Commit Graph

869 Commits

Author SHA1 Message Date
Eric Mc Sween a3682af6e4 Merge pull request #33710 from overleaf/em-tpds-config
Clean up tpdsworker config from web and third-party-datastore

GitOrigin-RevId: 3856126d9dc856fea4bc4133b11402c35b10630b
2026-05-18 08:06:25 +00:00
Copilot 3980b9e580 Fix IDOR in exports by adding token verification (Issue #31637) (#32883)
* Fix IDOR in exports by adding token verification

Implement jdleesmiller's suggested fix for Issue #31637:
- V1: Return export token in create response
- V1: Verify token in get_export using secure_compare
- Web: Pass token through fetchExport and fetchDownload
- Web: Return token from exportProject to frontend
- Frontend: Pass token as query param on status/download requests
- Add tests for both services

Agent-Logs-Url: https://github.com/overleaf/internal/sessions/7ba5f535-fba2-49a8-91d4-c87bd332d3a0

Co-authored-by: briangough <7457354+briangough@users.noreply.github.com>

Fix window.location.pathname to .href to preserve query params

Code review correctly identified that window.location.pathname strips
query parameters. Switch to window.location.href so the token query
parameter is preserved in download URLs.

Agent-Logs-Url: https://github.com/overleaf/internal/sessions/7ba5f535-fba2-49a8-91d4-c87bd332d3a0

Co-authored-by: briangough <7457354+briangough@users.noreply.github.com>

Fix test mocks to include token in POST responses

Agent-Logs-Url: https://github.com/overleaf/internal/sessions/0350c6ef-0fff-4e98-8464-812cd92c523f

Co-authored-by: briangough <7457354+briangough@users.noreply.github.com>

fix formatting

Fix token assignment in initiateExport to use pollResponse token if available

Add requireExportToken config setting and tests for invalid/missing token cases

Agent-Logs-Url: https://github.com/overleaf/internal/sessions/059bdba2-4f7a-4407-a5a5-cfcffd888739

Co-authored-by: briangough <7457354+briangough@users.noreply.github.com>

fix formatting

Add tests for export status and token validation in ExportsController and MockV1Api

Co-authored-by: Copilot <copilot@github.com>

* Update services/v1/main/app/controllers/api/v1/overleaf/exports_controller.rb

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fix linting

* fix fetchString response handling in ExportsHandler tests

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Brian Gough <briangough@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Brian Gough <brian.gough@overleaf.com>
GitOrigin-RevId: 399aef8eaa15ab3655f0905482f3a31fe94e2251
2026-05-15 08:08:04 +00:00
Jakob Ackermann 7c50dc9990 [history-v1] add endpoint for downloading latest zip (#33181)
* [history-v1] add endpoint for downloading latest zip

* [web] address review feedback

* [web] tests: do not overwrite db.projects.overleaf, extend it

* [web] set includeReferer flag from downloading zip

GitOrigin-RevId: e63e549f004230086f82eccf03b43fd62bde6071
2026-05-13 08:06:53 +00:00
Jakob Ackermann b1931d0b3b [web] cleanup archived split-test assignments from user record on login (#33365)
* [web] cleanup archived split-test assignments from user record on login

Co-authored-by: Anna Claire Fields <anna.fields@overleaf.com>

* [migrations] purge archived split tests from all users

Co-authored-by: Anna Claire Fields <anna.fields@overleaf.com>

* [web] add missing mock and update snapshot test

* [web] gracefully access db.users.splitTests

---------

Co-authored-by: Anna Claire Fields <anna.fields@overleaf.com>
GitOrigin-RevId: bd185074a402556d7b7c812208cf834dd52b27a5
2026-05-13 08:06:49 +00:00
Jakob Ackermann 1df98c028d [web] add includeReferer flag to SplitTestHandler.getAssignment (#33235)
* [web] add includeReferer flag to SplitTestHandler.getAssignment

* [web] tests: migrate User.getSplitTestAssignment to async/await

I don't want to fight with callbacks and optional arguments. Just move
it to async/await. New tests should use async/await, so there is no
point in making this work in callback-hell.

