sync main into fix-mcp-links - #3172
Merged
Merged
Conversation
add branch search with server-side filtering
Feat/corporate email policy
Adds the 'Sign in with Appwrite' identity-provider UI for the Console OAuth2 server — the two user-facing screens behind the new server env vars: - _APP_CONSOLE_OAUTH2_AUTHORIZATION_URL -> /oauth2/consent - _APP_CONSOLE_OAUTH2_VERIFICATION_URL -> /oauth2/device Consent (/oauth2/consent): authorization-code flow. Reads the grant, shows the requesting app's branding and what authorizing grants, and lets the user authorize or cancel. Approve redirects back to the client with a code; cancel returns access_denied. The permission list leads with full account access rather than the requested OIDC scopes, since console-project tokens receive the full users (member) role regardless of scopes. Device (/oauth2/device): Device Authorization Grant (RFC 8628). When opened via verification_uri_complete the code is rendered for the user to confirm it matches their device (no silent auto-submit); otherwise they type it in. After confirming, the same consent card is shown (with device-specific copy), then a terminal success state. SDK: bump @appwrite.io/console pin to 1a5604f which adds the Oauth2 grant service and Models.Oauth2Grant; wire Apps + Oauth2 into sdk.forConsole. Login: honor the redirect query param after email login (MFA-safe) so OAuth2 flows resume after sign-in, aligning login with register.
The oauth2 layout wrapped its slot in the generic .console-container class, which as a flex item in the row-flex section with no definite width shrank to min-content, collapsing the card (and its width:100% descendants) into a narrow sliver. Use a dedicated .oauth2-shell with a fixed max-width and make the section stretch and center its content.
Addresses code review findings on the OAuth2 screens: - consent: re-run the load effect on ANY authorize param change (full query string), not just grant_id/client_id, so a same-client request with a new redirect_uri/state/scope can't approve the previous grant - consent: validate max_age as a non-negative integer, omitting it instead of forwarding NaN to the SDK - consent-card: pin approve/reject to the grant id captured at call time and drop the result (and errors) if the parent swaps in a different grant mid-flight - device: track only the URL user_code and reset loaded grant/app/phase when it changes or is removed, so stale device requests can't be confirmed - device: ignore createGrant results/errors when the active code changed while awaiting, and guard against duplicate concurrent submits - login: resume to the stored redirect exactly instead of appending the login page's leftover query params (e.g. message=) to the OAuth2 route
bun audit (CI gate) flagged ws 8.19.0 (transitive via jsdom) for GHSA-96hv-2xvq-fx4p. Add an overrides pin to 8.21.0, matching the repo's existing security-pin convention.
feat: OAuth2 server consent & device verification screens
fix: preserve deprecated API key scopes
The settings form already resets it; the create flows kept the previous framework's entrypoint in state and submitted it, and kept sending it after a switch to a framework that only builds static. Reset it alongside the other adapter-derived fields in both places.
The effect is skipped whenever the URL supplied any command, so a deploy link carrying ?start= kept that entrypoint through a framework switch. Resetting inside the effect could not fix it either: the effect also runs on load, where the URL value has to survive. Move the reset onto the select, so only a user changing framework clears it and the link keeps working as written.
bun audit fails on GHSA-2v37-7h3g-55p8: the lockfile pinned nanoid 3.3.17 under postcss and @ai-sdk/provider-utils, and neither `bun update nanoid` nor updating those parents re-resolved it. Bun ignores npm's nested override syntax, so the override has to be flat. That takes the direct dependency to the 3.x line as well. The only use is nanoid/non-secure, which 3.x provides, and the declared range now matches what installs rather than claiming a 5.x that the override replaces.
Keep the start command field, drop the adapter reads behind it
/console/card and /console/card/<uid> served the 2023 Cloud public beta shareable card. The API no longer serves /cards/cloud, so both loaders already bounced to / — the pages were unreachable. getCampaignImageUrl was the only live export under the route and has nothing to do with the card, so it moves to $lib/helpers/campaign.ts next to its one consumer, the unauthenticated layout. getCardImgUrls went with the route; the [uid] loader kept its own copy. windowFocus.ts had no consumer besides Card.svelte, and the console layout's /card path check guarded a route that never rendered under that group.
The card page was its only consumer.
Remove the Cloud public beta card route
The three create-site pages conflicted only in their import blocks: main dropped the FrameworkAdapterWithStartCommand import along with the adapter start-command reads, while this branch added validateVariables next to it. Kept both sides' intent — the type is gone from $lib/stores/sites and no longer referenced, so only the validateVariables import remains.
fix(variables): validate variable keys before writing them
The first-party appwrite-cli client registers a wide wordmark as logoUri. Consent/outcome avatars use a square crop, so object-fit:cover left an unreadable fragment that looked like a missing logo (#3159). Prefer the square mark for that client and contain-fit other logos in the avatar. Co-authored-by: chiragaggarwal5k <chiragaggarwal5k@gmail.com>
The cloud values moved out of appwrite-labs/cloud-applications into the consolidated appwrite-labs/application-configuration repository, which is laid out as <project>/<env>/<app> instead of <env>/<app>. The values path was hardcoded; it now builds from PROJECT/ENVIRONMENT/ APPLICATION like the other deploy workflows. The tag still lands on the `cloud-console` alias inside the cloud release, and production still opens a reviewed PR rather than pushing to main.
…nfiguration chore(deploy): push image bumps to application-configuration
After invalidate, the store holds the new phoneVerification value. Match the email path so the toast reports verified/unverified correctly. Fixes #1392 Co-authored-by: chiragaggarwal5k <chiragaggarwal5k@gmail.com>
…ation-message fix: correct phone verification success notification
The avatar used object-fit: cover, which crops a wide wordmark into an
unreadable fragment. Switching to contain fixes that for every client, so
the appwrite-cli special case and its resolver helper are unnecessary.
