Commit Graph

1725 Commits

Author SHA1 Message Date
Jakob Ackermann
293d89a4cb [web] inline contacts service into web (#33546)
GitOrigin-RevId: d5e84d4f80f5ad4e951934d6dcdc332b0d26f3d0
2026-05-19 08:04:34 +00:00
Brian Gough
60860aa202 Merge pull request #33576 from overleaf/bg-jpa-convert-document-to-file
Modify convertDocToFile to bypass docstore

GitOrigin-RevId: 3ec789034a369d39d223450462394c8f303caa07
2026-05-19 08:04:13 +00:00
Eric Mc Sween
a3682af6e4 Merge pull request #33710 from overleaf/em-tpds-config
Clean up tpdsworker config from web and third-party-datastore

GitOrigin-RevId: 3856126d9dc856fea4bc4133b11402c35b10630b
2026-05-18 08:06:25 +00:00
Olzhas Askar
d388e48a99 Merge pull request #33679 from overleaf/oa-plan-names
[web] Get plan names from the settings

GitOrigin-RevId: 1e61975c3306c025f33e05686f9d2b57964b4f65
2026-05-18 08:05:52 +00:00
Copilot
3980b9e580 Fix IDOR in exports by adding token verification (Issue #31637) (#32883)
* Fix IDOR in exports by adding token verification

Implement jdleesmiller's suggested fix for Issue #31637:
- V1: Return export token in create response
- V1: Verify token in get_export using secure_compare
- Web: Pass token through fetchExport and fetchDownload
- Web: Return token from exportProject to frontend
- Frontend: Pass token as query param on status/download requests
- Add tests for both services

Agent-Logs-Url: https://github.com/overleaf/internal/sessions/7ba5f535-fba2-49a8-91d4-c87bd332d3a0

Co-authored-by: briangough <7457354+briangough@users.noreply.github.com>

Fix window.location.pathname to .href to preserve query params

Code review correctly identified that window.location.pathname strips
query parameters. Switch to window.location.href so the token query
parameter is preserved in download URLs.

Agent-Logs-Url: https://github.com/overleaf/internal/sessions/7ba5f535-fba2-49a8-91d4-c87bd332d3a0

Co-authored-by: briangough <7457354+briangough@users.noreply.github.com>

Fix test mocks to include token in POST responses

Agent-Logs-Url: https://github.com/overleaf/internal/sessions/0350c6ef-0fff-4e98-8464-812cd92c523f

Co-authored-by: briangough <7457354+briangough@users.noreply.github.com>

fix formatting

Fix token assignment in initiateExport to use pollResponse token if available

Add requireExportToken config setting and tests for invalid/missing token cases

Agent-Logs-Url: https://github.com/overleaf/internal/sessions/059bdba2-4f7a-4407-a5a5-cfcffd888739

Co-authored-by: briangough <7457354+briangough@users.noreply.github.com>

fix formatting

Add tests for export status and token validation in ExportsController and MockV1Api

Co-authored-by: Copilot <copilot@github.com>

* Update services/v1/main/app/controllers/api/v1/overleaf/exports_controller.rb

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fix linting

* fix fetchString response handling in ExportsHandler tests

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Brian Gough <briangough@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Brian Gough <brian.gough@overleaf.com>
GitOrigin-RevId: 399aef8eaa15ab3655f0905482f3a31fe94e2251
2026-05-15 08:08:04 +00:00
Miguel Serrano
5a886aa9fb [web] Add extra details to flexible license sales email (#32929)
* [web] Add extra details to flexible license sales email

GitOrigin-RevId: fbd41adae21c55c5e97f9531565100e1ae911808
2026-05-15 08:07:56 +00:00
Davinder Singh
a3a508d193 [WEB] Add analytics events for importing and exporting to different file types (#33614)
* adding events for success and failure for import and export from latex

* adding the operation property to capture the import/export keyword

GitOrigin-RevId: 2e5482b3c7517b402fc151966975ca8718729683
2026-05-14 08:06:30 +00:00
Jakob Ackermann
7c50dc9990 [history-v1] add endpoint for downloading latest zip (#33181)
* [history-v1] add endpoint for downloading latest zip

* [web] address review feedback

* [web] tests: do not overwrite db.projects.overleaf, extend it

* [web] set includeReferer flag from downloading zip

GitOrigin-RevId: e63e549f004230086f82eccf03b43fd62bde6071
2026-05-13 08:06:53 +00:00
Jakob Ackermann
b1931d0b3b [web] cleanup archived split-test assignments from user record on login (#33365)
* [web] cleanup archived split-test assignments from user record on login

