Commit Graph

1300 Commits

Author SHA1 Message Date
Tom Moor
ea28dc46eb fix: Error in WebhookProcessor when team is permanatly destroyed 2022-07-26 22:33:48 +01:00
Tom Moor
2794057738 fix: Sequelize rejectOnEmpty should result in 404 status 2022-07-26 22:06:47 +01:00
Tom Moor
b7b1f5e1fd fix: Cleanup attachments uploaded to S3 when import fails (#3868) 2022-07-26 12:10:13 -07:00
Tom Moor
8fdd5bf734 fix: substitution of content when sending an image to a profile (#3869)
* fix: Limit public uploads to basic image types

* test
2022-07-26 12:10:00 -07:00
Tom Moor
086c3ec2d8 fix: Allow more flexible SMTP connection when SSL is not required. Do not fail on self-signed certs 2022-07-25 23:44:20 +01:00
Tom Moor
f370b0296b fix: File operation cleanup task should also remove import data 2022-07-25 21:10:37 +01:00
Tom Moor
30190866f8 test: Flakey test 2022-07-25 08:59:30 +01:00
Tom Moor
53a08cf307 chore: Basic protection against zip bombs 2022-07-24 23:51:04 +01:00
Tom Moor
5e852170f9 perf: Read attachment buffers only when neccessary, closes #3849 2022-07-24 19:15:34 +01:00
Tom Moor
71da57773e docs 2022-07-24 14:09:43 +01:00
Tom Moor
ec35af4bc5 Refactor validations 2022-07-24 13:40:04 +01:00
Nan Yu
870d9ed41e feat: allow external SSO methods to log into teams as long as emails match (#3813)
* wip

* wip

* fix comments

* better separation of conerns

* fix up tests

* fix semantics

* fixup tsc

* fix some tests

* the old semantics were easier to use

* add db:reset to scripts

* explicitly throw for unauthorized external authorization

* fix minor bug

* add additional tests for user creator and team creator

* yank the email matching logic out of teamcreator

* renaming

* fix type and test errors

* adds test to ensure that accountProvisioner works with email matching

* remove only

* fix comments

* recreate changes to allow self hosted to make teams
2022-07-24 04:55:30 -07:00
Apoorv Mishra
24170e8684 chore: Remove updatedAt column from events table (#3841) 2022-07-24 01:57:21 -07:00
Tom Moor
7ae892fe06 fix: Long collection description prevents import (#3847)
* fix: Long collection description prevents import
fix: Parallelize attachment upload during import

* fix: Improve Notion image import matching

* chore: Bump JSZIP (perf)

* fix: Allow redirect from /doc/<id> to canonical url

* fix: Importing document with only title duplicates title in body
2022-07-24 01:37:20 -07:00
Tom Moor
4f537c7578 Remove retry on export task 2022-07-23 17:00:32 +01:00
Tom Moor
4bca081faa chore: Add rolling window limits to import and export operations 2022-07-23 16:29:28 +01:00
Tom Moor
ba264974cf fix: Improvement to accuracy of collaboration server metrics 2022-07-21 09:44:13 +01:00
Tom Moor
ef0412c449 fix: Cannot create new team on self-hosted (#3819) 2022-07-20 13:18:21 -07:00
Nan Yu
c3f5563e7f feat: scope login attempts to specific subdomains if available - do not switch subdomains (#3741)
* make the user lookup in user creator sensitive to team
* add team specific logic to oidc strat
* factor out slugifyDomain
* change type of req during auth to Koa.Context
2022-07-19 06:50:55 -07:00
Tom Moor
9ab409a640 fix: Account for non-SSL database connection in pending migrations check (#3811)
* fix: Account for non-SSL database connection in pending migrations check

* Double exit
2022-07-19 01:58:48 -07:00
Tom Moor
9dd28def67 fix: Force download of public attachments 2022-07-18 21:49:48 +01:00
Tom Moor
dc94a683e7 chore: Reduce timeout on webhook deliveries 2022-07-17 18:48:45 +01:00
Tom Moor
11e1ef455f chore: Improve UUID vaildation – prevent nonsense reaching db queries 2022-07-17 14:49:04 +01:00
Tom Moor
de18196fd8 chore: Upgrade socket.io (#3697)
* Upgrade wip

