Merge branch 'develop' into na/web/pub-trips-tab

Author: nabramow

CLAUDE.md

@@ -44,7 +44,8 @@ make mypy
 - gRPC for API (defined in `/app/proto`)
 - Background jobs in `couchers/jobs/handlers.py`
 - Notifications system in `couchers/notifications/`
-- Always run `make format` and `make mypy` after modifying backend code
+- Always run `make format` and `make mypy` after modifying backend code. mypy MUST pass — a failing mypy is never acceptable, so fix it before moving on (don't dismiss errors as "pre-existing")
+- If mypy or tests fail with import errors or missing symbols from generated proto modules (`couchers.proto.*` — e.g. a message type that exists in a `.proto` source but not in the generated `*_pb2.py`), your locally generated protos are stale: run `make protos` to regenerate them, then re-check
 - NEVER try-catch an exception and silently throw it away or just log it. By and large you don't need to wrap code in try-catch blocks, we already handle exceptions
 - Use `enum.auto()` for all enums (except in the rare case that they are inherently ordinal and we use that order in business logic)
 - Put relationships and constraints at the end of models

app/.gitlab-ci.yml

@@ -1040,7 +1040,9 @@ build:mobile-native-devtool:
     - npm ci
     - npm install -g eas-cli
     - bash scripts/devtool-build.sh ios
+    - bash scripts/devtool-build.sh ios-sim
     - bash scripts/devtool-build.sh android
+    - bash scripts/devtool-build.sh index
   rules:
     - if: ($BUILD_MOBILE == "true") && ($CI_COMMIT_BRANCH == $RELEASE_BRANCH)
 

app/backend.dev.env

@@ -63,10 +63,6 @@ LISTMONK_API_USERNAME=...
 LISTMONK_API_KEY=...
 LISTMONK_LIST_ID=3
 
-RECAPTHCA_PROJECT_ID=...
-RECAPTHCA_API_KEY=...
-RECAPTHCA_SITE_KEY=...
-
 SENTRY_ENABLED=0
 SENTRY_URL=...
 

app/backend/feature-flags.dev.json

@@ -4,7 +4,7 @@
   "strong_verification_enabled": false,
   "log_native_ota_requests": true,
   "donations_enabled": false,
-  "recaptcha_enabled": false,
+  "antibot_enabled": false,
   "postal_verification_enabled": false,
   "listmonk_enabled": false,
   "notification_translations_enabled": true,

app/backend/proto/internal/jobs.proto

@@ -15,13 +15,17 @@ message SendEmailPayload {
   // source data as to where this email came from
   string source_data = 8;
   reserved 9; // Previous "attachments" field, which had mime_type+filename subfields.
-  repeated EmailAttachmentV2 attachments = 10;
+  repeated EmailPart attachments = 10;
+  repeated EmailPart html_related_parts = 11; // MIME parts which are multipart/related to the HTML body.
 }
 
-message EmailAttachmentV2 {
+// A MIME part of an SMPT email, usable for attached files or inline images.
+message EmailPart {
   bytes data = 1;
   string content_disposition = 2; // The Content-Disposition header, including parameters
   string content_type = 3; // The Content-Type header, including parameters
+  string content_id = 4; // The Content-ID header, including parameters
+  string data_file_path = 5; // The server-side path to the file containing the data (mutually exclusive with "data").
 }
 
 message HandleNotificationPayload {

app/backend/pyproject.toml

@@ -139,7 +139,7 @@ module = ["couchers.migrations.versions.*"]
 ignore_errors = true
 
 [[tool.mypy.overrides]]
-module = ["http_ece", "py_vapid", "luhn", "sqlalchemy_utils.*", "growthbook", "user_agents", "pyroscope"]
+module = ["http_ece", "py_vapid", "luhn", "sqlalchemy_utils.*", "growthbook", "user_agents", "pyroscope", "ics"]
 # These libraries don't have type stubs or py.typed markers
 ignore_missing_imports = true
 

