mongo stats on native client

* [metrics] mongo: record namespace of find commands

* [metrics] mongo: add counter for all the commands with collection label

* [web] add missing mock

GitOrigin-RevId: 9f378d8aa8d7167f56cf512681d63ef115c6dd98
2026-04-20 08:05:44 +00:00
Domagoj Kriskovic
ecda482213 add JSDoc comments for FileWriter methods and promises
GitOrigin-RevId: a7b2229b12973a8ebf4a1d6b94159efbd63df02a
2026-04-20 08:04:58 +00:00
Andrew Rumble
b115edc0a5 Merge pull request #32505 from overleaf/ar-remove-several-usages-of-request
[web] remove several usages of request

GitOrigin-RevId: d6259bd47342f6ca4ab6ed6fc71b58f4b4962eee
2026-04-17 08:06:16 +00:00
Anna Claire Fields
2487b73962 Implement sanitization of control characters in user input for hackerone (#32521)
GitOrigin-RevId: 859299da44b1c60220592c8f71a90536a5aa34a3
2026-04-14 08:04:36 +00:00
Andrew Rumble
972c6e4710 Merge pull request #31327 from overleaf/ar-allow-split-test-ui-without-admin-privilege
[web/admin-roles] allow split test UI without admin privilege

GitOrigin-RevId: 1d10153d7762196dd7a8df835af6193b38670fbc
2026-04-01 08:06:25 +00:00
Mathias Jakobsen
9542334fef [web] Hide docx import behind setting (#32499)
GitOrigin-RevId: 72406af0ea7dffac579991acc114e43ceed03a50
2026-03-30 08:05:49 +00:00
Anna Claire Fields
6113c6c291 Enable TS noImplicitAny in web (#31636)
GitOrigin-RevId: 18881694770f2476c475f8fef4c6a2678a2a12fe
2026-03-27 09:05:30 +00:00
Jimmy Domagala-Tang
72b7524094 Revert "Revert "Adding More Ai Quota Tiers"" (#32433)
* Revert "Revert "Adding More Ai Quota Tiers (#32128)" (#32431)"

This reverts commit f0ea19b418da6096c84b42024aea643807347649.

* fix: dont block workbench from users who have access via WF

* fix: simplify workbench access rules and ensure wf premium users can use workbench

GitOrigin-RevId: 7927248eadd906d7f802d55fa5c6bc7df162b141
2026-03-27 09:05:21 +00:00
Jimmy Domagala-Tang
6f3e0963b8 Revert "Adding More Ai Quota Tiers (#32128)" (#32431)
This reverts commit e3ef38797f267677cad51d7273272623027ca330.

GitOrigin-RevId: f0ea19b418da6096c84b42024aea643807347649
2026-03-26 09:06:42 +00:00
Jimmy Domagala-Tang
c87fd5c42e Adding More Ai Quota Tiers (#32128)
* feat: adding tiers for free and standard

* feat: updating feature calculation to account for more quota tiers

* feat: rename freeTrialQuota to freeQuota

* feat: add hasAiFreeTier and hasUnlimitedAi to editor, block free tier from using workbench

* fix: updating tests

* fix: updating ordering precedence for quota tiers

* feat: bump unlimited ai fair usage to 300 uses

* fix: update workbench quota usage for unlimited plans

* feat: bump features version for ai quota split

* feat: popover should only show for relevant users on workbench, and adding upgrade notification to ineligible users

GitOrigin-RevId: e3ef38797f267677cad51d7273272623027ca330
2026-03-26 09:06:37 +00:00
Jimmy Domagala-Tang
942d0e7081 feat: moving writefull endpoint configs to settings and splitting the… (#32065)
* feat: moving writefull endpoint configs to settings and splitting them by quota tier

* feat: updating getAllowance to account for WF premium

GitOrigin-RevId: a4f8b50065206f4e841e2488a8bc37a4a3e44574
2026-03-26 09:06:28 +00:00
Jimmy Domagala-Tang
bb5d90a332 Add usage quota to Workbench (#31782)
* feat: adding usage rate limiting to workbench and aligning editor context values for suggestionsLeft

