decidim-api 0.31.7 → 0.31.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 28514d8d25459800a73dd93cb126d49e8c8cab02ce012bf7b3b2ac40f4689bfc
-  data.tar.gz: 43acbee1f49a0fbb17d77f3fdec0221461dd7bbe3dc5569458f9f98921ca92d0
+  metadata.gz: 000be390e45024f2d1ece4e95cfd630e24a23c9c3fb5358e05238767aa89ca5d
+  data.tar.gz: 36a051e7271e07c8ea618d44e6e0f73c98184e7a275d0b3889d3045fcf3cc4ed
 SHA512:
-  metadata.gz: 67b9f489204276a4c5e5bef80b41beefa8c2b0743097191478fd4d686d4e0fc007097a9db5f096476f7084b66ee55adce70ef157f592bc7004d9123b63f39f8a
-  data.tar.gz: b15628e679475a9ecbdb6582bec1219c8c1397b0d41f3b2cd357236dc9ea14fab7118a4209c4dc25fff555160b9cebc3c71363ba8bbc53e76281d1838a7370b5
+  metadata.gz: 4ebe3978797e8f12fd6e89767d408f52c9b086110a70ceb34c61c6472e0acfbb65e12f6496a4fe188236e59041863340f67c7c74af6ebd4a84a520eba3c68afb
+  data.tar.gz: c7851eccab45b3541e31e63058739cd601e36686fe7e7d4bcc82adf11ac6477e4308a73c667c6150bf17b6e20efafb3ea573e6caa74addfd0a2833800e9a89b3

data/config/locales/cs.yml

@@ -3,5 +3,6 @@ cs:
   decidim:
     api:
       errors:
+        introspection_disabled: Introspekce je pro tento požadavek zakázána
         recursion_limit_exceeded_error: V dotazu bylo zjištěno příliš mnoho rekurzí
         too_many_aliases_error: Příliš mnoho aliasů. Použili jste aliasy %{size}, ale %{limit} jsou povoleny.

data/config/locales/de.yml

@@ -1 +1,8 @@
+---
 de:
+  decidim:
+    api:
+      errors:
+        introspection_disabled: Introspection ist für diese Anfrage deaktiviert
+        recursion_limit_exceeded_error: In der Abfrage wurden zu viele Rekursionen festgestellt
+        too_many_aliases_error: Es wurden zu viele Aliase verwendet. Sie haben %{size} Aliase verwendet, erlaubt sind jedoch nur %{limit}.

data/config/locales/gl.yml

@@ -1 +1,8 @@
+---
 gl:
+  decidim:
+    api:
+      errors:
+        introspection_disabled: A introspección está desactivada para esta solicitude
+        recursion_limit_exceeded_error: Detectáronse demasiadas recursións na consulta
+        too_many_aliases_error: Usáronse demasiados alias. Usaches %{size}, pero só se permiten %{limit}.

data/lib/decidim/api/graphql_permissions.rb

@@ -17,8 +17,8 @@ module Decidim
           subject = determine_subject_name(object)
           context[subject] = object
 
-          chain.unshift(allowed_to?(:read, :participatory_space, object, context)) if object.respond_to?(:participatory_space)
-          chain.unshift(allowed_to?(:read, :component, object, context)) if object.respond_to?(:component) && object.component.present?
+          chain.unshift(allowed_to?(:read, :participatory_space, object.participatory_space, context)) if object.respond_to?(:participatory_space)
+          chain.unshift(allowed_to?(:read, :component, object.component, context)) if object.respond_to?(:component) && object.component.present?
 
           super && chain.all?
         end
@@ -43,12 +43,7 @@ module Decidim
           permission_action = Decidim::PermissionAction.new(scope:, action:, subject:)
 
           permission_chain(object).inject(permission_action) do |current_permission_action, permission_class|
-            permission_context =
-              if scope == :admin
-                local_admin_context(object, context)
-              else
-                local_context(object, context)
-              end
+            permission_context = local_user_context(object, context)
 
             permission_class.new(
               context[:current_user],
@@ -58,25 +53,40 @@ module Decidim
           end.allowed?
         end
 
