## Description
It was possible to use any builder subdomain for redirect_uri. What can
cause auth `code` leak.
Not a big deal having pkce but better to avoid as additional security
measure.
## Steps for reproduction
1. click button
2. expect xyz
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
## Description
1. What is this PR about (link the issue and add a short description)
## Steps for reproduction
1. click button
2. expect xyz
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
## Description
https://github.com/webstudio-is/webstudio-saas/issues/317#issuecomment-2317121292
See postMessage
Doesn't work as can be intercepted using `addEventListener`.
## Steps for reproduction
In chrome dev console in window and canvas context
```js
globalThis.postMessage = (...args) => console.log(...args); // no messages
```
```js
globalThis.postMessage({
"action": {
"type": "sendStoreData",
"payload": {
"source": "builder",
"data": [
{
"namespace": "hoveredInstanceSelector",
"value": [
"w2emY6HYI160BmYG9WA6C",
"_BKGofOEhOFV_zLiN0iZk"
]
}
]
}
},
"token": "development-token-2"
}, '*'); // Error in console "Invalid token"
```
```js
window["__webstudio__$__api_token"] // is undefined
```
```js
window.addEventListener(
"message",
e=>console.log({...e.data}), {capture: true}); // token prop is undefined
```
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
fixes#3797
## Description
Allow layers to be deleted even when the layers are in hidden state.
This change should reflect for all the following layer based properties.
- transforms
- translate
- filter
- backdrop-filter
- box-shadow
- text-shadow
- backgrounds
## Steps for reproduction
- Add a layer to any of the following layer based proeprties.
- Hide a layer in the list
- Now, delete the layer that is hidden
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [x] made a self-review
## Before merging
- [x] tested locally and on preview environment (preview dev login:
5de6)
## Description
- always use defaultValue and defaultChecked props when passing to react
- expose value and checked as props, remove default*
- reorder initial props to make more sense (name, value, checked - in
this order)
Affected components:
Forms:
- checkbox
- radio
- input
- select
- textarea
Radix:
- checkbox
- radio group
- select
- switch
## Steps for reproduction
1. test each component named above how bound and unbound value/checked
works
2. use in regular form and bind to url params
3. use in webhook form
## Code Review
- [ ] hi @john, I need you to do
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
---------
Co-authored-by: Ivan Starkov <istarkov@gmail.com>
Co-authored-by: Bogdan Chadkin <opensource@trysound.io>
## Description
This PR adds tooltips for all the layer based sections in the transform
property. The rest of the properties already have their tooltips managed
by the `PropertyName` component. I have taken our previous tooltips as
based and used a AI suggested one and proof read those. So, please let
me know if there are any suggestions to change.
## Steps for reproduction
- verify tooltips for `translate`, `scale`, `rotate` and `skew`,
`box-shadow`, `text-shadow`, `drop-shadow` properties.
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [x] made a self-review
## Before merging
- [x] tested locally and on preview environment (preview dev login:
5de6)
## Description
**✅🔍 Review per commit!!! ✅🔍**
We missed this bug because our CLI has two different sync methods:
