Skip to content

fix(github): apply guest token to images in markdown sync - #10659

Merged
ArtyomSavchenko merged 2 commits into
hcengineering:developfrom
ledoent:fix/github-image-guest-token
Mar 25, 2026
Merged

ArtyomSavchenko merged 2 commits into
hcengineering:developfrom
ledoent:fix/github-image-guest-token

Conversation

@dnplkndll

Copy link
Copy Markdown
Contributor

Summary

Fixes #10516

  • appendGuestLinkToImage() in services/github/pod-github/src/sync/guest.ts stamps a guest JWT token onto image URLs before serialization to GitHub markdown
  • The function existed but was dead code — never called from getMarkdown()
  • This PR adds it as the default preprocessor via preprocessor ?? (async (nodes) => { appendGuestLinkToImage(nodes, this.workspace.uuid) }), so all 10+ call sites automatically get image token injection when no custom preprocessor is provided
  • The serializer at foundations/core/packages/text-markdown/src/serializer.ts:175-191 already handles attrs.token&token= in URLs

Test plan

  • Create a Huly issue with an inline image in a GitHub-connected project
  • Verify the synced GitHub issue shows the image (URL contains &token=<guest-jwt>)
  • Verify that call sites passing an explicit preprocessor still work as before (nullish coalescing preserves existing behavior)

🤖 Generated with Claude Code

…ing#10516)

The appendGuestLinkToImage function existed but was never called from
getMarkdown(). Add it as the default preprocessor so image URLs include
a guest JWT token, allowing them to render on GitHub.

Signed-off-by: Daniel Kendall <dkendall@ledoweb.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Don Kendall <kendall@donkendall.com>
@huly-github-staging

Copy link
Copy Markdown

Connected to Huly®: UBERF-15990

@dnplkndll

dnplkndll commented Mar 21, 2026

Copy link
Copy Markdown
Contributor Author

Verified on self-hosted instance

Tested on huly.hz.ledoweb.com with hardcoreeng/github:v0.7.382 + this fix applied.

Test: Issue created in Huly with inline image → synced to GitHub

Synced issue: ledoent/cad-plm#11 — image synced with guest JWT token, rendered via GitHub's camo proxy.

With fix (this PR): Image URL includes &token=<guest-jwt>HTTP 200 (image renders)

$ curl -sk -o /dev/null -w "%{http_code} %{content_type}" "<url>&token=eyJ..."
200 image/png

Without fix (no token): Same URL without &token=HTTP 401 (broken image)

$ curl -sk -o /dev/null -w "%{http_code}" "<url>"  
401

The appendGuestLinkToImage preprocessor correctly stamps guest JWT tokens on all image nodes in the markdown before serialization to GitHub. GitHub proxies the image through camo.githubusercontent.com which fetches it with the token → 200.

@aonnikov

aonnikov commented Mar 24, 2026

Copy link
Copy Markdown
Member

Nice catch, ideally we need per-image tokens, but we don't have them now. Please fix formatting issues.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Don Kendall <kendall@donkendall.com>
@ArtyomSavchenko
ArtyomSavchenko merged commit cd1234b into hcengineering:develop Mar 25, 2026
11 of 13 checks passed
haiodo pushed a commit to haiodo/foundation that referenced this pull request Mar 28, 2026
…ing#10659)

* fix(github): apply guest token to images in markdown sync (hcengineering#10516)

The appendGuestLinkToImage function existed but was never called from
getMarkdown(). Add it as the default preprocessor so image URLs include
a guest JWT token, allowing them to render on GitHub.

Signed-off-by: Daniel Kendall <dkendall@ledoweb.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Don Kendall <kendall@donkendall.com>

* fix: formatting (prettier/eslint)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Don Kendall <kendall@donkendall.com>

---------

Signed-off-by: Don Kendall <kendall@donkendall.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
haiodo added a commit to haiodo/foundation that referenced this pull request May 4, 2026
* fix(tracker): parentIssue prop overrides draft when reopening create issue modal (hcengineering#10616)

* fix(tracker): parentIssue prop overrides draft when reopening create issue modal

When creating a sub-task, dismissing the modal via backdrop saves a
draft including the parentIssue. On the next open (for a different
parent), getDefaultObjectFromDraft() spreads the saved draft first but
all explicit props (status, priority, assignee, component, milestone)
correctly override the draft values. parentIssue was the only prop not
included in that override list, so the draft's stale parentIssue always
won, attaching the new sub-task to the previously opened parent.

