* Make CIAM copies of Pug files
passwordResetCiam.pug
setPasswordCiam.pug
* Update controller with split test assignment
* Use CIAM layout in passwordResetCiam.pug
* Style passwordResetCiam according to designs
* Use CIAM layout in setPasswordCiam.pug
* Style setPasswordCiam according to designs
* Use settings value in registration screen for must_be_at_least_n_characters
* Retrieve email input with a script
* Replace mb-4 by --ds-spacing-800
* Add eye icon to toggle password visibility
* Avoid double dots after some translated strings
* Use `ciamCustomFormDangerMessage`
* Use `ciamErrorNotification`
* Use `ciamButtonContentLoading`
* Replace remaining "mb" classes
* Move new password errors to the top of the form
* Fix CIAM mixins path after rebase
* Use `ciamCustomFormDangerMessage`
* Add `data-ol-spinner-inflight` to buttons
* Replace classname ciam-notification by notification-ds
Remove borders from CIAM notifications
Fix font size
* Revert "Use settings value in registration screen for must_be_at_least_n_characters"
This reverts commit a0af95c11e171097750ad7ee871f6baf89d5c0cb.
(It's Friday afternoon so I don't want to update unrelated stuff :D)
* Update: check_your_inbox
* Remove `.ciam-card` min-height.
Unnecessary thanks to `.confirm-email-success-form`'s min-height: 400px;
* Use phosphor icons
* Style `formMessagesNewStyle` with DS notifications within CIAM pages
Alternatively, we could extend/duplicate `showMessagesNewStyle` with a CIAM variant
* Revert "Style `formMessagesNewStyle` with DS notifications within CIAM pages"
This reverts commit ed382dc1e8cdf5b916c1527f4da0a825167e9675.
* Fix styling of dynamically-created DS notifications
* Set password length info to secondary color
* Move `ciamSamlErrorNotLoggedIn` to saas-authentication module
Prevents errors in CE:
Error: ENOENT: no such file or directory, open '/overleaf/services/web/modules/saas-authentication/app/views/_mixins.pug'
at /overleaf/services/web/app/views/_mixins/ciam_mixins.pug line 3
---------
Co-authored-by: Tim Down <158919+timdown@users.noreply.github.com>
GitOrigin-RevId: afe58f18ecee92460ab628a285b6edb48a5c678d
The affected values shouldn't ever have got past the validation in the
router (so the old behaviour should be unused)
GitOrigin-RevId: 3afbd09bd12279125b65fb0d3ec1242f0b456d6f
* Promisify clear_sessions_set_must_reconfirm.mjs
* Add test on PasswordResetTests.mjs
* Add `must-reset-password-unset` audit log
* Add `must-reset-password-set` audit log
* Add test ClearSessionsSetMustReconfirmTests.mjs
* Fixup bad copy-paste in test: `must-reset-password-set` -> `must-reset-password-unset`
* Check `must_reconfirm` before calling `removeReconfirmFlag`
Co-authored-by: Jakob Ackermann <jakob.ackermann@overleaf.com>
* Fix unit test
* Use `promiseMapWithLimit`
* Add `{ script: true }` to AuditLog. Also use `undefined` instead of `null` for consistency
---------
Co-authored-by: Jakob Ackermann <jakob.ackermann@overleaf.com>
GitOrigin-RevId: 522026c82196d263c196503d899b8c57b05b31dd
Allow checking permissions for all users on a project and rename checkPermissions -> AssertPermissions
GitOrigin-RevId: 511356cf2fe68367e284347e68e59f6116bd0f80
* Fix `revokeAllUserSessions` call in `_cleanupUser`
The user object should be passed, not the _id
* Change `revokeAllUserSessions` signature, take `req` and `stayLoggedIn` arguments
* Update uses of `revokeAllUserSessions`
* Fix promisified `revokeAllUserSessions` args
* Update tests
* Destroy or Regenerate the session in the end of `revokeAllUserSessions`
Per https://github.com/overleaf/internal/issues/17036#issuecomment-1938398570
* Revert "Destroy or Regenerate the session in the end of `revokeAllUserSessions`"
This reverts commit fe30734dbe45b27d2931d2e43a711d591bb85787.
* Rename `revokeAllUserSessions` to `removeSessionsFromRedis`
* Fixup tests
* Fix: add optional chaining in `req.sessionID` (!!)
GitOrigin-RevId: d41676bf00f463230af495e09c65fb9ee521f49f
* [web] set-password: reject same as current password
* [web] Add 'peek' operation on tokens
This allows us to improve the UX of the reset-password form,
by not invalidating the token in the case where the new
password will be rejected by validation logic.
We give up to three attempts before invalidating the token.
* [web] Add hide-on-error feature to async forms
This allows us to hide the form elements when certain
named error conditions occur.
* [web] reset-password: handle same-password rejection
We also change the implementation to use the new
peekValueFromToken API, and to expire the token explicitely
after it has been used to set the new password.
* [web] Validate OneTimeToken when loading password reset form
* [web] Rate limit GET: /user/password/set
Now that we are peeking at OneTimeToken when accessing this page,
we add rate to the GET request, matching that of the POST request.
* [web] Tidy up pug layout and mongo query for token peeking
Co-authored-by: Mathias Jakobsen <mathias.jakobsen@overleaf.com>
GitOrigin-RevId: 835205cc7c7ebe1209ee8e5b693efeb939a3056a
