Commit Graph

9305 Commits

Author SHA1 Message Date
Prakhar Pratyush
5f8edf669d zerver: Add endpoint to register a push device to server.
This commit adds an endpoint to register a push device
to receive E2EE push notifications.
2025-07-14 14:52:39 -07:00
Prakhar Pratyush
c846302417 send_to_push_bouncer: Avoid repeated code lookup in error handling.
This commit extracts `code` lookup into a local variable
to simplify and de-duplicate the conditional logic for
handling different error codes.
2025-07-14 14:52:38 -07:00
Prakhar Pratyush
afe6986991 register-queue: Add push_devices in response.
This commit adds a `push_devices` dictionary to
`POST /register` response, keyed with push account ID,
where each entry describes the user's push device's
registration status and error code (if registration failed).
2025-07-14 14:52:38 -07:00
Prakhar Pratyush
6a4b06b6f4 zerver: Add PushDevice model.
This commit adds a `PushDevice` model where each row
corresponds to an account on an install of the app
that has attempted to register with the bouncer to
receive mobile push notifications.

This is the core server table storing registrations
that are potentially registered with the mobile push
notifications bouncer service.
2025-07-14 14:52:38 -07:00
Prakhar Pratyush
3c6a3b0d77 zilencer: Add endpoint to register push device to bouncer.
This commit adds a zilencer endpoint to let self-hosted
servers register push devices to whom mobile push notifications
will be sent.

POST "/api/v1/remotes/push/e2ee/register"
Payload: realm_uuid, push_account_id, encrypted_push_registration,
bouncer_public_key

The post request needs to be authenticated with the server’s API key.

Note: For Zulip Cloud, a background fact about the push bouncer is
that it runs on the same server and database as the main application;
it’s not a separate service.
So, as an optimization, we plan to directly call the
`do_register_remote_push_device` function and skip the HTTP request.
2025-07-14 14:52:38 -07:00
Niloth P
c75a48b63b integrations: Remove Phabricator integration.
Phabricator has not been actively maintained since June 2021.
2025-07-14 12:03:48 -07:00
Anders Kaseorg
ea48a283b1 mypy: Add google-re2-stubs.
Signed-off-by: Anders Kaseorg <anders@zulip.com>
2025-07-14 14:33:54 -04:00
apoorvapendse
e2f3b64b35 streams: Extract channel creation permissions check logic.
Prep commit to add the channel creation API
endpoint.
Signed-off-by: apoorvapendse <apoorvavpendse@gmail.com>
2025-07-14 07:44:01 -07:00
Tim Abbott
5b1ec00350 remove_single_newlines: Fix double-space issue.
The Flutter mobile apps don't collapse repeated spaces into single
spaces the same way HTML text does, so leading/trailing whitespace in
these automated messages end up rendering weirdly.

The regex previously didn't handle a corner case that appears in the
latest message.

Co-authored-by: Greg Price <greg@zulip.com>
2025-07-11 15:52:24 -07:00
Aditya Kumar Kasaudhan
76811e0171 event: Fix navigation view event schema validation.
This commit aligns navigation view event type with Python event schema
classes. The schema validation script constructs class names from event
types, so this commit ensures the navigation view event type match the
expected EventNavigationView class names.
2025-07-11 15:48:20 -07:00
Aditya Kumar Kasaudhan
0b37ef6a9b email: Bulk clearing of scheduled emails for multiple users.
This commit is a preparatory step for allowing organization owners to
reset user preferences, refactors the `clear_scheduled_emails` function
to support bulk operations.
2025-07-11 14:15:49 -07:00
Rohan Gudimetla
26abfc4d91 markdown: Render inline audio files using the ![title](url) syntax.
Previouly, there was no option to play the inline audio files
within the web app without downloading or leaving the browser.

This commit adds option to render inline audio files that use
the syntax `![title](url)`.

