decidim-admin 0.31.6 → 0.31.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 85a91a0ec3c1ea347bf005fedb3b2ff0a6409a627098fa27f8b2934040d592d9
-  data.tar.gz: c84548b46b2c50b89a30db898f810217de60b2d5fb8cf602ad6c764ea6d2d3e1
+  metadata.gz: 9b09d289923eeba25084f2ef02203d589e66d9f9112ab0c07663f5cabcc27fa6
+  data.tar.gz: ac243685d31770727448e905d9cd8d92afc6681c2418f26c92336075d9c91df2
 SHA512:
-  metadata.gz: 0b4dabe28198f4de1d361c820af7cebe1cd5eb02e541bbee7fe4deb0183b79f252177b253bc647157e2857e171dcaaf32265405b1352237a9f13615feb5554af
-  data.tar.gz: a661711b289811f7f6890a3afc486c73dd48d13791c57244964bed5dcd1013bdd3574118ced21cad55be8907d0296290e2614ac5086a7a9c817f0a4e6682f27c
+  metadata.gz: 988427f2e29e0dc9d8ea2284421e014a690f65b90f0374a4c6acafaf5cbf0a566ea09c3678d420b0d24f6f2ac475f145f7a28dd84011bcf649f158c1527beec1
+  data.tar.gz: ca646ce7ca7f693b7c37f164504c2c076cfcf1cf231ec8450c675b82b94c058a856cd76659c020cf74ebf10ffecde940448111c138fe5d2974663eb696114079

data/app/controllers/concerns/decidim/admin/component_taxonomies_helper.rb

@@ -10,7 +10,7 @@ module Decidim
       end
 
       def current_component_taxonomy_filters
-        @current_component_taxonomy_filters ||= TaxonomyFilter.for(current_organization)
+        @current_component_taxonomy_filters ||= TaxonomyFilter.for(current_organization) # rubocop:disable Decidim/OrganizationScopedFinder -- .for scopes by decidim_organization_id internally
                                                               .for_manifest(current_participatory_space.manifest.name)
                                                               .where(id: current_component.settings.taxonomy_filters)
       end

data/app/controllers/concerns/decidim/admin/content_blocks/landing_page.rb

@@ -9,7 +9,7 @@ module Decidim
           helper_method :active_blocks, :active_content_blocks_title, :add_content_block_text, :available_manifests,
                         :content_block_destroy_confirmation_text, :content_blocks_title, :inactive_blocks,
                         :inactive_content_blocks_title, :resource_content_block_cell, :resource_create_url,
-                        :resource_sort_url
+                        :resource_sort_url, :scoped_resource
           def edit
             enforce_permission_to_update_resource
 
@@ -29,10 +29,6 @@ module Decidim
             end
           end
 
-          # Method that specifies the i18n scope for this controller. This can be overwritten in your controller.
-          # so that you can pass a different scope to the i18n methods.
-          def i18n_scope = "decidim.admin.content_blocks"
-
           # Method to be implemented at the controller. Returns a string
           # with the text for the title of content blocks
           #
@@ -70,6 +66,10 @@ module Decidim
 
           private
 
+          # Method that specifies the i18n scope for this controller. This can be overwritten in your controller.
+          # so that you can pass a different scope to the i18n methods.
+          def i18n_scope = "decidim.admin.content_blocks"
+
           # Method to be implemented at the controller. You need to
           # return a symbol that defines the content block scope.
           # Examples of scopes could be `:homepage` or `:landing_page`.

data/app/controllers/concerns/decidim/admin/global_moderation_context.rb

@@ -8,6 +8,8 @@ module Decidim
       extend ActiveSupport::Concern
 
       included do
+        protected
+
         # Private: Overwrites the method from the parent controller so that the
         # permission system does not overwrite permissions.
         def authorization_scope

data/app/controllers/concerns/decidim/admin/participatory_space_admin_context.rb

@@ -8,6 +8,8 @@ module Decidim
       extend ActiveSupport::Concern
 
       class_methods do
+        protected
+
         # Public: Called on a controller, it sets up all the surrounding methods to render a
         # participatory space's admin template. It expects the method `current_participatory_space`
         # to be defined, from which it will extract the participatory manifest.

