* chore: Audit and move inline actions to definitions
* fix: Reuse existing smart-quote translation key in emoji delete dialog
Co-Authored-By: Claude <noreply@anthropic.com>
* Remove two usages of 'Link copied' translation
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix: OIDC 502 on sign-in from oversized id_token cookie (#12986)
Storing the full OIDC id_token in the `oidcIdToken` cookie inflated the
sign-in response headers enough to exceed reverse proxy buffers, causing a
502 Bad Gateway. Store the id_token server-side in Redis keyed by a short
session identifier and keep only that identifier in the cookie, preserving
spec-compliant RP-initiated logout via `id_token_hint`.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: Make OIDC logout token persistence best-effort
A Redis failure when storing or reading the logout id_token_hint should not
block sign-in or logout; fall back to omitting the hint instead.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* docs
* refactor: Extract portable LogoutTokenStore for provider logout hints
Move the cookie-referenced, Redis-backed logout token persistence out of the
OIDC router into a provider-agnostic `LogoutTokenStore`. Any auth provider that
supports provider-initiated logout can now persist and consume a logout hint via
`new LogoutTokenStore(providerId)` without duplicating the cookie/Redis/error
handling. The OIDC-specific end-session URL construction stays in the router.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* perf: Keep vendor-prosemirror out of the eager authenticated bundle
Split the data-only helpers `getEmpty` and `isEmpty` out of
`ProsemirrorHelper` into a new prosemirror-free `ProsemirrorDataHelper`
module, and point the sidebar, DocumentNew, and other lightweight
callers at it. This removes the static edge from the authenticated entry
graph to `prosemirror-model`, deferring the ~653 KB vendor-prosemirror
chunk until an editor surface is actually opened.
Fixes#13005
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Use non-optional collection.data in defined branch
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* fix: Consistent usage of configured proxy with auth providers
* lint
* fix: Harden proxy agent helper against missing OAuth2 client
Degrade to a logged warning instead of crashing auth at boot if a
strategy's internal _oauth2 client is ever absent.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* Add Slab importer backed by the Markdown import pipeline
Slab exports a zip of Markdown documents that is structurally identical to
the Outline Markdown export, with one difference: images are referenced as
remote signed URLs rather than files inside the archive.
Rather than build a parallel importer, this reuses the Markdown task and
processor and teaches the shared import pipeline to download remote images:
- Enable per-page attachment upload for the Markdown task. The base
APIImportTask already downloads remote image/video/attachment URLs and
rewrites them to internal redirect URLs; the Markdown task previously
opted out because its attachments live in the zip.
- Make the base upload step skip URLs that are already internal, so local
zip attachments (resolved to redirect URLs during rewriteMarkdown and
uploaded from the archive in onAllTasksCompleted) pass through untouched
while remote URLs are fetched and re-hosted. Also guards the URL rewrite
against nodes not present in the download map.
- Introduce IntegrationService.Slab as a distinct, importable service that
routes through the Markdown task/processor, so imports are tracked and
labelled as "Slab" with no duplicated import logic.
- Wire the create API (schema + route), the import settings UI (Slab card
and dialog), and a placeholder logo asset.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AC5Ho2SHBjNpxEAMr5uL6o
* Add shell SlabAPIImportTask as a Slab-specific seam
Slab imports previously ran through MarkdownAPIImportTask directly. Introduce
a thin SlabAPIImportTask subclass so Slab gets its own task name (for
scheduling, tracing, and retries) and a dedicated place to override
behavior as Slab exports diverge from the generic Markdown shape.
The subclass inherits all conversion/attachment/persistence logic and only
overrides scheduleNextTask to keep the whole import chain on the Slab class.
MarkdownImportsProcessor now selects the task implementation by the import's
service when scheduling the first task.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AC5Ho2SHBjNpxEAMr5uL6o
* Unwrap single root "slab" directory in Slab imports
Slab exports wrap the entire workspace in a single top-level directory named
"slab". Without handling this, the import produces one "slab" collection
containing everything, instead of mapping each workspace area to its own
collection.
