* Replace token-link email with 6-digit code on SSO registration
Unverified SSO emails previously received a long-lived token link
(90-day TTL) via UserEmailsConfirmationHandler. This replaces that
flow with the same 6-digit code verification used for password
registration, redirecting through /registration/confirm-email.
- SSOManager.registerSSO now always confirms email (caller must
verify first); removes sendConfirmationEmail / _finishRegistration
- SSOController._signUp sends confirmation code and stores
pendingSSORegistration in session when IdP email_verified is false
- New SSOConfirmEmailHandler completes registration after code check
via completeSSOEmailConfirmation module hook
- OnboardingController confirm-email handlers accept
pendingSSORegistration alongside pendingUserRegistration
confirmEmailFromToken (POST /user/emails/confirm) removal is deferred
to a follow-up PR to avoid breaking in-flight 90-day tokens.
Closes#28607
* Fix unverified-email edge cases; Add ORCID e2e tests;
* Rename `confirmEmail` parameter to `emailVerifiedByIdP` in _signUp function
* Remove `sendConfirmationEmail`
* Mock getUserByAnyEmail in tests
* Extract _finishSSORegistration helper to deduplicate the register →
set session flags → allocate referral → finishSaasLogin → finishLogin
sequence shared by both the direct and deferred (code-confirmed) paths.
* Stop duplicating session data in pendingSSORegistration
analyticsId, splitTests, and referal_* are already in the session at
confirmation time — no need to copy them into pendingSSORegistration.
Re-fetch splitTests fresh on completion instead.
* Simplify the code
* Remove dead confirmEmail template
No callers remain after sendConfirmationEmail was deleted. The token-link
flow (confirmEmailFromToken) only validates tokens, never sends email.
* Remove dead reconfirmEmail template
* Address comments from Copilot
* Clear stale pending registration when starting a new flow
* Add unit tests for completeSSOEmailConfirmation
* Add `verificationMethod` param
* Fix camelcase issues
* Extract _createSSOUser and _registerAndFinish helpers to deduplicate registration logic
* Remove obscure "registration_error"
* Prevent FormTextIcon from shrinking
* Enable "email_already_registered_sso" error
* Misc. improvements to confirm-email-form.tsx
* Remove `UserEmailsConfirmationHandler` mock
Co-authored-by: Olzhas Askar <olzhas.askar@overleaf.com>
* Add info on sso_email.pug page
---------
Co-authored-by: Olzhas Askar <olzhas.askar@overleaf.com>
GitOrigin-RevId: d0196ebc6d81ff61bcd27726d0b899b743d08d64
- Add a Typst language (stream highlighting + completions) for .typ, and
Quarto completions (code chunks, callouts, cross-refs) for .qmd/markdown.
- Project dashboard: new Format column (Quarto/Typst/LaTeX) from the cheap
project compiler field, surfaced through the projects list API.
- Compiler dropdown: grey out engines that don't match the root file's
extension (.qmd->Quarto, .typ->Typst, .tex->LaTeX engines).
- Replace the Overleaf fill loader with an animated Verso logo: the four
quadrant circles drift on their own orbits while colour warms up with load
progress; reused on the token-access screen too.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A project whose root file is a .typ file now compiles straight to PDF with
Typst, as a third engine beside Quarto (.qmd) and latexmk (.tex). Dispatch
stays purely extension-based.
CLSI:
- New TypstRunner.js: runs `quarto typst compile <main>.typ output.pdf` (reuses
the Typst bundled in Quarto, so no extra binary / Docker change). stderr is
merged into output.log.
- CompileManager: _isTypstFile + a TypstRunner branch in _getRunner, and
TypstRunner added to the isRunning check and stopCompile kill list.
- RequestParser: 'typst' added to VALID_COMPILERS.
web:
- settings.defaults: 'typ' added to validRootDocExtensions and the text
extensions (so .typ opens in the editor); 'typst' added to safeCompilers.