data/app/controllers/concerns/decidim/admin/participatory_space_export.rb

@@ -22,6 +22,8 @@ module Decidim
 
         # Public: To be implemented at the controller. You need to
         # return the space that will be exported.
+        protected
+
         def exportable_space
           raise NotImplementedError
         end

data/app/controllers/decidim/admin/admin_terms_controller.rb

@@ -6,6 +6,7 @@ module Decidim
     # Terms of service agreement.
     class AdminTermsController < Decidim::Admin::ApplicationController
       def accept
+        enforce_permission_to :accept, :admin_terms
         current_user.admin_terms_accepted_at = Time.current
         if current_user.save!
           flash[:notice] = t("accept.success", scope: "decidim.admin.admin_terms_of_service")

data/app/controllers/decidim/admin/application_controller.rb

@@ -44,6 +44,8 @@ module Decidim
       register_permissions(::Decidim::Admin::ApplicationController,
                            ::Decidim::Admin::Permissions)
 
+      protected
+
       def user_has_no_permission_path
         decidim_admin.root_path
       end

data/app/controllers/decidim/admin/block_user_controller.rb

@@ -57,6 +57,7 @@ module Decidim
       end
 
       def bulk_create
+        enforce_permission_to :block, :admin_user
         @form = form(BlockUsersForm).from_params(params)
 
         Admin::BulkBlockUsers.call(@form) do
@@ -73,6 +74,7 @@ module Decidim
       end
 
       def bulk_destroy
+        enforce_permission_to :block, :admin_user
         Admin::BulkUnblockUsers.call(blocked_users, current_user) do
           on(:ok) do
             flash[:notice] = I18n.t("officializations.bulk_action.unblock.success", scope: "decidim.admin")

data/app/controllers/decidim/admin/components/base_controller.rb

@@ -23,13 +23,7 @@ module Decidim
                       :current_participatory_space,
                       :parent_path
 
-        before_action except: [:index, :show] do
-          enforce_permission_to :manage, :component, component: current_component unless skip_manage_component_permission
-        end
-
-        before_action on: [:index, :show] do
-          enforce_permission_to :read, :component, component: current_component
-        end
+        before_action :enforce_component_permissions
 
         before_action :set_component_breadcrumb_item
 
@@ -68,6 +62,17 @@ module Decidim
           false
         end
 
+        def enforce_component_permissions
+          case action_name.to_sym
+          when :index, :show
+            enforce_permission_to :read, :component, component: current_component
+          else
+            enforce_permission_to :manage, :component, component: current_component unless skip_manage_component_permission
+          end
+        end
+
+        protected
+
         def set_component_breadcrumb_item
           context_breadcrumb_items << {
             label: t("components", scope: "decidim.admin.menu"),

data/app/controllers/decidim/admin/components_controller.rb

@@ -86,7 +86,7 @@ module Decidim
 
         Decidim::Commands::SoftDeleteResource.call(trashable_deleted_resource, current_user) do
           on(:ok) do
-            Decidim::Reminder.where(component: resource).destroy_all
+            Decidim::Reminder.where(component: resource).destroy_all # rubocop:disable Decidim/OrganizationScopedFinder -- resource is the soft-deleted component, already scoped to current_participatory_space via query_scope
             flash[:notice] = I18n.t("soft_delete.success", scope: trashable_i18n_scope, resource_name: human_readable_resource_name.capitalize)
             redirect_to_resource_index
           end
@@ -135,9 +135,9 @@ module Decidim
       end
 
       def share
+        enforce_permission_to :share, :component
         @component = query_scope.find(params[:id])
         share_token = @component.share_tokens.create!(user: current_user, organization: current_organization)
-
         redirect_to share_token.url
       end
 

data/app/controllers/decidim/admin/concerns/has_attachment_collections.rb

@@ -82,6 +82,8 @@ module Decidim
             redirect_to after_destroy_path
           end
 