Fixes #27007
2025-07-11 13:11:56 -07:00
PieterCK
6bf6249d56 users: Fix check_valid_bot_config bug.
Currently `check_valid_bot_config` checks if `config_options` has a
falsy value to determine whether an integration is invalid or not. But,
what it actually does is check whether an exists in WEBHOOK_INTEGRATIONS
and it has at least one WebhookConfigOption.

It should instead, check if `config_options` is `None` to determine
whether an integration is invalid or not.
2025-07-11 12:34:46 -07:00
Vector73
ae9336a904 api_docs: Fix missing display_recipient object in API docs.
The `display_recipient` object was not rendered in the API docs
because the case where `items` key was inside `oneOf` block was not
handled in the "api_return_values_table_generator.py".
2025-07-11 12:32:21 -07:00
Alya Abbott
57321a6a4a updates: Add Zulip update announcement (level=18). 2025-07-10 18:42:47 -07:00
Greg Price
aaeabeda44 notifications: Dedupe APNs tokens case-insensitively.
Fixes zulip/zulip-flutter#1617.

It turns out that an APNs token (which is a hex string) is equally
valid in lower or upper case.  The old app would send the server
the lower-case form of the token, but the new app sends the
upper-case form.

Because we've been treating tokens case-sensitively, if the user
upgrades from the old app to the new, that results in the server
and bouncer each having two copies of the token (one lower-case and
one upper-case), and therefore sending that device two copies of
each notification: zulip/zulip-flutter#1617.

To fix that immediately, have the bouncer drop duplicate tokens
before sending the notifications to APNs.

Work is also in progress on fixing this in a better-structured way,
by having the database correctly treat tokens as the same when they
differ only in case.
2025-07-10 10:54:14 -07:00
Aman Agrawal
9b15dce1b2 auth: Only automatically redirect for same domain redirects.
If the `deactivated_redirect` belongs to the same domain as
`EXTERNAL_HOST`, automatically redirect, otherwise just point
user to the new URL.
2025-07-10 10:46:59 -07:00
Mateusz Mandera
a61d849e37 ldap: Implement external auth id auth+sync.
Fixes #24104.
2025-07-09 15:31:17 -07:00
Vector73
a77fc6aa79 stream_settings: Add new disable_topics option to topics_policy.
Adds new configuration option `disable_topics` in `topics_policy`
channel setting to support disabling topics in the channel.

Fixes #34553.
2025-07-09 14:25:53 -07:00
Vector73
7afed92c00 streams: Add function to get topic for channel events notifications.
Refactored the code to add a function `channel_events_topic_name`
to get the topic name for sending notification for channel events.
2025-07-09 14:25:53 -07:00
Sahil Batra
de1e08b9bf typed_endpoint: Handle "dataclass_type" pydantic errors.
This commit adds error message for handling "dataclass_type"
pydantic errors. An example when this occurs is when group
setting value passed to update the setting is invalid like group
ID is passed directly and not in an object with "new" field and
other invalid values as well.
2025-07-09 11:17:54 -07:00
PieterCK
4775f9673f integrations: Rename config_options "description" field.
This renames WebhookConfigOption's "description" field to "label". That
name is consistent with how config_data is declared on the events and
API level, it's also a more accurate description of how the field is
used in the web client, as the UI label element for the config_options.
2025-07-09 10:12:33 -07:00
PieterCK
feb25b0e6b integrations: Move configs in config_options to url_options.
Currently we have 2 implementations of `config_options`:

- It's used for generating optional webhook URL parameters. These
settings also come with custom UI in the "Generate integration URL"
modal.

- In `/bots` API, it's used as schema for the bots `BotConfigData`. Each
type of bots have different ways of defining their `BotConfigData`
fields. Currently, only embedded bots use `BotConfigData`, and only the
incoming webhooks use `config_options` to configure a bot's
`BotConfigData`; thus, the `config_options` remain unused.