Co-authored-by: Anna Claire Fields <anna.fields@overleaf.com>

* [migrations] purge archived split tests from all users

Co-authored-by: Anna Claire Fields <anna.fields@overleaf.com>

* [web] add missing mock and update snapshot test

* [web] gracefully access db.users.splitTests

---------

Co-authored-by: Anna Claire Fields <anna.fields@overleaf.com>
GitOrigin-RevId: bd185074a402556d7b7c812208cf834dd52b27a5
2026-05-13 08:06:49 +00:00
Mathias Jakobsen
62d92b70dd Merge pull request #33341 from overleaf/mj-two-step-export-web
[web] Add two-step pandoc conversion download

GitOrigin-RevId: 093f435a497a7583d2b4d23558415cc442f84553
2026-05-12 08:06:13 +00:00
Alf Eaton
b906de86db Add info to NotFoundError (#33440)
* Add info to errors in ProjectLocator

* Update ProjectLocator.test.mjs

* Add info to errors in SSOConfigManager

* Update SSOConfigManager.test.mjs

GitOrigin-RevId: 5a13350af1808f3a16a4bc8a9946cbe8f15e6b3a
2026-05-12 08:05:49 +00:00
Brian Gough
3940f8c2a7 Merge pull request #33504 from overleaf/bg-upgrade-yauzl
Upgrade yauzl library in web to version 3.3.0

GitOrigin-RevId: 82b4158db7a432f4257bd48402840f07801c6d07
2026-05-11 08:05:47 +00:00
Domagoj Kriskovic
11d35bd065 Test that pyodide package.json version matches fetch script
GitOrigin-RevId: e04ae191d2b1e5a08ba2e27518e61899d0e2d490
2026-05-11 08:05:39 +00:00
Jimmy Domagala-Tang
c37e46e1ad Add audit log entries when users max out their AI usage (#32886)
* feat: adding audit log entries when users max out their AI usage

* feat: also log when user hits quota exactly, since support wants to know that

* feat: moving audit logging to the rate limiters themselves

* feat: moving to single quota breach event with tool in info

* feat: adding audit log for ai quota tests

GitOrigin-RevId: 64056632f142a9ea22a703b7621234f93e9f6ec7
2026-05-08 08:10:23 +00:00
Eric Mc Sween
2bb35fafb8 Merge pull request #33490 from overleaf/em-parse-req-errors-2
Reintroduce custom error types in request validation

GitOrigin-RevId: 1985ca04c8fe693fb836b042517d94700343bc46
2026-05-08 08:10:13 +00:00
Mathias Jakobsen
5dc67db403 Merge pull request #33089 from overleaf/ds-export-md-files-pandoc
[WEB + CLSI] Download as markdown

GitOrigin-RevId: 181eddf2513e9c5edacbab37e93f9cac2191ee1a
2026-05-08 08:09:07 +00:00
Mathias Jakobsen
eddcc5a42e Merge pull request #32857 from overleaf/ds-pandoc-import-md
[WEB + CLSI] Import markdown files using pandoc

GitOrigin-RevId: adad7831ddb13a8fcb8063871166bde13cbbf1b6
2026-05-08 08:09:02 +00:00
roo hutton
498af9b07b Merge pull request #33467 from overleaf/rh-cio-prev-plan-type-fix
Only set previous_plan_type when normalised plan type changes

GitOrigin-RevId: 43133fc248bfb32b921da68bee91b445ca44eb1f
2026-05-08 08:08:11 +00:00
Jessica Lawshe
fc4e17d30f Merge pull request #32816 from overleaf/jel-domain-captured-by-group
[web] Check `domainCapturedByGroup` on domain instead of `group.domainCaptureEnabled` only for project/dash redirect

GitOrigin-RevId: a6389da9c943327e5941eaa24eb274106526f80b
2026-05-07 08:08:07 +00:00
roo hutton
5c348078c2 Merge pull request #33340 from overleaf/rh-pause-block
Prevent calls to pause endpoint if pause-subscription not enabled

GitOrigin-RevId: 6efd00391576441b3104e34def2e5ad110dcc853
2026-05-07 08:07:36 +00:00
Brian Gough
a6c8ce32c3 Merge pull request #33312 from overleaf/copilot/send-clear-site-data-header
Send `Clear-Site-Data` header on account deletion

