Commit Graph
26 Commits
Author SHA1 Message Date
Oleg Isonen 0d5efb6e0f chore: rename postrest package to postgrest and enable publishing (#5592)
## Description

1. What is this PR about (link the issue and add a short description)

## Steps for reproduction

1. click button
2. expect xyz

## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
0000)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
2026-01-28 21:32:34 +01:00
Oleg Isonen fdee339de0 chore: Migrate to tsgo (#5578) 2026-01-20 17:25:12 +01:00
Bogdan ChadkinandOleg Isonen 801181c8b6 feat: add project tags in dashboard (#5399)
Ref https://github.com/webstudio-is/webstudio/issues/860





https://github.com/user-attachments/assets/a85b525a-d43b-4361-aa5f-f2158b3c0211

---------

Co-authored-by: Oleg Isonen <oleg008@gmail.com>
2025-11-07 11:33:05 +01:00
Bogdan Chadkin 3cc2f3be1e feat: improve automatic domain configuration (#5289)
- added official entrijs with types and mimimal runtime (no
dependencies)
- automatically add `www.` prefix to non-cloudflare root domains
- enabled automatic www redirect to setup with entri (though does not
work seamlesly, namecheap requires ssl certificate, godaddy requires
manual setup by user)
- toast error when click on "Configure automatically" on free plan
2025-06-26 15:22:31 +03:00
Oleg Isonen c84374708a chore: Make dev password more escure! (#4425)
## Description

1. What is this PR about (link the issue and add a short description)

## Steps for reproduction

1. click button
2. expect xyz

## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
2024-11-15 17:25:34 +01:00
Bogdan Chadkin bb8e41ab57 refactor: migrate builder tests to vitest (#4415)
Really, this was too easy
2024-11-13 14:39:17 +04:00
Ivan Starkov 482839e83a chore: Remove prisma from the Builder app (#4182)
## Description

1. What is this PR about (link the issue and add a short description)

## Steps for reproduction

1. click button
2. expect xyz

## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
2024-10-01 13:51:50 +03:00
Ivan StarkovandOleg Isonen 50ff477c97 fix: Project Cloning Broken for Share Links (#4071)
## Description

closes #4068

<img width="267" alt="image"
src="https://github.com/user-attachments/assets/ba0d6287-1391-4f03-b513-cdd07a180a11">

AuthorizationContext - splitted on 4 types, user, token, service,
anonymous (before was a mix making it hard to understand permissions)

Clone - needs 2 contexts source and destination.



## Steps for reproduction

- **Log in as "Vasya Pupkin".** 
  `5de6:vasya@pupkin.com`
- **Create a project.**
- **Generate a ShareLink.**
- **Copy the ShareLink.**

`https://p-636d568a-0a42-43d7-9509-8b23607cd5e8-dot-clone-project.development.webstudio.is/?authToken=da7ef507-c91b-4393-a1fe-91848ba533c9&mode=preview`
- **Log out.**

---

- **Log in as another user.**
- **Paste the ShareLink then clone the project.**
- **See title etc in clone dialog**
<img width="588" alt="image"
src="https://github.com/user-attachments/assets/0a04ae59-548e-48ca-871c-d01c91778194">
- **Log out.**

---

- **Paste the ShareLink then clone the project.**
- **Login process**
- **See title etc in clone dialog after the login**
<img width="588" alt="image"
src="https://github.com/user-attachments/assets/0a04ae59-548e-48ca-871c-d01c91778194">
- **Log out.**

---

- **Paste ShareLink in the, go to the menu and copy the clone link.**
<img width="417" alt="image"
src="https://github.com/user-attachments/assets/5f2911c1-721c-4c36-8ad7-b91052c9f9c1">


`https://clone-project.development.webstudio.is/dashboard?projectToCloneAuthToken=da7ef507-c91b-4393-a1fe-91848ba533c9`

---

- **Log in as "Vasya Pupkin".**
- **Remove cloning permission for the project.**
- **Log out.**

---

Paste
`https://clone-project.development.webstudio.is/dashboard?projectToCloneAuthToken=da7ef507-c91b-4393-a1fe-91848ba533c9`
See  "unexpected server error"

---

## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file

---------

Co-authored-by: Oleg Isonen <oleg008@gmail.com>
2024-09-07 09:18:40 +03:00
Ivan Starkov 766d7eb95f chore: Add CSRF protection to prevent Canvas script execution vulnerability (#4047)
## Description

how it works
https://github.com/webstudio-is/webstudio-saas/issues/317#issuecomment-2317121292

