decidim-api 0.30.2 → 0.31.0.rc1

data/lib/decidim/api/types/base_object.rb

@@ -4,77 +4,12 @@ module Decidim
   module Api
     module Types
       class BaseObject < GraphQL::Schema::Object
-        field_class Types::BaseField
-
-        def self.authorized?(object, context)
-          chain = []
-
-          subject = determine_subject_name(object)
-          context[subject] = object
-
-          chain.unshift(allowed_to?(:read, :participatory_space, object, context)) if object.respond_to?(:participatory_space)
-          chain.unshift(allowed_to?(:read, :component, object, context)) if object.respond_to?(:component) && object.component.present?
-
-          super && chain.all?
-        end
-
-        def self.determine_subject_name(object)
-          object.class.name.split("::").last.underscore.to_sym
-        end
-
-        # This is a simplified adaptation of allowed_to? from NeedsPermission concern
-        # @param action [Symbol] The action performed. Most cases the action is :read
-        # @param subject [Object] The name of the subject. Ex: :participatory_space, :component, or object
-        # @param object [ActiveModel::Base] The object that is being represented.
-        # @param context [GraphQL::Query::Context] The GraphQL context
-        #
-        # @return Boolean
-        def self.allowed_to?(action, subject, object, context)
-          unless subject.is_a?(::Symbol)
-            subject = determine_subject_name(object)
-            context[subject] = object
-          end
+        include Decidim::Api::RequiredScopes
+        include Decidim::Api::GraphqlPermissions
 
-          permission_action = Decidim::PermissionAction.new(scope: :public, action:, subject:)
-
-          permission_chain(object).inject(permission_action) do |current_permission_action, permission_class|
-            permission_class.new(
-              context[:current_user],
-              current_permission_action,
-              local_context(object, context)
-            ).permissions
-          end.allowed?
-        end
-
-        # Injects into context object current_participatory_space and current_component keys as they are needed
-        #
-        # @param object [ActiveModel::Base] The object that is being represented.
-        # @param context [GraphQL::Query::Context] The GraphQL context
-        #
-        # @return Hash
-        def self.local_context(object, context)
-          context[:current_participatory_space] = object.participatory_space if object.respond_to?(:participatory_space)
-          context[:current_component] = object.component if object.respond_to?(:component) && object.component.present?
-
-          context.to_h
-        end
-
-        # Creates the permission chain arrau that contains all the permission classes required to authorize a certain resource
-        # We are using unshift as we need the Admin and base permissions to be last in the chain
-        # @param object [ActiveModel::Base] The object that is being represented.
-        #
-        # @return [Decidim::DefaultPermissions]
-        def self.permission_chain(object)
-          permissions = [
-            Decidim::Admin::Permissions,
-            Decidim::Permissions
-          ]
-
-          permissions.unshift(object.participatory_space.manifest.permissions_class) if object.respond_to?(:participatory_space)
-          permissions.unshift(object.component.manifest.permissions_class) if object.respond_to?(:component) && object.component.present?
+        field_class Types::BaseField
 
-          permissions
-        end
+        required_scopes "api:read"
       end
     end
   end

data/lib/decidim/api/types.rb

@@ -5,6 +5,9 @@ module Decidim
     autoload :QueryType, "decidim/api/query_type"
     autoload :MutationType, "decidim/api/mutation_type"
     autoload :Schema, "decidim/api/schema"
+    autoload :RequiredScopes, "decidim/api/required_scopes"
+    autoload :GraphqlPermissions, "decidim/api/graphql_permissions"
+    autoload :ComponentMutationType, "decidim/api/component_mutation_type"
 
     module Types
       autoload :BaseArgument, "decidim/api/types/base_argument"

data/lib/decidim/api/version.rb

@@ -4,7 +4,7 @@ module Decidim
   # This holds the decidim-api version.
   module Api
     def self.version
-      "0.30.2"
+      "0.31.0.rc1"
     end
   end
 end

data/lib/decidim/api.rb

@@ -1,7 +1,11 @@
 # frozen_string_literal: true
 
+require "devise/jwt"
+require "warden/jwt_auth/decidim_overrides"
+require "decidim/env"
 require "decidim/api/engine"
 require "decidim/api/types"
+require "decidim/api/devise"
 
 module Decidim
   # This module holds all business logic related to exposing a Public API for
@@ -11,27 +15,43 @@ module Decidim
 