GitOrigin-RevId: c3f0b5f27cc80a1927518c56436c3a808b144fb7
2026-05-07 08:07:20 +00:00
Jakob Ackermann
d97a659f92 [web] make double compile test parameters configurable via env vars (#33406)
* [web] make double compile test parameters configurable via env vars

* [k8s] web: enable double compile test for free compiles on n4 instances

GitOrigin-RevId: 3a5cb8ed6d044fcf3f4c0d2b9d252326bac48511
2026-05-06 08:07:28 +00:00
Eric Mc Sween
3da2d53acb Merge pull request #33413 from overleaf/revert-33040-em-parse-req-errors
Revert "Replace isZodErrorLike with custom error types in request validation"

GitOrigin-RevId: 1f51fe9e14ffabf283f1229552d3887136420f8f
2026-05-06 08:06:41 +00:00
Eric Mc Sween
98def949ec Merge pull request #33040 from overleaf/em-parse-req-errors
Replace isZodErrorLike with custom error types in request validation

GitOrigin-RevId: 9cb453a2cde595a00f5049e4829ea9e3dbe17b28
2026-05-06 08:06:37 +00:00
Antoine Clausse
cff35c743f [web] Fix wrong price shown in future payments preview when upgrading over a pending downgrade (#33305)
* fix(web): show correct plan in future payments preview when upgrading over a pending downgrade

When a user had a scheduled plan downgrade and then immediately upgraded
to a higher plan, makeChangePreview() always used the pending (stale)
plan code/name/price for the future payments display rather than the
newly selected plan.

Check whether the current change is a plan change (premium-subscription
or group-plan-upgrade type) and if so use subscriptionChange's plan
details instead of pendingChange's, since the immediate upgrade overrides
the scheduled downgrade.

Closes #33299

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* test(web): add unit tests for makeChangePreview pending-change plan override

Covers the four cases: premium-subscription and group-plan-upgrade types
use subscriptionChange plan (not pendingChange), add-on-purchase type
defers to pendingChange plan, and no-pending-change falls back to
subscriptionChange as before.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: cc2f9c88e5dfdfb89370798e857ea98caf8fcf85
2026-05-06 08:05:49 +00:00
Andrew Rumble
f434b1fc28 Merge pull request #33149 from overleaf/ar-ja-remove-i18next-additional-packages
[web] remove i18next additional libraries

GitOrigin-RevId: 98fc17b409090db32b02bb66953f1c2e6efee608
2026-05-06 08:05:41 +00:00
Jakob Ackermann
37cc65ec7e [web] consolidate clsi downloads and add zod validation (#33069)
* [web] consolidate clsi downloads and add zod validation

* [validation-tools] make prettier happy

* [web] make clsiServerId optional

* [web] fix type of buildId

* [web] gracefully handle ObjectId

* [web] fix type of buildId

* [monorepo] address review feedback

- cjs export
- update module path in comments
- skip adding ?clsiserverid if not set
- allow nested output file download for submissions and add tests

* [web] address review feedback

* [web] cache one more zod schema

* [web] fix unit tests

GitOrigin-RevId: 0a1e618955983e035defd6d3c0528b81e0e85c95
2026-05-05 08:06:05 +00:00
Kristina
fdc939fe0a [web] emit project:membership:changed when removing self from project (#33143)
GitOrigin-RevId: 5a101add69e0077f667f98f5b95c2476ad3085d4
2026-05-05 08:05:34 +00:00
Olzhas Askar
823f11426b Merge pull request #33109 from overleaf/oa-upgrade-path
[web] Upgrade path

GitOrigin-RevId: 532993e613bdc42cf92a7b10e629aa94596d854e
2026-05-01 08:07:01 +00:00
Antoine Clausse
353c681d51 [web] Disable AI Assist add-on purchase for plans-2026-phase-1 users (#33178)
Users in the plans-2026-phase-1=enabled split test can no longer
purchase the AI Assist add-on via crafted HTTP requests. The preview
and purchase endpoints return 404/redirect for these users.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: 2c75eb622cf44dc91019a692290ac646b51fd72c
2026-05-01 08:06:37 +00:00
Brian Gough
c19c25d113 Merge pull request #32874 from overleaf/bg-promisify-archive-manager
Promisify ArchiveManager

