* [ACS-9106] Make the descendants false iin data column component
* [ACS-8468] Add copy icon
* [ACS-8468] Remove change from data column
* [ACS-8468] Use if instead of *ngIf
* [ACS-8468] Revert to double click functionality
* [ACS-8468] Make copy button toggable and make it icon
* [ACS-8468] Add unit test for copy icons
* [ACS-8468] Add unit test for mat registry
* [ACS-8468] Remove deprecated component
* [ACS-8468] Align the styling with dropdown menu
* [ACS-8468] Fix sonar cloud issue
* [ACS-8468] Remove deprecated component
* [ACS-8468] Remove svg icon and use material icon
* [ACS-8468] Fix styling and remove mat-form-field-icon-suffix selector
* [ACS-8468] Make copy to clipboard icon property true
* [ACS-8468] Add unit tests and remove unused class
* [ACS-8468] Add unitTestingUtils
* [ACS-8468] use with args instead of callFake
* [ACS-8468] remove jasmine.spy
* [ACS-9106] Make the descendants false iin data column component
* [ACS-9106] Add unit test
* [ACS-9106] Fix formatting
* [ACS-9106] Remove the declaration of fixture outside it
* [ACS-12175] Fix annotation popup style
* [ACS-12175] Fix style and syntax issues for annotations
* [ACS-12175] Write unit test for date element
* [ACS-12175] Fix undefined error in unit test
* [ACS-12175] Use material theme for styling of popup
* [ACS-12175] Add style to title iinstead of using h1 header
* [ACS-12175] focus on annotation content
* [ACS-12175] Revert the change of background color
* [ACS-9584] Refresh after the change of name of a node
* [ACS-9584] Add unit test for name change
* [ACS-9584] Merge the changed fields onto the existing one
* [ACS-9584] Refresh does not happen after name change of a file
* [ACS-9584] Page only reload for extension and version change
* [ACS-9584] Add sidebarTemplateContext to unit test
* [ACS-9584] Add unit test for the changes in ngOnChanges
* Render spinner visibility rather than internal field
* [ACS-12286] Pass includeFields through to getRecentFiles for -recent-
loadFolderByNodeId forwarded includeFields to every custom source except
-recent-, and getRecentFiles had no includeFields parameter, hardcoding the
search include set. Thread includeFields through to the recent-files search
request (de-duplicated, defaults preserved) so callers can request extra
fields such as isFavorite.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* [ACS-12286] Document includeFields parameter for getRecentFiles
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* [ACS-12286] Use typed PersonEntry instead of any in getRecentFiles spec
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* fix: compensate for VM/Citrix clock drift in token expiry check
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Apply suggestions from code review
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* feat(core/auth): add TimeSyncDateTimeProvider for angular-oauth2-oidc clock drift correction
* feat(auth): add periodic clock re-sync to protect against mid-session drift in Citrix/VM environments
- Add startPeriodicSync() and stopPeriodicSync() to TimeSyncService
- Re-sync clock offset every 5 minutes and on document visibility change
- Add security cap (maxAllowedOffsetMs) to reject unreasonably large offsets
- Preserve existing offset on sync failures instead of resetting to 0
- Wire periodic sync start in RedirectAuthService.configureAuth()
- Wire periodic sync stop in RedirectAuthService.logout()
- Add unit tests for periodic sync and offset cap behavior
* feat: replace dedicated time API with passive Date response header interception
- Add `updateClockOffsetFromDateHeader()` to `TimeSyncService` so the clock
offset can be updated from any HTTP `Date` response header (RFC 7231)
- Make `serverTimeUrl` config optional: `syncClockOffset` is a safe no-op and
`checkTimeSync` uses the stored `clockOffsetMs` when no URL is configured
- Add `DateHeaderTimeSyncInterceptor` that reads the `Date` header from every
HTTP response and passively keeps `TimeSyncService.clockOffsetMs` current
- Register the new interceptor in `provideCoreAuth()` / `AuthModule`
- Export `DateHeaderTimeSyncInterceptor` from the public API
- Add unit tests for all new paths
* feat: retry token refresh before checking for clock out-of-sync
- tokenHasExpiredDueToClockOutOfSync$: skip the first "token expired" event
so the library's automatic refresh has a chance to run before clock drift
is diagnosed as the root cause
- oauthErrorEventOccurDueToClockOutOfSync$: use scan() to skip the first
token_refresh_error (allowing one retry) and only check clock sync on the
second occurrence; all other error types are still checked immediately
- Update test for token expiry: now requires two events before logout
- Replace single token_refresh_error clock-sync test with two tests:
one verifying no logout on first error, one verifying logout on second
* fix(core): remove duplicate @angular/common/http import in date-header-time-sync interceptor spec
* fix(core): treat empty/whitespace serverTimeUrl as not configured in TimeSyncService
* fix(core): limit DateHeaderTimeSyncInterceptor to IAM API responses only
* refactor: remove tokenHasExpiredDueToClockOutOfSync$ and re-sync clock + refresh token on validation failure
Instead of having a separate observable that detects token expiration due to clock
drift and immediately logs the user out, the oauthErrorEventOccurDueToClockOutOfSync$
now re-syncs the clock offset and attempts a token refresh when clock drift is detected.