* feat: prepend word token to headers of token rate limiter to prevent confusion with usage rate limiter

* Shared AI paywalls (#31948)

* feat: renaming hasPremiumSuggestion and adding token limits to editor context and project load

* feat: adding new ai features paywall component

* feat: rename getRemainingFeatureUses to token based naming for token based limiter, removed checking for feature usage on anonymous users, and removed guard on null userId since we shouldnt be calling getRemainingFeatureUses on a nonexistent user

* feat: using token rate limit headers to set token rate values in editor context

* feat: update workbench to be available without refreshing if rate limit reset occurs within session

* fix: move paywall out of inert section

* Hide new paywalls behind FF and open plans page on upgrade attempt (#32023)

* feat: hide new paywalls behind FF

* feat: update ai paywall buttons to navigate to plans page post quota plans change release

* feat: showing a fair limit notificaiton pre-quota change, and updating paywall to not fire if user has premium already (#32056)

GitOrigin-RevId: 565fb128d55543fea34c383bc4abeaa3dd148d09
2026-03-06 09:17:52 +00:00
Jessica Lawshe
e89c9128c3 Merge pull request #31783 from overleaf/jel-mongo-domainVerification
[web] Add `domainVerifications` collection

GitOrigin-RevId: 5a9fe9ea80ecf76af9802014149ae785cc4412d5
2026-03-06 09:17:33 +00:00
Jimmy Domagala-Tang
3fa5ce8b16 Add Shared Usage Quota to Writefull Functions (#31867)
* feat: moved error handling to controller, added config for each route, added usage rate limiter, and removed uneeded functions from manager

* feat: allow for 0 usage cost features in Writefull

* feat: update decrement to also use cost, and make cost optional, defaulting to 1

* feat: adding WF quota tests and updating tests for quota rate limiter (#31982)

* feat: adding WF quota tests and updating tests for quota rate limiter

* Apply suggestions from code review

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
GitOrigin-RevId: 281cb6b50b54c02f54a85a6492ca322ef8f00429
2026-03-06 09:14:46 +00:00
Jimmy Domagala-Tang
501e11a42a Move feature rate limiters to shared web folder (#31855)
* feat: remove old assist split test

* feat: moving featue rate limiters to main shared directory for use in multiple modules

* feat: base workbench rate limiter on a token specific base class

* feat: rename aiErrorAssistRateLimiter to AiFeatureUsageRateLimiter to better reflect its for our shared ai usage quota

GitOrigin-RevId: 89464d115b5904f6274756a7169e2b35945e2fc9
2026-03-06 09:13:40 +00:00
Jakob Ackermann
da50aee52c [web] disable buffering when downloading large files (#31874)
* [web] disable buffering when downloading large files

* [web] fix unit tests

GitOrigin-RevId: c8b0381962814fa62425364f03457600daf287ef
2026-03-06 09:10:32 +00:00
Antoine Clausse
b6c38ef5d0 [web] Show student discount pre checkout (#31820)
* Compute student discount from prices

* Add presentational discount in the checkout page

* Put student discount row behind feature flag

* Update code and tests to clarify that `currency` is always defined

* Introduce `usePlanPriceItems` to normalize the list

* Simplify `usePlanPriceItems`

Co-authored-by: Olzhas Askar <olzhas.askar@overleaf.com>

* Remove student discount percent

* Update Standard Monthly/Annual names in the checkout page

* Simplify `getRecommendedCurrency` mock

* Fix testid: price-summary-plan

* Add test on stripe-price-summary

* Add `Math.abs` on accessibility discounted info (!)

