Subscriptions sold at a replaced price lost their plan, because a
subscription was matched only against the configured price. Resolve
prices through the configured price, STRIPE_LEGACY_PRICES, then a
registry that now also records subscription prices and every configured
price at startup. Store the price on subscription grants.
Review fixes:
- Recover a Never expire add-on found by reconciliation before expiring.
- Open Checkout for the subscription cycle the hosting option shows.
- Report conference hosting only while the package payment stands.
- Keep automatic updates on a paid-slot repository while its owner subscribes.
- Apply the repository expiration limit only to repositories.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Most authors use the service for one paper a few times a year, so a
subscription does not fit. Add cheap one-time options (Paper pack, Extra
repository, Live updates, Extended expiration, Never expire), cap free
dated expiration at 5 months, keep cheaper subscriptions for heavy users,
and make every new conference a paid review package in three sizes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat: let owners leave chosen files unredacted (#941)
Redacting self-citations in a bibliography reveals which papers are the
authors' own. Owners can now pick files whose content is served as
written; file names are still redacted. Patterns follow .gitignore rules.
The form gets a file picker fed by GitHub's tree API, and the terms box
grows with its content and only warns about regex symbols that can stop a
term from matching.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: honour !patterns, keep picked braces literal, preview unredacted README
- Patterns now apply in order and the last match wins, as in .gitignore,
so "*.bib" then "!private.bib" excludes private.bib instead of
preserving every other file.
- Picked paths escape glob characters, braces included, with a
backslash; "[{]" did not survive brace expansion.
- The README preview drops terms when the README is an unredacted file,
and refreshes when the list changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: keep rule order when deduplicating unredacted-file patterns
Rules apply in order and the last match wins, so dedupe keeps the last
copy of a repeated pattern instead of the first. The picker also keeps a
plain path in its place when it follows another rule, rather than moving
it to the front as a pick.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: apply unredacted-file rules to folders, as in .gitignore
A rule that matches a folder now covers every file inside it, so "*.bib"
then "!private" keeps private/refs.bib redacted. A trailing "/" limits a
rule to folders.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: folder unchecks win over broad rules; accept short commit hashes
- Unchecking a folder that a broader rule such as "*.bib" still covers
appends a "!/folder/" exclusion, so its files really go back to being
redacted.
- The tree endpoint accepts the 6+ character hashes the commit field
allows and resolves them to a full SHA before reading the tree.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: picker counts folder rules exactly as the server does
Rules ending in "/" stay patterns instead of being read as picked files,
and the checkboxes now run the saved rule list (picks, then patterns)
through the server's matcher, so the dialog cannot show files as
redacted that the server leaves unredacted.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: insert escaped terms literally in "Match as written"
String.replace expanded "$&", "$'" and "$1" in the term, so the fix
could corrupt the line. Splice by index instead.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Follow-up review pass after the cache fixes turned up several bugs in
the same family — silent failures that look like success to the client,
plus content-correctness issues in the ZIP and per-file delivery paths.
- zipStream: stop calling archive.finalize() on upstream/parser errors.
That produced a valid-looking ZIP (200 OK, archive opens) silently
missing entries — same class as #694, but worse because the user has
no signal anything went wrong. Destroy the response on failure
instead so the client sees a connection drop.
- zipStream: apply per-repo image/pdf gates inside the entry handler.
The single-file /file/... endpoint refuses to serve those types
via AnonymizedFile.isFileSupported when image=false / pdf=false, but
the ZIP shipped them anyway — privacy-relevant for maintainers who
toggle image=false to suppress identifying screenshots. Threaded
contentOptions through both ZIP entry points (direct and streamer).
- GitHubUtils.getToken: validate the OAuth token-refresh response
before persisting. On a non-2xx response or a body without a string
token, we used to overwrite the stored token with `undefined`, which
then propagated as `Authorization: token undefined` to every API
call — 401 even on public repos, with the config.GITHUB_TOKEN
fallback unreachable because the field was no longer falsy.
- AnonymizedFile.send (streamer branch): forward Content-Type from the
upstream streamer response. got.stream(...).pipe(res) carries body
bytes only, so the parent response had no Content-Type and browsers
guessed (text rendered as download, etc.). Also resolve on
res.on("finish") in addition to "close" — keep-alive sockets stay
open long after the response is delivered, delaying countView().
- Repository.updateIfNeeded: persist a renamed source.repositoryName
even when the commit hasn't changed. Previously the new value lived
in memory only and was overwritten on the next reload, so the
rename detection ran every request.
- Repository.anonymize: stop materialising a dummy {path:"",name:""}
FileModel for empty repos. That row collided with the special case
in AnonymizedFile.getFileInfo and surfaced in unfiltered listings.
- streamer/route POST /: reject filePath segments containing ".." or
empty parts. Defence in depth — the parent server validates against
FileModel before calling, but the streamer joins filePath straight
into the storage path, so any future caller forwarding an
unvalidated path could traverse out of the repo root.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Thomas Durieux