+          protected
+
           # Public: Returns a String or Object that will be passed to `redirect_to` after
           # destroying an attachment collection. By default it redirects to the object
           # that holds the attachment collection.

data/app/controllers/decidim/admin/concerns/has_attachments.rb

@@ -82,6 +82,8 @@ module Decidim
             redirect_to after_destroy_path
           end
 
+          protected
+
           # Public: Returns a String or Object that will be passed to `redirect_to` after
           # destroying an attachment. By default it redirects to the attached_to.
           #

data/app/controllers/decidim/admin/concerns/has_breadcrumb_items.rb

@@ -7,12 +7,16 @@ module Decidim
         extend ActiveSupport::Concern
 
         class_methods do
+          protected
+
           def add_breadcrumb_item_from_menu(target_menu, opts = {})
             before_action -> { secondary_breadcrumb_menus << target_menu }, opts
           end
         end
 
         included do
+          protected
+
           def secondary_breadcrumb_menus
             @secondary_breadcrumb_menus ||= []
           end

data/app/controllers/decidim/admin/concerns/has_private_users.rb

@@ -105,6 +105,7 @@ module Decidim
           end
 
           def publish_all
+            enforce_permission_to :publish_all, :space_private_user
             PublishAllParticipatorySpacePrivateUsers.call(current_participatory_space, current_user) do
               on(:ok) do
                 flash[:notice] = I18n.t("participatory_space_private_users.publish_all.success", scope: "decidim.admin")
@@ -119,6 +120,7 @@ module Decidim
           end
 
           def unpublish_all
+            enforce_permission_to :unpublish_all, :space_private_user
             UnpublishAllParticipatorySpacePrivateUsers.call(current_participatory_space, current_user) do
               on(:ok) do
                 flash[:notice] = I18n.t("participatory_space_private_users.unpublish_all.success", scope: "decidim.admin")
@@ -132,6 +134,8 @@ module Decidim
             end
           end
 
+          protected
+
           # Public: Returns a String or Object that will be passed to `redirect_to` after
           # destroying a private user. By default it redirects to the privatable_to.
           #

data/app/controllers/decidim/admin/concerns/has_private_users_csv_import.rb

@@ -45,6 +45,8 @@ module Decidim
             redirect_to new_participatory_space_private_users_csv_imports_path
           end
 
+          protected
+
           # Public: Returns a String or Object that will be passed to `redirect_to` after
           # importing private users. By default it redirects to the privatable_to.
           #

data/app/controllers/decidim/admin/conflicts_controller.rb

@@ -18,8 +18,6 @@ module Decidim
       def edit
         enforce_permission_to :index, :impersonatable_user
 
-        conflict = Decidim::Verifications::Conflict.find(params[:id])
-
         @form = form(TransferUserForm).from_params(
           user: conflict.current_user,
           managed_user: conflict.managed_user,
@@ -30,8 +28,6 @@ module Decidim
       def update
         enforce_permission_to :index, :impersonatable_user
 
-        conflict = Decidim::Verifications::Conflict.find(params[:id])
-
         @form = form(TransferUserForm).from_params(
           current_user:,
           conflict:,
@@ -54,6 +50,10 @@ module Decidim
 
       private
 
+      def conflict
+        @conflict ||= collection.find(params.require(:id))
+      end
+
       def context_breadcrumb_items
         @context_breadcrumb_items ||= [impersonations_breadcrumb_item]
       end
@@ -67,7 +67,7 @@ module Decidim
 
       def collection
         @collection ||= Decidim::Verifications::Conflict.joins(:current_user).where(
-          decidim_users: { decidim_organization_id: current_organization.id }
+          decidim_users: { organization: current_organization }
         )
       end
 

data/app/controllers/decidim/admin/global_moderations/reports_controller.rb

@@ -9,6 +9,8 @@ module Decidim
 
         include Decidim::Admin::GlobalModerationContext
 
+        protected
+
         def moderation
           @moderation ||= moderations_for_user.find(params[:moderation_id])
         end

data/app/controllers/decidim/admin/global_moderations_controller.rb

@@ -9,6 +9,8 @@ module Decidim
 
       include Decidim::Admin::GlobalModerationContext
 
+      protected
+
       # Private: This method is used by the `Filterable` concern as the base query
       # without applying filtering and/or sorting options.
       def collection

data/app/controllers/decidim/admin/help_sections_controller.rb

@@ -12,17 +12,17 @@ module Decidim
 
       helper_method :sections
 
-      before_action do
+      def show
         enforce_permission_to :update, :help_sections
-      end
 
-      def show
         @form = form(HelpSectionsForm).from_model(
           OpenStruct.new(sections:)
         )
       end
 
       def update
+        enforce_permission_to :update, :help_sections
+
         @form = form(HelpSectionsForm).from_params(
           params[:help_sections]
         )

data/app/controllers/decidim/admin/impersonations_controller.rb

@@ -52,6 +52,7 @@ module Decidim
       end
 
       def close_session
+        enforce_permission_to :close_session, :managed_user
         CloseSessionManagedUser.call(user, current_user) do
           on(:ok) do
             flash[:notice] = I18n.t("impersonations.close_session.success", scope: "decidim.admin")
@@ -82,7 +83,7 @@ module Decidim
         )
         return nil unless handler.unique_id
 
-        existing_authorization = Authorization.find_by(
+        existing_authorization = Authorization.find_by( # rubocop:disable Decidim/OrganizationScopedFinder -- user: subquery scopes to current_organization
           user: User.where(organization: current_organization),
           name: handler_name,
           unique_id: handler.unique_id

data/app/controllers/decidim/admin/managed_users/impersonation_logs_controller.rb

@@ -11,7 +11,7 @@ module Decidim
         def index
           enforce_permission_to :index, :impersonatable_user
 
-          @impersonation_logs = Decidim::ImpersonationLog.where(user:).order(started_at: :desc).page(params[:page]).per(15)
+          @impersonation_logs = user.impersonation_logs.order(started_at: :desc).page(params[:page]).per(15)
         end
 
         private

data/app/controllers/decidim/admin/moderated_users_controller.rb

@@ -34,6 +34,7 @@ module Decidim
       end
 
       def bulk_unreport
+        enforce_permission_to :unreport, :moderate_users
         Admin::BulkUnreportUsers.call(current_user, reportables) do
           on(:ok) do
             flash[:notice] = I18n.t("reportable.bulk_action.ignore.success", scope: "decidim.moderations.admin")
@@ -67,6 +68,8 @@ module Decidim
         Decidim::Admin::ModerationStats.new(current_user).user_reports
       end
 
+      protected
+
       def collection
         @collection ||= if params[:blocked]
                           base_query_finder.blocked

data/app/controllers/decidim/admin/moderations_controller.rb

@@ -73,6 +73,8 @@ module Decidim
       end
 
       def bulk_action
+        enforce_permission_to :bulk_action, authorization_scope
+
         Admin::BulkAction.call(current_user, params[:bulk_action], selected_moderations) do
           on(:ok) do |ok, ko|
             flash[:notice] = I18n.t("reportable.bulk_action.#{params[:bulk_action]}.success", scope: "decidim.moderations.admin", count_ok: ok.count) if ok.count.positive?
@@ -92,6 +94,8 @@ module Decidim
         query_params[:q] || { s: "created_at desc" }
       end
 
+      protected
+
       # Private: This method is used by the `Filterable` concern as the base query
       #          without applying filtering and/or sorting options.
       def collection

data/app/controllers/decidim/admin/newsletter_templates_controller.rb

@@ -12,9 +12,12 @@ module Decidim
         enforce_permission_to :index, :newsletter
       end
 
-      def show; end
+      def show
+        enforce_permission_to :index, :newsletter
+      end
 
       def preview
+        enforce_permission_to :index, :newsletter
         email = NewsletterMailer.newsletter(current_user, fake_newsletter, true)
         Premailer::Rails::Hook.perform(email)
         render html: email.html_part.body.decoded.html_safe

data/app/controllers/decidim/admin/newsletters_controller.rb

@@ -113,6 +113,7 @@ module Decidim
       end
 
       def recipients_count
+        enforce_permission_to :read, :newsletter, newsletter:
         @form = form(SelectiveNewsletterForm).from_params(newsletter_params)
         render plain: recipients_count_query
       end
@@ -182,6 +183,8 @@ module Decidim
         end
       end
 
