Commit Graph

7040 Commits

Author SHA1 Message Date
Erik Michelson 475231b39a feat(oidc): add backchannel logout
Docker / build-and-push (backend) (push) Has been cancelled
Docker / build-and-push (frontend) (push) Has been cancelled
Deploy HD2 docs to Netlify / Deploys to netlify (push) Has been cancelled
E2E Tests / backend-sqlite (push) Has been cancelled
E2E Tests / backend-mariadb (push) Has been cancelled
E2E Tests / backend-postgres (push) Has been cancelled
Lint and check format / Lint files and check formatting (push) Has been cancelled
REUSE Compliance Check / reuse (push) Has been cancelled
Scorecard supply-chain security / Scorecard analysis (push) Has been cancelled
Static Analysis / Njsscan code scanning (push) Has been cancelled
Static Analysis / CodeQL analysis (javascript) (push) Has been cancelled
Run tests & build / Test and build with NodeJS 24 (push) Has been cancelled
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2026-05-02 11:35:33 +02:00
Erik Michelson 2d80f3b045 feat(csrf): add decorator to exclude routes from CSRF protection
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2026-05-02 11:35:33 +02:00
Philip Molares 1eb9ee2385 fix(readOnly): untangle edit button from toc button
Docker / build-and-push (backend) (push) Has been cancelled
Docker / build-and-push (frontend) (push) Has been cancelled
E2E Tests / backend-sqlite (push) Has been cancelled
E2E Tests / backend-mariadb (push) Has been cancelled
E2E Tests / backend-postgres (push) Has been cancelled
Lint and check format / Lint files and check formatting (push) Has been cancelled
REUSE Compliance Check / reuse (push) Has been cancelled
Scorecard supply-chain security / Scorecard analysis (push) Has been cancelled
Static Analysis / Njsscan code scanning (push) Has been cancelled
Static Analysis / CodeQL analysis (javascript) (push) Has been cancelled
Run tests & build / Test and build with NodeJS 24 (push) Has been cancelled
Fixes #6485

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2026-04-30 01:19:37 +02:00
Philip Molares 473fac6885 fix(readOnly): make image lightbox usable
Fixes #6486

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2026-04-30 01:00:12 +02:00
Philip Molares 1d00334019 fix(translation): change noteDeleted error message
Mention the explore page instead of the history page

Fixes #6483

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2026-04-30 00:11:14 +02:00
Philip Molares 22288891f7 chore: change history to explore page
Signed-off-by: Philip Molares <philip.molares@udo.edu>
2026-04-30 00:11:14 +02:00
Philip Molares 4db2f354de fix(editor): remove changing color from pin sidebar entry
Instead of a changing color, we now use a chaning icon.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2026-04-29 22:50:11 +02:00
Philip Molares 1a56e3ad15 fix(editor): use setNotePinStatus instead of setPinnedState
This method updates the backend and changes the redux state in one call, instead of just calling the backend.
With this the state get's updated, and the user see that they pinned a note immediately.

Fixes #6484

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2026-04-29 22:50:11 +02:00
Philip Molares 6b226a0f7a fix(explore): make navigation and search sticky
The navigation and the search box will now always be at the top of the page when scrolling

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2026-04-29 22:21:00 +02:00
Philip Molares 98db62f196 fix(explore): rework metadata box allignment
The box with username, and last edit is now always 12 rem wide and looks more even that way

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2026-04-29 22:21:00 +02:00
Philip Molares 8729fb207b fix(explore): add extra margin to endMessage of infinity scroll
This way the message doesn't seem so squeezed in

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2026-04-29 22:21:00 +02:00
Philip Molares d60a67ee33 fix(explore): always keep the notes list as high as two entries
This prevents problems with the dropdown menu creating a scroll bar

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2026-04-29 22:21:00 +02:00
Philip Molares c81dd893e7 fix(login): redirect correctly after login / registration
Docker / build-and-push (backend) (push) Has been cancelled
Docker / build-and-push (frontend) (push) Has been cancelled
E2E Tests / backend-sqlite (push) Has been cancelled
E2E Tests / backend-mariadb (push) Has been cancelled
E2E Tests / backend-postgres (push) Has been cancelled
Lint and check format / Lint files and check formatting (push) Has been cancelled
REUSE Compliance Check / reuse (push) Has been cancelled
Scorecard supply-chain security / Scorecard analysis (push) Has been cancelled
Static Analysis / Njsscan code scanning (push) Has been cancelled
Static Analysis / CodeQL analysis (javascript) (push) Has been cancelled
Run tests & build / Test and build with NodeJS 24 (push) Has been cancelled
We had two different approcaches to the redirect after the login / registration.
Because of this there were race conditions, and we sometimes got stuck on the redirect page.

