We will not block anymore the users not connected
to the collaboration server from editing the document,
we will have an HTTP fallback instead, so we can
remove the "can-edit" mechanism and the related code.
Address the findings of an adversarial review of the new endpoint:
- Only the backend admin token may attribute content to another user via
the X-User-Id header. The endpoint uses the default access purpose, so
any editor with update ability can call it — honoring the header for
them would let an editor forge the attribution history of the first
revision (the websocket path likewise stamps the server-side
identity). Regular callers now always author as themselves; verified:
an editor session posting X-User-Id gets its own userid stamped.
- Reject non-main ?branch= requests (400). Cookie users are main-only
via getAccessType, but the admin token bypasses it and could seed an
orphan (org, docid, branch) room no user-facing path reads — while
dodging the branch-scoped 409 existence check.
- Correct the concurrent-create comment: two racing creates merge as
independently generated updates (fresh clientIDs), so the seeded
content appears twice — user-visible duplication, not merely a
doubly-attributed revision. Still accepted (Django creates each doc
once and a duplicated seed is user-fixable), but the tradeoff is now
stated accurately.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Kevin Jahns <kevin.jahns@protonmail.com>
Python cannot call yhub's built-in PATCH ydoc api because its body must
be lib0-any encoded - a lib0-specific binary framing with no
implementation outside javascript. The new endpoint
POST /collaboration/create-ydoc/v1/{org}/{docid} accepts the raw binary
Yjs update (pycrdt get_update() / Y.encodeStateAsUpdate output) as
application/octet-stream, so Django can seed a document's initial state
with a plain requests.post(url, data=raw_bytes) - needed by the
server-side creation flows (file import, create-for-owner, duplication,
template instantiation) whose yhub rooms currently stay empty until the
first browser connects.
Strict create semantics: 409 when the room already has content
(checked via getDoc, covering persisted state and uncompacted stream
messages; yhub has no atomic create, concurrent creates merge via CRDT
and never corrupt). The initial content is attributed to the optional
X-User-Id header, else to the caller's identity. Access uses the
default purpose, i.e. standard document write access like the built-in
ydoc routes: the admin JWT, or a user session with update ability.
Malformed updates map to 400 (the compute worker rejects them and the
pool replaces the thread), empty updates to 400, bodies over 10MiB to
413.
Gotcha worth noting: req.bytes() resolves to a Node Buffer, but yhub's
compute-task schema validates with lib0's exact-constructor Uint8Array
check, so the body is re-viewed as a plain Uint8Array before it is
handed to the compute pool.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Kevin Jahns <kevin.jahns@protonmail.com>
Y_PROVIDER_API_KEY is no longer used in the codebase,
so we can remove it from the helm chart and the documentation.
We adapt the documentation to use the new JWT conversion
mechanism instead.
The /api/convert route no longer accepts the Y_PROVIDER_API_KEY shared
secret. It now verifies the admin JWT signed by Django against the
JWKS published on its /api/v1.0/jwks endpoint.
Add POST /collaboration/reset-connections/v1/{org}/{docid} (optional
X-User-Id header) to yhub-server. It distributes yhub recheckAuth: every
server re-runs the access check per matching connection and closes only
those whose access actually changed (close code 4401), so unaffected
clients see no reconnect churn. The endpoint authenticates with the
RS256 admin JWT issued by JWTService, verified against the backend JWKS
(new jose dependency); the admin token acts as the "system" user and is
the only principal granted the reset-connections access purpose. The
backend does not trigger it on permission changes yet - that wiring
comes separately, now that CollaborationService is gone.
yhub is upgraded to 0.4.0 and serves every route under the
/collaboration/ prefix (server.apiPrefix): the websocket moves to
/collaboration/ws/v1/docs, and the built-in document apis are meant to
be publicly exposed alongside it, with reset-connections as the one
backend-internal exception.
Also harden websocket auth: fail closed when the backend errors (only a
genuine 401/403 falls back to the anonymous identity, so a signed-in
editor can never hide from a targeted recheck under an anon userid) and
tolerate small clock skew when verifying the cached admin token.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Kevin Jahns <kevin.jahns@protonmail.com>
The CollaborationService was doing nothing since we started the
migration to yhub, all the code using it is now removed. Also the
`can-edit` endpoint and all the safeguard mechanism relying on the
presence of other users connected to the websocket will not be used
anymore, it will be possible to replace all of this with yhub, so all
this code is also removed.
For now the only token we will need is ont with the admin claim set to
True. To not repeat the creation of this token again and again, we
created a dedicated method to issue this token in the JWTService class.
The yhub service will need our public key in order to validate the jwt
token we will used. We choose to expose a jwks endpoint as it is a
standard wat to do this.
Support ?view=present&slide=N deep-links (clamped, URL kept in sync) and
a "Copy link to slide" action in the floating bar. Ignore the deep-link
on mobile.
Closes#2397
Recent upgrade of tsc-alias introduced a breaking
change in the build command, which now requires the
`--project` flag to specify the path to the
tsconfig file.
@gouvfr-lasuite/ui-kit pin @gouvfr-lasuite/cunningham-react,
so multiple versions of
@gouvfr-lasuite/cunningham-react were being installed,
which was causing issues.
We pin the version to 4.3.1, forcing all packages to
use the same version.