* [web] remove unused URL import

GitOrigin-RevId: 6251001e6ba7354f704fa663be8ef365ca0b9d23
2026-05-12 08:06:21 +00:00
Brian Gough 3940f8c2a7 Merge pull request #33504 from overleaf/bg-upgrade-yauzl
Upgrade yauzl library in web to version 3.3.0

GitOrigin-RevId: 82b4158db7a432f4257bd48402840f07801c6d07
2026-05-11 08:05:47 +00:00
Eric Mc Sween 2bb35fafb8 Merge pull request #33490 from overleaf/em-parse-req-errors-2
Reintroduce custom error types in request validation

GitOrigin-RevId: 1985ca04c8fe693fb836b042517d94700343bc46
2026-05-08 08:10:13 +00:00
Brian Gough a6c8ce32c3 Merge pull request #33312 from overleaf/copilot/send-clear-site-data-header
Send `Clear-Site-Data` header on account deletion

GitOrigin-RevId: c3f0b5f27cc80a1927518c56436c3a808b144fb7
2026-05-07 08:07:20 +00:00
Eric Mc Sween 3da2d53acb Merge pull request #33413 from overleaf/revert-33040-em-parse-req-errors
Revert "Replace isZodErrorLike with custom error types in request validation"

GitOrigin-RevId: 1f51fe9e14ffabf283f1229552d3887136420f8f
2026-05-06 08:06:41 +00:00
Eric Mc Sween 98def949ec Merge pull request #33040 from overleaf/em-parse-req-errors
Replace isZodErrorLike with custom error types in request validation

GitOrigin-RevId: 9cb453a2cde595a00f5049e4829ea9e3dbe17b28
2026-05-06 08:06:37 +00:00
Jakob Ackermann d61e3f5521 [web] fix caching of session.analyticsId (#33300)
* [web] fix caching of session.analyticsId

* [web] disable analyticsIdMiddleware tests for Server Pro/CE

GitOrigin-RevId: 2acf76f937adabd62b1e9f876a858211ef7a13c6
2026-05-05 08:06:09 +00:00
Jakob Ackermann 37cc65ec7e [web] consolidate clsi downloads and add zod validation (#33069)
* [web] consolidate clsi downloads and add zod validation

* [validation-tools] make prettier happy

* [web] make clsiServerId optional

* [web] fix type of buildId

* [web] gracefully handle ObjectId

* [web] fix type of buildId

* [monorepo] address review feedback

- cjs export
- update module path in comments
- skip adding ?clsiserverid if not set
- allow nested output file download for submissions and add tests

* [web] address review feedback

* [web] cache one more zod schema

* [web] fix unit tests

GitOrigin-RevId: 0a1e618955983e035defd6d3c0528b81e0e85c95
2026-05-05 08:06:05 +00:00
Brian Gough 8a8679eb78 Merge pull request #33297 from overleaf/bg-fix-acceptance-tests-in-dev-env
fix: update migration commands to use yarn instead of east
GitOrigin-RevId: 9cfcc393cfc1855e1edba6ba90ebb7b3a76ecb6b
2026-05-01 08:06:01 +00:00
Jakob Ackermann 50abfe8f0c [migrations] add migration for back filling db.users.analyticsId (#33115)
* [migrations] add migration for back filling db.users.analyticsId

Co-authored-by: Davinder Singh <davinder.singh@overleaf.com>

* [web] add acceptance test for backfilling db.users.analyticsId

---------

Co-authored-by: Davinder Singh <davinder.singh@overleaf.com>
GitOrigin-RevId: a0840969ac0c4c84e874c6f00cf0a78857a4bb06
2026-04-30 08:06:38 +00:00
Jimmy Domagala-Tang 994932b8e3 [Web + Doc-Updater] Add track changes accepted notification (#32752)
* feat: update doc manager to return a list of contributors to the accepted change