1. Sync by buildId - This one works fine.
2. Sync by projectId - broken
This PR contains:
1. Fix
2. Fixture with sync by projectId
## Steps for reproduction
1. click button
4. expect xyz
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
## Description
Test preconnect
## Steps for reproduction
1. click button
2. expect xyz
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
## Description
1. What is this PR about (link the issue and add a short description)
## Steps for reproduction
1. click button
2. expect xyz
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
## Description
When instance is selected the label often gets in the way of seeing the
element behind the label, we think its better to only show the label
when user is hovering the instance
## Steps for reproduction
1. hover instance - old behavior
2. selected instance with mouse hover - old behavior
3. selected instance without mouse over - no label
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
## Description
closes#4048
## Steps for reproduction
see fixtures
We are still supporting `BUILDER_URL_DEPRECATED` (in a single fixture)
and all other fixtures uses modern link format
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
## Description
1. What is this PR about (link the issue and add a short description)
## Steps for reproduction
1. click button
2. expect xyz
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
---------
Co-authored-by: johnsicili <john@createtoday.io>
## Description
1. What is this PR about (link the issue and add a short description)
## Steps for reproduction
1. click button
2. expect xyz
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
## Description
Regression with old share link urls
## Steps for reproduction
1. click button
2. expect xyz
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
## Description
Last PR broke the generator because if there are multiple types exported
it starts getting a different namespace
## Steps for reproduction
1. click button
2. expect xyz
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
## Description
Can't leave without this commands
## Steps for reproduction
1. click button
2. expect xyz
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
## Description
Unreveal remix, use fully default setup
## Steps for reproduction
1. click button
2. expect xyz
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
## Description
Cookie Overwriting in Canvas:
Scripts running inside the canvas can add any cookie client-side. There
is no way on the server to distinguish whether a cookie was created on
the server or client-side. A bad actor can even write a signed cookie by
copying it from their own session, making it difficult to identify the
source of the cookie.
To protect against cookie overwrites, we set a null session cookie if a
user is using an authToken.
This ensures that any existing HttpOnly, secure session cookies cannot
be overwritten by client-side scripts
See Storage model
https://datatracker.ietf.org/doc/html/rfc6265#section-5.3
If the cookie store contains a cookie with the same name,
domain, and path as the newly created cookie:
...
If the newly created cookie was received from a "non-HTTP"
API and the old-cookie's http-only-flag is set, abort these
steps and ignore the newly created cookie entirely.
_same domain and path are enforced by `__Host-` prefix__
## Steps for reproduction
1. click button
2. expect xyz
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
## Description
Chrome aggressively uses cache when restoring tabs (e.g., using
Shift+Command+T or automatic session restore).
This behavior can cause issues with loading a builder application due to
the following cycle:
1. The builder checks if the session needs to be renewed (a navigation
is detected) and redirects to `/auth/ws`.
2. Chrome retrieves the `/auth/ws` response from the cache, followed by
all OAuth redirect responses from the cache.
3. The last cached response redirects back to the builder's root (`/`).
Chrome detects this as a redirect cycle
and reloads the most recent OAuth step, resulting in an "expected state"
error.
4. To prevent this issue, the only solution is to add a `no-store`
directive to all redirect responses.
## Steps for reproduction
1. click button
2. expect xyz
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
Color control can be a thin wrapper around color picker
- fixed "inherit" keyword support
- moved intermediate value into color picker
- merge highlight and change low level events
## Description
Date can be in various forms, lets support them all:
1698377386 - A valid 10-digit Unix timestamp (October 26, 2023).
2147483647 - The maximum 32-bit signed integer timestamp (January 19,
2038).
1698377386000 - A valid 13-digit Unix timestamp (October 26, 2023).
9999999999999 - A far future date (November 20, 2286).
2024.10
## Steps for reproduction
1. click button
2. expect xyz
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
---------
Co-authored-by: johnsicili <john@createtoday.io>
We have two position controls which drive me crazy when I try to work
with any of them. `inset` is a shorthand for top/right/bottom/left so
should be a more straightforward name rather than "position" which we
use for background-position and object-position in another control
already.
## Description
Page titles were lost
## Steps for reproduction
1. click button
2. expect xyz
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
## Description
### Full track
https://github.com/webstudio-is/webstudio-saas/issues/317#issuecomment-2289241819
So thoughts about session
https://github.com/webstudio-is/webstudio-saas/issues/317#issuecomment-2314515772
Some explanations what is fixed and how
https://github.com/webstudio-is/webstudio-saas/issues/317#issue-2465048823
Next PR:
- [x] - Old share links auto redirect
- [x] - Try make better error message having that current PR will logout
all users.
## Steps for reproduction
1. Login using `google login` or `dev login` try to open projects on
dahsboard, create new, clone delete etc.