Fixes #6467

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2026-04-23 23:54:56 +02:00
Erik Michelson 95f28442c3 chore(tests): performance improvements for backend tests
Docker / build-and-push (backend) (push) Has been cancelled
Docker / build-and-push (frontend) (push) Has been cancelled
E2E Tests / backend-sqlite (push) Has been cancelled
E2E Tests / backend-mariadb (push) Has been cancelled
E2E Tests / backend-postgres (push) Has been cancelled
Lint and check format / Lint files and check formatting (push) Has been cancelled
REUSE Compliance Check / reuse (push) Has been cancelled
Scorecard supply-chain security / Scorecard analysis (push) Has been cancelled
Static Analysis / Njsscan code scanning (push) Has been cancelled
Static Analysis / CodeQL analysis (javascript) (push) Has been cancelled
Run tests & build / Test and build with NodeJS 24 (push) Has been cancelled
The backend end-to-end tests run with many parallel workers that
each start a full NestJS application including database connection
pools, HTTP server and so on. This can easily result in performance
bottlenecks - which is even the reason why we added the --runInBand
option for the CI. The performance can be improved by constraining
the number of workers and memory allocated per worker in our jest
config. Furthermore, we can forcefully close open HTTP connections
in the test cleanup. This terminates connections with a keepalive
flag, that would persist for a while longer otherwise. The following
`this.app.close()` waits for keepalive requests, so this reduces the
wait time.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2026-04-15 19:34:53 +02:00
Erik Michelson 8d0e89f49f chore(deps): upgrade netlify cli version and add renovate
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2026-04-15 19:33:49 +02:00
Erik Michelson 2b4f00d28f feat(config): TLS config options for database connection
Docker / build-and-push (backend) (push) Has been cancelled
Docker / build-and-push (frontend) (push) Has been cancelled
Deploy HD2 docs to Netlify / Deploys to netlify (push) Has been cancelled
E2E Tests / backend-sqlite (push) Has been cancelled
E2E Tests / backend-mariadb (push) Has been cancelled
E2E Tests / backend-postgres (push) Has been cancelled
Lint and check format / Lint files and check formatting (push) Has been cancelled
Static Analysis / Njsscan code scanning (push) Has been cancelled
Static Analysis / CodeQL analysis (javascript) (push) Has been cancelled
Run tests & build / Test and build with NodeJS 24 (push) Has been cancelled
REUSE Compliance Check / reuse (push) Has been cancelled
Scorecard supply-chain security / Scorecard analysis (push) Has been cancelled
This was originally contributed by @Avi98 back when the config still used
Joi and TypeORM instead of zod and knex. This commit adapts the same changes
previously done but ports them over to zod and knex. Furthermore, the tests
are updated to ensure all aspects of the config are tested.

Co-authored-by: Avinash <avinash.kumar.cs92@gmail.com>
Co-authored-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2026-04-09 23:04:53 +02:00
Erik Michelson 5b026c052a fix(csrf): refresh token after user has deleted their account
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2026-04-09 21:47:30 +02:00
Nicolai Søborg 3c18898e47 Image: use relative url
Embedding the full URL into the notes is a bit anoying if you want to
change hostname (or e.g. hosting from a local IP). Using the relative
URL should work in all(?) cases afaik.

I would also like to remove that `additionalUrlText` argument, which is
a bit confusing (not sure it works as intended?). It is only used in
file `use-on-image-upload-from-renderer.ts` - and not sure it even is
set to anything

