Cleanded up commit history - #6
Open
Srinandha-Murugesan wants to merge 59 commits into
Open
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Srinandha-Murugesan
force-pushed
the
19773-fixed
branch
2 times, most recently
from
July 30, 2026 18:58
f45069a to
349aa78
Compare
Signed-off-by: Anders Kaseorg <anders@zulip.com>
… the only possible return value. Signed-off-by: Anders Kaseorg <anders@zulip.com>
…g methods. Signed-off-by: Anders Kaseorg <anders@zulip.com>
…ption` call. Signed-off-by: Anders Kaseorg <anders@zulip.com>
Signed-off-by: Anders Kaseorg <anders@zulip.com>
Signed-off-by: Anders Kaseorg <anders@zulip.com>
We missed to set this flag in the original implementation of the self-serve flow - but there's no reason not to enable the conversion of threads.
Commit 0cd5c18 refactored the reply-button label to use a template that consumes the structured fields (stream, topic_display_name, has_empty_string_topic) directly, and dropped the now-redundant label_text for stream/topic recipients. However, label_text is still consumed by the BigBlueButton and Nextcloud Talk call-creation paths in compose_call_ui.ts Restore the label_text field for stream/topic recipients using the same format the refactor removed.
When testing for the logging output was improved in these stripe billing tests, duplicate calls to get the CustomerPlan object were added to multiple tests. Removing that duplication simplifies these tests and removes any confusion about whether the different plan variables are the same or different plans. Also removes any confusion via variable names that the logging output contains Stripe.customer IDs, when they in fact contain the IDs of our database's Customer objects.
Srinandha-Murugesan
force-pushed
the
19773-fixed
branch
from
July 31, 2026 16:20
c5f8500 to
a3f9305
Compare
The user icon was removed from the recent view table in commit 7ef8537 ("recent_view: Redesign table."). This removes the dead #recent_view_table .zulip-icon-user selector from both dark_theme.css and recent_view.css. Fixes part of zulip#39354.
The stream notice banner was removed from the invite modal in commit a76042c ("invite: Any combination of default streams should be subscribe-able."). This removes the dead selector from dark_theme.css and consolidates the remaining .tip rules in app_components.css. Fixes part of zulip#39354.
Zulip's nginx configuration listens on all hostnames by default. Servers that run other software alongside Zulip sometimes need nginx to route by a specific hostname instead, which previously required manually patching the puppet-managed nginx config after every zulip-puppet-apply run. Add an nginx_server_name option to the [application_server] section of zulip.conf, applied to both the HTTP-to-HTTPS redirect server block and the main server block. The option is prefixed with nginx_, matching the existing nginx_listen_port and nginx_worker_processes settings in the same section. Fixes zulip#5134.
The webhook unconditionally dereferenced alert["generatorURL"], so any payload without that field raised ValidationError before any message was sent. generatorURL is normally populated by Prometheus Alertmanager, but it can be absent for alerts inserted manually via the Alertmanager API or by tools that emulate the webhook format, and the integration shouldn't crash in those cases. Guard the lookup the same way the grafana webhook does, and drop the trailing "([source](...))" suffix when the URL is unavailable.
When search filter pills wrap onto a second line, they sat flush against the top and bottom edges of the search box. This adds vertical padding equal to the space a single line of pills already has from being centered in the fixed-height box, so wrapped rows get the same breathing room while the single-line height stays unchanged. Fixes zulip#38921.
We only pay an invoice by hand when the customer is charged automatically, so check that flag first rather than reading the invoice status and discarding the result on the pay-by-invoice path. Both operands are plain attribute reads, so this is a no-op. It does let a test upgrade an invoice-billed free trial through local_upgrade, whose single shared Stripe mock stands in for a card and so has no invoice status to read.
When an unpaid invoice is voided in Stripe -- for example, a full-price free trial upgrade invoice that support voids after setting up a discount -- the associated local Invoice object stayed in SENT. The upgrade page treats an outstanding SENT free-trial-upgrade invoice as a "your free trial invoice has expired, please pay" notice, so the customer was stuck and could not start a fresh upgrade with their discount. Handle invoice.voided events the same way we already handle invoice.paid: look up the local Invoice for the Stripe invoice and mark it VOID. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The billing page for a free trial billed by invoice only treated a PAID invoice as resolved; for any other status it showed a "please pay your invoice" notice linking to the invoices page. Once support voids the unpaid upgrade invoice in Stripe -- now marked VOID locally via the invoice.voided webhook -- that notice was stale, pointing the customer at an invoice that no longer exists. A free-trial invoice that is not paid results in the plan being downgraded at the end of the trial (see make_end_of_cycle_updates), so for the VOID case render the existing pending-downgrade notice instead, which honestly describes what will happen. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
These subsection headings carried the "light" class (font-weight: 300), but it never took effect: the higher-specificity "#settings_page h3" rule forces font-weight: normal and overrides the class. Drop the dead class; this is a no-op cleanup with no visual change.