- attack example
https://p-845e975a-4e84-4186-b312-431f3a6f99ea-dot-main.development.webstudio.is/
- attack fixed
https://p-845e975a-4e84-4186-b312-431f3a6f99ea-dot-csrf.staging.webstudio.is/

corresponding PR #4060 (Add postMessage token to secure against Canvas
script execution)

Additionally

csp on iframe (see comments)
destination checks - to prevent including loaders/pages into iframes

<img width="1015" alt="image"
src="https://github.com/user-attachments/assets/2d8c6840-e195-424e-942f-8b8d05203e18">


## Steps for reproduction

1. click button
2. expect xyz

## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
2024-09-04 17:08:08 +03:00
Ivan Starkov f46abe2f04 fix: Support new project links in the cli (#4049)
## Description

closes #4048

## Steps for reproduction

see fixtures
We are still supporting `BUILDER_URL_DEPRECATED` (in a single fixture)
and all other fixtures uses modern link format


## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
2024-09-02 16:59:06 +03:00
Ivan Starkov a25f2d7e93 fix: Chrome tab restore (#4033)
## Description

Chrome aggressively uses cache when restoring tabs (e.g., using
Shift+Command+T or automatic session restore).
This behavior can cause issues with loading a builder application due to
the following cycle:

1. The builder checks if the session needs to be renewed (a navigation
is detected) and redirects to `/auth/ws`.
2. Chrome retrieves the `/auth/ws` response from the cache, followed by
all OAuth redirect responses from the cache.
3. The last cached response redirects back to the builder's root (`/`).
Chrome detects this as a redirect cycle
and reloads the most recent OAuth step, resulting in an "expected state"
error.
4. To prevent this issue, the only solution is to add a `no-store`
directive to all redirect responses.


## Steps for reproduction

1. click button
2. expect xyz

## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
2024-08-30 19:33:40 +03:00
Ivan Starkov f7487fd1bc chore: New Builder Auth (#4010)
## Description

### Full track


https://github.com/webstudio-is/webstudio-saas/issues/317#issuecomment-2289241819

So thoughts about session

https://github.com/webstudio-is/webstudio-saas/issues/317#issuecomment-2314515772

Some explanations what is fixed and how

https://github.com/webstudio-is/webstudio-saas/issues/317#issue-2465048823

Next PR:
- [x] - Old share links auto redirect
- [x] - Try make better error message having that current PR will logout
all users.

## Steps for reproduction

1. Login using `google login` or `dev login` try to open projects on
dahsboard, create new, clone delete etc.
2. Try to open projects on dahboard, see each is on it's own domain and
work
3. Try to open project link (without share token) with other user -
should fail.
4. Try publish/clone any links and operations.
5. Share project from `userA`:
 - try to open it with other `userB`
   - see `userB` is not logged in to that project
- try to get using fetch from console anything about `userB` or `userA`
i.e rest etc endpoints on apps.webstudio.is domain
 - try to open incognito, check it works.
6. Open few project, then logout from dashboard, reload project page
 - See login page
 - Try to login as same uer - see it works
 - Or try to login as another user - see auth error


## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
2024-08-29 12:38:39 +03:00
Ivan Starkov 0b0707e61f chore: Project login (#3990)
## Description

New Project login without any automation or link changes.

corresponding PR
https://github.com/webstudio-is/webstudio-saas/pull/319


## Steps for reproduction

- Goto [Tmp/Login manul
page](https://oauth.staging.webstudio.is/tmp/login)
- Manually login/logout to project domains

## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
2024-08-24 08:58:54 +03:00
Ivan Starkov 50575df29b chore: Use secure cookies in local development and fix layout nesting (#3949)
## Description

- Use secure cookie at local development
- Fix layout nesting
https://remix.run/docs/en/main/file-conventions/routes#nested-urls-without-layout-nesting

## Steps for reproduction

1. click button
2. expect xyz

## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
2024-08-17 00:53:29 +03:00
Ivan Starkov 3105b5cec0 feat: Make it easy for a self-hosted version to set the plan features (#3475)
## Description

closes #3400 


`+` on dev login its now possible to add any email
like 
`{code}:hello@world.xx` to login as other user


## Steps for reproduction

Login on main with `{code}:ice@yandex.ru`
- See no plan
<img width="213" alt="image"
src="https://github.com/webstudio-is/webstudio/assets/5077042/65f79295-63b3-4d4f-b5d2-ed854f8462e3">

