* Replace token-link email with 6-digit code on SSO registration
Unverified SSO emails previously received a long-lived token link
(90-day TTL) via UserEmailsConfirmationHandler. This replaces that
flow with the same 6-digit code verification used for password
registration, redirecting through /registration/confirm-email.
- SSOManager.registerSSO now always confirms email (caller must
verify first); removes sendConfirmationEmail / _finishRegistration
- SSOController._signUp sends confirmation code and stores
pendingSSORegistration in session when IdP email_verified is false
- New SSOConfirmEmailHandler completes registration after code check
via completeSSOEmailConfirmation module hook
- OnboardingController confirm-email handlers accept
pendingSSORegistration alongside pendingUserRegistration
confirmEmailFromToken (POST /user/emails/confirm) removal is deferred
to a follow-up PR to avoid breaking in-flight 90-day tokens.
Closes#28607
* Fix unverified-email edge cases; Add ORCID e2e tests;
* Rename `confirmEmail` parameter to `emailVerifiedByIdP` in _signUp function
* Remove `sendConfirmationEmail`
* Mock getUserByAnyEmail in tests
* Extract _finishSSORegistration helper to deduplicate the register →
set session flags → allocate referral → finishSaasLogin → finishLogin
sequence shared by both the direct and deferred (code-confirmed) paths.
* Stop duplicating session data in pendingSSORegistration
analyticsId, splitTests, and referal_* are already in the session at
confirmation time — no need to copy them into pendingSSORegistration.
Re-fetch splitTests fresh on completion instead.
* Simplify the code
* Remove dead confirmEmail template
No callers remain after sendConfirmationEmail was deleted. The token-link
flow (confirmEmailFromToken) only validates tokens, never sends email.
* Remove dead reconfirmEmail template
* Address comments from Copilot
* Clear stale pending registration when starting a new flow
* Add unit tests for completeSSOEmailConfirmation
* Add `verificationMethod` param
* Fix camelcase issues
* Extract _createSSOUser and _registerAndFinish helpers to deduplicate registration logic
* Remove obscure "registration_error"
* Prevent FormTextIcon from shrinking
* Enable "email_already_registered_sso" error
* Misc. improvements to confirm-email-form.tsx
* Remove `UserEmailsConfirmationHandler` mock
Co-authored-by: Olzhas Askar <olzhas.askar@overleaf.com>
* Add info on sso_email.pug page
---------
Co-authored-by: Olzhas Askar <olzhas.askar@overleaf.com>
GitOrigin-RevId: d0196ebc6d81ff61bcd27726d0b899b743d08d64
* [web] Replace `pro` with `commons` wording on institutional subscriptions
Replaces the wording in several places:
- subscription settings
- email tags
- features tooltip
- institution portal
GitOrigin-RevId: 1b9a0e51245ed8a41865300d9e9d555bc05e6c17
* display global disabled state
* show loading indicator while project notification preferences load
GitOrigin-RevId: d7e905aaa3fc7b15b54bf99caeabf60c1e5d8050
* merging ide-redesign/components/file-tree into features/file-tree
* moving ide-redesign/contexts/settings-modal-context to features/settings/contexts
* use-collapsible-file-tree.tsx → features/file-tree/hooks
* use-focus-on-setting.tsx → features/settings/hooks
* use-project-notification-preferences.ts → features/settings/hooks
* use-rail-overflow.tsx→ features/ide-react/hooks
* deleting use-switch-enable-new-editor-state.ts
* use-toolbar-menu-editor-commands.tsx → features/source-editor/hooks
* npm run extract-translations
* modifying the test to target correct buttons and removing a test for old component
* adding a test back and modifying it
* changing the test
GitOrigin-RevId: baa1e9a992c88b84313eea82161354d4958cf1ef
* changing to pug conditional format for admin page conditional render
* feat: update notifications settings page and open BE route
feat: adding new page for notification prefs on user settings, along with updating saving prefs for global preferences
adding error handling and disabling when request is inflight
formatting and adding split test for viewing notification ettings
fix: updating to levels of preferences, and removing global type for preferences as we will now share the same backing settings between global and project preferences
feat: add global mute to user settings for notifications
making params in preferences schema optional
feat: update global settings to only set mute, and remove optional settings
fix: store userId as objectId, and filter based on global mute setting
GitOrigin-RevId: 947a95dc02d12b4a2d8e3cc29bd04c23af2aef25
* Remove focused style from the stepper
* Reduce spacing between password input and password policy
* Make input validation icon larger
* Make animated-tick.svg faster
* Move notification to below h1
* Move notification to below h1
* Fix: Warning: Invalid DOM property `autocomplete`. Did you mean `autoComplete`?
