* [web] set-password: reject same as current password
* [web] Add 'peek' operation on tokens
This allows us to improve the UX of the reset-password form,
by not invalidating the token in the case where the new
password will be rejected by validation logic.
We give up to three attempts before invalidating the token.
* [web] Add hide-on-error feature to async forms
This allows us to hide the form elements when certain
named error conditions occur.
* [web] reset-password: handle same-password rejection
We also change the implementation to use the new
peekValueFromToken API, and to expire the token explicitely
after it has been used to set the new password.
* [web] Validate OneTimeToken when loading password reset form
* [web] Rate limit GET: /user/password/set
Now that we are peeking at OneTimeToken when accessing this page,
we add rate to the GET request, matching that of the POST request.
* [web] Tidy up pug layout and mongo query for token peeking
Co-authored-by: Mathias Jakobsen <mathias.jakobsen@overleaf.com>
GitOrigin-RevId: 835205cc7c7ebe1209ee8e5b693efeb939a3056a
* [web] Upgrade restricted user access if they are invited members
Previously, if a user joined a project via a read-only link and later on
joined the project via an invite, we would still treat them as
restricted users, disabling chat and commenting. This patch changes
that, so that we do *not* consider an invited user restricted.
GitOrigin-RevId: e2acdfd29cc0687cb7276310a9c96d697087b21a
* Add onboarding survey page
* Add onboarding new analytics events to mixpanel allowlist
* [web] Try Premium prompt
* moved try-premium code to overleaf-integration
* fixed sheet styling
* Add onboarding flow redirect handling to registration handlers (#9462)
* Add redirect logic for onboarding flow after registration
* Update UPGRADE_PROMPT_URL
* Cleanup style of OverleafAuthenticationController
* Refactor finishLogin calls to call wrapped function in OverleafAuthenticationController
* Refactor user properties/onboarding flow redirect into finishLogin wrapper
* Fix async/await calls after refactoring
* Update tests for finishLogin refactoring
* Don't redirect to upgrade prompt if user has premium via commons
Co-authored-by: Miguel Serrano <mserranom@users.noreply.github.com>
GitOrigin-RevId: 7c392aa6949f99fa909f9ca4e4baad4c4d4ff6be
* Setup survey module and admin page skeleton
* Replace survey staff access permission with admin-only
* Manage survey config with admin tool
* Display configurable survey in project list + add preview in admin
* Fix linting errors and unit tests
* Add acceptance tests for survey module
* Move survey-form to survey components
* Add configuration option for Recurly group subscription users on surveys
* Change survey pre-link text to a lighter gray for accessibility
* Cleanup survey options implementation after review
GitOrigin-RevId: 8f621951efeae458d1ab081fe98b8d0d539cca1a
* Revert "Revert "Bump async to 3.2.2 (#7618)""
This reverts commit 75153a555211d654744c2e61e27fe21085826c22.
* [web] fix usage of async.queue.drain in script
* [clsi] fix usage of async.queue.drain
* [spelling] fix usage of async.queue.drain
* [redis-wrapper] fix usage of async.queue.drain
* [web] Test that LockManager queue is cleared
This protects against a regression found when upgrading the
async package. Here we test that the `queue.drain` callback
is really getting called, and the lock is being removed from
the LOCK_QUEUES map.
* [redis-wrapper] Upgrade async to 3.2.2
GitOrigin-RevId: df921e6d7f1d505bd467f22e58600ba1aff48869