     # defines the schema max_per_page to configure GraphQL pagination
     config_accessor :schema_max_per_page do
-      50
+      Decidim::Env.new("API_SCHEMA_MAX_PER_PAGE", 50).to_i
     end
 
     # defines the schema max_complexity to configure GraphQL query complexity
     config_accessor :schema_max_complexity do
-      5000
+      Decidim::Env.new("API_SCHEMA_MAX_COMPLEXITY", 5000).to_i
     end
 
     # defines the schema max_depth to configure GraphQL query max_depth
     config_accessor :schema_max_depth do
-      15
+      Decidim::Env.new("API_SCHEMA_MAX_DEPTH", 15).to_i
     end
 
     config_accessor :disclose_system_version do
-      %w(1 true yes).include?(ENV.fetch("DECIDIM_API_DISCLOSE_SYSTEM_VERSION", nil))
+      Decidim::Env.new("DECIDIM_API_DISCLOSE_SYSTEM_VERSION").present?
+    end
+
+    # Public Setting that can make the API authentication necessary in order to
+    # access it.
+    config_accessor :force_api_authentication do
+      Decidim::Env.new("DECIDIM_API_FORCE_API_AUTHENTICATION", nil).present?
+    end
+
+    # The expiration time of the JWT tokens, after which issued token will
+    # expire. Recommended to match the value of
+    # `DECIDIM_OAUTH_ACCESS_TOKEN_EXPIRES_IN`.
+    config_accessor :jwt_expires_in do
+      Decidim::Env.new(
+        "DECIDIM_API_JWT_EXPIRES_IN",
+        Decidim::Env.new("DECIDIM_OAUTH_ACCESS_TOKEN_EXPIRES_IN", "120").value
+      ).to_i
     end
 
     # This declares all the types an interface or union can resolve to. This needs
     # to be done in order to be able to have them found. This is a shortcoming of
     # graphql-ruby and the way it deals with loading types, in combination with
-    # rail's infamous autoloading.
+    # rail's infamous auto-loading.
     def self.orphan_types
       Decidim.component_manifests.map(&:query_type).map(&:constantize).uniq +
         Decidim.participatory_space_manifests.map(&:query_type).map(&:constantize).uniq +

data/lib/devise/models/api_authenticatable.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Devise
+  module Models
+    module ApiAuthenticatable
+      extend ActiveSupport::Concern
+
+      def api_secret=(new_secret)
+        self.encrypted_password = ::Devise::Encryptor.digest(self.class, new_secret)
+      end
+
+      # Verifies whether a secret (ie from sign in) matches the user's secret.
+      def valid_api_secret?(secret)
+        Devise::Encryptor.compare(self.class, encrypted_password, secret)
+      end
+
+      module ClassMethods
+        Devise::Models.config(self, :pepper, :stretches)
+
+        def authentication_keys
+          [:key, :secret]
+        end
+
+        def find_for_api_authentication(conditions)
+          find_for_authentication(conditions)
+        end
+      end
+    end
+  end
+end

data/lib/devise/strategies/api_authenticatable.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require "devise/strategies/authenticatable"
+
+module Devise
+  module Strategies
+    class ApiAuthenticatable < Authenticatable
+      def authenticate!
+        key = authentication_hash[:key]
+        secret = authentication_hash[:secret]
+
+        resource = mapping.to.find_for_api_authentication(api_key: key)
+        validation_status = validate(resource) { resource.valid_api_secret?(secret) }
+
+        success!(resource) if validation_status
+      end
+    end
+  end
+end
+
+Warden::Strategies.add(:api_authenticatable, Devise::Strategies::ApiAuthenticatable)