* feat: add new notification type for accepting a tracked change

* update email with tracked changes accepted

* feat: update tests

* fix: feedback on consistent api and returns

* feat: adding new tests

* feat: self accepted changes shouldnt trigger notification, and using existing changesAccepted hook

* Add better subject and activity list for track change accepted (#33094)

* feat: add better activity list entry and subject header for accepted changes, to match other notifications

* feat: updating tests

* feat: updating accepting_user_id to just user_id

* fix: adding users in emailBuilder test to userCache

GitOrigin-RevId: 6114f77916b5f503b7bbbb5ca8fed99e58edc31b
2026-04-30 08:06:19 +00:00
Olzhas Askar 7c0595f9a9 Merge pull request #32063 from overleaf/oa-group-plans
[web] Rename group plans

GitOrigin-RevId: 8a3097dc1724709b5d7b163e0f9d968c21d63831
2026-04-30 08:05:10 +00:00
Jakob Ackermann da11cf2669 [monorepo] fix running tests locally (#33186)
* [monorepo] fix running tests locally

* [web] fix east invocation

* [web] move corepack into entrypoint

* [web] fix running module acceptance tests locally

* [web] fix merged module targets

* [web] remove spurious change

GitOrigin-RevId: 84cf7f8d768d3429c8a98c789acf76f6cecd6e3e
2026-04-29 08:05:42 +00:00
Olzhas Askar 396e158ecd Merge pull request #31991 from overleaf/oa-rename-student-plans
[web] Rename Individual plan names

GitOrigin-RevId: f0133fc4e06542d7c68e0a0211a2ecc32afa733d
2026-04-29 08:05:37 +00:00
Jakob Ackermann d56477565c [web] deduplicate getting the project when loading the editor (#32762)
* [web] enable async local storage on all the endpoints

Co-authored-by: Brian Gough <brian.gough@overleaf.com>

* [web] deduplicate getting the project when loading the editor

Co-authored-by: Brian Gough <brian.gough@overleaf.com>

* [web] use ProjectAccess state for computing analytics segmentation

Co-authored-by: Brian Gough <brian.gough@overleaf.com>

* [web] restore ownership of active flag and deferredTpdsFlushCounter

* [web] add missing await

* [web] update unit tests

* [web] add metrics for project access caching

* [web] add missing test mock

* [web] invalidate async local storage when changing project access

* [web] deduplicate project lookup when checking for token access

* [web] add helper function for getting cached ProjectAccess

* [web] add acceptance test for caching of ProjectAccess

* [web] account for saas-only project access in tests

* Revert "[web] enable async local storage on all the endpoints"

This reverts commit 1b82f3b935040e8cfd180d1f6bf4183a655580e2.

* [web] add async local storage to project endpoints in top-50

* [web] invalidate async local storage for project access from modules

Co-authored-by: Jessica Lawshe <jessica.lawshe@overleaf.com>

---------

Co-authored-by: Brian Gough <brian.gough@overleaf.com>
Co-authored-by: Jessica Lawshe <jessica.lawshe@overleaf.com>
GitOrigin-RevId: 3eea7956b24e6f937dc1c17948681063d4dca3ea
2026-04-17 08:07:08 +00:00
Jessica Lawshe c483994a63 Merge pull request #32115 from overleaf/jel-web-combine-domain-v1-v2
[web] Combine v1 and v2 domains data for groups with domain capture

GitOrigin-RevId: d718ff3dbceeaad792a618b9d5dd6f3196ebca30
2026-03-26 09:07:13 +00:00
Jessica Lawshe bdbff7c3f6 Merge pull request #28814 from overleaf/jel-v1api-promisify
[web] v1 API decaf cleanup and remove unused code

GitOrigin-RevId: 706506ca12df20be74c7c3b35bec4d74baa7f130
2026-03-20 09:06:49 +00:00
Andrew Rumble a92bf982b0 Merge pull request #31889 from overleaf/ar-remove-web-smoke-test
[web] remove smoke test

GitOrigin-RevId: 7911b5e800ef466c59131fd739f95b11a587359f
2026-03-06 09:11:30 +00:00
Jimmy Domagala-Tang f96d37b7e3 Revert "Revert "[Web] Enable Quota System for AI Features"" (#31771)
* Revert "Revert "[Web] Enable Quota System for AI Features (#31544)" (#31767)"

This reverts commit f6589bdbf0ac7e71313739e3e3f4fb5bedd48c22.

