Fix Lumière theming + upload timeout via global middleware

Theming: replace per-controller isLumiere lookups with a single
ExpressLocals middleware that sets res.locals.isLumiere for every
web request. Uses getOverallTheme() (now exported from
UserSettingsHelper) so the date-based default is handled correctly.
This covers 404, settings, setPassword, activate, and all future
server-rendered pages automatically.

Upload timeout: add client_body_timeout 15m to nginx.conf.template
at the http level (was defaulting to 60s globally). This is more
reliable than the location-specific override from build 229.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server-ce/nginx/nginx.conf.template

@@ -47,6 +47,7 @@ http {
 	gzip_proxied any; # allow upstream server to compress.
 
 	client_max_body_size 500m;
+	client_body_timeout 15m;
 
 	# gzip_vary on;
 	# gzip_proxied any;

services/web/app/src/Features/Errors/ErrorController.mjs

@@ -5,26 +5,14 @@ import {
 } from '@overleaf/validation-tools'
 import Errors, { NotFoundError } from './Errors.js'
 import SessionManager from '../Authentication/SessionManager.mjs'
-import UserGetter from '../User/UserGetter.mjs'
 import SamlLogHandler from '../SamlLog/SamlLogHandler.mjs'
 import HttpErrorHandler from './HttpErrorHandler.mjs'
 import { plainTextResponse } from '../../infrastructure/Response.mjs'
 import { expressifyErrorHandler } from '@overleaf/promise-utils'
 
-async function notFound(req, res) {
+function notFound(req, res) {
   res.status(404)
-  const sessionUser = SessionManager.getSessionUser(req.session)
-  let isLumiere = false
-  if (sessionUser?._id) {
-    try {
-      const user = await UserGetter.promises.getUser(sessionUser._id, {
-        'ace.overallTheme': 1,
-        signUpDate: 1,
-      })
-      isLumiere = (user?.ace?.overallTheme ?? '') === 'lumiere-'
-    } catch {}
-  }
-  res.render('general/404', { title: 'page_not_found', isLumiere })
+  res.render('general/404', { title: 'page_not_found' })
 }
 
 function forbidden(req, res) {

services/web/app/src/Features/PasswordReset/PasswordResetController.mjs

@@ -215,23 +215,12 @@ async function renderSetPasswordForm(req, res, next) {
   const passwordResetToken = req.session.resetToken
   delete req.session.resetToken
 
-  let isLumiere = false
-  if (email) {
-    try {
-      const emailUser = await UserGetter.promises.getUserByMainEmail(email, {
-        'ace.overallTheme': 1,
-      })
-      isLumiere = (emailUser?.ace?.overallTheme ?? '') === 'lumiere-'
-    } catch {}
-  }
-
   res.render(
     Features.hasFeature('saas') ? 'user/setPasswordCiam' : 'user/setPassword',
     {
       title: 'set_password',
       email,
       passwordResetToken,
-      isLumiere,
     }
   )
 }

services/web/app/src/Features/Project/UserSettingsHelper.mjs

@@ -46,4 +46,5 @@ async function buildUserSettings(_req, _res, user) {
 
 export default {
   buildUserSettings,
+  getOverallTheme,
 }

services/web/app/src/Features/User/UserPagesController.mjs

@@ -177,7 +177,6 @@ async function settingsPage(req, res) {
     isSaas: Features.hasFeature('saas'),
     memberOfSSOEnabledGroups,
     capabilities: [...req.capabilitySet],
-    isLumiere: (user?.ace?.overallTheme ?? '') === 'lumiere-',
   })
 }
 

services/web/app/src/infrastructure/ExpressLocals.mjs

@@ -8,6 +8,8 @@ import { fetchJson } from '@overleaf/fetch-utils'
 import contentDisposition from 'content-disposition'
 import Features from './Features.mjs'
 import SessionManager from '../Features/Authentication/SessionManager.mjs'
+import UserGetter from '../Features/User/UserGetter.mjs'
+import UserSettingsHelper from '../Features/Project/UserSettingsHelper.mjs'
 import PackageVersions from './PackageVersions.js'
 import Modules from './Modules.mjs'
 import Errors from '../Features/Errors/Errors.js'
@@ -269,6 +271,28 @@ export default async function (webRouter, privateApiRouter, publicApiRouter) {
     next()
   })
 
+  webRouter.use(
+    expressify(async function (req, res, next) {
+      res.locals.isLumiere = false
+      const sessionUser = SessionManager.getSessionUser(req.session)
+      if (sessionUser?._id) {
+        try {
+          const user = await UserGetter.promises.getUser(sessionUser._id, {
+            'ace.overallTheme': 1,
+            signUpDate: 1,
+          })
+          if (user) {
+            res.locals.isLumiere =
+              UserSettingsHelper.getOverallTheme(user) === 'lumiere-'
+          }
+        } catch (err) {
+          logger.warn({ err }, 'failed to fetch theme for isLumiere')
+        }
+      }
+      next()
+    })
+  )
+
   webRouter.use(function (req, res, next) {
     res.locals.getLoggedInUserId = () =>
       SessionManager.getLoggedInUserId(req.session)

services/web/modules/user-activate/app/src/UserActivateController.mjs

@@ -40,7 +40,6 @@ async function activateAccountPage(req, res, next) {
   const user = await UserGetter.promises.getUser(req.query.user_id, {
     email: 1,
     loginCount: 1,
-    'ace.overallTheme': 1,
   })
 
   if (!user) {
@@ -60,7 +59,6 @@ async function activateAccountPage(req, res, next) {
     title: 'activate_account',
     email: user.email,
     token: req.query.token,
-    isLumiere: (user?.ace?.overallTheme ?? '') === 'lumiere-',
   })
 }