GitOrigin-RevId: 7a3ee3dfb2f07dc06ee894cfce0a9196622c878e
2026-05-01 08:06:05 +00:00
Brian Gough
eec3be362b Merge pull request #33172 from overleaf/bg-fix-project-upload-unlinks
fix: use fsPromises ins ProjectUploadController async functions for consistency
GitOrigin-RevId: beb858d9b6cf50431fb14626dfd7cddfaf093882
2026-05-01 08:05:52 +00:00
roo hutton
970bc85b78 Merge pull request #33247 from overleaf/rh-cio-fix-ai-group-enabled
Base group ai enabled cio attribute on group policy

GitOrigin-RevId: 2b2411aec3ffc694d2570e6031e9a876a1575e2c
2026-05-01 08:05:44 +00:00
Jimmy Domagala-Tang
41b96ec8d6 feat: ai quotas should reset when a new plan purchase is made or upgraded (#33095)
GitOrigin-RevId: 9034800e067426fc22f8f86f9d7309699797d02e
2026-04-30 08:06:30 +00:00
Jimmy Domagala-Tang
994932b8e3 [Web + Doc-Updater] Add track changes accepted notification (#32752)
* feat: update doc manager to return a list of contributors to the accepted change

* feat: add new notification type for accepting a tracked change

* update email with tracked changes accepted

* feat: update tests

* fix: feedback on consistent api and returns

* feat: adding new tests

* feat: self accepted changes shouldnt trigger notification, and using existing changesAccepted hook

* Add better subject and activity list for track change accepted (#33094)

* feat: add better activity list entry and subject header for accepted changes, to match other notifications

* feat: updating tests

* feat: updating accepting_user_id to just user_id

* fix: adding users in emailBuilder test to userCache

GitOrigin-RevId: 6114f77916b5f503b7bbbb5ca8fed99e58edc31b
2026-04-30 08:06:19 +00:00
Domagoj Kriskovic
117a783f21 [web] Add .py to defaultTextExtensions
GitOrigin-RevId: 0880c01f6e3b4267f6cb790a44c6094738ab2229
2026-04-30 08:05:30 +00:00
Olzhas Askar
7c0595f9a9 Merge pull request #32063 from overleaf/oa-group-plans
[web] Rename group plans

GitOrigin-RevId: 8a3097dc1724709b5d7b163e0f9d968c21d63831
2026-04-30 08:05:10 +00:00
Andrew Rumble
2f51ad5180 Merge pull request #32782 from overleaf/ar-allow-types-to-pass-through-for-parseReq
[web] fix typing of parseReq

GitOrigin-RevId: 6f10ed8682af7c999497e3a9fbd77a9d25bd7c28
2026-04-29 08:06:04 +00:00
Brian Gough
18b2308887 Merge pull request #32835 from overleaf/bg-fix-potential-race-condition-in-archive-manager
fix potential race condition in extractZipArchive

GitOrigin-RevId: 6dc77443e8a58172825d2b03645da05a9887e468
2026-04-28 08:07:26 +00:00
Simon Gardner
8a331bc943 fix: [web] managed group admins unable to re-subscribe (#29634)
GitOrigin-RevId: 5e3d46c39f4657fcc737403a80093b870bc42240
2026-04-28 08:06:27 +00:00
Kristina
b556fd40b5 [web] support email sender customization for email notifications (#33035)
GitOrigin-RevId: 9aa298c233c1f314ef3bdb381c20692bd0d4e212
2026-04-27 08:06:35 +00:00
Kristina
4db3982c08 [web] rename BaseWithHeaderEmailLayout -> BaseEmailLayout (#33026)
GitOrigin-RevId: 16967d34d5128a34ec9ddf382eb664e5a8e45065
2026-04-27 08:06:31 +00:00
Jessica Lawshe
7ff114bbef Merge pull request #32396 from overleaf/jel-unlink-sso
[web] Add button so user can unlink Commons SSO

GitOrigin-RevId: 46e0607549341a98beca3873ea63bf091a883e85
2026-04-24 08:06:48 +00:00
Davinder Singh
be5a7b56c8 [WEB + CLSI] Download as docx file feature (#32851)
* using CLSI logic for fetching the project contents and skip the .zip export

* Use unique conversion directory for project-to-docx export to avoid corrupting the shared compile
  directory when a compile runs concurrently

* Remove X-Accel-Buffering header — not needed as CLSI does not run behind nginx

* moving log before sending the data

* Return CLSI stream directly instead of buffering to disk on web

  Previously convertProjectToDocx wrote the CLSI response to a temp file
  on disk, then the controller read it back to stream to the client.
  Now the stream is returned directly and piped to the response,
  avoiding unnecessary disk I/O on the web server.