* Update writefull entitlement syncing for commons (#31774)

* feat: update wf entitlement syncing logic

* feat: remove unused env variable, and parse quota tier as string for analytics

GitOrigin-RevId: 37ae7522a249501719a64327e2b6aaff01a3cc0b
2026-03-06 09:07:15 +00:00
Jakob Ackermann 17e01526b4 [web] fix typo in i18n key (#31713)
* [web] fix typo in i18n key

* [web] sort locales

GitOrigin-RevId: 9736eae24cdbd7aabd995087de368c667b25b849
2026-02-24 09:07:18 +00:00
Jakob Ackermann 6c6e8d9a97 [monorepo] switch all output file reads to clsi-nginx (#31691)
* [monorepo] switch all output file reads to clsi-nginx

* [clsi-lb] allow gallery download requests

* [terraform] clsi: use nginx.conf from clsi service

* [clsi] fix flakey tests

* [clsi] replace alias with rewrite and root in nginx config

* [k8s] clsi-lb: expose download port on internal service

* [web] add explicit endpoint for downloading all output files

Serve the output.zip endpoint from clsi.

* [clsi] fix regex for latexqc submission ids

Previously, we only handled template submission ids.

GitOrigin-RevId: 6c3b21b01ec41ae767530b14aac31fbe3d640dd5
2026-02-24 09:07:12 +00:00
Jimmy Domagala-Tang 892047fcf6 Revert "[Web] Enable Quota System for AI Features (#31544)" (#31767)
This reverts commit 17763447965aae5777053b783d2601517bfe6b12.

GitOrigin-RevId: f6589bdbf0ac7e71313739e3e3f4fb5bedd48c22
2026-02-24 09:07:06 +00:00
Jimmy Domagala-Tang 92463fb3e2 [Web] Enable Quota System for AI Features (#31544)
* feat: migrate from aiErrorAssist naming for disabling AI features to aiFeatures.enabled to avoid confusion

feat: keep aiErrorAssistant as setting on user object until migration is run

* feat: migrate writefull.enabled unset to instead use promotionSet false

* feat: updating to use quota based system for AI usage

* feat: hide relevant sections of quota system behind split test

* feat: ship onAiFreeTrial instead of free quota amount to project meta

* fix: renaming splitTestEnabledForUser to featureFlagEnabledForUser

* fix: v1_personal should have free trial amount of ai quota

* fix: onAiFreeTrial in projectController should account for anonymous users with no features

* feat: fixing marketing exports for ai quotas

* feat: update features epoch

* feat: move to quota tiers, and map tier to numeric allowance within rateLimiters

GitOrigin-RevId: 17763447965aae5777053b783d2601517bfe6b12
2026-02-24 09:06:31 +00:00
Jakob Ackermann 03fd89fd77 [web] validate and parse email using EmailHelper when ratelimiting (#31622)
* [web] validate and parse email using EmailHelper when ratelimiting

* [web] use a fake email for rate-limiting ldap logins in Server Pro

GitOrigin-RevId: 27ea7724319e06c4d64ac81e1155dcab558da99c
2026-02-19 09:06:18 +00:00
Jakob Ackermann 7c70b749d4 [monorepo] remove PII and variables from error messages (#31508)
* [monorepo] remove PII and variables from error messages

