[CORL-822] Safari Fix (#2760)

* fix: forced version

* fix: removed cookie code

* chore: version bump

.circleci/config.yml

@@ -221,20 +221,17 @@ jobs:
 # only execute on a deploy related job.
 filter_deploy: &filter_deploy
   filters:
-    branches:
-      only:
-        - master
-        - next
     tags:
       only: /v[0-9]+(\.[0-9]+)*/
+    branches:
+      ignore: /.*/
 
 # filter_develop will add the filters for a development related commit.
 filter_develop: &filter_develop
   filters:
     branches:
       ignore:
-        - master
-        - next
+        - /release\/.*/
 
 workflows:
   version: 2

app.js

@@ -11,7 +11,12 @@ const { HELMET_CONFIGURATION } = require('./config');
 const { MOUNT_PATH } = require('./url');
 const routes = require('./routes');
 const debug = require('debug')('talk:app');
-const { ENABLE_TRACING, APOLLO_ENGINE_KEY, PORT } = require('./config');
+const {
+  ENABLE_TRACING,
+  APOLLO_ENGINE_KEY,
+  PORT,
+  TRUST_PROXY,
+} = require('./config');
 
 const app = express();
 
@@ -58,7 +63,26 @@ if (ENABLE_TRACING && APOLLO_ENGINE_KEY) {
 
 // Trust the first proxy in front of us, this will enable us to trust the fact
 // that SSL was terminated correctly.
-app.set('trust proxy', 1);
+app.set(
+  'trust proxy',
+  (function() {
+    if (!TRUST_PROXY) {
+      return null;
+    }
+
+    const lowercase = TRUST_PROXY.toLowerCase();
+    if (lowercase === 'true' || lowercase === 'false') {
+      return lowercase === 'true';
+    }
+
+    const parsed = Number(TRUST_PROXY);
+    if (!isNaN(parsed)) {
+      return parsed;
+    }
+
+    return TRUST_PROXY;
+  })()
+);
 
 // Enable a suite of security good practices through helmet. We disable
 // frameguard to allow crossdomain injection of the embed.

client/coral-admin/src/services/linkify.js

@@ -1,8 +0,0 @@
-import LinkifyIt from 'linkify-it';
-import tlds from 'tlds';
-
-export function createLinkify() {
-  const linkify = new LinkifyIt();
-  linkify.tlds(tlds);
-  return linkify;
-}

client/coral-framework/services/bootstrap.js

@@ -7,7 +7,6 @@ import { createReduxEmitter } from './events';
 import { createRestClient } from './rest';
 import thunk from 'redux-thunk';
 import { loadTranslations } from './i18n';
-import bowser from 'bowser';
 import noop from 'lodash/noop';
 import { BASE_PATH } from 'coral-framework/constants/url';
 import { createPluginsService } from './plugins';
@@ -65,12 +64,7 @@ const getAuthToken = (store, storage) => {
     }
 
     return token;
-  } else if (
-    !bowser.safari &&
-    !bowser.ios &&
-    storage &&
-    storage.getItem('token')
-  ) {
+  } else if (storage && storage.getItem('token')) {
     // Use local storage auth tokens where there's a stable api.
     return storage.getItem('token');
   }

config.js

@@ -85,6 +85,9 @@ const CONFIG = {
   // as report CSP violations.
   ENABLE_STRICT_CSP: process.env.TALK_ENABLE_STRICT_CSP === 'TRUE',
 
+  // TRUST_PROXY allows control over the `trust proxy` configuration on express.
+  TRUST_PROXY: process.env.TALK_TRUST_PROXY || '1',
+
   // LOGGING_LEVEL specifies the logging level used by the bunyan logger.
   LOGGING_LEVEL: ['fatal', 'error', 'warn', 'info', 'debug', 'trace'].includes(
     process.env.TALK_LOGGING_LEVEL

docs/_config.yml

@@ -94,8 +94,12 @@ sidebar:
               url: /v5/integrating/cms/
             - title: Single Sign On
               url: /v5/integrating/sso/
+            - title: GDPR
+              url: /v5/integrating/gdpr/
             - title: Comment Count
               url: /v5/integrating/counts/
+            - title: Slack
+              url: /v5/integrating/slack/
         - title: API
           children:
             - title: GraphQL Overview