- output-files: the Quarto/Typst log parser (which already understands Typst
`error:`/`warning:` + `┌─ file:line:col` diagnostics) now also handles .typ
compiles, so their errors/warnings populate the log tabs.
Polish:
- New-project menu: "Blank Typst project" + "Example Typst project" in both the
main and welcome dropdowns, backed by createBasicProject/createExampleProject
flavour 'typst', a new mainbasic.typ template and an example-project-typst
presentation (math, an image, a table, lists).
- Compiler dropdown gains a "Typst" option (cosmetic; dispatch is by extension).
README updated: three compilers side by side, with a Writing-a-Typst-document
section.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Verso now compiles both .tex (latexmk) and .qmd (Quarto) projects,
dispatching by the root file's extension rather than replacing one with
the other. LaTeX and Quarto projects can coexist on the same server.
CompileManager: re-import LatexRunner and add a _getRunner() dispatcher
that returns a uniform {run, isRunning, kill} interface. .qmd/.md/.Rmd
→ QuartoRunner; everything else (.tex/.ltx/.Rtex/.Rnw) → LatexRunner.
stopCompile now checks/kills both runners since it has no root path.
compiler-setting.tsx: restore the LaTeX engine choices (pdfLaTeX, LaTeX,
XeLaTeX, LuaLaTeX) alongside Quarto. The dropdown still controls which
TeX engine latexmk uses; actual engine dispatch is by file extension.
Dockerfile-base: reinstall TeX Live alongside Quarto (texlive-full minus
-doc/-lang- packages, plus xetex/luatex/biber/latexmk/texcount/chktex/
synctex). Restore TEXMFVAR for a writable LuaTeX cache. This brings back
a large image, which is the accepted cost of full LaTeX+Quarto support.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- compiler-setting.tsx: replace hardcoded LaTeX compiler list with a
single Quarto option; drop now-unused getMeta/lodash imports
- project-settings.ts: add 'quarto' to ProjectCompiler union type
- ClsiManager: detect main.qmd as a default root document (preferred
over main.tex); replace hasMainFile boolean with detectedMainFile
so we know which filename to use
- settings.defaults.js: add 'qmd' to validRootDocExtensions so .qmd
files appear as selectable root documents in the UI
- ProjectRootDocManager: sort main.qmd before main.tex in the root
doc candidate list
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* [web] Replace `pro` with `commons` wording on institutional subscriptions
Replaces the wording in several places:
- subscription settings
- email tags
- features tooltip
- institution portal
GitOrigin-RevId: 1b9a0e51245ed8a41865300d9e9d555bc05e6c17
* display global disabled state
* show loading indicator while project notification preferences load
GitOrigin-RevId: d7e905aaa3fc7b15b54bf99caeabf60c1e5d8050
* merging ide-redesign/components/file-tree into features/file-tree
* moving ide-redesign/contexts/settings-modal-context to features/settings/contexts
* use-collapsible-file-tree.tsx → features/file-tree/hooks
* use-focus-on-setting.tsx → features/settings/hooks
* use-project-notification-preferences.ts → features/settings/hooks
* use-rail-overflow.tsx→ features/ide-react/hooks
* deleting use-switch-enable-new-editor-state.ts
* use-toolbar-menu-editor-commands.tsx → features/source-editor/hooks
* npm run extract-translations
* modifying the test to target correct buttons and removing a test for old component
* adding a test back and modifying it
* changing the test
GitOrigin-RevId: baa1e9a992c88b84313eea82161354d4958cf1ef
* changing to pug conditional format for admin page conditional render
* feat: update notifications settings page and open BE route
feat: adding new page for notification prefs on user settings, along with updating saving prefs for global preferences
adding error handling and disabling when request is inflight
formatting and adding split test for viewing notification ettings
fix: updating to levels of preferences, and removing global type for preferences as we will now share the same backing settings between global and project preferences
feat: add global mute to user settings for notifications
making params in preferences schema optional
feat: update global settings to only set mute, and remove optional settings
fix: store userId as objectId, and filter based on global mute setting
GitOrigin-RevId: 947a95dc02d12b4a2d8e3cc29bd04c23af2aef25
* Remove focused style from the stepper
* Reduce spacing between password input and password policy
* Make input validation icon larger
* Make animated-tick.svg faster
* Move notification to below h1
* Move notification to below h1
* Fix: Warning: Invalid DOM property `autocomplete`. Did you mean `autoComplete`?