Added parentIssue to the override spread so an explicitly passed parent
always takes precedence over any saved draft value.

Fixes hcengineering#10348

Signed-off-by: SaiVaraprasad Medapati <varaprasadreddy9676@gmail.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(tracker): drop stale SubIssues import change

Signed-off-by: SaiVaraprasad Medapati <varaprasadreddy9676@gmail.com>

---------

Signed-off-by: SaiVaraprasad Medapati <varaprasadreddy9676@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* User should be able to see only own training results (hcengineering#10629)

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Add action to export project documents (hcengineering#10592)

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* fix(tracker): make Project.defaultIssueStatus optional (hcengineering#10598)

defaultIssueStatus is not reliably populated for all projects.Make the field optional in the type definition and guard the
  migration to handle undefined values.

Signed-off-by: Igor Loskutov <igor.loskutoff@gmail.com>

* feat(notification): improve inbox list keyboard navigation and a11y (hcengineering#10612)

Signed-off-by: SaiVaraprasad Medapati <varaprasadreddy9676@gmail.com>

* feat(communication): improve messages loading state accessibility (hcengineering#10613)

Signed-off-by: SaiVaraprasad Medapati <varaprasadreddy9676@gmail.com>

* feat(notification): add inbox settings keyboard shortcuts (hcengineering#10614)

Signed-off-by: SaiVaraprasad Medapati <varaprasadreddy9676@gmail.com>

* Reset id (hcengineering#10643)

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Allow cherry picks

Signed-off-by: Andrey Sobolev <haiodo@gmail.com>

* Fix translation error loop (hcengineering#10636)

* Test issue duplicates and fix translation error loop

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Clean up

Signed-off-by: Artem Savchenko <armisav@gmail.com>

---------

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Load RefTo fields in markdown table (hcengineering#10642)

* Load RefTo fields in markdown table

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Fix Polynomial regexp

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Fix formatting

Signed-off-by: Artem Savchenko <armisav@gmail.com>

---------

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Fix request section visibility and hide card activity for guests (hcengineering#10641)

* move RequestsCardSection visibility check into the component.

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Hide card activity for guests

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Fix formatting

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

---------

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Fix export translations (hcengineering#10652)

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Fix intermittent PDF print failures (hcengineering#10654)

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* fix(account): handle single-word names in OIDC and GitHub auth providers (hcengineering#10631) (hcengineering#10656)

When a user's name has no spaces (common for CJK names like "西门吹雪"),
name.split(' ') returns a single-element array so the last name
destructures as undefined, causing a PostgreSQL NOT NULL constraint
violation on the last_name column.

- openid: prefer standard OIDC given_name/family_name claims when
  available, fall back to splitting name with safe slice(1).join()
- github: same split fix using displayName ?? username
- loginOrSignUpWithProvider: add ?? '' defensive fallback at insertOne
  to guard against any undefined last name reaching the DB

Fixes hcengineering#10628

Signed-off-by: SaiVaraprasad Medapati <varaprasadreddy9676@gmail.com>
Co-authored-by: SaiVaraprasad Medapati <varaprasadreddy9676@gmail.com>

* Fix social link save (hcengineering#10655)

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Allow to add social links if there are no attached messages (hcengineering#10657)

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Implement persistent table sorting by integrating with view options. (hcengineering#10665)

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Fix process card update check for tags (hcengineering#10671)

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* feat: Add new process functions for data type conversion, including s… (hcengineering#10670)

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Add date difference calculation functionality (hcengineering#10673)

* Add date difference calculation functionality

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Fix

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Fix formatting

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

---------

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Fix view setting bug (hcengineering#10674)

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Add 15/30 minutes time spent reports (hcengineering#10675)

* Add 15/30 minutes time spent reports

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Set default employee

Signed-off-by: Artem Savchenko <armisav@gmail.com>

---------

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Do not display collaboration errors in case of reconnects (hcengineering#10678)

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Format stats error (hcengineering#10681)

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Fix markdown link escaping (hcengineering#10685)

* Fix markdown link escaping

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Fix escape

Signed-off-by: Artem Savchenko <armisav@gmail.com>

---------

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Do not create Github worker for deleting workspace (hcengineering#10661)

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Fix github UI issues (hcengineering#10684)

* Fix github UI issues

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Fix formatting

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Remove legacy project fields

Signed-off-by: Artem Savchenko <armisav@gmail.com>

---------

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* feat(setting): display version in Help & Support button (hcengineering#9796) (hcengineering#10667)

Show the platform version inline on the "Help & Support" navigation
footer button, right-aligned in a subtle style. This follows the
reviewer suggestion to use the existing Help button rather than
adding a separate version label in the settings sidebar.