Exclusions:
- scripts
- tests
- fuzzing
- SplitTestManager (messages are sent to admin frontend)
- Group setup (we may want an error per unique tuple)
- sharejs (unused types; text type errors are shadowed already)
- history-v1 error messages that are used by the ErrorRecorder
- errors that flag issues with configuration/call signatures

I've used these search terms for finding unwanted error messages:
- new Error(`
- new Error\(\n\s+` (regex search)
- new OError(`
- new OError\(\n\s+` (regex search)

* [web] throw NotFoundError from ProjectLocator

* [github-sync] fix OError.tag call in script

Co-authored-by: Jessica Lawshe <jessica.lawshe@overleaf.com>

* [templates] revert changes to test client

---------

Co-authored-by: Jessica Lawshe <jessica.lawshe@overleaf.com>
GitOrigin-RevId: 736857a4fc5d9bfb0f8cb03e0f004eda87e5a220
2026-02-17 09:05:04 +00:00
Jessica Lawshe 9d625fc834 Merge pull request #30964 from overleaf/jel-commons-migrate-email-not-primary
[web] Check all emails instead of just primary on group SSO callbacks

GitOrigin-RevId: 52ac46e04134772025ca1812d25aad2e68fa44ea
2026-01-29 09:06:26 +00:00
Alf Eaton 461acef756 [workbench] Add voice input to the prompt form (#30086)
GitOrigin-RevId: cecb613f8d204a68287e93deb6c62d071a039a8d
2026-01-28 09:07:19 +00:00
Andrew Rumble 2dfcfd1804 Merge pull request #30916 from overleaf/ar-allow-read-only-institution-access-for-admins-with-no-modify-capability
[web] Add view-only version of institution managers page

GitOrigin-RevId: 65d19e42220932fe268d595ea13d0ba0b18c4398
2026-01-22 09:06:49 +00:00
Anna Claire Fields ff8f77d85c replace staff access with role based sytem (#30004)
- remove references to staff access

GitOrigin-RevId: 5d7df3ae8bc78aa02b65ec0dac0a323520c3df15
2026-01-19 09:06:59 +00:00
Antoine Clausse 379788a8a6 [web] Promisify RegistrationTests and SessionTests (#30646)
* Promisify RegistrationTests.mjs

* Re-add `await this.user.request.get('/login')` and remove comment

* Promisify SessionTests.mjs

* Remove callback versions of RedisHelper

* Re-add `await this.user.request.get('/login')`

GitOrigin-RevId: 9d0e21336f348c6aff99cb262738163e611f5712
2026-01-19 09:06:06 +00:00
Tim Down 2b39beab80 Merge pull request #29697 from overleaf/ac-td-user-audit-log-index
Add migration to improve index on userAuditLogEntries

GitOrigin-RevId: c4a606e1ab7299008baa3b05ac1fb8ca18036fae
2026-01-14 09:05:31 +00:00
Jakob Ackermann 425e7b1e5b [web] enable mongo notablescan in CI (#29501)
* [monorepo] record ERROR/FATAL log messages in junit report

* [web] put SaaS specific code behind feature flag

* [web] use split test cache for getting user assignments

The unit tests needed updating as they did not replicate any of the
 mongo filtering. The acceptance tests cover this logic.

* [web] make better use of existing indexes

* [web] avoid col-scan in tests of notifications module

* [web] remove cleanup of empty feedbacks collection

* [web] add assertion for reason of rejected request in launchpad test

* [web] add missing indexes

* [web] enable mongo notablescan

* [web] make emailNotifications tests compatible with notablescan

GitOrigin-RevId: b888f2feeb3a0e915f068ae1c4ea23ec17821221
2026-01-13 09:06:38 +00:00
Domagoj Kriskovic 7b00e5d9f5 Add routes to save/get project notification preferences (#30114)
* Add routes to save/get project notification preferences

* update route url

* improve zod schema

* remove unused json response

* update schema and fix tests

* add jsdoc types to pass type-check

* remove using zod strict()