The privacy subsection headings are direct children of a ".subsection-header", which is "display: flex". Flex items ignore their own "display" value for layout, so the "inline-block" class on the wrapper and the headings had no effect. Drop the dead class; no visual change.
Wrap the Account, API key, "Deactivate organization", Profile and "Export organization" subsection headings in a ".subsection-header", matching the other settings subsections. Previously these were positioned ad hoc (the Account and Profile headings via an "inline-block" class, the Account heading also via "account-settings-heading") or left unwrapped with a larger default margin. All non-table subsection headings now share a single "#settings_page .subsection-header h3" margin rule, replacing the per-heading ".account-settings-heading" margin.
The "Invitations are required" container is a plain block whose nearest shrink-to-fit ancestor is sized to the widest control in the subsection (pill inputs, selects), so it stretched well past its single checkbox. Because the disabled-state hover tooltip is bound to that container (see tippyjs.ts), the tooltip triggered across the empty space beside the checkbox. Constrain the container with width: fit-content, matching how the other disabled_setting_tooltip containers shrink-wrap. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The Organization profile, settings, and permissions subsections wrapped their controls in an `organization-settings-parent` / `organization-permissions-parent` div, applied inconsistently (some with `inline-block`, some not) and only to size the group to its widest child and add a small top padding. Both effects were incidental: the controls are intrinsic-width, and the padding existed on only some subsections. Remove the wrappers so the controls are direct children of `.settings-subsection-parent`, matching subsections that never had a wrapper, and drop the two now-unused padding rules. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Stream and group settings used a mix of h3 and h4 for subsection titles at the same structural level -- e.g. in the channel edit panel, "Personal settings" was an h3 while its sibling "Notification settings" was an h4. Promote the h4 subsection titles to h3 so they match, rendering via the existing h3.stream_setting_subsection_title styling, and drop the now-unused h4 rules. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Align the stream and group settings subsection titles with the organization settings headings: subsection titles (.stream_setting_subsection_title) use the same expression as the org subsection h3 margin, while the member/subscriber list headers keep the larger org settings table heading margin (10px), since those are table headings rather than subsections. The group "Members" list header was an unclassed <div>; give it a members-list-header class so its heading can be scoped like the stream subscriber list headers. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The channel Subscribers and group Members list headers (both the edit panels and the create-flow previews) used bespoke markup (.subscribers-list-header / .members-list-header / .create_*_list_header with a float-right filter), giving different alignment and margins from the organization settings tables. Adopt the org '.settings_panel_list_header' layout (added alongside the existing class) and move the filter into a '.user_filters' container so the heading/filter row matches org tables. Drop the create-form-only container margin and the filter's now-stale float and top margins. The loading-spinner grouping and heading font/margin are preserved; the unused .subscriber-search/.member-search rules are removed but their filter widths are retained unchanged. The filter width change (to the flexible org width) and the clear-filter button follow in a separate commit. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adopt the shared filter_text_input partial for the channel Subscribers and group Members filters (edit panels and create-flow previews), so they gain the clear (x) button and the flexible filter width used by the organization settings tables, replacing the bespoke fixed widths (max-width 160px in the edit panels, width 140px in the create flow). The clear button is auto-wired by ListWidget (it activates the .clear-filter sibling), so no new handler is needed. The create-flow filters were found via .add-user-list-filter; point those lookups (and the e2e test) at the partial's input.search instead, and drop the now unused .add-user-list-filter class and user_list_filter name. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
After the subscriber/member headers adopted .settings_panel_list_header, the .subscribers-list-header / .create_stream_subscriber_list_header rule only repeated layout (display:flex, flex-direction:row, justify-content:space-between) that .settings_panel_list_header already provides. Drop it, keeping the .subscribers-heading spinner-grouping rule on its own, and remove the now-dead .subscribers-list-header / .create_stream_subscriber_list_header classes from the templates. Also drop the unused .new-stream-subscribers-title class, which had no CSS or JS. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
We used "light" class only for feedback container heading and it was used to set font-weight to 300. This commit updates the CSS to set font-weight using "#feedback_container h3" selector so that we can remove "light" class from the element and also its CSS.