docs/source/version-5-configuration.md

@@ -58,3 +58,10 @@ the variables in a `.env` file in the root of the project in a simple
   , `1 minute`) that should be used to send keep alive messages through the
   websocket to keep the socket alive (Default `30 seconds`)
 - `TRUST_PROXY` - When provided, it configures the "trust proxy" settings for Express (See https://expressjs.com/en/guide/behind-proxies.html)
+
+## `TRUST_PROXY`
+
+If you are encountering issues where urls in the administration are showing with
+a `http` instead of `https`, you may need to set the `TRUST_PROXY` setting.
+Refer to https://expressjs.com/en/guide/behind-proxies.html for possible values
+of this configuration variable as it pertains to your setup.

docs/source/version-5-counts.md

@@ -6,7 +6,7 @@ permalink: /v5/integrating/counts/
 Add the `count.js` script to your `html` tree. On a page that includes the _Stream Embed_ this is done for you automatically, however for best performance we recommend to include it into the `<head>` tag.
 
 ```html
-<script href="//{{ CORAL_DOMAIN_NAME }}/assets/js/count.js" defer></script>
+<script src="//{{ CORAL_DOMAIN_NAME }}/assets/js/count.js" defer></script>
 ```
 
 > **NOTE:** Replace the value of `{% raw %}{{ CORAL_DOMAIN_NAME }}{% endraw %}` with the location of your running instance of Coral.

docs/source/version-5-development.md

@@ -6,7 +6,7 @@ permalink: /v5/developing/
 Running Coral for development is very similar to installing Coral via Source as
 described above.
 
-Coral requires NodeJS >=10, we recommend using `nvm` to help manage node
+Coral requires NodeJS >=12, we recommend using `nvm` to help manage node
 versions: https://github.com/creationix/nvm.
 
 ```bash

docs/source/version-5-gdpr.md

@@ -0,0 +1,39 @@
+---
+title: GDPR Compliance
+permalink: /v5/integrating/gdpr/
+---
+
+In order to facilitate compliance with the
+[EU General Data Protection Regulation (GDPR)](https://www.eugdpr.org/), Coral
+provides features so your users can change and manage their own data.
+
+Even if GDPR will not apply to you, it is recommended to enable these
+features as a best practice to provide your users with control over their own
+data.
+
+## GDPR Feature Overview
+
+Integrating our GDPR tools will give your users and organizations the following benefits:
+
+- **Download my comment data**: Users can request a download of their comments. An email with a link is emailed to them to download a CSV with each comment they've made, what story it was made on, and the comment's ID and timestamp.
+- **Delete my account**: Users can request deletion of their account. Deleted account requests are pending for 24 hours to allow the user to download their comments, or to change their mind and reactivate their account before the expiry. Account deletions remove all of their comments from the site, all their comments and actions from the database, and their account info from our system.
+- **Add an email to an OAuth/external account**: Users are prompted to add an email to their non-Coral account (Facebook, Google, external, etc) so that they can take part in GDPR and other features requiring email communication.
+- **Change my username**: Users can update their username. This is capped at once every 2 weeks.
+- **Change my email**: Users can change their email.
+- **Change my password**: Users can change their password.
+
+## GDPR with SSO
+
+As many newsrooms often implement their own [SSO solutions](/talk/v5/integrating/sso/),
+we also provide API support to manage GDPR features directly from your own Account or My Profile page.
+
+We provide the following GraphQL mutations designed to allow you to integrate it into your existing user
+interfaces or exports.
+
+- `requestUserCommentsDownload` - lets you grab the direct link to download a users
+  account in a zip format. From there, you can integrate it into your existing
+  data export or simply proxy it to the user to allow them to download it
+  elsewhere in your UI.
+- `deleteUserAccount` - lets you delete the specified user
+
+**Note: These mutations require an administrative token**

docs/source/version-5-installation.md

@@ -3,14 +3,18 @@ title: Installing Version 5
 permalink: /
 ---
 
-Online comments are broken. Our open-source commenting platform, Coral, rethinks
-how moderation, comment display, and conversation function, creating the
-opportunity for safer, smarter discussions around your work.
-[Read more about Coral here](https://coralproject.net/).
+Online comments are broken. Our open-source commenting platform, Coral, reimagines
+moderation, comment display, and conversation. Use Coral to add safer, smarter discussions to your site without giving away your data.
+
+More than 70 publishers in 14 countries trust Coral to run their on-site communities, including the Washington Post, the Wall Street Journal, and Der Spiegel.[Read more about Coral here](https://coralproject.net/).
+
+<div class="callout">
+  We offer hosting and support packages for Coral, as well as exclusive, customer-only resources. [Contact us for more information.](https://coralproject.net/pricing/)
+</div>
 
 Built with ❤️ by Coral by [Vox Media](https://product.voxmedia.com/).
 
-Preview Coral easily by running it via a Heroku App:
+Try out a test version of Coral by running it via a Heroku App:
 
 [![Deploy](https://www.herokucdn.com/deploy/button.svg)](https://heroku.com/deploy?template=https://github.com/coralproject/talk)
 
@@ -18,7 +22,7 @@ Preview Coral easily by running it via a Heroku App:
 
 - MongoDB >=4.2
 - Redis >=3.2
-- NodeJS >=10
+- NodeJS >=12
 - NPM >=6.7
 
 ## Running
@@ -75,7 +79,7 @@ Then head on over to http://localhost:3000 to install Coral!
 
 ### Source
 
-Coral requires NodeJS >=10, we recommend using `nvm` to help manage node
+Coral requires NodeJS >=12, we recommend using `nvm` to help manage node
 versions: https://github.com/creationix/nvm.
 
 ```bash

docs/source/version-5-slack.md

@@ -0,0 +1,28 @@
+---
+title: Slack
+permalink: /v5/integrating/slack/
+---
+
+Coral version 5 supports built-in Slack integration to help you forward comments from your moderation queues into appropriate Slack channels.
+
+## Creating a Slack App
+
+To enable web hooks that we will use to forward comments, you'll need to create an App and give it permissions over a channel.
+
+For details on how to create a Slack app with webhooks, please go to:
+
+https://slack.com/intl/en-ca/help/articles/115005265063-incoming-webhooks-for-slack
+
+After you have created a Slack app with a webhook, you can use it in your Coral configuration.
+
+1. Sign into the administration side of your Coral deployment.
+2. Select _Configure_ from the top navigation.
+3. Select _Slack_ from the side navigation for the configuration area.
+4. Here you can configure a Slack channel.
+5. Paste in the webhook URL you created for your Slack app and select which comment categories you want to receive notifications for.
+
+## I need to find the webhook URL again, where is it?
+
+Webhooks options are tied to a Slack app and can be found under your app settings at:
+
+https://api.slack.com/apps

docs/source/version-5-sso.md

@@ -7,47 +7,43 @@ In order to allow seamless connection to an existing authentication system,
 Coral utilizes the industry standard [JWT Token](https://jwt.io/) to connect. To
 learn more about how to create a JWT token, see [this introduction](https://jwt.io/introduction/).
 
-1. Visit: `https://{{ CORAL_DOMAIN_NAME }}/admin/configure/auth`
+1. Visit: ```https://{{ CORAL_DOMAIN_NAME }} /admin/configure/auth```
 2. Scroll to the `Login with Single Sign On` section
 3. Enable the Single Sign On Authentication Integration
 4. Enable `Allow Registration`
 5. Copy the string in the `Key` box
 6. Click Save
 
-> **NOTE:** Replace the value of `{{ CORAL_DOMAIN_NAME }}` with the location of your running instance of Coral.
+> **NOTE:** Replace the value of ```{{ CORAL_DOMAIN_NAME }}``` with the location of your running instance of Coral.
 
