decidim-api 0.31.6 → 0.31.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 61cb160723618a257df9405aa39500197934046e6082c7fa6d6fe69c74d87135
-  data.tar.gz: 4b3e95e1cbc0c284dd195a5c48527b0784cac902f42e90c1fa1268c290deb3af
+  metadata.gz: 000be390e45024f2d1ece4e95cfd630e24a23c9c3fb5358e05238767aa89ca5d
+  data.tar.gz: 36a051e7271e07c8ea618d44e6e0f73c98184e7a275d0b3889d3045fcf3cc4ed
 SHA512:
-  metadata.gz: c19c90f82366f13dd3c70b8b437a5df828a69b832e10c4345a47b6d05651aded1c4dc59d0b787d86b75e53c7f46f7831d84f7a100e979b5d1bc469fc75b0cc19
-  data.tar.gz: b518b8b68e627eff552f84b5b3b9ec8faeda1181c24b777de57b372b825da37bccc54813bd5aaf7b88d064980b807ba0c92a08bb2baf6282686c7f29836cfa99
+  metadata.gz: 4ebe3978797e8f12fd6e89767d408f52c9b086110a70ceb34c61c6472e0acfbb65e12f6496a4fe188236e59041863340f67c7c74af6ebd4a84a520eba3c68afb
+  data.tar.gz: c7851eccab45b3541e31e63058739cd601e36686fe7e7d4bcc82adf11ac6477e4308a73c667c6150bf17b6e20efafb3ea573e6caa74addfd0a2833800e9a89b3

data/app/models/concerns/decidim/api/user_extension.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module Decidim
+  module Api
+    # This concern adds the JWT authenticable strategy for the User models to
+    # allow regular users to sign in through the API (if configured from the
+    # system panel). Allows normal users to utilize the API e.g. through mobile
+    # applications.
+    module UserExtension
+      extend ActiveSupport::Concern
+
+      included do
+        devise :jwt_authenticatable, jwt_revocation_strategy: Decidim::Api::JwtDenylist
+      end
+    end
+  end
+end

data/config/locales/cs.yml

@@ -3,5 +3,6 @@ cs:
   decidim:
     api:
       errors:
+        introspection_disabled: Introspekce je pro tento požadavek zakázána
         recursion_limit_exceeded_error: V dotazu bylo zjištěno příliš mnoho rekurzí
         too_many_aliases_error: Příliš mnoho aliasů. Použili jste aliasy %{size}, ale %{limit} jsou povoleny.

data/config/locales/de.yml

@@ -1 +1,8 @@
+---
 de:
+  decidim:
+    api:
+      errors:
+        introspection_disabled: Introspection ist für diese Anfrage deaktiviert
+        recursion_limit_exceeded_error: In der Abfrage wurden zu viele Rekursionen festgestellt
+        too_many_aliases_error: Es wurden zu viele Aliase verwendet. Sie haben %{size} Aliase verwendet, erlaubt sind jedoch nur %{limit}.

data/config/locales/gl.yml

@@ -1 +1,8 @@
+---
 gl:
+  decidim:
+    api:
+      errors:
+        introspection_disabled: A introspección está desactivada para esta solicitude
+        recursion_limit_exceeded_error: Detectáronse demasiadas recursións na consulta
+        too_many_aliases_error: Usáronse demasiados alias. Usaches %{size}, pero só se permiten %{limit}.

data/lib/decidim/api/engine.rb

@@ -41,6 +41,45 @@ module Decidim
         end
       end
 
+      initializer "decidim_api.devise", before: "add_routing_paths" do |app|
+        config.to_prepare do
+          Decidim::User.include Decidim::Api::UserExtension
+        end
+
+        # Required for the development environment because otherwise the JWT
+        # authentication strategy would be lost during code reloads.
+        app.reloader.after_class_unload do
+          Decidim::User.include Decidim::Api::UserExtension
+        end
+      end
+
+      initializer "decidim_api.devise_jwt", after: "devise.secret_key" do
+        Devise.jwt do |jwt|
+          # In order to be compatible with the JWT authentication, we need to set these
+          # configurations. JWT secret is being used by the devise-jwt to sign the
+          # tokens, once the user authenticated. The token signature ensures the
+          # validity of the token and that the user has not tampered with it. If the
+          # secret is not set correctly, the API authentication does not work.
+          #
+          # Note that the `dispatch_requests` and `revocation_requests` paths are the
+          # full paths because we do not want the JWT tokens to be dispatched or revoked
+          # during normal Decidim user sign ins or sign outs. This also requires a small
+          # override to `Warden::JWTAuth` which is defined at
+          # `decidim-api/lib/warden/jwt_auth/decidim_overrides.rb`.
+          jwt.secret = Decidim::Env.new("DECIDIM_API_JWT_SECRET").value || Devise.secret_key
+          raise "Please define the secret key for Devise" unless jwt.secret
+
+          jwt.dispatch_requests = [
+            ["POST", %r{^/api/sign_in$}]
+          ]
+          jwt.revocation_requests = [
+            ["DELETE", %r{^/api/sign_out$}]
+          ]
+          jwt.expiration_time = Decidim::Api.jwt_expires_in.minutes.to_i
+          jwt.aud_header = "X_JWT_AUD"
+        end
+      end
+
       initializer "decidim_api.data_migrate", after: "decidim_core.data_migrate" do
         DataMigrate.configure do |config|
           config.data_migrations_path << root.join("db/data").to_s

