decidim-api 0.31.6 → 0.31.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 61cb160723618a257df9405aa39500197934046e6082c7fa6d6fe69c74d87135
-  data.tar.gz: 4b3e95e1cbc0c284dd195a5c48527b0784cac902f42e90c1fa1268c290deb3af
+  metadata.gz: 28514d8d25459800a73dd93cb126d49e8c8cab02ce012bf7b3b2ac40f4689bfc
+  data.tar.gz: 43acbee1f49a0fbb17d77f3fdec0221461dd7bbe3dc5569458f9f98921ca92d0
 SHA512:
-  metadata.gz: c19c90f82366f13dd3c70b8b437a5df828a69b832e10c4345a47b6d05651aded1c4dc59d0b787d86b75e53c7f46f7831d84f7a100e979b5d1bc469fc75b0cc19
-  data.tar.gz: b518b8b68e627eff552f84b5b3b9ec8faeda1181c24b777de57b372b825da37bccc54813bd5aaf7b88d064980b807ba0c92a08bb2baf6282686c7f29836cfa99
+  metadata.gz: 67b9f489204276a4c5e5bef80b41beefa8c2b0743097191478fd4d686d4e0fc007097a9db5f096476f7084b66ee55adce70ef157f592bc7004d9123b63f39f8a
+  data.tar.gz: b15628e679475a9ecbdb6582bec1219c8c1397b0d41f3b2cd357236dc9ea14fab7118a4209c4dc25fff555160b9cebc3c71363ba8bbc53e76281d1838a7370b5

data/app/models/concerns/decidim/api/user_extension.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module Decidim
+  module Api
+    # This concern adds the JWT authenticable strategy for the User models to
+    # allow regular users to sign in through the API (if configured from the
+    # system panel). Allows normal users to utilize the API e.g. through mobile
+    # applications.
+    module UserExtension
+      extend ActiveSupport::Concern
+
+      included do
+        devise :jwt_authenticatable, jwt_revocation_strategy: Decidim::Api::JwtDenylist
+      end
+    end
+  end
+end

data/lib/decidim/api/engine.rb

@@ -41,6 +41,45 @@ module Decidim
         end
       end
 
+      initializer "decidim_api.devise", before: "add_routing_paths" do |app|
+        config.to_prepare do
+          Decidim::User.include Decidim::Api::UserExtension
+        end
+
+        # Required for the development environment because otherwise the JWT
+        # authentication strategy would be lost during code reloads.
+        app.reloader.after_class_unload do
+          Decidim::User.include Decidim::Api::UserExtension
+        end
+      end
+
+      initializer "decidim_api.devise_jwt", after: "devise.secret_key" do
+        Devise.jwt do |jwt|
+          # In order to be compatible with the JWT authentication, we need to set these
+          # configurations. JWT secret is being used by the devise-jwt to sign the
+          # tokens, once the user authenticated. The token signature ensures the
+          # validity of the token and that the user has not tampered with it. If the
+          # secret is not set correctly, the API authentication does not work.
+          #
+          # Note that the `dispatch_requests` and `revocation_requests` paths are the
+          # full paths because we do not want the JWT tokens to be dispatched or revoked
+          # during normal Decidim user sign ins or sign outs. This also requires a small
+          # override to `Warden::JWTAuth` which is defined at
+          # `decidim-api/lib/warden/jwt_auth/decidim_overrides.rb`.
+          jwt.secret = Decidim::Env.new("DECIDIM_API_JWT_SECRET").value || Devise.secret_key
+          raise "Please define the secret key for Devise" unless jwt.secret
+
+          jwt.dispatch_requests = [
+            ["POST", %r{^/api/sign_in$}]
+          ]
+          jwt.revocation_requests = [
+            ["DELETE", %r{^/api/sign_out$}]
+          ]
+          jwt.expiration_time = Decidim::Api.jwt_expires_in.minutes.to_i
+          jwt.aud_header = "X_JWT_AUD"
+        end
+      end
+
       initializer "decidim_api.data_migrate", after: "decidim_core.data_migrate" do
         DataMigrate.configure do |config|
           config.data_migrations_path << root.join("db/data").to_s

data/lib/decidim/api/version.rb

@@ -4,7 +4,7 @@ module Decidim
   # This holds the decidim-api version.
   module Api
     def self.version
-      "0.31.6"
+      "0.31.7"
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: decidim-api
 version: !ruby/object:Gem::Version
-  version: 0.31.6
+  version: 0.31.7
 platform: ruby
 authors:
 - Josep Jaume Rey Peroy
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-06 00:00:00.000000000 Z
+date: 2026-07-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: decidim-core
@@ -18,14 +18,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.6
+        version: 0.31.7
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.6
+        version: 0.31.7
 - !ruby/object:Gem::Dependency
   name: devise-jwt
   requirement: !ruby/object:Gem::Requirement
@@ -94,56 +94,56 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.6
+        version: 0.31.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.6
+        version: 0.31.7
 - !ruby/object:Gem::Dependency
   name: decidim-comments
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.6
+        version: 0.31.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.6
+        version: 0.31.7
 - !ruby/object:Gem::Dependency
   name: decidim-dev
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.6
+        version: 0.31.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.6
+        version: 0.31.7
 - !ruby/object:Gem::Dependency
   name: decidim-participatory_processes
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.6
+        version: 0.31.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.6
+        version: 0.31.7
 description: API engine for decidim
 email:
 - josepjaume@gmail.com
@@ -160,6 +160,7 @@ files:
 - app/controllers/decidim/api/graphiql_controller.rb
 - app/controllers/decidim/api/queries_controller.rb
 - app/controllers/decidim/api/sessions_controller.rb
+- app/models/concerns/decidim/api/user_extension.rb
 - app/models/decidim/api/api_user.rb
 - app/models/decidim/api/jwt_denylist.rb
 - app/packs/entrypoints/decidim_api_docs.js
@@ -172,7 +173,6 @@ files:
 - app/views/decidim/api/graphiql/show.html.erb
 - app/views/layouts/decidim/api/documentation.html.erb
 - config/assets.rb
-- config/initializers/devise.rb
 - config/locales/am-ET.yml
 - config/locales/ar.yml
 - config/locales/bg.yml

data/config/initializers/devise.rb

@@ -1,26 +0,0 @@
-# frozen_string_literal: true
-
-Devise.jwt do |jwt|
-  # In order to be compatible with the JWT authentication, we need to set these
-  # configurations. JWT secret is being used by the devise-jwt to sign the
-  # tokens, once the user authenticated. The token signature ensures the
-  # validity of the token and that the user has not tampered with it. If the
-  # secret is not set correctly, the API authentication does not work.
-  #
-  # Note that the `dispatch_requests` and `revocation_requests` paths are the
-  # full paths because we do not want the JWT tokens to be dispatched or revoked
-  # during normal Decidim user sign ins or sign outs. This also requires a small
-  # override to `Warden::JWTAuth` which is defined at
-  # `decidim-api/lib/warden/jwt_auth/decidim_overrides.rb`.
-  jwt.secret = Decidim::Env.new("DECIDIM_API_JWT_SECRET").value
-  next unless jwt.secret
-
-  jwt.dispatch_requests = [
-    ["POST", %r{^/api/sign_in$}]
-  ]
-  jwt.revocation_requests = [
-    ["DELETE", %r{^/api/sign_out$}]
-  ]
-  jwt.expiration_time = Decidim::Api.jwt_expires_in.minutes.to_i
-  jwt.aud_header = "X_JWT_AUD"
-end