app/backend/src/couchers/abuse.py

@@ -0,0 +1,55 @@
+from couchers.context import CouchersContext
+from couchers.db import session_scope
+from couchers.metrics import observe_nonvisible_user_access
+from couchers.models import (
+    NonvisibleUserAccess,
+    NonvisibleUserAccessType,
+    NonvisibleUserState,
+    User,
+)
+
+
+def nonvisible_user_state(user: User) -> NonvisibleUserState | None:
+    if user.banned_at is not None:
+        return NonvisibleUserState.banned
+    if user.shadowed_at is not None:
+        return NonvisibleUserState.shadowed
+    if user.deleted_at is not None:
+        return NonvisibleUserState.deleted
+    return None
+
+
+def maybe_log_nonvisible_user_access(
+    context: CouchersContext,
+    user: User,
+    *,
+    access_type: NonvisibleUserAccessType,
+    actor_user_id: int | None,
+) -> None:
+    target_state = nonvisible_user_state(user)
+    if target_state is None:
+        return
+
+    if actor_user_id == user.id:
+        ip_address = context.get_header("x-couchers-real-ip")
+        user_agent = context.get_header("user-agent")
+        sofa = context._sofa
+    else:
+        ip_address = None
+        user_agent = None
+        sofa = None
+
+    with session_scope() as session:
+        session.add(
+            NonvisibleUserAccess(
+                access_type=access_type,
+                target_user_id=user.id,
+                target_state=target_state,
+                actor_user_id=actor_user_id,
+                ip_address=ip_address,
+                user_agent=user_agent,
+                sofa=sofa,
+            )
+        )
+
+    observe_nonvisible_user_access(access_type, target_state)

app/backend/src/couchers/config.py

@@ -108,10 +108,6 @@ class Config:
     LISTMONK_API_USERNAME: str
     LISTMONK_API_KEY: str
     LISTMONK_LIST_ID: int
-    # Google recaptcha antibot (gated at runtime by the `recaptcha_enabled` feature flag)
-    RECAPTHCA_PROJECT_ID: str
-    RECAPTHCA_API_KEY: str
-    RECAPTHCA_SITE_KEY: str
     # Whether we're in test
     IN_TEST: bool = False
     # Dev-only override file; when set, flags are read from it instead of GrowthBook.
@@ -196,8 +192,8 @@ def check(self) -> None:
                 raise Exception("Listmonk credentials must be configured in production")
 
             # The following features are gated at runtime by feature flags (`strong_verification_enabled`,
-            # `postal_verification_enabled`, `recaptcha_enabled`), which can be flipped on remotely at any
-            # time, so prod must always have their credentials present.
+            # `postal_verification_enabled`), which can be flipped on remotely at any time, so prod must
+            # always have their credentials present.
             if not self.IRIS_ID_PUBKEY or not self.IRIS_ID_SECRET or not self.VERIFICATION_DATA_PUBLIC_KEY:
                 raise Exception("Iris ID credentials must be configured in production")
             if (
@@ -208,8 +204,6 @@ def check(self) -> None:
                 or not self.MYPOSTCARD_CAMPAIGN_ID
             ):
                 raise Exception("MyPostcard API credentials must be configured in production")
-            if not self.RECAPTHCA_PROJECT_ID or not self.RECAPTHCA_API_KEY or not self.RECAPTHCA_SITE_KEY:
-                raise Exception("reCAPTCHA credentials must be configured in production")
 
             if self.FEATURE_FLAGS_FILE_OVERRIDE_PATH:
                 raise Exception("FEATURE_FLAGS_FILE_OVERRIDE_PATH is dev-only and must not be set in production")

app/backend/src/couchers/context.py

@@ -4,6 +4,7 @@
 
 from couchers import experimentation
 from couchers.i18n import LocalizationContext
+from couchers.i18n.locales import get_translation_component
 
 if TYPE_CHECKING:
     from growthbook import GrowthBook
@@ -122,17 +123,30 @@ def abort(self, status_code: grpc.StatusCode, error_message: str) -> NoReturn:
             context.abort(status_code, error_message)
 
     def abort_with_error_code(
-        self, status_code: grpc.StatusCode, error_message_id: str, *, substitutions: dict[str, str | int] | None = None
+        self,
+        status_code: grpc.StatusCode,
+        error_message_id: str,
+        *,
+        substitutions: dict[str, str | int] | None = None,
     ) -> NoReturn:
         """
         Raises an error that's returned to the user, but error_message_id should be an entry from translateable errors
+
+        error_message_id may be namespaced with a translation component, like i18next, e.g. "admin:object_not_found"
+        looks up "object_not_found" in the "admin" component (where admin/editor errors live). Without a prefix the
+        "main" component is used.
         """
         if not self.__is_interactive:
             raise NonInteractiveAbortException(status_code, error_message_id)
         else:
             context = cast(grpc.ServicerContext, self._grpc_context)
+            component, _, error_name = error_message_id.rpartition(":")
             # Get the translated error message using the user's language preference
-            error_message = self.localization.localize_string(f"errors.{error_message_id}", substitutions=substitutions)
+            error_message = self.localization.localize_string(
+                f"errors.{error_name}",
+                i18next=get_translation_component(component or "main"),
+                substitutions=substitutions,
+            )
             context.abort(status_code, error_message)
 
     def set_cookies(self, cookies: list[str]) -> None: