decidim-admin 0.32.1 → 0.32.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0a90920d105b666ce847ed0d99808d90d024a223c0a93f1bf19830faadb54aae
-  data.tar.gz: df11befe78e45801e6dd398383cb66b8b50f80a90a54dcf169910f21b8efea09
+  metadata.gz: f7e4aa0b61296192c830ed2690b872cfe4d17a82cf9d4269fc151166d8953d16
+  data.tar.gz: bc62d61beb3506a34e90f3f9c286ec0f4f9230c8e9cacb1fbdd31e0449485510
 SHA512:
-  metadata.gz: 571e1c659b6bf02c4d3b7587eca36cfb92597210bcc0267a7e2f917f2e57370fa418ec937fd9be16900d26b81b68067dc3d88eeff950d0b89e294f2435c3b82a
-  data.tar.gz: d442beed22e818bb00757c92359a9cc582cc21257c2b5927167af3e4cabb9f5ff64049f04accc12047e2809e2d323ec06fd788cf23a1044c1609b081dbc87394
+  metadata.gz: 327ac89d92b53e8e85e08018609fe9541d98af5fc2ade1515a49f25471dfde2fda77882537a7a03a6dddd501338591459a90c2140de67695dd01a94021b105e9
+  data.tar.gz: 3b008b454c45287c00555c08a47ee0f57481841fab52c43f21ac7fe6c08a36aba270c74fdde2e5c8943d00e1e47674e07a1e2f89d93e11005c83489442a1881e

data/app/controllers/concerns/decidim/admin/component_taxonomies_helper.rb

@@ -10,7 +10,7 @@ module Decidim
       end
 
       def current_component_taxonomy_filters
-        @current_component_taxonomy_filters ||= TaxonomyFilter.for(current_organization)
+        @current_component_taxonomy_filters ||= TaxonomyFilter.for(current_organization) # rubocop:disable Decidim/OrganizationScopedFinder -- .for scopes by decidim_organization_id internally
                                                               .for_manifest(current_participatory_space.manifest.name)
                                                               .where(id: current_component.settings.taxonomy_filters)
       end

data/app/controllers/concerns/decidim/admin/content_blocks/landing_page.rb

@@ -10,7 +10,7 @@ module Decidim
           helper_method :active_blocks, :active_content_blocks_title, :add_content_block_text, :available_manifests,
                         :content_block_destroy_confirmation_text, :content_blocks_title, :inactive_blocks,
                         :inactive_content_blocks_title, :resource_content_block_cell, :resource_create_url,
-                        :resource_sort_url
+                        :resource_sort_url, :scoped_resource
           def edit
             enforce_permission_to_update_resource
 
@@ -30,10 +30,6 @@ module Decidim
             end
           end
 
-          # Method that specifies the i18n scope for this controller. This can be overwritten in your controller.
-          # so that you can pass a different scope to the i18n methods.
-          def i18n_scope = "decidim.admin.content_blocks"
-
           # Method to be implemented at the controller. Returns a string
           # with the text for the title of content blocks
           #
@@ -71,6 +67,10 @@ module Decidim
 
           private
 
+          # Method that specifies the i18n scope for this controller. This can be overwritten in your controller.
+          # so that you can pass a different scope to the i18n methods.
+          def i18n_scope = "decidim.admin.content_blocks"
+
           # Method to be implemented at the controller. You need to
           # return a symbol that defines the content block scope.
           # Examples of scopes could be `:homepage` or `:landing_page`.

data/app/controllers/concerns/decidim/admin/global_moderation_context.rb

@@ -8,6 +8,8 @@ module Decidim
       extend ActiveSupport::Concern
 
       included do
+        protected
+
         # Private: Overwrites the method from the parent controller so that the
         # permission system does not overwrite permissions.
         def authorization_scope

data/app/controllers/concerns/decidim/admin/participatory_space_admin_context.rb

@@ -8,6 +8,8 @@ module Decidim
       extend ActiveSupport::Concern
 
       class_methods do
+        protected
+
         # Public: Called on a controller, it sets up all the surrounding methods to render a
         # participatory space's admin template. It expects the method `current_participatory_space`
         # to be defined, from which it will extract the participatory manifest.

data/app/controllers/concerns/decidim/admin/participatory_space_export.rb

@@ -22,6 +22,8 @@ module Decidim
 
         # Public: To be implemented at the controller. You need to
         # return the space that will be exported.
+        protected
+
         def exportable_space
           raise NotImplementedError
         end

data/app/controllers/decidim/admin/admin_terms_controller.rb

@@ -6,6 +6,7 @@ module Decidim
     # Terms of service agreement.
     class AdminTermsController < Decidim::Admin::ApplicationController
       def accept
+        enforce_permission_to :accept, :admin_terms
         current_user.admin_terms_accepted_at = Time.current
         if current_user.save!
           flash[:notice] = t("accept.success", scope: "decidim.admin.admin_terms_of_service")

data/app/controllers/decidim/admin/application_controller.rb

@@ -44,6 +44,8 @@ module Decidim
       register_permissions(::Decidim::Admin::ApplicationController,
                            ::Decidim::Admin::Permissions)
 
+      protected
+
       def user_has_no_permission_path
         decidim_admin.root_path
       end

data/app/controllers/decidim/admin/block_user_controller.rb

@@ -57,6 +57,7 @@ module Decidim
       end
 
       def bulk_create
+        enforce_permission_to :block, :admin_user
         @form = form(BlockUsersForm).from_params(params)
 
         Admin::BulkBlockUsers.call(@form) do
@@ -73,6 +74,7 @@ module Decidim
       end
 
       def bulk_destroy
+        enforce_permission_to :block, :admin_user
         Admin::BulkUnblockUsers.call(blocked_users, current_user) do
           on(:ok) do
             flash[:notice] = I18n.t("officializations.bulk_action.unblock.success", scope: "decidim.admin")

data/app/controllers/decidim/admin/components/base_controller.rb

@@ -72,6 +72,8 @@ module Decidim
           end
         end
 
+        protected
+
         def set_breadcrumb_items
           context_breadcrumb_items << {
             label: t("components", scope: "decidim.admin.menu"),

data/app/controllers/decidim/admin/components_controller.rb

@@ -87,7 +87,7 @@ module Decidim
 
         Decidim::Commands::SoftDeleteResource.call(trashable_deleted_resource, current_user) do
           on(:ok) do
-            Decidim::Reminder.where(component: resource).destroy_all
+            Decidim::Reminder.where(component: resource).destroy_all # rubocop:disable Decidim/OrganizationScopedFinder -- resource is the soft-deleted component, already scoped to current_participatory_space via query_scope
             flash[:notice] = I18n.t("soft_delete.success", scope: trashable_i18n_scope, resource_name: human_readable_resource_name.capitalize)
             redirect_to_resource_index
           end
@@ -136,7 +136,8 @@ module Decidim
       end
 
       def share
-        @component = query_scope.find(params[:id])
+        enforce_permission_to :share, :component
+        @component = query_scope.find(params.expect(:id))
         share_token = @component.share_tokens.create!(user: current_user, organization: current_organization)
 
         redirect_to share_token.url

data/app/controllers/decidim/admin/concerns/has_attachment_collections.rb

@@ -82,6 +82,8 @@ module Decidim
             redirect_to after_destroy_path
           end
 
+          protected
+
           # Public: Returns a String or Object that will be passed to `redirect_to` after
           # destroying an attachment collection. By default it redirects to the object
           # that holds the attachment collection.

data/app/controllers/decidim/admin/concerns/has_attachments.rb

@@ -82,6 +82,8 @@ module Decidim
             redirect_to after_destroy_path
           end
 