Only if the refresh fails after re-syncing does it propagate the error and trigger logout.
* fix(auth): check token validity after clock re-sync before attempting refresh
After re-syncing the clock offset, the code now checks whether the token
is actually still valid using the corrected time (via tokenHasExpired()).
If the token is valid, no refresh is needed — the token only appeared
expired due to clock drift. This avoids the impossible situation of
retrying a token refresh when the triggering error was itself a refresh
error.
* refactor(auth): replace IAM header interceptor with HEAD request to app root for time sync
Instead of passively reading the Date header from IAM responses (which
requires IAM to be reachable and has CORS constraints), the TimeSyncService
now makes a lightweight HEAD request to the application's own root URL
(served by nginx). This is simpler and more reliable because:
- No CORS issues (same origin)
- Nginx always includes a Date header
- HEAD request has minimal payload (no body)
- Works before authentication is established
- No dedicated serverTimeUrl configuration needed
The DateHeaderTimeSyncInterceptor has been removed as it is no longer needed.
* fix(auth): reset tokenRefreshErrorCount on successful token event
The tokenRefreshErrorCount in the oauthErrorEventOccurDueToClockOutOfSync$
stream now resets to 0 when a 'token_received' or 'token_refreshed' event
occurs. This prevents intermittent errors that self-correct from
accumulating toward the clock-drift detection threshold.
* fix(core): provide meaningful error message when API response body is null
When the server returns no response body (e.g., during token expiration,
network interruption, or CORS failures), err.error is null causing
JSON.stringify(null) to produce the unhelpful message "null".
Now we explicitly handle the null case and produce a message like
"401 Unauthorized" instead of "null".
* fix: resync clock before invalidating tokens at startup
At startup, when the first OAuth event fires, the service checks if the
access token is valid. Previously it would immediately clear storage if
the token appeared invalid. This could cause false negatives when the
local clock was out of sync (e.g. VM/Citrix environments).
Now the service first re-syncs the clock offset via TimeSyncService, then
re-evaluates the token validity. Storage is only cleared if the token is
still invalid after the corrected time check.
* Remove maxAllowedOffsetMs from TimeSyncService
* Fix startPeriodicSync call to match updated signature
* WIP
* Add Flag
* AAE-48166 Sync time using server time
* AAE-48166 Fix unit test
* AAE-48166 Fix service
* AAE-48166 Fix service
* AAE-48166 Fix service and add tests
* AAE-48166 Use app root instead of server time url
* AAE-48166 Use oauth2.timeSync config key for time sync gate
* AAE-48166 Keep redirect auth flow unchanged when time sync is disable
* Add oauth2.showDebugInformation and related debug logging for time sync
* AAE-48166 Fix multi-tab OIDC refresh failures by resyncing server time when timeSync enabled
* AAE-48166 Avoid repeated server time calls by caching the result for 2 seconds
* AAE-48166 test(auth): cover timeSync clock sync for implicit flow silent refresh
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Eugenio Romano <eromano@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Diogo Bastos <diogo.bastos@hyland.com>
Co-authored-by: alep85 <amedeo.lepore@hyland.com>
* [MNT-25230] Displayed user displayName in version history for specific version
* [MNT-25230] Unit tests
* [MNT-25230] Addressed copilot comment
* [MNT-25230] Addressed copilot comment
* [MNT-25230] Addressed copilot comment
* [MNT-25230] Addressed copilot comment
* [MNT-25230] Addressed copilot comment
* AAE-43974 Fix for alfresco-content-app e2e failure
* AAE-43974 Refactored based on review comments
* AAE-43974 Removing unit test cases written for isError as it is being tested by passwordErrorStateMatcher
* [ci:force] re-trigger CI
Shivangi Shree
Mykyta Maliarchuk
Tomasz Gnyp
Bartosz Sekula
alfresco-engineering-contributor[bot]andhxpstudiocicduser
AleksanderSklorz
Ehsan Rezaei
Alex Molodyh
Dominik Iwanek
Darren Thornton
Amedeo Lepore
Denys Vuika
Munir Fati Haji
Joshua Cain
Michal Kinas
David Olson
Anamika Dey