Lucie GermainandClaude Opus 5
9cf4fa8bf5
* [web] gracefully handle failed oauth token exchange for reference managers Mendeley/ReadCube redirect back to /:ref_provider/oauth/token-exchange with `error` and `error_description` instead of `code` when a user declines consent. completeAuth forwarded the whole query string on to third-party-references, whose strict zod schema (d8c1679bb08) accepts only oauth_token, oauth_verifier and code, so the exchange failed and the user got a 500. The same forwarding also sent `state` on every callback, success or failure. `state` is web's own CSRF token and is never read by third-party-references, so it tripped the log-only schema on every single token exchange, and would have broken linking outright under REQ_VALIDATION_MODE=enforce. Forward only the credentials the exchange needs, and show a translated notification in the Reference managers section rather than erroring. Validate ref_provider against the known providers so the provider name can be interpolated into the message without reflecting a URL segment. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * [web] fix providerName argument and validate before deriving refProvider Address Copilot review on #36377: - The token-exchange failure handler passed `false` positionally into the `providerName` slot of _redirectWithLinkingError, so a failed exchange would have rendered "your false account". Pass providerName and an explicit false. - _getRefProviderBackendKey(req) ran before parseReq, so refProvider was derived from raw, unvalidated req.params. Parse first and derive from the validated params via _toRefProviderBackendKey; _getRefProviderBackendKey now delegates to it so the other handlers are unchanged. The completeAuth tests kept their assertions inside ctx.res.callback without awaiting the controller, so the callback fired after the test had already returned and the assertions were never enforced — which is why the suite was green with the providerName bug in it. Await the controller and assert inline. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * [web] add logOnly to the completeAuth schema and guard the provider lookup logOnly returns the raw input on a schema failure, so ref_provider can be an arbitrary URL segment. Check it against the display-name table rather than trusting the schema: unknown providers 404 in both validation modes, and providerName is guaranteed non-null for the rest of the handler. Also covers the schema half under REQ_VALIDATION_MODE=enforce, so dropping ref_provider from completeAuthSchema fails a test rather than passing unnoticed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> GitOrigin-RevId: b98eb5414fe8b672f44aab8c3690f7637d434cd2
overleaf/web
overleaf/web is the front-end web service of the open-source web-based collaborative LaTeX editor, Overleaf. It serves all the HTML pages, CSS and javascript to the client. overleaf/web also contains a lot of logic around creating and editing projects, and account management.
The rest of the Overleaf stack, along with information about contributing can be found in the overleaf/overleaf repository.
Running the app
The app runs natively using yarn and Node on the local system:
$ yarn install
$ yarn run start
Running Tests
To run all tests run:
make test
To run both unit and acceptance tests for a module run:
make test_module MODULE=saas-authentication
Unit Tests
The test suites run in Docker.
Unit tests can be run in the test_unit container defined in docker-compose.tests.yml.
The makefile contains a short cut to run these:
make test_unit
During development it is often useful to only run a subset of tests, which can be configured with arguments to the mocha CLI:
make test_unit TEST_NAME_PATTERN='AuthorizationManager'
To run only the unit tests for a single module do:
make test_unit_module MODULE=saas-authentication
Module tests can also use a TEST_NAME_PATTERN argument:
make test_unit_module MODULE=saas-authentication TEST_NAME_PATTERN=SSO
Acceptance Tests
Acceptance tests are run against a live service, which runs in the acceptance_test container defined in docker-compose.tests.yml.
To run the tests out-of-the-box, the makefile defines:
make test_acceptance
However, during development it is often useful to leave the service running for rapid iteration on the acceptance tests. This can be done with:
make test_acceptance_app_start_service
make test_acceptance_app_run # Run as many times as needed during development
make test_acceptance_app_stop_service
make test_acceptance just runs these three commands in sequence and then runs make test_acceptance_modules which performs the tests for each module in the modules directory. (Note that there is not currently an equivalent to the -start / -run x n / -stop series for modules.)
During development it is often useful to only run a subset of tests, which can be configured with arguments to the mocha CLI:
make test_acceptance_run TEST_NAME_PATTERN='AuthorizationManager'
To run only the acceptance tests for a single module do:
make test_acceptance_module MODULE=saas-authentication
Module tests can also use a TEST_NAME_PATTERN argument:
make test_acceptance_module MODULE=saas-authentication TEST_NAME_PATTERN=SSO
Routes
Run bin/routes to print out all routes in the project.
License and Credits
This project is licensed under the AGPLv3 license
Stylesheets
Overleaf is based on Bootstrap, which is licensed under the
MIT license.
All modifications (*.less files in public/stylesheets) are also licensed
under the MIT license.
Artwork
Silk icon set 1.3
We gratefully acknowledge Mark James for
releasing his Silk icon set under the Creative Commons Attribution 2.5 license. Some
of these icons are used within Overleaf inside the public/img/silk and
public/brand/icons directories.
IconShock icons
We gratefully acknowledge IconShock for use of the icons
in the public/img/iconshock directory found via
findicons.com