Blocknote is not compatible with the latest version
of the ai packages:
- @ai-sdk/openai
- ai
Better to downgrade to the previous version until the
compatibility issue is resolved.
We upgraded prettier in a previous commit. Some files
were not formatted with the new prettier version.
This commit applies the new prettier formatting to
those files.
We are downgrading TypeScript from version 7.0.2
to 6.0.3.
To bump the version of TypeScript, we will need
to update the codebase to be compatible with the
new version.
FRONTEND_HOMEPAGE_FEATURE_ENABLED=false makes the Auth guard send
anonymous visitors on / straight to login instead of /home, but the
/home page itself still rendered the full homepage when reached via a
direct link. Redirect it to login too, so disabling the feature really
disables the page.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PhqB4SHsHCuMfprwLEN3rR
Signed-off-by: Maarten Draijer <maarten@madra.nl>
We have renamed the Chinese locale from `cn_CN`
to `zh_CN` to align with standard locale naming
conventions.
Additionally, we have added support for two new
locales: Esperanto (`eo_PL`) and
Traditional Chinese (`zh_TW`).
A selected image (or any selected node) leaked its editing outline into
the read-only slide. Suppress the selected-node outline so nothing looks
focused unless the user tabs or clicks.
Closes#2393
Dividers with children are kept as structural parents so their slide
keeps its indentation; the divider's own rule is hidden. Empty
paragraphs around a divider are dropped so habitual spacing no longer
offsets slides.
Closes#2398
Prepend a slide with the document title (emoji stripped) so every
presentation opens on a cover, announced to screen readers like any
other slide (#2466).
Pull the BlockNote rendering out of PresenterSlide into
PresenterSlideContent so it can be reused by the title slide and the PDF
export. Add a PresenterSlideData union (title | content) and a shared
PresenterBlock type.
Move presenter ownership out of DocToolBox into a top-level
PresenterRoot driven by a zustand store, lazy-load the overlay and paint
a boot cover while the editor boots. Groundwork for the deep-link and
present-from-here features (#2466).
Changed:
- ♻️(backend) reset collaboration connection in cascade for all children
Fixed:
- 💄(frontend) fix some UI/UX in the left panel
- 🐛(frontend) fix tree dnd firefox
- Collapse panel button is now:
- fully clickable,
- the title is hidden
- when the doc title is visible
- when small mobile the title is hidden
- Add button login when logout whatever the device
- Fix flickering logo
- New icon name to avoid cache
With Firefox, the DND was not working properly anymore.
From a previous refacto, a item is now a link,
by default a link has a draggable attribute set
to true, it was conflicting with the DND library,
so we need to set it to false.
When an access is updated or deleted, or a link_configuration is
changed, the collaration_service is used to reset the connection in the
collaboration server. As accesses and link_configuration are inherited
in a Docs tree, if the user is connected to a child, the connection is
not reset. This commit fix this issue by calling the reset on every
children in the tree.
In the settings, the logging has set the propagate property to False.
While writing tests it wasn't possible to assert log was made using the
caplog fixtures because this propagate is set to False. Changing it to
True allow to correctly tests that a log is made using the caplog
fixture.
The y-provider `/api/convert` handler catches every writer/reader
exception and returns a generic `{"error":"An error occurred"}` 500. The
real JS exception is silently dropped: `logger()` only prints to stdout
when `COLLABORATION_LOGGING=true`, and Sentry's
`setupExpressErrorHandler` only sees unhandled errors — never this one.
Result: Sentry issues `DOCS-4ZY` / `DOCS-4ZZ` / `DOCS-6DK` all fire on
every 500, but none of them carry the underlying JS stack, making
root-cause diagnosis impossible from Python alone.
This patch adds `Sentry.captureException` in the outer catch with
`handler:convert` tag and `contentType` / `accept` / `bodyBytes` extras.
Behavior otherwise unchanged.
Signed-off-by: Stephan Meijer <me@stephanmeijer.com>
Added:
- ✨(y-provider) preserve callouts, PDFs, page breaks, interlinking
links and commented text on HTML/markdown export
- ✨(frontend) add a user menu
- ✨(frontend) new header and responsive harmonization
- ✨(backend) add management command to reset a Document
Changed:
- ♿️(frontend) hide mobile left panel from screen readers when collapsed
- ♿️(frontend) enable blocknote heading ids for toc anchors
- ♿️(frontend) focus export modal on format select
- ♿️(frontend) configurable legal submenu in HelpMenu, remove Crisp
- ♻️(frontend) new create button for docs
- ♿️(frontend) align search modal field label with placeholder
- 🚚(frontend) move Waffle to bottom left
- ♿️(frontend) remove redundant aria-label on table of contents links
- ♻️(core) fix typo in settings COLLABORATION_WS_NOT_CONNECTED_READY_ONLY
- ♻️(backend) scope document search by document id instead of path
Fixed:
- 🐛(backend) prevent owner from leaving a soft-deleted document
- 🐛(frontend) fix removed item in the tree
- 🐛(frontend) fix service worker causing reload on tab focus
- 🐛(backend) update restore ability for inherited deletion
- 🔧(dev) make the dev stack domain-agnostic
- 🐛(frontend) stop force index redirect when delete doc
- 🐛(frontend) fix CTA on move modal on mobile
Removed:
- 🔥(backend) remove unused default authentication backend