data/lib/decidim/api/graphql_permissions.rb

@@ -17,8 +17,8 @@ module Decidim
           subject = determine_subject_name(object)
           context[subject] = object
 
-          chain.unshift(allowed_to?(:read, :participatory_space, object, context)) if object.respond_to?(:participatory_space)
-          chain.unshift(allowed_to?(:read, :component, object, context)) if object.respond_to?(:component) && object.component.present?
+          chain.unshift(allowed_to?(:read, :participatory_space, object.participatory_space, context)) if object.respond_to?(:participatory_space)
+          chain.unshift(allowed_to?(:read, :component, object.component, context)) if object.respond_to?(:component) && object.component.present?
 
           super && chain.all?
         end
@@ -43,12 +43,7 @@ module Decidim
           permission_action = Decidim::PermissionAction.new(scope:, action:, subject:)
 
           permission_chain(object).inject(permission_action) do |current_permission_action, permission_class|
-            permission_context =
-              if scope == :admin
-                local_admin_context(object, context)
-              else
-                local_context(object, context)
-              end
+            permission_context = local_user_context(object, context)
 
             permission_class.new(
               context[:current_user],
@@ -58,25 +53,40 @@ module Decidim
           end.allowed?
         end
 
-        # Injects into context object current_participatory_space and current_component keys as they are needed
+        # Injects into the context the current_participatory_space and current_component keys
+        # for the object being checked, as they are needed by the permission classes.
         #
         # @param object [ActiveModel::Base] The object that is being represented.
         # @param context [GraphQL::Query::Context] The GraphQL context
         #
         # @return Hash
         def local_context(object, context)
-          context[:current_participatory_space] = object.participatory_space if object.respond_to?(:participatory_space)
-          context[:current_component] =
-            if object.is_a?(Decidim::Component)
-              object
-            elsif object.respond_to?(:component)
-              object.component
-            end
+          participatory_space = participatory_space_for(object)
+          component = component_for(object)
+
+          # Always use the associations of the object being checked. The context
+          # is shared by every field in the query, so keeping a previous object's
+          # space could authorize resources from a different space.
+          context[:current_participatory_space] = participatory_space if participatory_space
+          context[:current_component] = component if component
 
           context.to_h
         end
 
-        def local_admin_context(object, context)
+        def participatory_space_for(object)
+          return object.participatory_space if object.respond_to?(:participatory_space)
+          return object if object.is_a?(Decidim::Participable)
+
+          component_for(object)&.participatory_space
+        end
+
+        def component_for(object)
+          return object if object.is_a?(Decidim::Component)
+
+          object.component if object.respond_to?(:component)
+        end
+
+        def local_user_context(object, context)
           context = local_context(object, context)
 
           component = context[:current_component]
@@ -103,7 +113,9 @@ module Decidim
             Decidim::Permissions
           ]
 
-          if object.is_a?(Decidim::Component)
+          if object.is_a?(Decidim::Participable)
+            permissions.unshift(object.manifest.permissions_class)
+          elsif object.is_a?(Decidim::Component)
             permissions.unshift(object.participatory_space.manifest.permissions_class)
             permissions.unshift(object.manifest.permissions_class)
           else