---

Login on main as usual
- See user has plan
<img width="265" alt="image"
src="https://github.com/webstudio-is/webstudio/assets/5077042/db9e1c3e-a8d7-4cde-bbd5-1f39ce7442b8">

---

Login locally
See user has plan

<img width="231" alt="image"
src="https://github.com/webstudio-is/webstudio/assets/5077042/c1187bce-2c7e-49f3-a3ac-bfa15560ccce">




## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env.example`
and the `builder/env-check.js` if mandatory
2024-06-02 14:54:19 +03:00
Ivan Starkov 393cc90612 build: Move build time env vars in env.static (#3183)
## Description

This variables are build time and not dependent on deploy. Moreover we
don't know them during production deploy.
But they are used as versioning at saas level 


## Steps for reproduction

1. click button
2. expect xyz

## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env.example`
and the `builder/env-check.js` if mandatory
2024-04-17 16:34:46 +03:00
Bogdan Chadkin eb5e9200d9 refactor: drop unused sentry (#3100)
We do not use sentry 1 year (since 5 april 2023).
Better get rid of for now to not block updates.
2024-04-05 23:21:45 +07:00
Ivan Starkov 8957792973 refactor: Generalize trpc client (#3010)
## Description

- [x] - Test that clone by authToken is working

Next PR:

Add caching headers support

## Steps for reproduction

1. click button
2. expect xyz

## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env.example`
and the `builder/env-check.js` if mandatory
2024-03-14 14:25:43 +03:00
Ivan Starkov b85cfa7950 fix: Switch on single router (#3006)
## Description

Preparation on using std trpc protocol for everything

## Steps for reproduction

1. click button
2. expect xyz

## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env.example`
and the `builder/env-check.js` if mandatory
2024-03-13 16:54:31 +03:00
Ivan Starkov 5518303c74 fix: Resolve inconsistencies between database and session (#2350)
## Description

This PR addresses an issue where inconsistencies between the database
and session were causing crashes on every page of the application.

## Steps for reproduction

1. click button
2. expect xyz

## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env.example`
and the `builder/env-check.js` if mandatory
2023-09-21 15:05:12 +03:00
Bogdan Chadkin e1fa2075a5 Enforce server constraints for packages (#1507)
Ref
https://remix.run/docs/en/1.15.0/guides/constraints#server-code-pruning

Remix use NAME.server.ts extension to enforce omitting module from
client bundles. Though we heavily used `/server` in packages which had
no affect and blocked us in using a few node apis which were not
polifilled with empty modules while bundling for client.

Here I replaced `/server` with `/index.server` and removed all legacy
server entry points which are not longer necessary with new typescript
resolution.
2023-04-22 09:14:14 +07:00
Bogdan Chadkin 9c316b0499 Enable typescript preserveValueImports (#1341)
This option forces all type imports to have "type" specifier even though
there are other value imports.

TS 5 forces it when new verbatimModuleSyntax is enabled.
2023-04-01 17:47:55 +07:00
Oleg Isonen 0c9e96d2e3 Login redesign (#1222)
## Description

Login redesign

<img width="430" alt="Screenshot 2023-03-10 at 19 41 51"
src="https://user-images.githubusercontent.com/52824/224399146-74ee67f4-db60-4c1e-9582-f39f84498e8a.png">
<img width="1371" alt="Screenshot 2023-03-10 at 19 42 01"
src="https://user-images.githubusercontent.com/52824/224399154-3e7db67a-0149-4b86-8f12-9661395ae1b9.png">



## Steps for reproduction

1. go to /login


## Code Review

- [ ] hi @rpominov , I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio-builder/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env.example`
and the `builder/env-check.js` if mandatory
2023-03-10 23:04:09 +01:00
Oleg Isonen 1f2475b9f4 consistent error naming in catch 2023-02-24 09:16:31 +00:00
Bogdan Chadkin 9bf86d150d Fix trpc client setup with default .env for local dev (#1034)
We have trpc envs specified like this

TRPC_SERVER_URL=
TRPC_SERVER_API_TOKEN=

Which gives empty string in runtime though we check for undefined
expecting envs are not defined.

In this PR I covered both undefined and empty string to not break new
setups.
2023-02-15 16:59:46 +03:00
Andras Bacsai ac413cdd5f rename designer to builder 2023-02-14 11:15:24 +01:00