gristlabs_grist-core

Commit Graph

Author	SHA1	Message	Date
Paul Fitzpatrick	36d5e7870e	(core) streamline registration flow for new appsumo users Summary: This adds a new landing page for cognito sign-up, intended for use by new appsumo users. Their email address is pre-filled and locked down, and sign-up is by entering a password. The page is very crude compared to hosted cognito - especially in error reporting! - but having the address filled in more than makes up for that. The flow does not quite connect with the new billing signup. I think we can do that through the regular "welcome" process, which will list the user's team site. When the user visits that site, we could detect that we are on a site with no domain set yet and for which the user is a billing manager, and trigger a visit to the appropriate billing page. Test Plan: manual - hard to test through cognito email step Reviewers: dsagal Reviewed By: dsagal Differential Revision: https://phab.getgrist.com/D2880	3 years ago
Dmitry S	de1719ee08	(core) Make side panels responsive and start closed on small screens. Summary: - Add isNarrowScreenObs() observable. - Remove optimizeNarrowScreen flag (now assumed always true). - Added viewport support and mobile tweaks to Error/Billing/Welcome pages. - Fix responsiveness of panel transitions, and of side panel state. - Close left panel on navigation to another page or workspace. - Start panels collapsed in both doc and docmenu cases. Test Plan: Tested manually, and fixed tests to accept the new behavior. Reviewers: paulfitz Reviewed By: paulfitz Differential Revision: https://phab.getgrist.com/D2726	4 years ago
Dmitry S	02ed4c59a0	(core) On welcome form pages, prevent accidental multiple submissions. Summary: Disable the submit button while a form submission is pending. (We don't move to the next page without waiting since we get the page to redirect to from the server.) Test Plan: Tested manually by pausing the server and trying to submit multiple times. Reviewers: paulfitz Reviewed By: paulfitz Differential Revision: https://phab.getgrist.com/D2688	4 years ago
Dmitry S	275a35d03a	(core) In Welcome questionnaire, add 'School' option, ask to enter company or school Test Plan: Added some checks that company and use_school get recorded. (Live doc will need to be updated before release.) Reviewers: paulfitz Reviewed By: paulfitz Differential Revision: https://phab.getgrist.com/D2650	4 years ago
Dmitry S	ad7be0fd8d	(core) Fix WelcomePage to use an explicit action URL, and parse submitted body in time to log it with errors. Test Plan: Tested manually that "Preflight" error goes away in Safari. Reviewers: paulfitz Reviewed By: paulfitz Differential Revision: https://phab.getgrist.com/D2644	4 years ago
Dmitry S	0b1aa22ad9	(core) Ask the user some questions after they sign up and set their name. Summary: - Add a /welcome/info endpoint, to serve a page after /welcome/user - Add a new forms module to factor out the styles that feel more natural for a web form. - Simplify form submission using JSON with a BaseAPI helper. - The POST submission to /welcome/info gets added to a Grist doc, using a specialPermit grant to gain access. A failure (e.g. missing doc) is logged but does not affect the user. Test Plan: Added a test case. Reviewers: paulfitz Reviewed By: paulfitz Differential Revision: https://phab.getgrist.com/D2640	4 years ago
Paul Fitzpatrick	bd6a54e901	(core) mitigate csrf by requiring custom header for unsafe methods Summary: For methods other than `GET`, `HEAD`, and `OPTIONS`, allow cookie-based authentication only if a certain custom header is present. Specifically, we check that `X-Requested-With` is set to `XMLHttpRequest`. This is somewhat arbitrary, but allows us to use https://expressjs.com/en/api.html#req.xhr. A request send from a browser that sets a custom header will prompt a preflight check, giving us a chance to check if the origin is trusted. This diff deals with getting the header in place. There will be more work to do after this: * Make sure that all important endpoints are checking origin. Skimming code, /api endpoint check origin, and some but not all others. * Add tests spot-testing origin checks. * Check on cases that authenticate differently. - Check the websocket endpoint - it can be connected to from an arbitrary site; there is per-doc access control but probably better to lock it down more. - There may be old endpoints that authenticate based on knowledge of a client id rather than cookies. Test Plan: added a test Reviewers: dsagal Reviewed By: dsagal Differential Revision: https://phab.getgrist.com/D2631	4 years ago
Paul Fitzpatrick	1654a2681f	(core) move client code to core Summary: This moves all client code to core, and makes minimal fix-ups to get grist and grist-core to compile correctly. The client works in core, but I'm leaving clean-up around the build and bundles to follow-up. Test Plan: existing tests pass; server-dev bundle looks sane Reviewers: dsagal Reviewed By: dsagal Differential Revision: https://phab.getgrist.com/D2627	4 years ago

8 Commits (4a23b964ed8f74379a8dae5323a98f75ab883026)