The section and subsection headings in the settings, channel, and group settings overlays each sit inside a flex container (e.g. .subsection-header, .settings_panel_list_header, .subscribers-heading, .advance-config-toggle-area). A flex item's display value is blockified by the layout algorithm, so the display: inline and display: inline-block declarations on these headings had no effect. The one declaration that did apply -- inline-block on the channel and group subsection titles, which reaches the channel-creation permission headings whose container is not a flex parent -- only changes the computed display from block to inline-block with identical geometry (same height, margins, and position), so it is likewise safe to drop. Also drop h4 from the .fa-info-circle positioning rule: no <h4> in settings contains that icon, so that part of the selector matched nothing. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The settings, channel, and group overlays styled their section and subsection headings through bare h3 element selectors (notably those containers whether or not it is meant to be a heading. Give these headings explicit classes and style those instead, so the styling contract is explicit and greppable: .settings-subsection-title for the subsection headings, and .settings-table-title for the table/list-panel headings (those in .settings_panel_list_header, e.g. "Users", "Subscribers", "Members"), which use a larger margin. The shared font declaration (font-size, font-weight, line-height) is defined once, grouped across both classes, replacing the copies that were duplicated in #settings_page h3 and subscriptions.css and resolving the existing "Unify with settings.css definition" TODO. This is a pure refactor: the classes are applied to exactly the elements the old selectors matched, and the per-context spacing is preserved, so computed heading styles are unaffected (verified with before/after getComputedStyle measurements across the settings and channel/group overlays). The larger, bold .group-permissions-section > h3 section titles are a distinct heading style, not part of the definition being unified, and are left as-is. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Prep for checking the "condensed" class on the message row for the collapse and uncollapse actions.
Previously, when a message was partially collapsed, i.e., a longer message with the "condensed" class in the message row, the message actions menu displayed the "Collapse message" option. This commit updates the behavior so that these "condensed" messages now show the "Expand message" option instead. This follows the behavior of the "-" shortcut for long messages.
compose_ui.compose_textarea_typeahead should always point at the main compose box's typeahead. But message-edit boxes also create their typeaheads through initialize_compose_typeahead. So opening an edit box overwrote the variable with the edit box's typeahead. This broke the language typeahead for code fences. If the user types ```py and deletes the "py", the typeahead should stay open. get_candidates checked compose_textarea_typeahead.shown for this. After opening an edit box, that variable pointed at the edit box's closed typeahead, so the compose box's typeahead closed instead of staying open. bootstrap_typeahead now passes the typeahead instance as a third argument to source callbacks, so a callback can check the state of the typeahead it is generating candidates for. Fix get_candidates by checking the typeahead that asked for candidates. The variable's other users had the same problem; fix those by making maybe_set_compose_textarea_typeahead ignore edit-box typeaheads. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Renames GENERIC_BOT_TYPE to GENERIC_BOT_TYPE_INT so the `_INT` suffix consistently marks the int form across all bot types. Adds the string form GENERIC_BOT_TYPE = "1", and migrates web/e2e-tests/settings.test.ts to import these constants from bot_type_values.ts instead of defining them locally. Follow-up to zulip#39026.
Updates the warning banner shown when a user links to a private
channel that not all subscribers of the compose-audience channel
can access. The previous wording ("#channel-name is a private
channel.") was concise but unclear about the actual concern. The
new wording explicitly names both channels and the consequence:
Warning: Not all subscribers of #this-channel can
view #linked-channel, a private channel.
Follow-up to zulip#39026.
When a user selected message text with the keyboard and quoted it, mentions inside the selection were emitted as plain text (`@Desdemona`) because `paste_handler_converter` had no Turndown rule for user, group, or topic mention spans. The quoted block lost the pill and did not render as a mention. Add a Turndown rule that converts these spans back to mention syntax, handling silent vs non-silent variants and the single-asterisk syntax used for group mentions. Also bypass the early single-text-child shortcut for mention elements so they reach the rule. The same converter is used when pasting copied rendered HTML into the compose box, so paste also benefits. The rendered display text can't be trusted to round-trip, so we resolve names by id where possible. For user mentions, look up the canonical full_name via `people.maybe_get_user_by_id` and emit `@**Name|id**` (reusing `get_mention_syntax` with a new `always_include_id` argument), falling back to the id-only `@**|id**` syntax when the user can't be resolved locally. This avoids the "(guest)" suffix that would break a name-based round-trip. Group mentions are resolved similarly: system groups render with a display name (e.g. "Owners") that differs from their mention name (`role:owners`), so we look up the canonical name by `data-user-group-id` instead of using the pill text. At copy/quote time, expand the selection range so a partial selection inside a mention pill becomes a selection of the full span, mirroring the existing KaTeX and timestamp expansion. Wired into both `copy_handler` and `get_message_selection`.