* Wrap form-text in a span so it's displayed correctly and not altered by flex
* Remove "Please request a new password reset email and follow the link." text after the email is entered
* Remove (unnecessary?) flex property on .ciam-form-text-icon
* Rename `messageTextNode` to `messageTextSpan`
* Revert changes to input-validator.ts
GitOrigin-RevId: ad83c92a59b9dbc872cf4e49362b0baec9fb5b93
* no grey hyphen when the input is empty
* show email in bold
* Fix tests
* Add test to verify email display in confirmation code input
* Format
GitOrigin-RevId: ade4a670b9dc80b99f64cc3273407a98428521b8
* Make CIAM copies of Pug files
passwordResetCiam.pug
setPasswordCiam.pug
* Update controller with split test assignment
* Use CIAM layout in passwordResetCiam.pug
* Style passwordResetCiam according to designs
* Use CIAM layout in setPasswordCiam.pug
* Style setPasswordCiam according to designs
* Use settings value in registration screen for must_be_at_least_n_characters
* Retrieve email input with a script
* Replace mb-4 by --ds-spacing-800
* Add eye icon to toggle password visibility
* Avoid double dots after some translated strings
* Use `ciamCustomFormDangerMessage`
* Use `ciamErrorNotification`
* Use `ciamButtonContentLoading`
* Replace remaining "mb" classes
* Move new password errors to the top of the form
* Fix CIAM mixins path after rebase
* Use `ciamCustomFormDangerMessage`
* Add `data-ol-spinner-inflight` to buttons
* Replace classname ciam-notification by notification-ds
Remove borders from CIAM notifications
Fix font size
* Revert "Use settings value in registration screen for must_be_at_least_n_characters"
This reverts commit a0af95c11e171097750ad7ee871f6baf89d5c0cb.
(It's Friday afternoon so I don't want to update unrelated stuff :D)
* Update: check_your_inbox
* Remove `.ciam-card` min-height.
Unnecessary thanks to `.confirm-email-success-form`'s min-height: 400px;
* Use phosphor icons
* Style `formMessagesNewStyle` with DS notifications within CIAM pages
Alternatively, we could extend/duplicate `showMessagesNewStyle` with a CIAM variant
* Revert "Style `formMessagesNewStyle` with DS notifications within CIAM pages"
This reverts commit ed382dc1e8cdf5b916c1527f4da0a825167e9675.