Add a `resolveCollectionRootNodes` seam on the Markdown bootstrap phase
(default: pass entries through unchanged) and override it in SlabAPIImportTask
to descend into a lone, case-insensitive "slab" root directory so its child
directories become collections. Paths are left intact, so the attachment
manifest, completion re-walk, and internal-link resolution stay consistent.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AC5Ho2SHBjNpxEAMr5uL6o
* Use the filename, not the first heading, as the title for Slab imports
In Slab a document's leading heading is real content, not its title — the
filename is authoritative. Add an `extractTitle` option to
DocumentConverter.convert (default true, preserving existing callers) that,
when false, skips lifting a leading H1 into the title and leaves it in the
body. Expose it through a `shouldExtractTitleFromHeading` seam on the
Markdown task and override it in SlabAPIImportTask. With no extracted title,
the page falls back to the filename-derived title.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AC5Ho2SHBjNpxEAMr5uL6o
* Update logo
* Narrow MarkdownAPIImportTask generic back to Markdown
Slab imports now run through SlabAPIImportTask, so the base Markdown task no
longer handles the Slab service directly and its generic can return to
Markdown-only. SlabAPIImportTask keeps a Markdown | Slab union on its
scheduleNextTask override, which is required so the override stays a valid
(contravariant) override of the base's Markdown-typed parameter.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AC5Ho2SHBjNpxEAMr5uL6o
* Optimised images with calibre/image-actions
* reorder
* Move Slab importer into its own plugin
Restructure the Slab importer to live in plugins/slab, mirroring the Notion
plugin, instead of being threaded through the core Markdown importer.
- plugins/slab/server registers SlabImportsProcessor (Hook.Processor) and
SlabAPIImportTask (Hook.Task). The processor extends MarkdownImportsProcessor
to claim the Slab service and schedule the Slab task; the task keeps its
Slab-specific overrides (remote image download, root "slab" dir unwrap,
filename-as-title).
- plugins/slab/client registers the Slab import card (Hook.Imports) and owns
the import dialog.
- Revert MarkdownImportsProcessor to Markdown-only and drop the hardcoded Slab
card from the Import settings screen.
The Slab service enum, import schema, and create route remain in core, as the
Notion plugin's equivalents do.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AC5Ho2SHBjNpxEAMr5uL6o
* Generalize DropToImport to accept an importable service
DropToImport previously branched on `format` to map MarkdownZip/JSON/Slab
to specific imports.create calls, with a dead collections.import fallback.
Replace this with a single `service` prop and one generic imports.create
call. Core no longer hardcodes any service name (notably the Slab plugin
service), and the Markdown, JSON, and Slab dialogs each pass their service.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AC5Ho2SHBjNpxEAMr5uL6o
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
An empty Notion table was converted to a schema-invalid table node with
no rows. Node.fromJSON accepts it, but Markdown serialization then crashed
in renderTable's node.child(0), surfacing only "Index 0 out of range for <>".
Drop empty tables in the Notion converter, and guard renderTable against
tables with no rows so any source is handled safely.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* Treat legacy boolean commenting preference as disabled
Teams not yet migrated to the CommentingAccess enum may still have a
boolean `false` stored for the commenting preference. Guard the
enabled checks so `false` reads as disabled rather than enabled.
* Move commenting setting from Details to Security settings
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* fix: Import avatar image from Azure/Entra/Microsoft
* fix: Cap Azure photo fetch and backfill avatar-less users
Add a timeout and response size limit to the Microsoft Graph photo
request so a slow or oversized response can't stall the login callback,
and sync the avatar whenever the user has none stored (respecting a
manually set avatar) rather than only on account creation.
* Avoid empty webhook processor work via cached subscription lookup
WebhookProcessor ran for every event but most teams have no matching
webhook subscription, costing an empty processor job and a database query
per event.
Cache a team's enabled subscriptions ({ id, events }) in Redis, invalidated
by model lifecycle hooks, and add an optional BaseProcessor.shouldQueue hook
consulted by the global event queue so the webhook processor only enqueues a
job when a matching subscription exists.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* feedback
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* fix: Increase valid user-supplied URL length to 1024
* fix: Wrap URL length migration in a transaction
Wrap the multi-column changeColumn operations in a transaction so a
failure on any column rolls back the whole migration rather than leaving
the database partially migrated.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* chore(deps): bump zod from 4.3.6 to 4.4.3
Bumps [zod](https://github.com/colinhacks/zod) from 4.3.6 to 4.4.3.
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](https://github.com/colinhacks/zod/compare/v4.3.6...v4.4.3)
---
updated-dependencies:
- dependency-name: zod
dependency-version: 4.4.3
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* fix: Make files.create file param optional in schema for zod 4.4
zod 4.4 changed z.custom() to reject undefined. Since validate runs
before multipart injects the file, validation failed with 400 on all
files.create requests. Mark the field optional and guard in the handler.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Tom Moor <tom@getoutline.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Returning the unfurl promises without awaiting them inside the try
block meant rejections (e.g. "Entity not found: Issue") escaped the
catch and were reported to error tracking. Await them so they are
caught and returned as a handled { error } result.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
The Notion API can return transient 5xx errors during imports. Retry these
up to 8 times with exponential backoff, tracked separately from the existing
timeout/rate-limit retry budget.