+      protected
+
       def collection
         @collection ||= Newsletter.where(organization: current_organization)
       end

data/app/controllers/decidim/admin/organization_homepage_controller.rb

@@ -10,14 +10,18 @@ module Decidim
 
       add_breadcrumb_item_from_menu :admin_settings_menu
 
-      def content_block_scope
-        :homepage
-      end
+      helper_method :scoped_resource
 
       def scoped_resource
         nil
       end
 
+      protected
+
+      def content_block_scope
+        :homepage
+      end
+
       def enforce_permission_to_update_resource
         enforce_permission_to :update, :organization, organization: current_organization
       end

data/app/controllers/decidim/admin/resource_permissions_controller.rb

@@ -10,12 +10,16 @@ module Decidim
       helper_method :authorizations, :other_authorizations_for, :resource_params, :resource
 
       def edit
+        enforce_permission_to :update, :resource_permission, resource:
+
         @permissions_form = PermissionsForm.new(
           permissions: permission_forms
         )
       end
 
       def update
+        enforce_permission_to :update, :resource_permission, resource:
+
         @permissions_form = PermissionsForm.from_params(params).with_context(current_organization:)
 
         UpdateResourcePermissions.call(@permissions_form, resource) do

data/app/controllers/decidim/admin/static_pages_controller.rb

@@ -11,34 +11,10 @@ module Decidim
 
       before_action :tos_version_formatted, only: [:index, :edit]
 
-      helper_method :topics
+      helper_method :topics, :scoped_resource
 
       alias update_content_blocks update
 
-      def content_block_scope
-        :static_page
-      end
-
-      def scoped_resource
-        @scoped_resource ||= collection.find_by(slug: params[:id])
-      end
-
-      def enforce_permission_to_update_resource
-        enforce_permission_to :update, :static_page, static_page: scoped_resource
-      end
-
-      def resource_sort_url
-        update_content_blocks_static_page_path(scoped_resource)
-      end
-
-      def resource_create_url(manifest_name)
-        static_page_content_blocks_path(scoped_resource, manifest_name:)
-      end
-
-      def resource_content_block_cell
-        "decidim/admin/static_page_content_block"
-      end
-
       def index
         enforce_permission_to :read, :static_page
         @topics = Decidim::StaticPageTopic.where(organization: current_organization)
@@ -101,8 +77,32 @@ module Decidim
         end
       end
 
+      def scoped_resource
+        @scoped_resource ||= collection.find_by(slug: params[:id])
+      end
+
       private
 
+      def content_block_scope
+        :static_page
+      end
+
+      def enforce_permission_to_update_resource
+        enforce_permission_to :update, :static_page, static_page: scoped_resource
+      end
+
+      def resource_sort_url
+        update_content_blocks_static_page_path(scoped_resource)
+      end
+
+      def resource_create_url(manifest_name)
+        static_page_content_blocks_path(scoped_resource, manifest_name:)
+      end
+
+      def resource_content_block_cell
+        "decidim/admin/static_page_content_block"
+      end
+
       def tab_menu_name = :admin_static_pages_menu
 
       def form_params
@@ -121,6 +121,8 @@ module Decidim
         @page ||= scoped_resource
       end
 
+      protected
+
       def collection
         current_organization.static_pages
       end

data/app/controllers/decidim/admin/taxonomy_filters_controller.rb

@@ -88,11 +88,11 @@ module Decidim
       end
 
       def root_taxonomy
-        @root_taxonomy ||= Taxonomy.roots.find(params[:taxonomy_id])
+        @root_taxonomy ||= Taxonomy.for(current_organization).roots.find(params.require(:taxonomy_id)) # rubocop:disable Decidim/OrganizationScopedFinder -- .for(current_organization) scopes to current org
       end
 
       def taxonomy_filter
-        @taxonomy_filter ||= TaxonomyFilter.find_by(id: params[:id])
+        @taxonomy_filter ||= collection.find_by(id: params[:id])
       end
 