+          protected
+
           # Public: Returns a String or Object that will be passed to `redirect_to` after
           # destroying an attachment. By default it redirects to the attached_to.
           #

data/app/controllers/decidim/admin/concerns/has_breadcrumb_items.rb

@@ -7,12 +7,16 @@ module Decidim
         extend ActiveSupport::Concern
 
         class_methods do
+          protected
+
           def add_breadcrumb_item_from_menu(target_menu, opts = {})
             before_action -> { secondary_breadcrumb_menus << target_menu }, opts
           end
         end
 
         included do
+          protected
+
           def secondary_breadcrumb_menus
             @secondary_breadcrumb_menus ||= []
           end

data/app/controllers/decidim/admin/conflicts_controller.rb

@@ -18,8 +18,6 @@ module Decidim
       def edit
         enforce_permission_to :index, :impersonatable_user
 
-        conflict = Decidim::Verifications::Conflict.find(params[:id])
-
         @form = form(TransferUserForm).from_params(
           user: conflict.current_user,
           managed_user: conflict.managed_user,
@@ -30,8 +28,6 @@ module Decidim
       def update
         enforce_permission_to :index, :impersonatable_user
 
-        conflict = Decidim::Verifications::Conflict.find(params[:id])
-
         @form = form(TransferUserForm).from_params(
           current_user:,
           conflict:,
@@ -54,6 +50,10 @@ module Decidim
 
       private
 
+      def conflict
+        @conflict ||= collection.find(params.expect(:id))
+      end
+
       def context_breadcrumb_items
         @context_breadcrumb_items ||= [impersonations_breadcrumb_item]
       end
@@ -67,7 +67,7 @@ module Decidim
 
       def collection
         @collection ||= Decidim::Verifications::Conflict.joins(:current_user).where(
-          decidim_users: { decidim_organization_id: current_organization.id }
+          decidim_users: { organization: current_organization }
         )
       end
 

data/app/controllers/decidim/admin/global_moderations/reports_controller.rb

@@ -9,6 +9,8 @@ module Decidim
 
         include Decidim::Admin::GlobalModerationContext
 
+        protected
+
         def moderation
           @moderation ||= moderations_for_user.find(params[:moderation_id])
         end

data/app/controllers/decidim/admin/global_moderations_controller.rb

@@ -9,6 +9,8 @@ module Decidim
 
       include Decidim::Admin::GlobalModerationContext
 
+      protected
+
       # Private: This method is used by the `Filterable` concern as the base query
       # without applying filtering and/or sorting options.
       def collection

data/app/controllers/decidim/admin/help_sections_controller.rb

@@ -12,17 +12,17 @@ module Decidim
 
       helper_method :sections
 
-      before_action do
+      def show
         enforce_permission_to :update, :help_sections
-      end
 
-      def show
         @form = form(HelpSectionsForm).from_model(
           OpenStruct.new(sections:)
         )
       end
 
       def update
+        enforce_permission_to :update, :help_sections
+
         @form = form(HelpSectionsForm).from_params(
           params[:help_sections]
         )

data/app/controllers/decidim/admin/impersonations_controller.rb

@@ -52,6 +52,7 @@ module Decidim
       end
 
       def close_session
+        enforce_permission_to :close_session, :managed_user
         CloseSessionManagedUser.call(user, current_user) do
           on(:ok) do
             flash[:notice] = I18n.t("impersonations.close_session.success", scope: "decidim.admin")
@@ -82,7 +83,7 @@ module Decidim
         )
         return nil unless handler.unique_id
 
-        existing_authorization = Authorization.find_by(
+        existing_authorization = Authorization.find_by( # rubocop:disable Decidim/OrganizationScopedFinder -- user: subquery scopes to current_organization
           user: User.where(organization: current_organization),
           name: handler_name,
           unique_id: handler.unique_id

data/app/controllers/decidim/admin/managed_users/impersonation_logs_controller.rb

@@ -11,7 +11,7 @@ module Decidim
         def index
           enforce_permission_to :index, :impersonatable_user
 
-          @impersonation_logs = Decidim::ImpersonationLog.where(user:).order(started_at: :desc).page(params[:page]).per(15)
+          @impersonation_logs = user.impersonation_logs.order(started_at: :desc).page(params[:page]).per(15)
         end
 
         private

data/app/controllers/decidim/admin/moderated_users_controller.rb

@@ -34,6 +34,7 @@ module Decidim
       end
 
       def bulk_unreport
+        enforce_permission_to :unreport, :moderate_users
         Admin::BulkUnreportUsers.call(current_user, reportables) do
           on(:ok) do
             flash[:notice] = I18n.t("reportable.bulk_action.ignore.success", scope: "decidim.moderations.admin")
@@ -67,6 +68,8 @@ module Decidim
         Decidim::Admin::ModerationStats.new(current_user).user_reports
       end
 
+      protected
+
       def collection
         @collection ||= if params[:blocked]
                           base_query_finder.blocked

data/app/controllers/decidim/admin/moderations_controller.rb

@@ -73,6 +73,8 @@ module Decidim
       end
 
       def bulk_action
+        enforce_permission_to :bulk_action, authorization_scope
+
         Admin::BulkAction.call(current_user, params[:bulk_action], selected_moderations) do
           on(:ok) do |ok, ko|
             flash[:notice] = I18n.t("reportable.bulk_action.#{params[:bulk_action]}.success", scope: "decidim.moderations.admin", count_ok: ok.count) if ok.count.positive?
@@ -92,6 +94,8 @@ module Decidim
         query_params[:q] || { s: "created_at desc" }
       end
 
+      protected
+
       # Private: This method is used by the `Filterable` concern as the base query
       #          without applying filtering and/or sorting options.
       def collection

data/app/controllers/decidim/admin/newsletter_templates_controller.rb

@@ -12,9 +12,12 @@ module Decidim
         enforce_permission_to :index, :newsletter
       end
 
-      def show; end
+      def show
+        enforce_permission_to :index, :newsletter
+      end
 
       def preview
+        enforce_permission_to :index, :newsletter
         email = NewsletterMailer.newsletter(current_user, fake_newsletter, true)
         Premailer::Rails::Hook.perform(email)
         render html: email.html_part.body.decoded.html_safe

data/app/controllers/decidim/admin/newsletters_controller.rb

@@ -114,6 +114,7 @@ module Decidim
       end
 
       def recipients_count
+        enforce_permission_to :read, :newsletter, newsletter:
         @form = form(SelectiveNewsletterForm).from_params(newsletter_params)
         render plain: recipients_count_query
       end
@@ -183,6 +184,8 @@ module Decidim
         end
       end
 
+      protected
+
       def collection
         @collection ||= Newsletter.where(organization: current_organization)
       end

data/app/controllers/decidim/admin/organization_homepage_controller.rb

@@ -10,14 +10,18 @@ module Decidim
 
       add_breadcrumb_item_from_menu :admin_settings_menu
 
-      def content_block_scope
-        :homepage
-      end
+      helper_method :scoped_resource
 
       def scoped_resource
         nil
       end
 
+      protected
+
+      def content_block_scope
+        :homepage
+      end
+
       def enforce_permission_to_update_resource
         enforce_permission_to :update, :organization, organization: current_organization
       end

data/app/controllers/decidim/admin/participatory_space/concerns/has_members.rb

@@ -107,6 +107,7 @@ module Decidim
             end
 
             def publish_all
+              enforce_permission_to :publish_all, :space_member
               PublishAllMembers.call(current_participatory_space, current_user) do
                 on(:ok) do
                   flash[:notice] = I18n.t("members.publish_all.success", scope: "decidim.admin")
@@ -121,6 +122,7 @@ module Decidim
             end
 
             def unpublish_all
+              enforce_permission_to :unpublish_all, :space_member
               UnpublishAllMembers.call(current_participatory_space, current_user) do
                 on(:ok) do
                   flash[:notice] = I18n.t("members.unpublish_all.success", scope: "decidim.admin")
@@ -134,6 +136,8 @@ module Decidim
               end
             end
 
+            protected
+
             # Public: Returns a String or Object that will be passed to `redirect_to` after
             # destroying a member. By default it redirects to the participatory_space.
             #

data/app/controllers/decidim/admin/participatory_space/concerns/has_members_csv_import.rb

@@ -46,6 +46,8 @@ module Decidim
               redirect_to new_members_csv_imports_path
             end
 
+            protected
+
             # Public: Returns a String or Object that will be passed to `redirect_to` after
             # importing members. By default it redirects to the participatory_space.
             #

data/app/controllers/decidim/admin/resource_permissions_controller.rb

@@ -10,12 +10,16 @@ module Decidim
       helper_method :authorizations, :other_authorizations_for, :resource_params, :resource
 
       def edit
+        enforce_permission_to :update, :resource_permission, resource:
+
         @permissions_form = PermissionsForm.new(
           permissions: permission_forms
         )
       end
 
       def update
+        enforce_permission_to :update, :resource_permission, resource:
+
         @permissions_form = PermissionsForm.from_params(params).with_context(current_organization:)
 
         UpdateResourcePermissions.call(@permissions_form, resource) do

data/app/controllers/decidim/admin/static_pages_controller.rb

@@ -11,34 +11,10 @@ module Decidim
 
       before_action :tos_version_formatted, only: [:index, :edit]
 
-      helper_method :topics
+      helper_method :topics, :scoped_resource
 
       alias update_content_blocks update
 
-      def content_block_scope
-        :static_page
-      end
-
-      def scoped_resource
-        @scoped_resource ||= collection.find_by(slug: params[:id])
-      end
-
-      def enforce_permission_to_update_resource
-        enforce_permission_to :update, :static_page, static_page: scoped_resource
-      end
-
-      def resource_sort_url
-        update_content_blocks_static_page_path(scoped_resource)
-      end
-
-      def resource_create_url(manifest_name)
-        static_page_content_blocks_path(scoped_resource, manifest_name:)
-      end
-
-      def resource_content_block_cell
-        "decidim/admin/static_page_content_block"
-      end
-
       def index
         enforce_permission_to :read, :static_page
         @topics = Decidim::StaticPageTopic.where(organization: current_organization)
@@ -101,8 +77,32 @@ module Decidim
         end
       end
 
+      def scoped_resource
+        @scoped_resource ||= collection.find_by(slug: params[:id])
+      end
+
       private
 
+      def content_block_scope
+        :static_page
+      end
+
+      def enforce_permission_to_update_resource
+        enforce_permission_to :update, :static_page, static_page: scoped_resource
+      end
+
+      def resource_sort_url
+        update_content_blocks_static_page_path(scoped_resource)
+      end
+
+      def resource_create_url(manifest_name)
+        static_page_content_blocks_path(scoped_resource, manifest_name:)
+      end
+
+      def resource_content_block_cell
+        "decidim/admin/static_page_content_block"
+      end
+
       def tab_menu_name = :admin_static_pages_menu
 
       def form_params
@@ -121,6 +121,8 @@ module Decidim
         @page ||= scoped_resource
       end
 
+      protected
+
       def collection
         current_organization.static_pages
       end

data/app/controllers/decidim/admin/taxonomy_filters_controller.rb

@@ -88,11 +88,11 @@ module Decidim
       end
 
       def root_taxonomy
-        @root_taxonomy ||= Taxonomy.roots.find(params[:taxonomy_id])
+        @root_taxonomy ||= Taxonomy.for(current_organization).roots.find(params.expect(:taxonomy_id)) # rubocop:disable Decidim/OrganizationScopedFinder -- .for(current_organization) scopes to current org
       end
 
       def taxonomy_filter
-        @taxonomy_filter ||= TaxonomyFilter.find_by(id: params[:id])
+        @taxonomy_filter ||= collection.find_by(id: params[:id])
       end
 
       def set_taxonomies_breadcrumb_item

data/app/controllers/decidim/admin/taxonomy_filters_selector_controller.rb

@@ -66,7 +66,7 @@ module Decidim
       end
 
       def component
-        @component ||= Component.find_by(id: params[:component_id])
+        @component ||= Component.find_by(id: params[:component_id]) # rubocop:disable Decidim/OrganizationScopedFinder -- validated by before_action: component.organization == current_organization
       end
 
       def root_taxonomy

data/app/jobs/decidim/admin/newsletter_job.rb

@@ -6,7 +6,6 @@ module Decidim
     #
     class NewsletterJob < ApplicationJob
       queue_as :newsletter
-      self.enqueue_after_transaction_commit = false
 
       def perform(newsletter, form, recipients_ids)
         @newsletter = newsletter

data/app/packs/entrypoints/decidim_admin.js

@@ -1,7 +1,6 @@
 /* eslint no-unused-vars: 0 */
 /* eslint id-length: ["error", { "exceptions": ["$"] }] */
 