data/lib/decidim/api/test/shared_examples/commentable_interface_examples.rb

@@ -10,4 +10,50 @@ shared_examples_for "commentable interface" do
       expect(response["totalCommentsCount"]).to eq(model.comments_count)
     end
   end
+
+  describe "with comments" do
+    let(:comments) { create_list(:comment, 5, commentable: model) }
+    let(:subcomments_level1) do
+      comments.map do |comment|
+        create_list(:comment, 2, commentable: comment)
+      end.flatten
+    end
+    let!(:subcomments_level2) do
+      subcomments_level1.map do |comment|
+        create(:comment, commentable: comment)
+      end
+    end
+
+    let(:query) do
+      %(
+        {
+          comments {
+            ...dataFragment
+            comments {
+              ...dataFragment
+            }
+          }
+        }
+        fragment dataFragment on Comment {
+          id
+          body
+          createdAt
+          author { name }
+        }
+      )
+    end
+
+    it "includes the comments" do
+      expect(response["comments"]).to be_a(Array)
+      expect(response["comments"].count).to eq(5)
+
+      response["comments"].each do |comment|
+        expect(comment["comments"]).to be_a(Array)
+        expect(comment["comments"].count).to eq(2)
+
+        subcomments = subcomments_level1.select { |c| c.commentable.id == comment["id"].to_i }
+        expect(comment["comments"].map { |c| c["id"].to_i }).to match_array(subcomments.map(&:id))
+      end
+    end
+  end
 end

data/lib/decidim/api/version.rb

@@ -4,7 +4,7 @@ module Decidim
   # This holds the decidim-api version.
   module Api
     def self.version
-      "0.31.6"
+      "0.31.8"
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: decidim-api
 version: !ruby/object:Gem::Version
-  version: 0.31.6
+  version: 0.31.8
 platform: ruby
 authors:
 - Josep Jaume Rey Peroy
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-06 00:00:00.000000000 Z
+date: 2026-10-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: decidim-core
@@ -18,14 +18,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.6
+        version: 0.31.8
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.6
+        version: 0.31.8
 - !ruby/object:Gem::Dependency
   name: devise-jwt
   requirement: !ruby/object:Gem::Requirement
@@ -94,56 +94,56 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.6
+        version: 0.31.8
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.6
+        version: 0.31.8
 - !ruby/object:Gem::Dependency
   name: decidim-comments
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.6
+        version: 0.31.8
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.6
+        version: 0.31.8
 - !ruby/object:Gem::Dependency
   name: decidim-dev
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.6
+        version: 0.31.8
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.6
+        version: 0.31.8
 - !ruby/object:Gem::Dependency
   name: decidim-participatory_processes
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.6
+        version: 0.31.8
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.6
+        version: 0.31.8
 description: API engine for decidim
 email:
 - josepjaume@gmail.com
@@ -160,6 +160,7 @@ files:
 - app/controllers/decidim/api/graphiql_controller.rb
 - app/controllers/decidim/api/queries_controller.rb
 - app/controllers/decidim/api/sessions_controller.rb
+- app/models/concerns/decidim/api/user_extension.rb
 - app/models/decidim/api/api_user.rb
 - app/models/decidim/api/jwt_denylist.rb
 - app/packs/entrypoints/decidim_api_docs.js
@@ -172,7 +173,6 @@ files:
 - app/views/decidim/api/graphiql/show.html.erb
 - app/views/layouts/decidim/api/documentation.html.erb
 - config/assets.rb
-- config/initializers/devise.rb
 - config/locales/am-ET.yml
 - config/locales/ar.yml
 - config/locales/bg.yml

data/config/initializers/devise.rb

@@ -1,26 +0,0 @@
-# frozen_string_literal: true
-
-Devise.jwt do |jwt|
-  # In order to be compatible with the JWT authentication, we need to set these
-  # configurations. JWT secret is being used by the devise-jwt to sign the
-  # tokens, once the user authenticated. The token signature ensures the
-  # validity of the token and that the user has not tampered with it. If the
-  # secret is not set correctly, the API authentication does not work.
-  #
-  # Note that the `dispatch_requests` and `revocation_requests` paths are the
-  # full paths because we do not want the JWT tokens to be dispatched or revoked
-  # during normal Decidim user sign ins or sign outs. This also requires a small
-  # override to `Warden::JWTAuth` which is defined at
-  # `decidim-api/lib/warden/jwt_auth/decidim_overrides.rb`.
-  jwt.secret = Decidim::Env.new("DECIDIM_API_JWT_SECRET").value
-  next unless jwt.secret
-
-  jwt.dispatch_requests = [
-    ["POST", %r{^/api/sign_in$}]
-  ]
-  jwt.revocation_requests = [
-    ["DELETE", %r{^/api/sign_out$}]
-  ]
-  jwt.expiration_time = Decidim::Api.jwt_expires_in.minutes.to_i
-  jwt.aud_header = "X_JWT_AUD"
-end