 You will then have to generate a JWT with the following claims:
 
-- `jti` (_optional_) - A unique ID for this particular JWT token. We recommend
+- `jti` _(optional)_ - A unique ID for this particular JWT token. We recommend
   using a [UUID](https://en.wikipedia.org/wiki/Universally_unique_identifier)
   for this value. Without this parameter, the logout functionality inside the
   embed stream will not work and you will need to call logout on the embed
   itself.
-- `exp` (_optional_) - When the given SSO token should expire. This is
+- `exp` _(optional)_ - When the given SSO token should expire. This is
   specified as a unix time stamp in seconds. Once the token has expired, a new
   token should be generated and passed into Coral. Without this parameter, the
   logout functionality inside the embed stream will not work and you will need
   to call logout on the embed itself.
-- `iat` (_optional_) - When the given SSO token was issued. This is required to
+- `iat` _(optional)_ - When the given SSO token was issued. This is required to
   utilize the automatic user detail update system. If this time is newer than
   the time we received the last update, the contents of the token will be used
   to update the user.
-- `user.id` (**required**) - the ID of the user from your authentication system.
+- `user.id` **(required)** - the ID of the user from your authentication system.
   This is required to connect the user in your system to allow a seamless
   connection to Coral.
-- `user.email` (**required**) - the email address of the user from your
+- `user.email` **(required)** - the email address of the user from your
   authentication system. This is required to facilitate notification email's
   about status changes on a user account such as bans or suspensions.
-- `user.username` (**required**) - the username that should be used when being
-  presented inside Coral to moderators and other users. The following restrictions apply :
-  - Can only contain letter (`a-zA-Z`), number (`0-9`), underscore (`_`) or period (`.`) characters. Spaces and other special characters are not allowed.
-  - Min length = 3
-  - Max length = 30
-
-- `user.badges` (_optional_) - array of strings to be displayed as badges beside
+- `user.username` **(required)** - the username that should be used when being
+  presented inside Coral to moderators and other users. There are no username validations or restrictions enforced by Coral when you're using SSO.
+- `user.badges` _(optional)_ - array of strings to be displayed as badges beside
   username inside Coral, visible to other users and moderators. For example, to indicate
   a user's subscription status.
-- `user.role` (_optional_) - one of "COMMENTER", "STAFF", "MODERATOR", "ADMIN". Will create/update
+- `user.role` _(optional)_ - one of "COMMENTER", "STAFF", "MODERATOR", "ADMIN". Will create/update
   Coral user with this role.
 
 An example of the claims for this token would be:

models/schema/action.js

@@ -41,4 +41,7 @@ const Action = new Schema(
   }
 );
 
+// Indexes for listing users actions.
+Action.index({ user_id: 1, item_type: 1 }, { background: true });
+
 module.exports = Action;

package.json

@@ -1,6 +1,6 @@
 {
   "name": "talk",
-  "version": "4.11.0",
+  "version": "4.11.4",
   "description": "A better commenting experience from Vox Media.",
   "main": "app.js",
   "private": true,
@@ -251,6 +251,6 @@
     "yaml-lint": "^1.0.0"
   },
   "engines": {
-    "node": ">=8"
+    "node": "~8"
   }
 }

plugin-api/beta/server/getReactionConfig.js

@@ -21,17 +21,6 @@ function getReactionConfig(reaction) {
         background: true,
       }
     );
-
-    Comment.collection.ensureIndex(
-      {
-        asset_id: 1,
-        [`action_counts.${sc(reaction)}`]: -1,
-        created_at: -1,
-      },
-      {
-        background: true,
-      }
-    );
   }
 
   const reactionPlural = pluralize(reaction);

scripts/docker.sh

@@ -30,7 +30,7 @@ deploy_tag() {
   done
 
   # Push each of the tags to dockerhub, including latest
-  for version in $tag_list latest
+  for version in $tag_list
   do
       echo "==> pushing $version"
       docker push coralproject/talk:$version
@@ -38,22 +38,6 @@ deploy_tag() {
   done
 }
 