Signed-off-by: Nicolai Søborg <git@xn--sb-lka.org>
2026-04-09 21:29:57 +02:00
Erik Michelson 7ade60aab7 chore(deps): replace cookie and cookie-signature with fastify-cookie
We already used fastify-cookie in other places. Technically, fastify-cookie
uses the same cookie library under the hood as well. However,
we should stick to the framework defaults in order to avoid
future breaking.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2026-04-09 21:19:28 +02:00
Erik Michelson 8f4c1ae17f refactor(sessions): move session store into database
This allows session persistence across restarts of the backend.
At the same time it makes future scaling of HedgeDoc easier
since we reduce the amount of in-memory stored data by this
change.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2026-04-09 21:19:28 +02:00
Nicolai Søborg 5fcae2884d chore(env): match documentation + remove "broken" path to cert 2026-04-08 23:47:19 +02:00
Philip Molares 57234ee810 feat(backend): set charset to utf8mb4 for mariadb
Docker / build-and-push (backend) (push) Has been cancelled
Docker / build-and-push (frontend) (push) Has been cancelled
E2E Tests / backend-sqlite (push) Has been cancelled
E2E Tests / backend-mariadb (push) Has been cancelled
E2E Tests / backend-postgres (push) Has been cancelled
Lint and check format / Lint files and check formatting (push) Has been cancelled
REUSE Compliance Check / reuse (push) Has been cancelled
Scorecard supply-chain security / Scorecard analysis (push) Has been cancelled
Static Analysis / Njsscan code scanning (push) Has been cancelled
Static Analysis / CodeQL analysis (javascript) (push) Has been cancelled
Run tests & build / Test and build with NodeJS 24 (push) Has been cancelled
Signed-off-by: Philip Molares <philip.molares@udo.edu>
2026-03-29 12:27:03 +02:00
Erik Michelson 84852c22be feat(editor): add button to open current note in read-only/slides mode
Docker / build-and-push (backend) (push) Has been cancelled
Docker / build-and-push (frontend) (push) Has been cancelled
E2E Tests / backend-sqlite (push) Has been cancelled
E2E Tests / backend-mariadb (push) Has been cancelled
E2E Tests / backend-postgres (push) Has been cancelled
Lint and check format / Lint files and check formatting (push) Has been cancelled
REUSE Compliance Check / reuse (push) Has been cancelled
Scorecard supply-chain security / Scorecard analysis (push) Has been cancelled
Static Analysis / Njsscan code scanning (push) Has been cancelled
Static Analysis / CodeQL analysis (javascript) (push) Has been cancelled
Run tests & build / Test and build with NodeJS 24 (push) Has been cancelled
Co-authored-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2026-03-25 22:47:22 +01:00
Erik Michelson 0720534d7e fix(logout): refresh CSRF token after logout
Since the CSRF token is stored in the session, which is invalidated
on logout, we need to fetch a new token after logout.
Otherwise the client would require a full page reload to obtain a
new token.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2026-03-25 21:56:55 +01:00
Philip Molares e16d5d5349 fix(frontend): remove lowercaseUsername from UsernamePasswordLogin component
We don't use this functionality anymore

Co-authored-by: Erik Michelson <github@erik.michelson.eu>
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Signed-off-by: Philip Molares <philip.molares@udo.edu>
2026-03-25 20:15:11 +01:00
renovate[bot] bb3db041fd fix(deps): update dependency @azure/storage-blob to v12.31.0
Docker / build-and-push (backend) (push) Has been cancelled
Docker / build-and-push (frontend) (push) Has been cancelled
Deploy HD2 docs to Netlify / Deploys to netlify (push) Has been cancelled
E2E Tests / backend-sqlite (push) Has been cancelled
E2E Tests / backend-mariadb (push) Has been cancelled
E2E Tests / backend-postgres (push) Has been cancelled
Lint and check format / Lint files and check formatting (push) Has been cancelled
REUSE Compliance Check / reuse (push) Has been cancelled
Scorecard supply-chain security / Scorecard analysis (push) Has been cancelled
Static Analysis / Njsscan code scanning (push) Has been cancelled
Static Analysis / CodeQL analysis (javascript) (push) Has been cancelled
Run tests & build / Test and build with NodeJS 24 (push) Has been cancelled
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-24 12:57:11 +01:00
renovate[bot] c52b83ae58 fix(deps): update dependency dompurify to v3.3.2 [security]
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-24 12:55:24 +01:00
renovate[bot] 8d77266a91 fix(deps): update dependency @nestjs/platform-fastify to v11.1.16 [security]
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-24 12:54:55 +01:00
renovate[bot] 8d606b3b4b fix(deps): update dependency @dicebear/core to v9.4.1 [security]
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-24 12:54:04 +01:00
Erik Michelson 7c4b84c455 fix(database): use parameters to be database-agnostic
The ?? placeholder syntax is replaced by Knex with the proper
quoting of the identifier matching the configured database.
This resolves the bug that MariaDB wasn't working with the new
whereEqualLowercase selector since it uses different quoting than
PostgreSQL and SQLite.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2026-03-24 12:49:12 +01:00
Erik Michelson 284d562913 fix(tests): remove Content-Type override for e2e test
This causes errors for two reasons:
1. A DELETE request should not have a body and therefore
   should not have a content-type set.
2. The explicit .set(...) call overrides the set which is
   done in agent setup for extending the agent with CSRF-
   token submission.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2026-03-24 12:49:12 +01:00
Erik Michelson 55c636b84d fix(backend): ignore TS errors for whereEqualLowercase
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2026-03-24 12:49:12 +01:00
Philip Molares abb25d8784 test: fix forbidden alias concatenation
We don't want to have extra spaces around the words

