decidim-api 0.28.4 → 0.28.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 81726d50d218c9b420f4ed8c23357b0b9eb8a849d778cf27a8e297a756b43f60
-  data.tar.gz: be2e886b84412da834583e7f4b0cd90a1faff07f4bb16fce7546f00d6a138826
+  metadata.gz: 88423df68a4d00904f695f91718a1ddcc50a5ec349f72f556953c5f0da6ac37f
+  data.tar.gz: 474806afddaa0642ce4f47dfd5d95995825444ea4184f1a455c99228a3f67a82
 SHA512:
-  metadata.gz: 49a20f58a028560facd9c6cb2bbd6156d4becd0137dde86ca7ef614086c0b43f1e766d6589523a6410c553b0a0d47196fb13817b0d2b0bf67641d7718a7a614e
-  data.tar.gz: ce75ff26c38bb4b9cc495bf9c6191a7d30fe19d92a31d008fd05ab84cc00cedb8d7bde280be0016b296fd61fce761278c02c9a756b905bf4a62b4157fbdf1879
+  metadata.gz: 88a714501878574770b3961359740ad405b111777c9bc5b54200987c38f0e9203748895f747937cf313c845d479cc9d27e8e388a316b13cb05c63aa061803e88
+  data.tar.gz: 92b2932c7d96f26e5e2a5b0d9fe4ae4023b56b79af26d982b9fed0901887ff768ee5160d99a948adb1fdee6098abc0963b44fd4fed83b5f8abc8a41e1f4dd25f

data/decidim-api.gemspec

@@ -10,7 +10,7 @@ Gem::Specification.new do |s|
   s.version = Decidim::Api.version
   s.authors = ["Josep Jaume Rey Peroy", "Marc Riera Casals", "Oriol Gual Oliva"]
   s.email = ["josepjaume@gmail.com", "mrc2407@gmail.com", "oriolgual@gmail.com"]
-  s.license = "AGPL-3.0"
+  s.license = "AGPL-3.0-or-later"
   s.homepage = "https://decidim.org"
   s.metadata = {
     "bug_tracker_uri" => "https://github.com/decidim/decidim/issues",
@@ -39,6 +39,7 @@ Gem::Specification.new do |s|
   s.add_dependency "graphql-docs", "~> 3.0.1"
   s.add_dependency "rack-cors", "~> 1.0"
 
+  s.add_development_dependency "decidim-assemblies", Decidim::Api.version
   s.add_development_dependency "decidim-comments", Decidim::Api.version
   s.add_development_dependency "decidim-dev", Decidim::Api.version
   s.add_development_dependency "decidim-participatory_processes", Decidim::Api.version