-deploy_latest() {
-  echo "==> pushing latest"
-  docker push coralproject/talk:latest
-  docker push coralproject/talk:latest-onbuild
-}
-
-deploy_branch() {
-  echo "==> tagging branch $CIRCLE_BRANCH"
-  docker tag coralproject/talk:latest coralproject/talk:$CIRCLE_BRANCH
-  docker tag coralproject/talk:latest-onbuild coralproject/talk:$CIRCLE_BRANCH-onbuild
-
-  echo "==> pushing branch $CIRCLE_BRANCH"
-  docker push coralproject/talk:$CIRCLE_BRANCH
-  docker push coralproject/talk:$CIRCLE_BRANCH-onbuild
-}
-
 ARGS=""
 
 if [[ -n "$CIRCLE_SHA1" ]]
@@ -79,12 +63,5 @@ then
   if [ -n "$CIRCLE_TAG" ]
   then
     deploy_tag
-  else
-    if [ "$CIRCLE_BRANCH" = "master" ]
-    then
-      deploy_latest
-    else
-      deploy_branch
-    fi
   fi
 fi

services/moderation/phases/links.js

@@ -1,4 +1,4 @@
-const linkify = require('linkify-it')().tlds(require('tlds'));
+const linkify = require('linkifyjs');
 
 // This phase checks the comment if it has any links in it if the check is
 // enabled.
@@ -11,7 +11,12 @@ module.exports = (
     },
   }
 ) => {
-  if (premodLinksEnable && linkify.test(comment.body.replace(/\xAD/g, ''))) {
+  if (premodLinksEnable) {
+    const links = linkify.find(comment.body.replace(/\xAD/g, ''));
+    if (!links || links.length === 0) {
+      return;
+    }
+
     // Add the flag related to Trust to the comment.
     return {
       status: 'SYSTEM_WITHHELD',

services/passport.js

@@ -14,8 +14,6 @@ const {
 } = require('../errors');
 const uuid = require('uuid');
 const debug = require('debug')('talk:services:passport');
-const bowser = require('bowser');
-const ms = require('ms');
 const _ = require('lodash');
 const { attachStaticLocals } = require('../middleware/staticTemplate');
 const { encodeJSONForHTML } = require('./response');
@@ -57,21 +55,6 @@ const GenerateToken = user => {
   });
 };
 
-// SetTokenForSafari sends the token in a cookie for Safari clients.
-const SetTokenForSafari = (req, res, token) => {
-  const browser = bowser._detect(req.headers['user-agent']);
-  if (browser.ios || browser.safari) {
-    debug('browser was safari/ios, setting a cookie');
-    res.cookie(JWT_SIGNING_COOKIE_NAME, token, {
-      httpOnly: true,
-      secure: process.env.NODE_ENV === 'production',
-      expires: new Date(Date.now() + ms(JWT_EXPIRY)),
-    });
-  } else {
-    debug("browser wasn't safari/ios, didn't set a cookie");
-  }
-};
-
 // HandleGenerateCredentials validates that an authentication scheme did indeed
 // return a user, if it did, then sign and return the user and token to be used
 // by the frontend to display and update the UI.
@@ -87,8 +70,6 @@ const HandleGenerateCredentials = (req, res, next) => (err, user) => {
   // Generate the token to re-issue to the frontend.
   const token = GenerateToken(user);
 
-  SetTokenForSafari(req, res, token);
-
   // Set the cache control headers.
   res.header('Cache-Control', 'private, no-cache, no-store, must-revalidate');
   res.header('Expires', '-1');
@@ -139,8 +120,6 @@ const HandleAuthPopupCallback = (req, res, next) => (err, user) => {
   // Generate the token to re-issue to the frontend.
   const token = GenerateToken(user);
 
-  SetTokenForSafari(req, res, token);
-
   // We logged in the user! Let's send back the user data.
   res.render('auth-callback.njk', {
     auth: { err: null, data: { user, token } },

services/scraper/index.js

@@ -75,6 +75,12 @@ const scraper = {
     });
     const html = await res.text();
 
+    if (!res.ok) {
+      let err = new Error(res.statusText);
+      err.response = res;
+      throw err;
+    }
+
     // Get the metadata from the scraped html.
     const meta = await metascraper({
       html,