FIXTURE_DIR_NAME was renamed to WEBHOOK_DIR_NAME in 5ecbfec, which missed this docs example and wekan's test class. Airbyte was written much later with a copy of the stale name, and 97efb06 removed only its correctly named WEBHOOK_DIR_NAME and left this dead one behind. Nothing has read FIXTURE_DIR_NAME since the rename, so all three occurrences are dead code.
Co-authored-by: Niloth P <20315308+Niloth-p@users.noreply.github.com>
Co-authored-by: Niloth P <20315308+Niloth-p@users.noreply.github.com>
STREAM_NAME was renamed to CHANNEL_NAME in dc31347, months before this integration was written; it was added here anyway, alongside a correct CHANNEL_NAME. 83d0946 then removed only CHANNEL_NAME, leaving the dead attribute behind. Nothing has read STREAM_NAME since the rename, so this occurrence is dead code.
As per documented in https://docs.slack.dev/reference/methods/users.info/#profile, only the "image_*" fields are guaranteed to be included in a successful response from the UserInfo endpoint.
In production, computed_settings.py points ROOT_URLCONF at zproject.tornado_urls when RUNNING_INSIDE_TORNADO, so Tornado resolves requests against a 5-entry urlconf rather than the ~800-pattern Django one. These tests ran against the full configuration, and so could not observe anything that depends on the minimal one -- including whether Django's error handling works at all under it. The existing tests pass unchanged, since the endpoints they exercise are exactly the ones Tornado serves. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Tornado routes every request it receives to Django, so a request for a URL that zproject/tornado_urls.py does not contain reaches Django's default 404 handler. That renders templates/404.html, which extends the portico templates; portico-header.html reverses `register` to build its "Sign up" link, and that name exists only in the full Django urlconf, so rendering raises NoReverseMatch. Django then falls back to the 500 handler, which renders templates/500.html -- the same portico chain, failing identically. With no further fallback the request ends with no response at all, which is why Sentry reports this as a stack of nested exceptions rather than a single error. Such requests do arrive: `//api/v1/events` reproduces it, because nginx merges the duplicate slashes when matching its `location` block but proxies the path as the client sent it, so a URL nginx considers Tornado's is one Tornado cannot resolve. Reverting 8ec9808 was the earlier production mitigation, but that commit merely exposed this by routing unmatched URLs to Django; the defect is that Tornado's urlconf has no error handlers of its own. Point handler404 and handler500 at JSON views instead. Tornado serves only API endpoints, whose clients parse JSON and cannot use an HTML page with a "Sign up" link, so the portico pages were never the right response there. Fixing handler500 alongside handler404 matters independently: it is the missing backstop that turned a failed error page into no response at all. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Update WebhookTestCase to inject test secrets and build signature headers automatically. Enable signature validation in GitHub webhooks to reject invalid payloads early, and simplify test setup for future integrations. Co-authored-by: Srinandha Murugesan <srinandhamurugesan@gmail.com> Co-authored-by: Isaiah Marte <JDoe-code@users.noreply.github.com> Co-authored-by: Akshaj Katkuri <Akshaj-Katkuri@users.noreply.github.com> Co-authored-by: Jason Zheng <jasonzheng13@users.noreply.github.com>
Add UI for adding a webhook secret in the add bot form and modifying or deleting it in the manage bot form. This allows for secure storage of secrets in BotConfigData over URL parameters and lets users modify it as needed. Co-authored-by: Srinandha Murugesan <srinandhamurugesan@gmail.com> Co-authored-by: Isaiah Marte <JDoe-code@users.noreply.github.com> Co-authored-by: Akshaj Katkuri <Akshaj-Katkuri@users.noreply.github.com> Co-authored-by: Jason Zheng <jasonzheng13@users.noreply.github.com>
Add a UI field and backend endpoint to the integrations dev panel to type a secret and dynamically calculate signature headers for fixture payloads. This allows developers to test signature verification in webhook endpoints directly through fixture mock requests. Co-authored-by: Srinandha Murugesan <srinandhamurugesan@gmail.com> Co-authored-by: Isaiah Marte <JDoe-code@users.noreply.github.com> Co-authored-by: Akshaj Katkuri <Akshaj-Katkuri@users.noreply.github.com> Co-authored-by: Jason Zheng <jasonzheng13@users.noreply.github.com>
Srinandha-Murugesan
force-pushed
the
19773-fixed
branch
from
August 4, 2026 17:38
5068a29 to
c504649
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
16 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consolidated commit history into 5 commits