data/lib/decidim/api/test/component_context.rb

@@ -41,3 +41,438 @@ shared_context "with a graphql decidim component" do
     )
   end
 end
+
+shared_examples "with resource visibility" do
+  let(:process_space_factory) { :participatory_process }
+  let(:space_type) { "participatoryProcess" }
+
+  shared_examples "graphQL visible resource" do
+    it "is visible" do
+      expect(response[space_type]["components"].first[lookout_key]).to eq(query_result)
+    end
+  end
+
+  shared_examples "graphQL hidden space" do
+    it "should not be visible" do
+      expect(response[space_type]).to be_nil
+    end
+  end
+
+  shared_examples "graphQL hidden component" do
+    it "should not be visible" do
+      expect(response[space_type]["components"].first).to be_nil
+    end
+  end
+
+  shared_examples "graphQL resource visible for admin" do
+    context "when the user is admin" do
+      let!(:current_user) { create(:user, :admin, :confirmed, organization: current_organization) }
+
+      it_behaves_like "graphQL visible resource"
+    end
+  end
+
+  shared_examples "graphQL space hidden to visitor" do
+    context "when user is visitor" do
+      let!(:current_user) { nil }
+      it_behaves_like "graphQL hidden space"
+    end
+  end
+
+  context "when space is published" do
+    let!(:participatory_process) { create(process_space_factory, :published, :with_steps, organization: current_organization) }
+
+    context "when component is published" do
+      let!(:current_component) { create(component_factory, :published, participatory_space: participatory_process) }
+
+      it_behaves_like "graphQL resource visible for admin"
+
+      context "when the user is space admin" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:participatory_process_user_role, participatory_process:, user: current_user, role: "admin") }
+        it_behaves_like "graphQL visible resource"
+      end
+
+      context "when the user is space collaborator" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:participatory_process_user_role, participatory_process:, user: current_user, role: "collaborator") }
+        it_behaves_like "graphQL visible resource"
+      end
+
+      context "when the user is space moderator" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:participatory_process_user_role, participatory_process:, user: current_user, role: "moderator") }
+        it_behaves_like "graphQL visible resource"
+      end
+
+      context "when the user is space valuator" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:participatory_process_user_role, participatory_process:, user: current_user, role: "valuator") }
+        it_behaves_like "graphQL visible resource"
+      end
+
+      context "when user is visitor" do
+        let!(:current_user) { nil }
+        it_behaves_like "graphQL visible resource"
+      end
+
+      context "when user is member" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:participatory_space_private_user) { create(:participatory_space_private_user, user: current_user, privatable_to: participatory_process) }
+        it_behaves_like "graphQL visible resource"
+      end
+
+      context "when user is member" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:participatory_space_private_user) { create(:participatory_space_private_user, user: current_user, privatable_to: participatory_process) }
+        it_behaves_like "graphQL visible resource"
+      end
+
+      context "when user is normal user" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        it_behaves_like "graphQL visible resource"
+      end
+    end
+
+    context "when component is not published" do
+      let!(:current_component) { create(component_factory, :unpublished, participatory_space: participatory_process) }
+
+      it_behaves_like "graphQL resource visible for admin"
+
+      context "when the user is space admin" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:participatory_process_user_role, participatory_process:, user: current_user, role: "admin") }
+        it_behaves_like "graphQL visible resource"
+      end
+
+      context "when the user is space collaborator" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:participatory_process_user_role, participatory_process:, user: current_user, role: "collaborator") }
+        it_behaves_like "graphQL hidden component"
+      end
+
+      context "when the user is space moderator" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:participatory_process_user_role, participatory_process:, user: current_user, role: "moderator") }
+        it_behaves_like "graphQL hidden component"
+      end
+
+      context "when the user is space valuator" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:participatory_process_user_role, participatory_process:, user: current_user, role: "valuator") }
+        it_behaves_like "graphQL visible resource"
+      end
+
+      context "when user is visitor" do
+        let!(:current_user) { nil }
+
+        it_behaves_like "graphQL hidden component"
+      end
+
+      context "when user is normal user" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        it_behaves_like "graphQL hidden component"
+      end
+
+      context "when user is member" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:participatory_space_private_user) { create(:participatory_space_private_user, user: current_user, privatable_to: participatory_process) }
+        it_behaves_like "graphQL hidden component"
+      end
+    end
+  end
+
+  context "when space is published, private and transparent" do
+    let(:process_space_factory) { :assembly }
+    let(:space_type) { "assembly" }
+
+    let(:participatory_process_query) do
+      %(
+      assembly(id: #{participatory_process.id}) {
+        components(filter: {type: "#{component_type}"}){