       def set_taxonomies_breadcrumb_item

data/app/controllers/decidim/admin/taxonomy_filters_selector_controller.rb

@@ -66,7 +66,7 @@ module Decidim
       end
 
       def component
-        @component ||= Component.find_by(id: params[:component_id])
+        @component ||= Component.find_by(id: params[:component_id]) # rubocop:disable Decidim/OrganizationScopedFinder -- validated by before_action: component.organization == current_organization
       end
 
       def root_taxonomy

data/app/jobs/decidim/admin/newsletter_job.rb

@@ -6,7 +6,6 @@ module Decidim
     #
     class NewsletterJob < ApplicationJob
       queue_as :newsletter
-      self.enqueue_after_transaction_commit = :never
 
       def perform(newsletter, form, recipients_ids)
         @newsletter = newsletter

data/app/packs/stylesheets/decidim/admin/_sidebar-menu.scss

@@ -37,7 +37,9 @@
 
       li {
         a {
-          @apply px-2 py-1;
+          @apply px-2 py-1 overflow-hidden;
+
+          overflow-wrap: anywhere;
         }
 
         &.is-active a {

data/app/permissions/decidim/admin/permissions.rb

@@ -26,6 +26,7 @@ module Decidim
 
         allow! if user_can_enter_space_area?(require_admin_terms_accepted: true)
 
+        accept_admin_terms_action?
         read_admin_dashboard_action?
         apply_newsletter_permissions_for_admin!
 
@@ -43,6 +44,7 @@ module Decidim
           allow! if user_action?
           allow! if admin_user_action?
           allow! if moderate_user_action?
+          allow! if resource_permission_action?
 
           allow! if permission_action.subject == :component
           allow! if permission_action.subject == :attachment
@@ -90,6 +92,13 @@ module Decidim
         user && !user.admin? && user.role?("user_manager")
       end
 
+      def accept_admin_terms_action?
+        return unless permission_action.subject == :admin_terms &&
+                      permission_action.action == :accept
+
+        allow! if user.admin? || user_has_any_role?(user, nil, broad_check: true)
+      end
+
       def read_admin_dashboard_action?
         return unless permission_action.subject == :admin_dashboard &&
                       permission_action.action == :read
@@ -247,6 +256,13 @@ module Decidim
         end
       end
 
+      def resource_permission_action?
+        return unless permission_action.subject == :resource_permission &&
+                      permission_action.action == :update
+
+        true
+      end
+
       def organization
         @organization ||= context.fetch(:organization, nil) || context.fetch(:current_organization, nil)
       end

data/app/views/decidim/admin/organization/form/_extra_features.html.erb

@@ -22,8 +22,24 @@
       </div>
 
       <div class="row column">
-        <%= form.label :machine_translation_display_priority, t("activemodel.attributes.organization.machine_translation_display_priority") %>
-          <%= form.collection_radio_buttons :machine_translation_display_priority, form.object.machine_translation_priorities, :first, :last %>
+        <fieldset class="row column" id="machine_translation_display_priority">
+          <legend>
+            <%= t("activemodel.attributes.organization.machine_translation_display_priority") %>
+          </legend>
+          <div class="radio-group">
+            <%# i18n-tasks-use t("decidim.admin.organization.form.machine_translation_display_priority.options.original") %>
+            <%# i18n-tasks-use t("decidim.admin.organization.form.machine_translation_display_priority.options.translation") %>
+            <%= form.collection_radio_buttons :machine_translation_display_priority, form.object.machine_translation_priorities, :first, :last  do |builder| %>
+              <%= builder.label(for: nil, class: "form__wrapper-checkbox-label") do %>
+                <%= builder.radio_button(id: nil, label: false) %>
+                <span>
+                  <strong class="font-semibold"><%= builder.text %></strong>
+                  <%= t(builder.value, scope: "decidim.admin.organization.form.machine_translation_display_priority.options") %>
+                </span>
+              <% end %>
+            <% end %>
+          </div>
+        </fieldset>
       </div>
     <% end %>