Signed-off-by: Don Kendall <kendall@donkendall.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(github): apply guest token to images in markdown sync (hcengineering#10659)

* fix(github): apply guest token to images in markdown sync (hcengineering#10516)

The appendGuestLinkToImage function existed but was never called from
getMarkdown(). Add it as the default preprocessor so image URLs include
a guest JWT token, allowing them to render on GitHub.

Signed-off-by: Daniel Kendall <dkendall@ledoweb.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Don Kendall <kendall@donkendall.com>

* fix: formatting (prettier/eslint)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Don Kendall <kendall@donkendall.com>

---------

Signed-off-by: Don Kendall <kendall@donkendall.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Remove unused field (hcengineering#10686)

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Process middleware fixes (hcengineering#10687)

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Fix hyperlink in contoll doc comment (hcengineering#10690)

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Fix todo reassign (hcengineering#10693)

* Correctly user reassignment target by handling mixins.

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Fix formatting

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

---------

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Fix SSRF in Link Preview Service (hcengineering#10689)

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* fix(github): guard REST octokit in comment sync to prevent createComment crash (hcengineering#10692)

Same class of bug fixed in hcengineering#10442 for graphql calls. The user-scoped
Octokit returned by getOctokit() may lack the .rest plugin, causing
"okit.rest.issues.createComment is not a function". Add ensureRESTOctokit()
guard to both createGithubComment and updateComment paths.

Fixes hcengineering#10691

Signed-off-by: Yulian Diaz <5605867+spatialy@users.noreply.github.com>

* Fix markdown links in table (hcengineering#10688)

* Fix markdown links in table

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Potential fix for code scanning alert no. 294: Inefficient regular expression

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: Artyom Savchenko <armisav@gmail.com>

* Add tests

Signed-off-by: Artem Savchenko <armisav@gmail.com>

---------

Signed-off-by: Artem Savchenko <armisav@gmail.com>
Signed-off-by: Artyom Savchenko <armisav@gmail.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Fix formatting (hcengineering#10697)

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* fix(calendar): add error handling for outbound Google Calendar sync (hcengineering#10696)

Add proper error handling to prevent silent failures when syncing events
to Google Calendar:

- Add .catch() handler in main.ts webhook to log sync failures
- Add try/catch in create() method to log Google API insert errors
- Improve error handling in remove() method to log get/delete errors

Fixes hcengineering#10535
Signed-off-by: Andrey Sobolev <haiodo@gmail.com>

* Allow guest users edit documents created by them (hcengineering#10695)

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Fix Github login update (hcengineering#10683)

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Fix view setting freeze (hcengineering#10700)

* Fix view setting freeze

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Fix formatting

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

---------

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Fix filter removed attribute from viewlet (hcengineering#10701)

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Fix view settings (hcengineering#10706)

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Do not select space not accessible to the user (hcengineering#10707)

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* feat: add spellcheck prop to text editor components (hcengineering#10694)

* feat: add spellcheck prop to text editor components

Add a configurable `spellcheck` boolean prop (default: true) to all
text editor components: TextEditor, CollaborativeTextEditor,
StyledTextEditor, and CollaboratorEditor.

The prop sets the HTML spellcheck attribute on the TipTap editor
element, allowing parent components to disable browser spell checking.
This is useful for users writing in non-English languages where the
default English spell checker produces false positives.

Closes hcengineering#10623

* fix: format TextEditor.svelte to pass Prettier check

Break long mergeAttributes() line to comply with the project's
Prettier line-length configuration.