* Wrap form-text in a span so it's displayed correctly and not altered by flex
* Remove "Please request a new password reset email and follow the link." text after the email is entered
* Remove (unnecessary?) flex property on .ciam-form-text-icon
* Rename `messageTextNode` to `messageTextSpan`
* Revert changes to input-validator.ts
GitOrigin-RevId: ad83c92a59b9dbc872cf4e49362b0baec9fb5b93
* no grey hyphen when the input is empty
* show email in bold
* Fix tests
* Add test to verify email display in confirmation code input
* Format
GitOrigin-RevId: ade4a670b9dc80b99f64cc3273407a98428521b8
* Make CIAM copies of Pug files
passwordResetCiam.pug
setPasswordCiam.pug
* Update controller with split test assignment
* Use CIAM layout in passwordResetCiam.pug
* Style passwordResetCiam according to designs
* Use CIAM layout in setPasswordCiam.pug
* Style setPasswordCiam according to designs
* Use settings value in registration screen for must_be_at_least_n_characters
* Retrieve email input with a script
* Replace mb-4 by --ds-spacing-800
* Add eye icon to toggle password visibility
* Avoid double dots after some translated strings
* Use `ciamCustomFormDangerMessage`
* Use `ciamErrorNotification`
* Use `ciamButtonContentLoading`
* Replace remaining "mb" classes
* Move new password errors to the top of the form
* Fix CIAM mixins path after rebase
* Use `ciamCustomFormDangerMessage`
* Add `data-ol-spinner-inflight` to buttons
* Replace classname ciam-notification by notification-ds
Remove borders from CIAM notifications
Fix font size
* Revert "Use settings value in registration screen for must_be_at_least_n_characters"
This reverts commit a0af95c11e171097750ad7ee871f6baf89d5c0cb.
(It's Friday afternoon so I don't want to update unrelated stuff :D)
* Update: check_your_inbox
* Remove `.ciam-card` min-height.
Unnecessary thanks to `.confirm-email-success-form`'s min-height: 400px;
* Use phosphor icons
* Style `formMessagesNewStyle` with DS notifications within CIAM pages
Alternatively, we could extend/duplicate `showMessagesNewStyle` with a CIAM variant
* Revert "Style `formMessagesNewStyle` with DS notifications within CIAM pages"
This reverts commit ed382dc1e8cdf5b916c1527f4da0a825167e9675.