To avoid confusion as to which implementation of `config_options` is
used by an integration, this separates the first use case -- to generate
optional webhook URL -- to a new field called `url_options`. Thus, the
`config_options` field is reserved only for the second use case.
2025-07-09 10:12:33 -07:00
Tim Abbott
dd5ae0af44 test_helpers: Include an empty session for HostRequestMock.
This allows code that expects request.session to exist to not crash.
2025-07-08 17:02:08 -07:00
opmkumar
8786b12f0c streams: Add can_resolve_topics_group setting.
Fixes #19955.
2025-07-08 16:53:43 -07:00
Rohan Gudimetla
05b6672777 refactor: Extract method handling URLs starting with user_uploads.
This commit extracts the method which handles both relative
URLs starting with `/user_uploads` and `user_uploads`,
converting the latter into former, and attaching the path_id
to it.

This is a preparatory commit to #27007
2025-07-08 15:46:18 -07:00
PieterCK
f4432f99df message_report: Use get_message_link_syntax.
This updates the message report module to use the
`get_message_link_syntax` function.
2025-07-08 10:08:44 -07:00
Mateusz Mandera
fe993032a6 validate_email_not_already_in_realm: Add kwarg for mirror dummies.
In user signup context, we are okay with there being an existing mirror
dummy user with the matching email - at the end of the signup, that
mirror dummy account will be activated and control of it given to the
user doing this signup.

However, in email change contexts (SCIM API and regular email change
flow), we can't change an account's email address to the address that
already belongs to an existing mirror dummy user.

To avoid subtle bugs like this, we make callers have to explicitly
specify whether existance of mirror dummies with the matching email
address is okay or not.
2025-07-07 17:15:08 -07:00
Prakhar Pratyush
e6bdf84363 validate_token: Move validate_token to avoid dependency cycle.
Prep commit to avoid depencency cycle.
2025-07-06 21:11:26 -07:00
Prakhar Pratyush
86e771c982 test_classes: Use "pk" instead of "id" for primary key lookup.
Prep commit to use "pk" to get the primary keys instead of
hardcoded "id" as we plan to introduce a model with `device_id`
as the primary key name.
2025-07-06 21:07:27 -07:00
PieterCK
75f2e27500 url_encoding: Refactor a encode_user_full_name_and_id.
This refactors out a function that encode user name and user id into URL
compatible format.
2025-07-03 14:40:49 -07:00
PieterCK
29d42ab6ad url_encoding: Refactor a encode_user_ids.
This refactors out a function to encode the user ids into URL compatible
format. Previously we use the "-pm" decorator to encode user ids for
group direct messages. That decoration tag is not valid, so this also
updates some existing test cases.
2025-07-03 14:40:49 -07:00
PieterCK
48e33eed31 url_encoding: Standardize to use encode_hash_component.
Previously we use `hash_util_encode` to encode channel and topic names
to be URL compatible. This uses the more capable `encode_hash_component`
from the recently added `topic_link_utils.py` module. It also moves the
function to `url_encoding.py`
2025-07-03 14:40:49 -07:00
PieterCK
c460dc3c9c url_encoding: Update encode_stream -> encode_channel. 2025-07-03 14:40:49 -07:00
Rohan Gudimetla
8e0ba8cccf topics: Server generated permalinks now prefer latest message id.
Previously, when a topic is mentioned, the server generated a
permalink using the earliest accessible message of the topic.

This commit updates it to rather use the latest message of the
topic.
2025-07-03 11:06:39 -07:00
Aman Agrawal
5a65bd4746 reminders: Fix poll and todo list not correctly formatted for reminder. 2025-07-02 13:02:53 -07:00
Aman Agrawal
25731859b6 zerver: Add endpoints and events for reminders.
There are similar to what exists for scheduled messages expect
the PATCH requests which will be added later when the
functionality is implemented.
2025-07-02 12:47:00 -07:00
Anders Kaseorg
08a17ef22d CVE-2025-52559: Generate HTML for digest new channels safely.
Signed-off-by: Anders Kaseorg <anders@zulip.com>
2025-07-02 12:12:36 -07:00
Anders Kaseorg
a274170293 CVE-2025-52559: Generate HTML for digest message sender safely.
Signed-off-by: Anders Kaseorg <anders@zulip.com>
2025-07-02 12:12:36 -07:00
Anders Kaseorg
c33b6cae38 CVE-2025-52559: Generate HTML for digest recipient header safely.
Signed-off-by: Anders Kaseorg <anders@zulip.com>
2025-07-02 12:12:36 -07:00
Vector73
459b4867f2 tools: Add support for viewing updated changelog for testing.
Adds support for showing unmerged changelogs in
"changelog.md" for testing purposes.
2025-07-02 11:34:34 -07:00
Alex Vandiver
8cde0af040 email_mirror: Fail more gracefully on empty EMAIL_GATEWAY_PATTERN.
Otherwise, this fails on `match.group(1)` as there is no match group.