GitOrigin-RevId: f3ab5c88b58bd5af71e0504d0efbe03bdf9b243c
2025-12-16 09:07:07 +00:00
ilkin-overleaf 4801174f68 Merge pull request #30188 from overleaf/ii-domain-capture-group-sso-link
[web] Improved `group-sso-link` logs

GitOrigin-RevId: 426dfa46c5c3a236382744fe408f33df81c5a9a0
2025-12-16 09:06:53 +00:00
Andrew Rumble f1e788d9b3 Merge pull request #29967 from overleaf/ar/web-remove-mocha-unit-tests
[web] remove mocha unit tests

GitOrigin-RevId: eda753af3470dbd1f385cb0bc3f06d78ade8a764
2025-12-03 09:05:37 +00:00
Andrew Rumble 07c827e9fd Merge pull request #29928 from overleaf/ar-last-infrastructure-conversions
[web] last infrastructure conversions

GitOrigin-RevId: ad1aff9b7df0610ed0303157d9e2c8032f32c02b
2025-11-28 09:05:56 +00:00
Andrew Rumble 18f44866e5 Merge pull request #29919 from overleaf/revert-29795-ar-last-infrastructure-conversions
Revert "[web] last infrastructure conversions"

GitOrigin-RevId: 48dc64553012afb5d2db4b2eb9c9898489b7e5ef
2025-11-27 09:05:54 +00:00
Andrew Rumble d748d8d606 Merge pull request #29795 from overleaf/ar-last-infrastructure-conversions
[web] last infrastructure conversions

GitOrigin-RevId: 68aa11625a9bc6d0d5324ecd95bb5ac52af8ee96
2025-11-27 09:05:30 +00:00
Simon Gardner 7dce5f0e25 Adds audit log entry for user Logout event
GitOrigin-RevId: 5a305166ba0e017ae7cb3d426cdae541e8db62c3
2025-11-25 09:05:38 +00:00
Malik Glossop 016778295a Merge pull request #29733 from overleaf/mg-transfer-ownership
Fix transfer ownership permissions

GitOrigin-RevId: b6d09704361507085e3eae8dc9240a36ae47c70e
2025-11-24 09:06:50 +00:00
Andrew Rumble beb6f6d484 Merge pull request #29597 from overleaf/ar-last-features-esm-conversion
[web] last features esm conversion

GitOrigin-RevId: a35ab995bf654f1cdfe0e0062d8806761ecccf2d
2025-11-21 09:05:36 +00:00
Andrew Rumble 5a4592b153 Merge pull request #29720 from overleaf/renovate-npm-glob-vulnerability
[Core] Update dependency glob to v11.1.0 [SECURITY] - abandoned

GitOrigin-RevId: 866612e84e2afd3edc97c244e22faeaff22484cf
2025-11-20 09:05:44 +00:00
Antoine Clausse 1447842fbd Remove scripts about unconfirmed emails removal (#29683)
* Remove unconfirmed email deletion scripts

* Remove tests

GitOrigin-RevId: a0ef84207fced135a13074265fe5d3b38400d76f
2025-11-18 09:05:29 +00:00
Andrew Rumble 394c60f2cf Merge pull request #29659 from overleaf/revert-29656-revert-29521-ar-models-es-conversion
Revert "Revert "[web] Convert models and self-referential test files to ESM ""

GitOrigin-RevId: f64000ae31d298b075a8722dfc51f294c71bc021
2025-11-18 09:04:56 +00:00
Andrew Rumble ae6dec9dcb Merge pull request #29656 from overleaf/revert-29521-ar-models-es-conversion
Revert "[web] Convert models and self-referential test files to ESM "

GitOrigin-RevId: 5455cccbb513bd9ca36ce526ff1553065f83d233
2025-11-13 09:06:36 +00:00
Andrew Rumble 7c9fea64ac [web] Convert models and self-referential test files to ESM (#29521)
from overleaf/ar-models-es-conversion

GitOrigin-RevId: a92ab8342c0f3e23155eacc0570458fc910c3d71
2025-11-13 09:06:13 +00:00