+          id
+          name {
+            translation(locale: "#{locale}")
+          }
+          weight
+          __typename
+          ...fooComponent
+        }
+        id
+      }
+    )
+    end
+    let!(:participatory_process) { create(process_space_factory, :published, :private, :transparent, organization: current_organization) }
+
+    context "when component is published" do
+      let!(:current_component) { create(component_factory, :published, participatory_space: participatory_process) }
+
+      it_behaves_like "graphQL resource visible for admin"
+
+      context "when the user is space admin" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:assembly_user_role, assembly: participatory_process, user: current_user, role: "admin") }
+        it_behaves_like "graphQL visible resource"
+      end
+
+      context "when the user is space collaborator" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:assembly_user_role, assembly: participatory_process, user: current_user, role: "collaborator") }
+        it_behaves_like "graphQL visible resource"
+      end
+
+      context "when the user is space moderator" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:assembly_user_role, assembly: participatory_process, user: current_user, role: "moderator") }
+        it_behaves_like "graphQL visible resource"
+      end
+
+      context "when the user is space valuator" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:assembly_user_role, assembly: participatory_process, user: current_user, role: "valuator") }
+        it_behaves_like "graphQL visible resource"
+      end
+
+      context "when user is visitor" do
+        let!(:current_user) { nil }
+        it_behaves_like "graphQL visible resource"
+      end
+
+      context "when user is member" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:participatory_space_private_user) { create(:assembly_private_user, user: current_user, privatable_to: participatory_process) }
+        it_behaves_like "graphQL visible resource"
+      end
+
+      context "when user is normal user" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        it_behaves_like "graphQL visible resource"
+      end
+    end
+
+    context "when component is not published" do
+      let!(:current_component) { create(component_factory, :unpublished, participatory_space: participatory_process) }
+
+      it_behaves_like "graphQL resource visible for admin"
+
+      context "when the user is space admin" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:assembly_user_role, assembly: participatory_process, user: current_user, role: "admin") }
+        it_behaves_like "graphQL visible resource"
+      end
+
+      context "when the user is space collaborator" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:assembly_user_role, assembly: participatory_process, user: current_user, role: "collaborator") }
+        it_behaves_like "graphQL visible resource"
+      end
+
+      context "when the user is space moderator" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:assembly_user_role, assembly: participatory_process, user: current_user, role: "moderator") }
+        it_behaves_like "graphQL hidden component"
+      end
+
+      context "when the user is space valuator" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:assembly_user_role, assembly: participatory_process, user: current_user, role: "valuator") }
+        it_behaves_like "graphQL visible resource"
+      end
+
+      context "when user is visitor" do
+        let!(:current_user) { nil }
+        it_behaves_like "graphQL hidden component"
+      end
+
+      context "when user is normal user" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        it_behaves_like "graphQL hidden component"
+      end
+
+      context "when user is member" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:participatory_space_private_user) { create(:assembly_private_user, user: current_user, privatable_to: participatory_process) }
+        it_behaves_like "graphQL hidden component"
+      end
+    end
+  end
+
+  context "when space is published but private" do
+    let!(:participatory_process) { create(process_space_factory, :published, :private, :with_steps, organization: current_organization) }
+
+    context "when component is published" do
+      let!(:current_component) { create(component_factory, :published, participatory_space: participatory_process) }
+
+      it_behaves_like "graphQL resource visible for admin"
+
+      context "when the user is space admin" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:participatory_process_user_role, participatory_process:, user: current_user, role: "admin") }
+        it_behaves_like "graphQL hidden space"
+      end
+
+      context "when the user is space collaborator" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:participatory_process_user_role, participatory_process:, user: current_user, role: "collaborator") }
+        it_behaves_like "graphQL hidden space"
+      end
+
+      context "when the user is space moderator" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:participatory_process_user_role, participatory_process:, user: current_user, role: "moderator") }
+
+        it_behaves_like "graphQL hidden space"
+      end
+
+      context "when the user is space valuator" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:participatory_process_user_role, participatory_process:, user: current_user, role: "valuator") }
+        it_behaves_like "graphQL hidden space"
+      end
+
+      it_behaves_like "graphQL space hidden to visitor"
+
+      context "when user is normal user" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        it_behaves_like "graphQL hidden space"
+      end
+