2. Try to open projects on dahboard, see each is on it's own domain and
work
3. Try to open project link (without share token) with other user -
should fail.
4. Try publish/clone any links and operations.
5. Share project from `userA`:
- try to open it with other `userB`
- see `userB` is not logged in to that project
- try to get using fetch from console anything about `userB` or `userA`
i.e rest etc endpoints on apps.webstudio.is domain
- try to open incognito, check it works.
6. Open few project, then logout from dashboard, reload project page
- See login page
- Try to login as same uer - see it works
- Or try to login as another user - see auth error
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
## Description
Show `rotate` and `skew` next to the transform list dropdown values.
When applied it should show just the transform in the layer list.
<img width="497" alt="Screenshot 2024-08-28 at 9 24 03 PM"
src="https://github.com/user-attachments/assets/3dd4bc45-f5a2-46a9-b0fa-91e6ee1646b8">
<img width="492" alt="Screenshot 2024-08-28 at 9 23 53 PM"
src="https://github.com/user-attachments/assets/68078d59-9d92-419a-8585-f54540d0d36f">
## Steps for reproduction
- Add a transform layer list.
- Now, click on the layer to edit the layer and search for transform.
- The dropdown list should show `rotate` and `skew` next to the dropdown
list.
- When added it should show `Transform` alone in the label.
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [x] made a self-review
## Before merging
- [x] tested locally and on preview environment (preview dev login:
5de6)
Ref https://github.com/webstudio-is/webstudio/issues/3914
Closes https://github.com/webstudio-is/webstudio/issues/3800
## Description
This allows to see borders/outlines when changing ephimeral styles e.g.
scrubbing border-outline width or color
This is not 100% fixing the problem, as you still can't see the
border/outline when you change non ephimeral value, but there is not
much we can actually do, because outline has to be blue for clarity,
making it look like the user color, would be potentially very confusing.
## Steps for reproduction
1. change any ephimeral styles like padding drag/drop or scrub any input
2. see outline is hidden during that change
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
Removed setProperty, deleteProperty and createBatchUpdates from react
hook. All parameters can be accessed from global stores.
Note: review with hidden spaces.
fixes#3982#3977
## Description
This PR aims to improve the experience for selecting
`transition-property` values while selecting from the dropdown.
And now, we show the `Rotate` and `Skew` next to the `Transform` layer
name to exactly show what properties are being effected when something
is applied on transform.
<img width="243" alt="Screenshot 2024-08-22 at 8 18 29 PM"
src="https://github.com/user-attachments/assets/6931c0bb-c180-4e7a-b5ba-710e84e3240f">
And the properties on the node are show at the top under the `Defined`
sections.
<img width="243" alt="Screenshot 2024-08-22 at 8 19 17 PM"
src="https://github.com/user-attachments/assets/6a63d9f3-bfdd-4af9-a03e-e912ab2d9b10">
## Steps for reproduction
- Add a transition layer and set the property to transform.
- This will show the layer name as `Transform (Rotate, Skew)`
- Change the node to multiple breakpoints and it should change the
defined properties list items.
- When there are no properties set on the node, the `Derived` section
should not show on the list items.
- Should be able to select the item from dropdown using the arrow keys
when in focus.
- Select the list item using the mouse.
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [x] made a self-review
- [x] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [x] tested locally and on preview environment (preview dev login:
5de6)
## Description
This has always been our convention, I have a feeling our linter used to
check this. Now its also important so that AI doesn't give you wrong
suggestions.
## Steps for reproduction
1. click button
2. expect xyz
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
## Description
Tired of deployment messages
https://github.com/orgs/community/discussions/36919
## Steps for reproduction
1. click button
2. expect xyz
## Code Review
- [ ] hi @kof, I need you to do
- conceptual review (architecture, feature-correctness)
- detailed review (read every line)
- test it on preview
## Before requesting a review
- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")
## Before merging
- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