Hardcoding the CLI's client ID in the console was also the wrong layer:
logoUri is server-owned app-registry data, so a square mark belongs in the
registration upstream. Worse, app IDs are user-supplied, so anyone able to
create an OAuth app on a self-hosted instance could claim `appwrite-cli`
and render official Appwrite branding on a consent screen.
The helper's trim/?? '' normalization was dead too: the {#if} already
covered empty and undefined, and cimdDocumentToApp gates logoUri through
HTTP_URL before it ever reaches the template.
Fold the rule into .avatar rather than a separate img.avatar block. Every
other .avatar is a flex-centered div, so object-fit is inert there and the
padding stays harmless.
This reverts commit d049860.
fix: show Appwrite icon for CLI OAuth consent avatars
The 1.9.6 console spec adds the mfa-factors project policy, which the pinned 15.3.0 build predates. The major bump also removes the Health service (registered in the SDK store but never called), renames Models.CloudLocale to Models.Locale, moves createTextEmbeddings from VectorsDB to a new Embeddings service, drops UsageProject.executionsBreakdown in favour of the dimensional usage API, and splits the composite `databaseId:collectionId` migration resourceId into resourceId plus parentResourceId. Models.Database.type is now the SDK's DatabaseType enum, which also covers the dedicated backings (mysql, postgresql, mongodb) this console has no UI for. The local union is extracted from the SDK enum so a renamed or dropped value breaks the switches instead of drifting silently, and toDatabaseType() narrows at the boundary — matching the entity dispatchers, which already throw on an unknown type.
Lets a project choose which factors can complete an MFA challenge, including the new custom factor, where Appwrite generates and verifies the code and the app delivers it over a channel of its own. The card stays hidden when listPolicies() omits mfa-factors, so a self-hosted server older than 1.9.6 does not render a control whose PATCH would 404.
…cy-card # Conflicts: # bun.lock
Matches the project settings cards, which disable their controls on !$canWriteProjects rather than letting a read-only member submit a request the API rejects. Also fills in labels, installationScopes, and installationRedirectUrl on the App literal built from a CIMD document. Those three became required on Models.App in SDK 16 and a CIMD document carries none of them, so they take the same empty defaults as the other fields the document does not provide.
`executions` is the umbrella metric covering both functions and sites,
but the table it feeds is headed "Function" and links each row to
/functions/function-{resourceId}. A project with a trafficked site would
get rows showing a raw site ID, unresolvable by functions.list, linking
to a function that does not exist. `functions.executions` is the metric
that matches the table.
Fold the call into the load function's existing Promise.all so it no
longer serialises behind the invoice and usage requests, and report a
failure through trackError instead of swallowing it — a 403 or a
malformed response was previously indistinguishable from a project with
no executions.
Drop the duplicate database-type read in the collection layout, which
recomputed locally what the component already derives.
Datetime inputs are displayed as timezone-less local ISO strings. Without converting back to UTC on submit, unchanged datetime fields drift by the browser offset on every update (console#2870). Mirror the filters path and canonicalize datetime scalars/arrays in buildPayload. Co-authored-by: chiragaggarwal5k <chiragaggarwal5k@gmail.com>
fix: preserve datetime timezone on row updates
* fix: normalize smart quotes in function execution body Safari substitutes curly quotes while typing, which makes JSON bodies invalid (console#2872). Normalize typographic quotes on submit and disable spellcheck on the body textarea. Co-authored-by: chiragaggarwal5k <chiragaggarwal5k@gmail.com> * fix: only repair smart quotes when they invalidate JSON Address Greptile P1: unconditional normalization could rewrite intentional typographic quotes in valid JSON string values or plain-text bodies. Only normalize when the original body fails JSON.parse and the repaired body succeeds. Co-authored-by: chiragaggarwal5k <chiragaggarwal5k@gmail.com> * fix: repair only curly double quotes in JSON bodies Narrow Greptile follow-up: JSON delimiters are double quotes, so leave apostrophes/single smart quotes untouched. Still only rewrite when the original body is invalid JSON and the repaired body parses. Co-authored-by: chiragaggarwal5k <chiragaggarwal5k@gmail.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: chiragaggarwal5k <chiragaggarwal5k@gmail.com>
* fix: refresh $updatedAt after inline row edits Inline spreadsheet edits called updateRow but kept the pre-write row in local state, so $updatedAt never changed until a full reload. Apply the API response system fields before updating the grid (console#2873). Co-authored-by: chiragaggarwal5k <chiragaggarwal5k@gmail.com> * chore: retrigger CI Co-authored-by: chiragaggarwal5k <chiragaggarwal5k@gmail.com> * chore: nudge CI for stuck Tests queue Co-authored-by: chiragaggarwal5k <chiragaggarwal5k@gmail.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: chiragaggarwal5k <chiragaggarwal5k@gmail.com>
Contributor
|
Too many files changed for review (357 files, 200 file limit). Bypass the limit by tagging |
Console (appwrite/console)Project ID: Sites (1)
Tip Trigger functions via HTTP, SDKs, events, webhooks, or scheduled cron jobs |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
(Provide a description of what this PR does.)
Test Plan
(Write your test plan here. If you changed any code, please provide us with clear instructions on how you verified your changes work.)
Related PRs and Issues
(If this PR is related to any other PR or resolves any issue or related to any issue link all related PR and issues here.)
Have you read the Contributing Guidelines on issues?
(Write your answer here.)