+      context "when user is member" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:participatory_space_private_user) { create(:participatory_space_private_user, user: current_user, privatable_to: participatory_process) }
+        it_behaves_like "graphQL visible resource"
+      end
+    end
+
+    context "when component is not published" do
+      let!(:current_component) { create(component_factory, :unpublished, participatory_space: participatory_process) }
+
+      it_behaves_like "graphQL resource visible for admin"
+
+      context "when the user is space admin" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:participatory_process_user_role, participatory_process:, user: current_user, role: "admin") }
+        it_behaves_like "graphQL hidden space"
+      end
+
+      context "when the user is space collaborator" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:participatory_process_user_role, participatory_process:, user: current_user, role: "collaborator") }
+        it_behaves_like "graphQL hidden space"
+      end
+
+      context "when the user is space moderator" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:participatory_process_user_role, participatory_process:, user: current_user, role: "moderator") }
+        it_behaves_like "graphQL hidden space"
+      end
+
+      context "when the user is space valuator" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:participatory_process_user_role, participatory_process:, user: current_user, role: "valuator") }
+        it_behaves_like "graphQL hidden space"
+      end
+      it_behaves_like "graphQL space hidden to visitor"
+
+      context "when user is member" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:participatory_space_private_user) { create(:participatory_space_private_user, user: current_user, privatable_to: participatory_process) }
+        it_behaves_like "graphQL hidden component"
+      end
+      context "when user is normal user" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        it_behaves_like "graphQL hidden space"
+      end
+    end
+  end
+
+  context "when space is unpublished" do
+    let(:participatory_process) { create(process_space_factory, :unpublished, :with_steps, organization: current_organization) }
+
+    context "when component is published" do
+      let!(:current_component) { create(component_factory, :published, participatory_space: participatory_process) }
+
+      it_behaves_like "graphQL resource visible for admin"
+
+      context "when the user is space admin" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:participatory_process_user_role, participatory_process:, user: current_user, role: "admin") }
+        it_behaves_like "graphQL hidden space"
+      end
+
+      context "when the user is space collaborator" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:participatory_process_user_role, participatory_process:, user: current_user, role: "collaborator") }
+        it_behaves_like "graphQL hidden space"
+      end
+
+      context "when the user is space moderator" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:participatory_process_user_role, participatory_process:, user: current_user, role: "moderator") }
+        it_behaves_like "graphQL hidden space"
+      end
+
+      context "when the user is space valuator" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:participatory_process_user_role, participatory_process:, user: current_user, role: "valuator") }
+        it_behaves_like "graphQL hidden space"
+      end
+
+      it_behaves_like "graphQL space hidden to visitor"
+
+      context "when user is member" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:participatory_space_private_user) { create(:participatory_space_private_user, user: current_user, privatable_to: participatory_process) }
+        it_behaves_like "graphQL hidden space"
+      end
+
+      context "when user is normal user" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        it_behaves_like "graphQL hidden space"
+      end
+    end
+
+    context "when component is not published" do
+      let!(:current_component) { create(component_factory, :unpublished, participatory_space: participatory_process) }
+
+      it_behaves_like "graphQL resource visible for admin"
+
+      context "when the user is space admin" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:participatory_process_user_role, participatory_process:, user: current_user, role: "admin") }
+        it_behaves_like "graphQL hidden space"
+      end
+
+      context "when the user is space collaborator" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:participatory_process_user_role, participatory_process:, user: current_user, role: "collaborator") }
+        it_behaves_like "graphQL hidden space"
+      end
+
+      context "when the user is space moderator" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:participatory_process_user_role, participatory_process:, user: current_user, role: "moderator") }
+        it_behaves_like "graphQL hidden space"
+      end
+
+      context "when the user is space valuator" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:role) { create(:participatory_process_user_role, participatory_process:, user: current_user, role: "valuator") }
+        it_behaves_like "graphQL hidden space"
+      end
+      it_behaves_like "graphQL space hidden to visitor"
+
+      context "when user is member" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+        let!(:participatory_space_private_user) { create(:participatory_space_private_user, user: current_user, privatable_to: participatory_process) }
+        it_behaves_like "graphQL hidden space"
+      end
+
+      context "when user is normal user" do
+        let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+
+        it_behaves_like "graphQL hidden space"
+      end
+    end
+  end
+end

