Zotero: fix: cloning projects failed with zotero (#253)

walks every project's folder tree and rewrites legacy Zotero linkedFileData to the new key names.

server-ce/nginx/overleaf.conf.template

@@ -21,7 +21,14 @@ server {
 		proxy_send_timeout 10m;
 	}
 
-	location ^~ /git/ {
+	# Only the git smart-HTTP endpoints of a project (/git/<project id>[.git]/...) are
+	# public. git-bridge's other routes (/status, /health_check, /metrics, /diags,
+	# /api/...) are meant for the internal network only and must not be reachable.
+	location /git/ {
+		return 404;
+	}
+
+	location ~ "^/git/[0-9a-f]{24}(\.git)?(/|$)" {
 		resolver_timeout 2s;
 		resolver 127.0.0.11 valid=10s;
 		set $git_upstream http://${GIT_BRIDGE_HOST}:${GIT_BRIDGE_PORT};

services/web/modules/git-bridge/app/src/GitBridgePATManager.mjs

@@ -101,14 +101,14 @@ const GitBridgePATManager = {
 
     if (!objToken?.user_id) return null
 
-// does the user still exists and not deleted?
+// does the user still exists, not deleted and not suspended?
 // tokens of a deleted user are not deleted until user expires
     const user = await db.users.findOne(
       { _id: new ObjectId(objToken.user_id) },
-      { projection: { _id: 1 } }
+      { projection: { _id: 1, suspended: 1 } }
     )
 
-    if (!user) return null
+    if (!user || user.suspended) return null
 
     // non-blocking
     db.oauthAccessTokens.updateOne(

services/web/modules/registration-page/app/src/UserRegistrationHandler.mjs

@@ -12,7 +12,7 @@ export default async function registerNewUserAndSendActivationEmail(userData) {
   let user
   try {
     const password = crypto.randomBytes(32).toString('hex')
-    user = await UserRegistrationHandler.promises.registerNewUser({ ...userData, password })
+    user = await UserRegistrationHandler.promises.registerNewUser({ ...userData, password, analyticsId: crypto.randomUUID() })
   } catch (error) {
     if (error.message === 'EmailAlreadyRegistered') {
       logger.debug({ email: userData.email }, 'user already registered')

services/web/modules/track-changes/app/src/TrackChangesController.mjs

@@ -37,8 +37,11 @@ const TrackChangesController = {
   async getAllRanges(req, res, next) {
     try {
       const { project_id } = req.params
-      const ranges = await DocumentUpdaterHandler.promises.getProjectRanges(project_id)
-      res.json(ranges)
+      // document-updater only knows the docs loaded in Redis. Flush them to
+      // docstore (without unloading) and read every non-deleted doc from there.
+      await DocumentUpdaterHandler.promises.flushProjectToMongo(project_id)
+      const docs = await DocstoreManager.promises.getAllRanges(project_id)
+      res.json(docs.map(doc => ({ id: doc._id, ranges: doc.ranges ?? {} })))
     } catch (err) {
       next(err)
     }
@@ -50,6 +53,9 @@ const TrackChangesController = {
 // provided here to assign names to authors who have left the project but still have unaccepted changes.
     try {
       const { project_id } = req.params
+      // Same as getAllRanges: a tracked change still in document-updater is
+      // not in docstore yet, so its author would be missing here.
+      await DocumentUpdaterHandler.promises.flushProjectToMongo(project_id)
       const memberIds = await DocstoreManager.promises.getTrackedChangesUserIds(project_id)
       const limit = pLimit(3)
       const users = await Promise.all(

tools/migrations/20261001000000_ce_sp_zotero_linked_file_data_keys.mjs

@@ -0,0 +1,77 @@
+import { batchedUpdate } from '@overleaf/mongo-utils/batchedUpdate.js'
+import { promiseMapWithLimit } from '@overleaf/promise-utils'
+import { db } from './lib/mongodb.mjs'
+
+const tags = ['server-ce', 'server-pro']
+
+const WRITE_CONCURRENCY = parseInt(process.env.WRITE_CONCURRENCY, 10) || 10
+
+// The Zotero module used to store linkedFileData with its own key names.
+// "Zotero: fix for 6.3.0" switched to the names accepted by the
+// overleaf-editor-core schema, but files imported before that still carry the
+// old keys, which document-updater rejects (e.g. when cloning the project).
+const LEGACY_KEYS = [
+  'zoteroGroupId',
+  'importedByUserId',
+  'importedByName',
+  'bibFormat',
+]
+
+function hasLegacyKeys(data) {
+  return (
+    data?.provider === 'zotero' && LEGACY_KEYS.some(key => key in data)
+  )
+}
+
+function convert(data) {
+  const importerId = data.importer_id ?? data.importedByUserId
+  const format = data.format ?? data.bibFormat
+  return {
+    provider: 'zotero',
+    group_id: data.group_id ?? data.zoteroGroupId ?? null,
+    ...(data.importedAt && { importedAt: data.importedAt }),
+    ...(importerId && { importer_id: importerId.toString() }),
+    importer_name: data.importer_name ?? data.importedByName ?? 'Unknown',
+    format: format === 'biblatex' ? 'biblatex' : 'bibtex',
+  }
+}
+
+function collectUpdates(folder, mongoPath, updates) {
+  if (!folder) return
+  ;(folder.fileRefs || []).forEach((file, i) => {
+    if (hasLegacyKeys(file?.linkedFileData)) {
+      updates[`${mongoPath}.fileRefs.${i}.linkedFileData`] = convert(
+        file.linkedFileData
+      )
+    }
+  })
+  ;(folder.folders || []).forEach((subfolder, i) => {
+    collectUpdates(subfolder, `${mongoPath}.folders.${i}`, updates)
+  })
+}
+
+const migrate = async () => {
+  await batchedUpdate(
+    db.projects,
+    {},
+    async nextBatch => {
+      await promiseMapWithLimit(WRITE_CONCURRENCY, nextBatch, async project => {
+        const updates = {}
+        ;(project.rootFolder || []).forEach((folder, i) => {
+          collectUpdates(folder, `rootFolder.${i}`, updates)
+        })
+        if (Object.keys(updates).length === 0) return
+        await db.projects.updateOne({ _id: project._id }, { $set: updates })
+      })
+    },
+    { _id: 1, rootFolder: 1 }
+  )
+}
+
+const rollback = async () => {}
+
+export default {
+  tags,
+  migrate,
+  rollback,
+}