The server would ideally respond with a 521 or 556 code[^1] on initial
connection, but aiosmtpd does not provide that option.

[^1]: https://www.rfc-editor.org/rfc/rfc7504
2025-07-02 10:21:08 -07:00
Evy Kassirer
0c5e1ac492 subscription_data: Flesh out partial suscription data sent to client.
Part of #34244.
2025-06-30 17:10:36 -07:00
Shubham Padia
d701fec37d markdown: Show inline video previews for dropbox videos.
Fixes https://chat.zulip.org/#narrow/channel/9-issues/topic/.F0.9F.93.82.20video.20preview.20not.20working.20.28Dropbox.29
2025-06-30 11:21:32 -07:00
Shubham Padia
276bc7284f markdown: Rename dropbox_image to dropbox_media.
We are adding video support to the function in upcoming commits and we
need to rename the function for that to be more generic.
We've also added a proper return type in the name of DropboxMediaInfo
TypedDict for the `dropbox_media` function.
2025-06-30 11:21:32 -07:00
Kislay Verma
1588b72e60 email_notifications: Use with and near operators when applicable.
We currently don't use either of those operators in email
topic links, which breaks the links on topic moves.

Quoting Tim for choosing `near` vs `with`:
"I guess for each case we should decide if we want /near/ links
to /with/ links. We likely want /with/ in some cases, to make
sure we land in the right conversation but not forcing the scroll
position to be on that particular message, which /near/ does."

"I feel like email notifications might want /near/ if the trigger
is a mention or something else that is specific to the message,
rather than the conversation, but probably /with/ otherwise."
2025-06-30 11:19:00 -07:00
Kislay Verma
6bd6f23549 url_encoding: Add support for with message links.
We abstract away "near" vs "with" from the function names and
allow callers to specify whether they want a conversation_link,
ie, use the "with" operator. The default choice is "near".
2025-06-30 11:19:00 -07:00
Shubham Padia
a0deeae80e help-beta: Introduce NavigationSteps component for settings links.
Fixes #31254.
We are using `SHOW_RELATIVE_LINKS` as the env variable to set if we
want to show relative settings link or non-linked markdown instructions.
We are not trying to determine `SHOW_SETTINGS_LINK` by ourselves. See
https://chat.zulip.org/#narrow/channel/49-development-help/topic/Passing.20sitename.20for.20astro.20project.20in.20production.2E
for more details.
Until the cutover happens, we would need to manually update the mapping
in both the astro component and the python file, but since that mapping
is not frequently changed, that is a tradeoff we can make.
We had to add margin-bottom: 0 to icon styling since starlight was
inserting a margin-bottom of 1.25 em for list items.
2025-06-26 10:46:37 -07:00
Kislay Verma
5f80f0a970 channel: Add option to notify users newly added to a channel.
When a user is added to a channel, we send
the user that was added a Notification Bot
DMs to let them know about it.

In this commit, we add an option for whether or not
this message is sent.

If more than 100 users are added at once, we
do not send notification bot DMs since it would
be a performance-costly operation.

We also send this threshold value of 100 in the
initial state data to the clients.

Fixes part of #31189
2025-06-26 10:08:11 -07:00
Aman Agrawal
68aefeafdd reminder: Use pretty message link for reminder text. 2025-06-25 12:05:28 -07:00