data/lib/decidim/api/test/type_context.rb

@@ -2,7 +2,8 @@
 
 shared_context "with a graphql class type" do
   let!(:current_organization) { create(:organization) }
-  let!(:current_user) { create(:user, organization: current_organization) }
+  let!(:current_user) { create(:user, :confirmed, organization: current_organization) }
+  let!(:current_component) { create(:component) }
   let(:model) { OpenStruct.new({}) }
   let(:type_class) { described_class }
   let(:variables) { {} }

data/lib/decidim/api/types/base_object.rb

@@ -5,6 +5,76 @@ module Decidim
     module Types
       class BaseObject < GraphQL::Schema::Object
         field_class Types::BaseField
+
+        def self.authorized?(object, context)
+          chain = []
+
+          subject = determine_subject_name(object)
+          context[subject] = object
+
+          chain.unshift(allowed_to?(:read, :participatory_space, object, context)) if object.respond_to?(:participatory_space)
+          chain.unshift(allowed_to?(:read, :component, object, context)) if object.respond_to?(:component) && object.component.present?
+
+          super && chain.all?
+        end
+
+        def self.determine_subject_name(object)
+          object.class.name.split("::").last.underscore.to_sym
+        end
+
+        # This is a simplified adaptation of allowed_to? from NeedsPermission concern
+        # @param action [Symbol] The action performed. Most cases the action is :read
+        # @param subject [Object] The name of the subject. Ex: :participatory_space, :component, or object
+        # @param object [ActiveModel::Base] The object that is being represented.
+        # @param context [GraphQL::Query::Context] The GraphQL context
+        #
+        # @return Boolean
+        def self.allowed_to?(action, subject, object, context)
+          unless subject.is_a?(::Symbol)
+            subject = determine_subject_name(object)
+            context[subject] = object
+          end
+
+          permission_action = Decidim::PermissionAction.new(scope: :public, action:, subject:)
+
+          permission_chain(object).inject(permission_action) do |current_permission_action, permission_class|
+            permission_class.new(
+              context[:current_user],
+              current_permission_action,
+              local_context(object, context)
+            ).permissions
+          end.allowed?
+        end
+
+        # Injects into context object current_participatory_space and current_component keys as they are needed
+        #
+        # @param object [ActiveModel::Base] The object that is being represented.
+        # @param context [GraphQL::Query::Context] The GraphQL context
+        #
+        # @return Hash
+        def self.local_context(object, context)
+          context[:current_participatory_space] = object.participatory_space if object.respond_to?(:participatory_space)
+          context[:current_component] = object.component if object.respond_to?(:component) && object.component.present?
+
+          context.to_h
+        end
+
+        # Creates the permission chain arrau that contains all the permission classes required to authorize a certain resource
+        # We are using unshift as we need the Admin and base permissions to be last in the chain
+        # @param object [ActiveModel::Base] The object that is being represented.
+        #
+        # @return [Decidim::DefaultPermissions]
+        def self.permission_chain(object)
+          permissions = [
+            Decidim::Admin::Permissions,
+            Decidim::Permissions
+          ]
+
+          permissions.unshift(object.participatory_space.manifest.permissions_class) if object.respond_to?(:participatory_space)
+          permissions.unshift(object.component.manifest.permissions_class) if object.respond_to?(:component) && object.component.present?
+
+          permissions
+        end
       end
     end
   end

data/lib/decidim/api/version.rb

@@ -4,7 +4,7 @@ module Decidim
   # This holds the decidim-api version.
   module Api
     def self.version
-      "0.28.4"
+      "0.28.6"
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: decidim-api
 version: !ruby/object:Gem::Version
-  version: 0.28.4
+  version: 0.28.6
 platform: ruby
 authors:
 - Josep Jaume Rey Peroy
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-10-02 00:00:00.000000000 Z
+date: 2025-04-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: commonmarker
@@ -38,14 +38,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.4
+        version: 0.28.6
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.4
+        version: 0.28.6
 - !ruby/object:Gem::Dependency
   name: graphql
   requirement: !ruby/object:Gem::Requirement
@@ -88,48 +88,62 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: decidim-assemblies
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.28.6
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.28.6
 - !ruby/object:Gem::Dependency
   name: decidim-comments
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.4
+        version: 0.28.6
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.4
+        version: 0.28.6
 - !ruby/object:Gem::Dependency
   name: decidim-dev
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.4
+        version: 0.28.6
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.4
+        version: 0.28.6
 - !ruby/object:Gem::Dependency
   name: decidim-participatory_processes
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.4
+        version: 0.28.6
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.4
+        version: 0.28.6
 description: API engine for decidim
 email:
 - josepjaume@gmail.com
@@ -182,7 +196,7 @@ files:
 - lib/tasks/decidim_api_docs.rake
 homepage: https://decidim.org
 licenses:
-- AGPL-3.0
+- AGPL-3.0-or-later
 metadata:
   bug_tracker_uri: https://github.com/decidim/decidim/issues
   documentation_uri: https://docs.decidim.org/