When a user query produces a pg-tsquery output ending in mixed `&` and `\`
characters (e.g. `"plugins"&\`), stripping them with separate single-char
regexes in a fixed order could leave a dangling `&` operator, causing
Postgres to reject the query with "no operand in tsquery".
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* perf: Avoid correlated subquery in Slack hooks user lookup
Query UserAuthentication directly by indexed providerId and load the
associated User and Team, instead of driving from User.findOne with a
required hasMany include — which Sequelize translates into a correlated
subquery that scans the users table.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix: Scope Slack fallback user lookup to matching AuthenticationProvider
The fallback in findUserForRequest matched any UserAuthentication with
the same providerId, which is only unique per (providerId, userId).
A colliding external user id from another workspace or provider could
resolve a user from the wrong team. Constrain via the AuthenticationProvider
join (name = "slack", providerId = serviceTeamId).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* test
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* fix: Unable to link secondary auth provider on custom domain
* doc
* chore: Custom -> Apex transfer token
* Refactor, address security concerns
* Ensure OAuth intent is single-use
* Secure OAuth state actor binding
* Use scrypt for OAuth actor session binding
* feat: Request document access
Allow users without permission to a document to request access. Notifies
document managers via in-app notification and email; managers can grant
or dismiss the request.
- Adds AccessRequest model, migration, policy, presenter
- Adds accessRequests.create/info/approve/dismiss endpoints
- Adds DocumentAccessRequestNotificationsTask + email
- Adds Error403 request flow with loading state and pending indicator
- Auto-opens notifications popover via ?notifications=true (used in email)
- Adds SplitButton primitive for permission selection in notifications
- Refactors useConsumeQueryParam hook
* refactor
* fix: Make approve/dismiss idempotent on access requests
Return success when the access request has already been dismissed, or
when the user already has document membership at approve time, instead
of throwing 400. Avoids racy double-clicks on notification actions
producing user-visible errors.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* Minor fixes
---------
Co-authored-by: Tom Moor <tom@getoutline.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* wip
* Remove obsolete snapshots
* simplify
* chore(test): Convert mocks to TypeScript and tighten fetch mock types
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* Remove unneccessary patches
* Migrate to msw instead of custom fetch mock
* Address PR review comments
- Split chained vi.useFakeTimers().setSystemTime() into separate calls.
- Switch test setup to dynamic imports so EventEmitter.defaultMaxListeners
assignment runs before module init (static imports were hoisted above it).
- Drop redundant NODE_ENV guard in monkeyPatchSequelizeErrorsForJest; its
sole caller already gates on env.isTest.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* chore: Replace lodash with es-toolkit
Migrate all direct lodash imports to es-toolkit/compat for a smaller,
faster, lodash-compatible utility library. Transitive lodash usage from
other packages remains unchanged.
* fix: Restore isPlainObject semantics in CanCan policy
The lodash migration aliased `isObject` to `lodash/isPlainObject` and
the codemod incorrectly mapped the local name to es-toolkit's `isObject`,
which also returns true for arrays and functions. This caused condition
objects in policy definitions to be skipped, breaking authorization
checks across the codebase.
* fix: Restore unicode-aware length counting in validators
es-toolkit/compat's size() returns string.length, while lodash's _.size()
counts unicode code points. Switch to [...value].length to preserve the
previous behavior so multi-byte characters like emoji count as one.
* chore: resolve no-explicit-any lint warnings in plugins
Replaces uses of `any` in the plugins directory with concrete types,
`unknown`, or structured type assertions, addressing the remaining
typescript-eslint(no-explicit-any) warnings flagged by oxlint.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* chore: address review feedback in GitLabIssueProvider
Drop trailing semicolon from log string and add early return in
`destroyNamespace` when neither `user_id` nor `full_path` is present
to avoid an unnecessary full-scan transaction.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* chore: resolve no-redundant-type-constituents and test/mock no-explicit-any warnings
Clears 36 lint warnings: all 5 no-redundant-type-constituents, 6
no-misused-spread (via narrowing getPartitionWhereClause's return type
to WhereAttributeHash), and 25 no-explicit-any in test/mock files.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* chore: resolve no-base-to-string warnings in tests
Convert userProvisioner try/catch error assertions to Jest's
.rejects.toThrow() idiom, and cast webhook test body to string.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* chore: resolve no-explicit-any warnings in cancan and tracing
Tighten types in the cancan policy framework and tracing decorators.
Constructor / generic-function upper bounds keep `any` where TypeScript
variance requires it, scoped to single-line oxlint-disable comments.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