Signed-off-by: V Govindarajan <vijay.govindarajan91@gmail.com>

---------

Signed-off-by: V Govindarajan <vijay.govindarajan91@gmail.com>

* Update employee role on account role change (hcengineering#10709)

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Add automationOnly flag to associations and restrict manual management in UI (hcengineering#10730)

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Fix subProcessMatchCheck (hcengineering#10731)

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Fix UI freeze on missing translation params (hcengineering#10735)

* Fix UI freeze on missing translation params

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Revert redundant changes

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Clean up

Signed-off-by: Artem Savchenko <armisav@gmail.com>

---------

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* qfix: Call resolve after error handling (hcengineering#10736)

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Fix markdown links in table refresh (hcengineering#10732)

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* fix: rename twitter to x (hcengineering#10744)

Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com>

* implement auto-start logic for processes when creating new card versions (hcengineering#10747)

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Card grid (hcengineering#10749)

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Card space type selector with submenu (hcengineering#10750)

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* EmptyValue process function (hcengineering#10756)

* EmptyValue process function

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Fix formatting

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

---------

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Allow to answer questions in training for guests (hcengineering#10746)

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Section locking (hcengineering#10702)

* implement section locking functionality with role-based access control

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Fix formatting

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Add translations

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

---------

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Fix Mermaid diagram paste (hcengineering#10714)

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Change icons (hcengineering#10711)

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Color control documents (hcengineering#10717)

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Fix formatting

Signed-off-by: Andrey Sobolev <haiodo@gmail.com>

* fix: remove duplicate sortOrder declaration in Table.svelte

Duplicate was introduced during cherry-pick merge conflict resolution for
persistent table sorting (hcengineering#10665). The second declaration with
preferredSortingOrder support was correct; the first bare one was leftover.

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

Signed-off-by: Andrey Sobolev <haiodo@gmail.com>

* Fix MR issues

Signed-off-by: Andrey Sobolev <haiodo@gmail.com>

* Process minor fixes (hcengineering#10704)

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Add configurable card layout modes (hcengineering#10724)

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Fix grid migration (hcengineering#10762)

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Fix card viewlet setting for associations (hcengineering#10761)

Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>

* Merge fix

Signed-off-by: Andrey Sobolev <haiodo@gmail.com>

* Fix AttributeEditor concurrency

Signed-off-by: Andrey Sobolev <haiodo@gmail.com>

* Revert "feat(setting): display version in Help & Support button (hcengineering#9796) (hcengineering#10667)"

This reverts commit d1fa02be3f62b98f1944e0e345223a083c9576f6.

Signed-off-by: Andrey Sobolev <haiodo@gmail.com>

---------

Signed-off-by: SaiVaraprasad Medapati <varaprasadreddy9676@gmail.com>
Signed-off-by: Artem Savchenko <armisav@gmail.com>
Signed-off-by: Igor Loskutov <igor.loskutoff@gmail.com>
Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>
Signed-off-by: Andrey Sobolev <haiodo@gmail.com>
Signed-off-by: Don Kendall <kendall@donkendall.com>
Signed-off-by: Yulian Diaz <5605867+spatialy@users.noreply.github.com>
Signed-off-by: Artyom Savchenko <armisav@gmail.com>
Signed-off-by: V Govindarajan <vijay.govindarajan91@gmail.com>
Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com>
Co-authored-by: SaiVaraprasad Medapati <varaprasadreddy9676@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Artyom Savchenko <armisav@gmail.com>
Co-authored-by: Igor Loskutov <igor.loskutoff@gmail.com>
Co-authored-by: Denis Bykhov <bykhov.denis@gmail.com>
Co-authored-by: Don Kendall <dkendall@ledoweb.com>
Co-authored-by: Yulian Diaz <5605867+spatialy@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Rayan Salhab <r.salhab@aiyexpertsolutions.com>
Co-authored-by: V Govindarajan <vijay.govindarajan91@gmail.com>
Co-authored-by: Alexander Onnikov <aonnikov@hardcoreeng.com>
MichaelUray pushed a commit to MichaelUray/huly-platform that referenced this pull request Jul 9, 2026
…ing#10659)

* fix(github): apply guest token to images in markdown sync (hcengineering#10516)

The appendGuestLinkToImage function existed but was never called from
getMarkdown(). Add it as the default preprocessor so image URLs include
a guest JWT token, allowing them to render on GitHub.

Signed-off-by: Daniel Kendall <dkendall@ledoweb.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Don Kendall <kendall@donkendall.com>

* fix: formatting (prettier/eslint)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Don Kendall <kendall@donkendall.com>

---------

Signed-off-by: Don Kendall <kendall@donkendall.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Images in Huly issue comments don't appear on GitHub side (GitHub integration)

3 participants