data/lib/warden/jwt_auth/decidim_overrides.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module Warden
+  module JWTAuth
+    # This module adds some overrides to Warde::JWTAuth due to some issues with
+    # how it needs to be setup.
+    module EnvHelper
+      # Returns ORIGINAL_FULLPATH, REQUEST_PATH or REQUEST_URI environment
+      # variable, which is different from the original version returning the
+      # PATH_INFO environment variable.
+      #
+      # This is overridden because the `PATH_INFO` string only includes the
+      # route under the engine where it is defined, i.e. `/sign_in` and
+      # `/sign_out` which are defined under the `Decidim::Api`.
+      #
+      # Instead, we want this method to return the full path, i.e.
+      # `/api/sign_in` and `/api/sign_out` in order to map these routes
+      # correctly as the JWT token dispatch and revocation routes. Otherwise the
+      # token would be dispatched and revoked also with normal user sign in and
+      # sign out requests under the `Decidim::Core` engine which we do not want.
+      #
+      # This affects the Devise::JWT / Warden::JWTAuth configuration that is
+      # defined at `decidim-api/config/initializers/devise.rb` (as
+      # `config.jwt`).
+      #
+      # The return value is only used by Warden::JWTAuth to check when the token
+      # should be dispatched or revoked for the user, nothing else.
+      #
+      # Note that this behaves slightly differently during controller testing
+      # and when the application is actually running under Rack. The end result
+      # is the same but some of the environment variables may be missing during
+      # controller testing (e.g. `REQUEST_PATH` is not defined under that
+      # situation).
+      #
+      # @param env [Hash] Rack env
+      # @return [String]
+      def self.path_info(env)
+        env["ORIGINAL_FULLPATH"] || env["REQUEST_PATH"] || env["REQUEST_URI"] || ""
+      end
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: decidim-api
 version: !ruby/object:Gem::Version
-  version: 0.30.2
+  version: 0.31.0.rc1
 platform: ruby
 authors:
 - Josep Jaume Rey Peroy
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-09-23 00:00:00.000000000 Z
+date: 2025-09-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: decidim-core
@@ -18,14 +18,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.30.2
+        version: 0.31.0.rc1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.30.2
+        version: 0.31.0.rc1
+- !ruby/object:Gem::Dependency
+  name: devise-jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.12.1
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.12.1
 - !ruby/object:Gem::Dependency
   name: graphql
   requirement: !ruby/object:Gem::Requirement
@@ -33,6 +47,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 2.4.0
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.4.17
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -40,6 +57,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 2.4.0
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.4.17
 - !ruby/object:Gem::Dependency
   name: graphql-docs
   requirement: !ruby/object:Gem::Requirement
@@ -74,56 +94,56 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.30.2
+        version: 0.31.0.rc1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.30.2
+        version: 0.31.0.rc1
 - !ruby/object:Gem::Dependency
   name: decidim-comments
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.30.2
+        version: 0.31.0.rc1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.30.2
+        version: 0.31.0.rc1
 - !ruby/object:Gem::Dependency
   name: decidim-dev
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.30.2
+        version: 0.31.0.rc1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.30.2