* Use href redirect for docx export instead of fetching blob into memory

* making functions and files more generic so they can be used in future for other documents exports as well

* adding export-docx split test

* adding unit tests

* adding cypress E2E test

* format:fix

* renaming the route to download from convert

* adding new icon for export docx button

* format:fix

* remove unused showExportDocumentErrorToast export and adding guard against invalid Content-Length header from CLSI

* format:fix

* refactor(clsi): move promisify(parse) into RequestParser

* refactor: generic conversion endpoint with type as route
  param

* refactor: use type→extension map for validated conversion types

* refactor(clsi): remove --standalone flag and fix rejection test

* fixing the href in cypress test

* renaming function

* adding type to Metrics.inc

* fix: rename exportProjectDocument, add WithLock wrapper and metrics type label

* format:fix

* fix: hide docx export from anonymous users and add WithLock wrapper

* format fix

* remove redundant Content-Length validation from DocumentConversionManager

* format:fix

* removing trailing icon

GitOrigin-RevId: e9764fefac2c4b625d23be9e942ea4a8b283c70d
2026-04-24 08:06:10 +00:00
Kristina
b6ec7945f4 [web] update copy in email notifications (#32912)
* add footerMessage to base email template
* add customized subject line and CTA
* add _getBundledActivityList

GitOrigin-RevId: e70c0955485b0892f31e20daa0430faef80b0d64
2026-04-23 08:07:01 +00:00
roo hutton
dece22ba92 Merge pull request #32871 from overleaf/rh-cio-comms-attributes
Expose remaining marketing properties to customer.io

GitOrigin-RevId: 6956e1faf90ecc650108404fe13b2f6de2eb4d0c
2026-04-23 08:06:04 +00:00
Mathias Jakobsen
1110172597 Merge pull request #32927 from overleaf/mj-themed-project-page-teardown
[web] Tear down new-user-system-overall-theme split test and themed-project-dashboard feature flag

GitOrigin-RevId: fe947a603266166332b73a5707bb6cbc9e3d03b9
2026-04-21 08:06:08 +00:00
Jakob Ackermann
4ce5620b1d [web] add metrics for mongo access in split test system (#32920)
GitOrigin-RevId: cd93401bace60c003a63914e2898cf1f0defdabc
2026-04-21 08:05:14 +00:00
Jakob Ackermann
d56477565c [web] deduplicate getting the project when loading the editor (#32762)
* [web] enable async local storage on all the endpoints

Co-authored-by: Brian Gough <brian.gough@overleaf.com>

* [web] deduplicate getting the project when loading the editor

Co-authored-by: Brian Gough <brian.gough@overleaf.com>

* [web] use ProjectAccess state for computing analytics segmentation

Co-authored-by: Brian Gough <brian.gough@overleaf.com>

* [web] restore ownership of active flag and deferredTpdsFlushCounter

* [web] add missing await

* [web] update unit tests

* [web] add metrics for project access caching

* [web] add missing test mock

* [web] invalidate async local storage when changing project access

* [web] deduplicate project lookup when checking for token access

* [web] add helper function for getting cached ProjectAccess

* [web] add acceptance test for caching of ProjectAccess

* [web] account for saas-only project access in tests

* Revert "[web] enable async local storage on all the endpoints"

This reverts commit 1b82f3b935040e8cfd180d1f6bf4183a655580e2.

* [web] add async local storage to project endpoints in top-50

* [web] invalidate async local storage for project access from modules

Co-authored-by: Jessica Lawshe <jessica.lawshe@overleaf.com>

---------

Co-authored-by: Brian Gough <brian.gough@overleaf.com>
Co-authored-by: Jessica Lawshe <jessica.lawshe@overleaf.com>
GitOrigin-RevId: 3eea7956b24e6f937dc1c17948681063d4dca3ea
2026-04-17 08:07:08 +00:00
roo hutton
c02ba36b83 Merge pull request #32594 from overleaf/rh-cio-migration-mapping
Add customer.io fields for migration comms and marketing initiatives

GitOrigin-RevId: f11ffee255d9582cbfd4c7e285bd6690c0cf1e3c
2026-04-17 08:05:47 +00:00