---------

Co-authored-by: Olzhas Askar <olzhas.askar@overleaf.com>
GitOrigin-RevId: f297eab4b6abd6a84842054667a3734cb33866fe
2026-03-06 09:09:41 +00:00
Jimmy Domagala-Tang
f96d37b7e3 Revert "Revert "[Web] Enable Quota System for AI Features"" (#31771)
* Revert "Revert "[Web] Enable Quota System for AI Features (#31544)" (#31767)"

This reverts commit f6589bdbf0ac7e71313739e3e3f4fb5bedd48c22.

* Update writefull entitlement syncing for commons (#31774)

* feat: update wf entitlement syncing logic

* feat: remove unused env variable, and parse quota tier as string for analytics

GitOrigin-RevId: 37ae7522a249501719a64327e2b6aaff01a3cc0b
2026-03-06 09:07:15 +00:00
Jimmy Domagala-Tang
892047fcf6 Revert "[Web] Enable Quota System for AI Features (#31544)" (#31767)
This reverts commit 17763447965aae5777053b783d2601517bfe6b12.

GitOrigin-RevId: f6589bdbf0ac7e71313739e3e3f4fb5bedd48c22
2026-02-24 09:07:06 +00:00
Jimmy Domagala-Tang
92463fb3e2 [Web] Enable Quota System for AI Features (#31544)
* feat: migrate from aiErrorAssist naming for disabling AI features to aiFeatures.enabled to avoid confusion

feat: keep aiErrorAssistant as setting on user object until migration is run

* feat: migrate writefull.enabled unset to instead use promotionSet false

* feat: updating to use quota based system for AI usage

* feat: hide relevant sections of quota system behind split test

* feat: ship onAiFreeTrial instead of free quota amount to project meta

* fix: renaming splitTestEnabledForUser to featureFlagEnabledForUser

* fix: v1_personal should have free trial amount of ai quota

* fix: onAiFreeTrial in projectController should account for anonymous users with no features

* feat: fixing marketing exports for ai quotas

* feat: update features epoch

* feat: move to quota tiers, and map tier to numeric allowance within rateLimiters

GitOrigin-RevId: 17763447965aae5777053b783d2601517bfe6b12
2026-02-24 09:06:31 +00:00
Antoine Clausse
43832b7a43 [web] Remove CIAM login notification and cookie (#31563)
* Remove legacy notification cookies

* Remove CIAM notification message from login page

* Remove e2e test "it can dismiss the login notification"

* Clarify comment about removing legacy notification dismiss cookies

GitOrigin-RevId: 33fdc02a397c0f4be491f030ab58fd8954276048
2026-02-19 09:06:49 +00:00
Jakob Ackermann
7c70b749d4 [monorepo] remove PII and variables from error messages (#31508)
* [monorepo] remove PII and variables from error messages

Exclusions:
- scripts
- tests
- fuzzing
- SplitTestManager (messages are sent to admin frontend)
- Group setup (we may want an error per unique tuple)
- sharejs (unused types; text type errors are shadowed already)
- history-v1 error messages that are used by the ErrorRecorder
- errors that flag issues with configuration/call signatures

I've used these search terms for finding unwanted error messages:
- new Error(`
- new Error\(\n\s+` (regex search)
- new OError(`
- new OError\(\n\s+` (regex search)

* [web] throw NotFoundError from ProjectLocator

* [github-sync] fix OError.tag call in script

Co-authored-by: Jessica Lawshe <jessica.lawshe@overleaf.com>

* [templates] revert changes to test client

---------

Co-authored-by: Jessica Lawshe <jessica.lawshe@overleaf.com>
GitOrigin-RevId: 736857a4fc5d9bfb0f8cb03e0f004eda87e5a220
2026-02-17 09:05:04 +00:00
Copilot
55c3b6b7ea Replace promisifyAll with individual promisify calls in web service (#30931)
* Initial plan