* Fix styling of dynamically-created DS notifications
* Set password length info to secondary color
* Move `ciamSamlErrorNotLoggedIn` to saas-authentication module
Prevents errors in CE:
Error: ENOENT: no such file or directory, open '/overleaf/services/web/modules/saas-authentication/app/views/_mixins.pug'
at /overleaf/services/web/app/views/_mixins/ciam_mixins.pug line 3
---------
Co-authored-by: Tim Down <158919+timdown@users.noreply.github.com>
GitOrigin-RevId: afe58f18ecee92460ab628a285b6edb48a5c678d
* removing placeholders and adding labels
* adding a test
* adding a test back
* deleting comment
* Target the label of department and role
---------
Co-authored-by: Rebeka <o.dekany@gmail.com>
GitOrigin-RevId: 890c2f836a17c360a577bd71280805e3e5408dd6
* Move `main#main-content.content.content-alt` into a React component (`ContentLayout`)
* Create the CIAM variant of `RegistrationConfirmEmailForm`
* `bin/run web npm run extract-translations`
* Use `CiamLayout` in the Storybook demo
* Add `SplitTestProvider` in tests
* Fix Storybook: Wrap `RegistrationConfirmEmailForm` Story in `onboarding-confirm-email`
* Refactor SCSS files:
- only imports in all.scss
- split .storybook-layout and .storybook-enabled
- extract ciam-spacing.scss
GitOrigin-RevId: f4a214a0978423a1621dd8f60bf459af7b8f877e
[web] Do not show notification to link to Commons SSO when domain is also for group with domain capture
GitOrigin-RevId: 6779e2db02d5d9cc4e7a60789a620403a4e4aa11
* Convert OLModal to named exports only
* Make closeButton the default for OLModalHeader
* Set `closeButton={false}` for modal that is not dismissible
* Fix duplicated imports
* Remove another unnecessary `closeButton` prop
* Fix import
---------
Co-authored-by: Antoine Clausse <antoine.clausse@overleaf.com>
GitOrigin-RevId: ddd7be6e59a966ac634683d2494d6e9d2c3732e6
* Update test for the loading spinner component
* Create a story for the loading spinner component
* Move role and use CSS for spacing instead
* Add a classname prop
* Reuse LoadingSpinner
* Use OLSpinner instead of Spinner
* Use data-testid since status role was moved
* Wait for journals to load
* Use `isLoading` prop instead and fix the button's height
* Use `isLoading` prop instead
* Use LoadingSpinner instead and remove spacing
* Update test for the loading spinner component
* Use `isLoading` prop instead
* Add aria-describedby to layout button for processing state
* Replace `spinner` to `ol-spinner`
* Scope status
* Remove redundant `div.loading`
---------
Co-authored-by: Antoine Clausse <antoine.clausse@overleaf.com>
GitOrigin-RevId: 8f43b991f8f458b2abd5a4661913ac9b972d892a
* Create eslint rule for requiring loadingLabel prop when isLoading is specified on OLButton
* Add `loadingLabel` props for OLButton components with `isLoading`
* Clarify loading label and button loading state
GitOrigin-RevId: 89279d5b4c346f9c3b67a59d0db822a2ff04314a
* Update selectors to improve test stability
* Update selectors to improve test stability
* Use plain string matchers
* Fix test
* [monorepo] use plain string matchers everywhere
* [web] remove Kb/ prefix from title of learn wiki links
---------
Co-authored-by: Jakob Ackermann <jakob.ackermann@overleaf.com>
GitOrigin-RevId: 12e13c39822795338a3bee20236454f9948e6221
* Replace placeholders for labels
* Remove redundant aria-label and update labels with `.visually-hidden`
* Change "Invite more members" to a label
* Fix helper text for group members and fix responsiveness
* Change error message to an error notification
* Use label and helper text instead of a placeholder
* Remove redundant label and use the placeholder text instead for the admin user searchbar
* Extract translations
GitOrigin-RevId: a504fda9779da82920b57c7b8aad38a8b027d09a
* Update Reconfirm Affiliation (Pug) in Portal page
Change the notification so it directs users to the settings page instead of triggering an email confirmation with token-link
* Update Reconfirm Affiliation (React) in Settings page
Update the component so it sends the 6-digits code and opens the modal to enter it
* Update Reconfirm Affiliation (React) in Projects page
Update the component so it sends the 6-digits code and opens the modal to enter it
* `cleanup_unused_locales`
* `bin/run web npm run extract-translations`
* Update tests
* Minor updates in tests
* Update Pug notifications with the notification mixin
* De-center the "reconfirmed notification"
* Update "Learn more" links to "Learn more about institutional email reconfirmation"
* Update tests
GitOrigin-RevId: cb65623e209217614786eec56f7f5d28b9e8cec5
claude