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2026-03-24 12:49:12 +01:00
Philip Molares 5eb15e43d8 feat(username): allow mixed case usernames
Usernames should be saved as is, but in the search we should use like

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2026-03-24 12:49:12 +01:00
Erik Michelson 29f60f1d9b fix(aliases): verify alias regex in frontend and backend
Co-authored-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2026-03-24 12:49:12 +01:00
Philip Molares 2a2bd92265 feat(alias): allow mixed case aliases
Aliases should be saved as is, but in the search we should use like

Co-authored-by: Erik Michelson <github@erik.michelson.eu>
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Signed-off-by: Philip Molares <philip.molares@udo.edu>
2026-03-24 12:49:12 +01:00
Philip Molares 6e4470b626 feat(knex): extend knex with whereEqualLowercase
This allows us to reuse the same logic instead of copying it all over the place

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2026-03-24 12:49:12 +01:00
renovate[bot] d99c311f3b fix(deps): update dependency yjs to v13.6.29
Docker / build-and-push (backend) (push) Has been cancelled
Docker / build-and-push (frontend) (push) Has been cancelled
Deploy HD2 docs to Netlify / Deploys to netlify (push) Has been cancelled
E2E Tests / backend-sqlite (push) Has been cancelled
E2E Tests / backend-mariadb (push) Has been cancelled
E2E Tests / backend-postgres (push) Has been cancelled
Lint and check format / Lint files and check formatting (push) Has been cancelled
REUSE Compliance Check / reuse (push) Has been cancelled
Scorecard supply-chain security / Scorecard analysis (push) Has been cancelled
Static Analysis / Njsscan code scanning (push) Has been cancelled
Static Analysis / CodeQL analysis (javascript) (push) Has been cancelled
Run tests & build / Test and build with NodeJS 24 (push) Has been cancelled
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-04 12:36:14 +01:00
renovate[bot] a1ced25475 fix(deps): update dependency mermaid to v11.12.3
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-04 12:35:15 +01:00
renovate[bot] 28b492c186 chore(deps): update actions/upload-artifact action to v7
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-04 12:34:45 +01:00
renovate[bot] 23832684b4 fix(deps): update nestjs packages
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-04 12:33:40 +01:00
renovate[bot] 85498bacf8 chore(deps): update testing-library
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-04 12:33:02 +01:00
renovate[bot] 8f6d8e63e1 chore(deps): update actions/setup-node action to v6.3.0
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-04 12:31:50 +01:00
renovate[bot] c7006482c9 fix(deps): update dependency keyv to v5.6.0
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-04 12:31:15 +01:00
renovate[bot] b9498adca1 fix(deps): update dependency react-infinite-scroll-component to v6.1.1
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-04 12:20:19 +01:00
renovate[bot] 68cb90ef7b fix(deps): update dependency minio to v8.0.7
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-04 12:19:32 +01:00
renovate[bot] 1f6eeecaaa fix(deps): update dependency @dicebear/identicon to v9.4.0
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-04 01:33:51 +01:00
renovate[bot] 536d782ff2 fix(deps): update dependency i18next-browser-languagedetector to v8.2.1
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-04 01:33:38 +01:00
renovate[bot] b758343fad fix(deps): update dependency mysql2 to v3.18.2
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-04 01:32:25 +01:00
renovate[bot] 2531dac28c chore(deps): update dependency @dicebear/converter to v9.4.0
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-04 01:27:56 +01:00