* Replace promisifyAll with individual promisify calls in all 8 files

Co-authored-by: Seinzu <194547+Seinzu@users.noreply.github.com>

* Remove unused promisify imports from V1Api and FileStoreHandler

Co-authored-by: Seinzu <194547+Seinzu@users.noreply.github.com>

* Fix formatting and remove unnecessary .bind() calls

Co-authored-by: Seinzu <194547+Seinzu@users.noreply.github.com>

* Fix formatting: collapse multi-line promisify calls to single lines

Co-authored-by: Seinzu <194547+Seinzu@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Seinzu <194547+Seinzu@users.noreply.github.com>
GitOrigin-RevId: c16a3f3ea48c93c2f62ad32c1f4512cd237882bf
2026-02-12 09:05:28 +00:00
Mathias Jakobsen
ae2d28505b [web] Abstract AiErrorAssistantRateLimiter (#31176)
* [web] Abstract AiErrorAssistantRateLimiter

* [web] Remove AI error assist reference in FeatureUsageRateLimiter

GitOrigin-RevId: cb12ea8b7a5a06576087b937380652fbe1948e95
2026-02-10 09:06:25 +00:00
Anna Claire Fields
ee4b5f515c Handle ERR_STREAM_UNABLE_TO_PIPE alongside ERR_STREAM_PREMATURE_CLOSE (#31174)
GitOrigin-RevId: bbf49237b177d7a58a9b13efc6f38f5eecfb745c
2026-02-03 09:05:50 +00:00
Mathias Jakobsen
2259c915e8 [web+ops+references] Remove references service code (#29699)
GitOrigin-RevId: 76656abe2e7b012355438d053a05e157bb719b0a
2026-01-28 09:06:34 +00:00
Antoine Clausse
b57df2602a [web] Reapply: Make CIAM login notification dismissible (with cookies) (#30829)
* Reapply "[web] Make CIAM login notification dismissible (with cookies) (#30251)"

This reverts commit 7bafafe54b24245c4da88d1c81540a3b1c98231b.

* Add a test `should redirect to /register with a notification`

* Fix destructuring of options in notification mixins

* Remove `data-ol-dismiss-cookie-paths` default, enforce it being set

* Handle the case of standard notifications without the dismiss setup

Co-authored-by: Jakob Ackermann <jakob.ackermann@overleaf.com>

---------

Co-authored-by: Jakob Ackermann <jakob.ackermann@overleaf.com>
GitOrigin-RevId: fbf441c1efe0aa5d80899a31ec3ad51c1dba6d24
2026-01-23 09:06:10 +00:00
ilkin-overleaf
f461dcc913 Merge pull request #30883 from overleaf/ii-domain-capture-url-expiry
[web] Add option to skip expiration checking when decoding JWT

GitOrigin-RevId: bc81b9e0581286ac26b0c31f0cb48e743bca5f9c
2026-01-21 09:05:53 +00:00
Alf Eaton
03a3518aae Merge pull request #30703 from overleaf/ae-prettier
Upgrade Prettier to v3.7.4

GitOrigin-RevId: 0f4434019bc7d12f2d5b7ecbb833ee20570d0706
2026-01-16 09:56:07 +00:00
Tim Down
64da16f0d1 Merge pull request #28670 from overleaf/td-rename-validate-req
Rename validateReq to parseReq

GitOrigin-RevId: a935aaa3f89495e164ce5d10b0bd80436571440f
2026-01-15 09:05:09 +00:00
Jakob Ackermann
425e7b1e5b [web] enable mongo notablescan in CI (#29501)
* [monorepo] record ERROR/FATAL log messages in junit report

* [web] put SaaS specific code behind feature flag

* [web] use split test cache for getting user assignments

The unit tests needed updating as they did not replicate any of the
 mongo filtering. The acceptance tests cover this logic.

* [web] make better use of existing indexes

* [web] avoid col-scan in tests of notifications module

* [web] remove cleanup of empty feedbacks collection

* [web] add assertion for reason of rejected request in launchpad test

* [web] add missing indexes

* [web] enable mongo notablescan

* [web] make emailNotifications tests compatible with notablescan

GitOrigin-RevId: b888f2feeb3a0e915f068ae1c4ea23ec17821221
2026-01-13 09:06:38 +00:00