+        version: 0.31.0.rc1
 - !ruby/object:Gem::Dependency
   name: decidim-participatory_processes
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.30.2
+        version: 0.31.0.rc1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.30.2
+        version: 0.31.0.rc1
 description: API engine for decidim
 email:
 - josepjaume@gmail.com
@@ -139,28 +159,59 @@ files:
 - app/controllers/decidim/api/documentation_controller.rb
 - app/controllers/decidim/api/graphiql_controller.rb
 - app/controllers/decidim/api/queries_controller.rb
+- app/controllers/decidim/api/sessions_controller.rb
+- app/models/decidim/api/api_user.rb
+- app/models/decidim/api/jwt_denylist.rb
 - app/packs/entrypoints/decidim_api_docs.js
 - app/packs/entrypoints/decidim_api_docs.scss
 - app/packs/entrypoints/decidim_api_graphiql.js
 - app/packs/entrypoints/decidim_api_graphiql.scss
+- app/presenters/decidim/api/api_user_presenter.rb
 - app/views/decidim/api/documentation/graphql_docs_template.html.erb
 - app/views/decidim/api/documentation/show.html.erb
 - app/views/decidim/api/graphiql/show.html.erb
 - app/views/layouts/decidim/api/documentation.html.erb
 - config/assets.rb
+- config/initializers/devise.rb
 - config/routes.rb
 - decidim-api.gemspec
 - docs/usage.md
 - lib/decidim/api.rb
+- lib/decidim/api/component_mutation_type.rb
+- lib/decidim/api/devise.rb
 - lib/decidim/api/engine.rb
 - lib/decidim/api/graphiql-initial-query.txt
 - lib/decidim/api/graphiql/config.rb
+- lib/decidim/api/graphql_permissions.rb
 - lib/decidim/api/mutation_type.rb
 - lib/decidim/api/query_type.rb
+- lib/decidim/api/required_scopes.rb
 - lib/decidim/api/schema.rb
 - lib/decidim/api/test.rb
 - lib/decidim/api/test/component_context.rb
+- lib/decidim/api/test/factories.rb
+- lib/decidim/api/test/mutation_context.rb
+- lib/decidim/api/test/shared_examples/amendable_interface_examples.rb
+- lib/decidim/api/test/shared_examples/amendable_proposals_interface_examples.rb
+- lib/decidim/api/test/shared_examples/attachable_interface_examples.rb
+- lib/decidim/api/test/shared_examples/authorable_interface_examples.rb
+- lib/decidim/api/test/shared_examples/categories_container_examples.rb
+- lib/decidim/api/test/shared_examples/categorizable_interface_examples.rb
+- lib/decidim/api/test/shared_examples/coauthorable_interface_examples.rb
+- lib/decidim/api/test/shared_examples/commentable_interface_examples.rb
+- lib/decidim/api/test/shared_examples/fingerprintable_interface_examples.rb
+- lib/decidim/api/test/shared_examples/followable_interface_examples.rb
+- lib/decidim/api/test/shared_examples/input_filter_examples.rb
+- lib/decidim/api/test/shared_examples/input_sort_examples.rb
+- lib/decidim/api/test/shared_examples/likeable_interface_examples.rb
+- lib/decidim/api/test/shared_examples/localizable_interface_examples.rb
+- lib/decidim/api/test/shared_examples/participatory_space_resourcable_interface_examples.rb
+- lib/decidim/api/test/shared_examples/referable_interface_examples.rb
+- lib/decidim/api/test/shared_examples/scopable_interface_examples.rb
 - lib/decidim/api/test/shared_examples/statistics_examples.rb
+- lib/decidim/api/test/shared_examples/taxonomizable_interface_examples.rb
+- lib/decidim/api/test/shared_examples/timestamps_interface_examples.rb
+- lib/decidim/api/test/shared_examples/traceable_interface_examples.rb
 - lib/decidim/api/test/type_context.rb
 - lib/decidim/api/types.rb
 - lib/decidim/api/types/base_argument.rb
@@ -173,7 +224,10 @@ files:
 - lib/decidim/api/types/base_scalar.rb
 - lib/decidim/api/types/base_union.rb
 - lib/decidim/api/version.rb
+- lib/devise/models/api_authenticatable.rb
+- lib/devise/strategies/api_authenticatable.rb
 - lib/tasks/decidim_api_docs.rake
+- lib/warden/jwt_auth/decidim_overrides.rb
 homepage: https://decidim.org
 licenses:
 - AGPL-3.0-or-later