* Fix styling of dynamically-created DS notifications
* Set password length info to secondary color
* Move `ciamSamlErrorNotLoggedIn` to saas-authentication module
Prevents errors in CE:
Error: ENOENT: no such file or directory, open '/overleaf/services/web/modules/saas-authentication/app/views/_mixins.pug'
at /overleaf/services/web/app/views/_mixins/ciam_mixins.pug line 3
---------
Co-authored-by: Tim Down <158919+timdown@users.noreply.github.com>
GitOrigin-RevId: afe58f18ecee92460ab628a285b6edb48a5c678d
* removing placeholders and adding labels
* adding a test
* adding a test back
* deleting comment
* Target the label of department and role
---------
Co-authored-by: Rebeka <o.dekany@gmail.com>
GitOrigin-RevId: 890c2f836a17c360a577bd71280805e3e5408dd6
* Move `main#main-content.content.content-alt` into a React component (`ContentLayout`)
* Create the CIAM variant of `RegistrationConfirmEmailForm`
* `bin/run web npm run extract-translations`
* Use `CiamLayout` in the Storybook demo
* Add `SplitTestProvider` in tests
* Fix Storybook: Wrap `RegistrationConfirmEmailForm` Story in `onboarding-confirm-email`
* Refactor SCSS files:
- only imports in all.scss
- split .storybook-layout and .storybook-enabled
- extract ciam-spacing.scss
GitOrigin-RevId: f4a214a0978423a1621dd8f60bf459af7b8f877e
[web] Do not show notification to link to Commons SSO when domain is also for group with domain capture
GitOrigin-RevId: 6779e2db02d5d9cc4e7a60789a620403a4e4aa11
* Convert OLModal to named exports only
* Make closeButton the default for OLModalHeader
* Set `closeButton={false}` for modal that is not dismissible
* Fix duplicated imports
* Remove another unnecessary `closeButton` prop
* Fix import
---------
Co-authored-by: Antoine Clausse <antoine.clausse@overleaf.com>
GitOrigin-RevId: ddd7be6e59a966ac634683d2494d6e9d2c3732e6
* Update test for the loading spinner component
* Create a story for the loading spinner component
* Move role and use CSS for spacing instead
* Add a classname prop
* Reuse LoadingSpinner
* Use OLSpinner instead of Spinner
* Use data-testid since status role was moved
* Wait for journals to load
* Use `isLoading` prop instead and fix the button's height
* Use `isLoading` prop instead
* Use LoadingSpinner instead and remove spacing
* Update test for the loading spinner component
* Use `isLoading` prop instead
* Add aria-describedby to layout button for processing state
* Replace `spinner` to `ol-spinner`
* Scope status
* Remove redundant `div.loading`
---------
Co-authored-by: Antoine Clausse <antoine.clausse@overleaf.com>
GitOrigin-RevId: 8f43b991f8f458b2abd5a4661913ac9b972d892a
* Create eslint rule for requiring loadingLabel prop when isLoading is specified on OLButton
* Add `loadingLabel` props for OLButton components with `isLoading`
* Clarify loading label and button loading state
GitOrigin-RevId: 89279d5b4c346f9c3b67a59d0db822a2ff04314a
* Update selectors to improve test stability
* Update selectors to improve test stability
* Use plain string matchers
* Fix test
* [monorepo] use plain string matchers everywhere
* [web] remove Kb/ prefix from title of learn wiki links
---------
Co-authored-by: Jakob Ackermann <jakob.ackermann@overleaf.com>
GitOrigin-RevId: 12e13c39822795338a3bee20236454f9948e6221
* Replace placeholders for labels
* Remove redundant aria-label and update labels with `.visually-hidden`
* Change "Invite more members" to a label
* Fix helper text for group members and fix responsiveness
* Change error message to an error notification
* Use label and helper text instead of a placeholder
* Remove redundant label and use the placeholder text instead for the admin user searchbar
* Extract translations
GitOrigin-RevId: a504fda9779da82920b57c7b8aad38a8b027d09a
* Update Reconfirm Affiliation (Pug) in Portal page
Change the notification so it directs users to the settings page instead of triggering an email confirmation with token-link
* Update Reconfirm Affiliation (React) in Settings page
Update the component so it sends the 6-digits code and opens the modal to enter it
* Update Reconfirm Affiliation (React) in Projects page
Update the component so it sends the 6-digits code and opens the modal to enter it
* `cleanup_unused_locales`
* `bin/run web npm run extract-translations`
* Update tests
* Minor updates in tests
* Update Pug notifications with the notification mixin
* De-center the "reconfirmed notification"
* Update "Learn more" links to "Learn more about institutional email reconfirmation"
* Update tests
GitOrigin-RevId: cb65623e209217614786eec56f7f5d28b9e8cec5