* tsc

* tsc

* fix: Missing authenticated message
2022-07-16 06:02:03 -07:00
Tom Moor
95f4fb2424 chore: Remove deprecated socket.io-auth (#3780) 2022-07-16 02:27:09 -07:00
Tom Moor
e509719c77 Add ability to quickly create test users in development (#3764) 2022-07-15 16:11:30 -07:00
Tom Moor
47e73cee4e feat: Cleanup api keys and webhooks for suspended users (#3756) 2022-07-13 00:59:31 -07:00
Tom Moor
973cfc3fa3 Do not show suspended users to non admins (#3776) 2022-07-13 00:59:06 -07:00
Tom Moor
206545f350 fix: Ensure signed attachment urls are always downloaded rather than loaded in browser 2022-07-12 17:14:22 +01:00
Tom Moor
35e82beaf7 chore: Upgrade koa- dependencies (#3761) 2022-07-09 10:23:42 -07:00
Tom Moor
8bb88b8550 chore: Audit of all model column validations (#3757)
* chore: Updating all model validations before the white-hatters get to it ;)

* test

* Remove isUrl validation, thinking about it need to account for minio and other weird urls here
2022-07-09 08:04:40 -07:00
Tom Moor
da4a10e877 chore: Remove shares.info apiVersion 1 (#3758)
* chore: Remove shares.info apiVersion 1

* fix: Sporadic test failure
2022-07-09 04:28:56 -07:00
Tom Moor
2893924e9a fix: Must check length before passing to timingSafeEqual 2022-07-09 11:19:40 +02:00
Tom Moor
97f8c0813c fix: Use crypto.timingSafeEqual, closes #3740 2022-07-08 21:10:51 +02:00
CuriousCorrelation
746dc30aeb feat: Add pending migrations check during startup (#3744)
* feat: Add pending migrations check during startup

* fix: migration pending log message

Co-authored-by: Tom Moor <tom.moor@gmail.com>

Co-authored-by: Tom Moor <tom.moor@gmail.com>
2022-07-08 11:30:16 -07:00
Tom Moor
4a46d19846 fix: Improved model validation for Collection (#3749)
* fix: Added improved model validation for Collection attributes

* sp

* fix: Enforce title length in UI
2022-07-08 11:10:22 -07:00
Tom Moor
98106e7f6f Update 20220702132722-add-webhooks-deleted-at.js 2022-07-08 02:22:48 -07:00
Nan Yu
1e808fc52c Feat: add auth provider to users on sign in (#3739)
* feat: merge a new authentication method onto existing user records when emails match

* adds test for invite acceptance and auth provider creation

* addresses comments
- test existing user and invites in different test cases
- update lastActiveAt syncronously when an invite is accepted

* sort arrays in test to prevent nondeterministic test behaivior when doing array compare
2022-07-08 00:24:46 -07:00
Tom Moor
ec8c0645ba fix: Correct annotation order 🙈 2022-07-07 12:23:27 +02:00
Tom Moor
f90309e781 fix: Unneccessary restrictive avatarUrl length 2022-07-07 12:16:54 +02:00
Tom Moor
c36e7bfbb6 fix: Add 10 domain limit per team (#3733)
* fix: Validate team domains are FQDN's
Add 10 domain limit per team
fix: Deletion of domains not happening within request lifecycle

* tests

* docs
2022-07-05 12:27:02 -07:00
Tom Moor
831df67358 feat: Adds route-level role filtering. (#3734)
* feat: Adds route-level role filtering. Another layer in the onion of security and performance

* fix: Regression in authentication middleware
2022-07-05 12:26:49 -07:00
Tom Moor
c6fdffba77 chore: Internal request filtering 2022-07-05 11:06:47 +02:00
Tom Moor
9cd26168e1 Separates policy for file operations 2022-07-03 18:19:56 +02:00
Tom Moor
ee10e1407a fix: Typo of fileOperation -> fileOperations 2022-07-03 16:27:03 +02:00
Tom Moor
c9af7ff889 fix: Suppress db validation errors in error reporting 2022-07-03 16:03:53 +02:00
Tom Moor
27978b8fc4 fix: Remove teams.create from audit events 2022-07-03 14:16:49 +02:00
Tom Moor
62d9bf7105 chore: Move initial avatar upload to background worker (#3727)
* chore: Async user avatar upload processor

* chore: Async team avatar upload

* Refactor to task for retries

* Docs
Include avatarUrl in task props to prevent race condition
Remove transaction around upload fetch request
2022-07-03 02:36:15 -07:00
Tom Moor
1f3a1d4b86 fix: Improved websockets error handling (#3726)
* fix: Add websocket client error capturing
fix: Incorrect parsing of documentName will never be empty

* fix: Non-present documentId in collaboration route should trigger an error response

* fix: Close unhandled websocket requests
2022-07-03 00:00:59 -07:00
Tom Moor
8ebe4b27b1 fix: Add additional model validation (#3725) 2022-07-02 14:29:01 -07:00