-import "src/decidim/admin/tab_focus"
 import "src/decidim/admin/application"
 import "src/decidim/admin/resources_permissions"
 import "src/decidim/admin/newsletters"

data/app/packs/stylesheets/decidim/admin/_sidebar-menu.scss

@@ -37,7 +37,9 @@
 
       li {
         a {
-          @apply px-2 py-1;
+          @apply px-2 py-1 overflow-hidden;
+
+          overflow-wrap: anywhere;
         }
 
         &.is-active a {

data/app/permissions/decidim/admin/permissions.rb

@@ -26,6 +26,7 @@ module Decidim
 
         allow! if user_can_enter_space_area?(require_admin_terms_accepted: true)
 
+        accept_admin_terms_action?
         read_admin_dashboard_action?
         apply_newsletter_permissions_for_admin!
 
@@ -43,6 +44,7 @@ module Decidim
           allow! if user_action?
           allow! if admin_user_action?
           allow! if moderate_user_action?
+          allow! if resource_permission_action?
 
           allow! if permission_action.subject == :component
           allow! if permission_action.subject == :attachment
@@ -90,6 +92,13 @@ module Decidim
         user && !user.admin? && user.role?("user_manager")
       end
 
+      def accept_admin_terms_action?
+        return unless permission_action.subject == :admin_terms &&
+                      permission_action.action == :accept
+
+        allow! if user.admin? || user_has_any_role?(user, nil, broad_check: true)
+      end
+
       def read_admin_dashboard_action?
         return unless permission_action.subject == :admin_dashboard &&
                       permission_action.action == :read
@@ -247,6 +256,13 @@ module Decidim
         end
       end
 
+      def resource_permission_action?
+        return unless permission_action.subject == :resource_permission &&
+                      permission_action.action == :update
+
+        true
+      end
+
       def organization
         @organization ||= context.fetch(:organization, nil) || context.fetch(:current_organization, nil)
       end

data/app/views/decidim/admin/organization/form/_extra_features.html.erb

@@ -18,8 +18,24 @@
       </div>
 
       <div class="row column">
-        <%= form.label :machine_translation_display_priority, t("activemodel.attributes.organization.machine_translation_display_priority") %>
-          <%= form.collection_radio_buttons :machine_translation_display_priority, form.object.machine_translation_priorities, :first, :last %>
+        <fieldset class="row column" id="machine_translation_display_priority">
+          <legend>
+            <%= t("activemodel.attributes.organization.machine_translation_display_priority") %>
+          </legend>
+          <div class="radio-group">
+            <%# i18n-tasks-use t("decidim.admin.organization.form.machine_translation_display_priority.options.original") %>
+            <%# i18n-tasks-use t("decidim.admin.organization.form.machine_translation_display_priority.options.translation") %>
+            <%= form.collection_radio_buttons :machine_translation_display_priority, form.object.machine_translation_priorities, :first, :last  do |builder| %>
+              <%= builder.label(for: nil, class: "form__wrapper-checkbox-label") do %>
+                <%= builder.radio_button(id: nil, label: false) %>
+                <span>
+                  <strong class="font-semibold"><%= builder.text %></strong>
+                  <%= t(builder.value, scope: "decidim.admin.organization.form.machine_translation_display_priority.options") %>
+                </span>
+              <% end %>
+            <% end %>
+          </div>
+        </fieldset>
       </div>
     <% end %>
 

data/config/locales/bg.yml

@@ -877,6 +877,8 @@ bg:
       taxonomy_filters:
         actions:
           new_taxonomy_filter: Нов класификационен филтър
+        form:
+          all: Всички
       titles:
         areas: Области
         authorization_workflows: Методи за проверка