-        # Injects into context object current_participatory_space and current_component keys as they are needed
+        # Injects into the context the current_participatory_space and current_component keys
+        # for the object being checked, as they are needed by the permission classes.
         #
         # @param object [ActiveModel::Base] The object that is being represented.
         # @param context [GraphQL::Query::Context] The GraphQL context
         #
         # @return Hash
         def local_context(object, context)
-          context[:current_participatory_space] = object.participatory_space if object.respond_to?(:participatory_space)
-          context[:current_component] =
-            if object.is_a?(Decidim::Component)
-              object
-            elsif object.respond_to?(:component)
-              object.component
-            end
+          participatory_space = participatory_space_for(object)
+          component = component_for(object)
+
+          # Always use the associations of the object being checked. The context
+          # is shared by every field in the query, so keeping a previous object's
+          # space could authorize resources from a different space.
+          context[:current_participatory_space] = participatory_space if participatory_space
+          context[:current_component] = component if component
 
           context.to_h
         end
 
-        def local_admin_context(object, context)
+        def participatory_space_for(object)
+          return object.participatory_space if object.respond_to?(:participatory_space)
+          return object if object.is_a?(Decidim::Participable)
+
+          component_for(object)&.participatory_space
+        end
+
+        def component_for(object)
+          return object if object.is_a?(Decidim::Component)
+
+          object.component if object.respond_to?(:component)
+        end
+
+        def local_user_context(object, context)
           context = local_context(object, context)
 
           component = context[:current_component]
@@ -103,7 +113,9 @@ module Decidim
             Decidim::Permissions
           ]
 
-          if object.is_a?(Decidim::Component)
+          if object.is_a?(Decidim::Participable)
+            permissions.unshift(object.manifest.permissions_class)
+          elsif object.is_a?(Decidim::Component)
             permissions.unshift(object.participatory_space.manifest.permissions_class)
             permissions.unshift(object.manifest.permissions_class)
           else

data/lib/decidim/api/test/shared_examples/commentable_interface_examples.rb

@@ -10,4 +10,50 @@ shared_examples_for "commentable interface" do
       expect(response["totalCommentsCount"]).to eq(model.comments_count)
     end
   end
+
+  describe "with comments" do
+    let(:comments) { create_list(:comment, 5, commentable: model) }
+    let(:subcomments_level1) do
+      comments.map do |comment|
+        create_list(:comment, 2, commentable: comment)
+      end.flatten
+    end
+    let!(:subcomments_level2) do
+      subcomments_level1.map do |comment|
+        create(:comment, commentable: comment)
+      end
+    end
+
+    let(:query) do
+      %(
+        {
+          comments {
+            ...dataFragment
+            comments {
+              ...dataFragment
+            }
+          }
+        }
+        fragment dataFragment on Comment {
+          id
+          body
+          createdAt
+          author { name }
+        }
+      )
+    end
+
+    it "includes the comments" do
+      expect(response["comments"]).to be_a(Array)
+      expect(response["comments"].count).to eq(5)
+
+      response["comments"].each do |comment|
+        expect(comment["comments"]).to be_a(Array)
+        expect(comment["comments"].count).to eq(2)
+
+        subcomments = subcomments_level1.select { |c| c.commentable.id == comment["id"].to_i }
+        expect(comment["comments"].map { |c| c["id"].to_i }).to match_array(subcomments.map(&:id))
+      end
+    end
+  end
 end

data/lib/decidim/api/version.rb

@@ -4,7 +4,7 @@ module Decidim
   # This holds the decidim-api version.
   module Api
     def self.version
-      "0.31.7"
+      "0.31.8"
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: decidim-api
 version: !ruby/object:Gem::Version
-  version: 0.31.7
+  version: 0.31.8
 platform: ruby
 authors:
 - Josep Jaume Rey Peroy
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-30 00:00:00.000000000 Z
+date: 2026-10-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: decidim-core
@@ -18,14 +18,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.7
+        version: 0.31.8
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.7
+        version: 0.31.8
 - !ruby/object:Gem::Dependency
   name: devise-jwt
   requirement: !ruby/object:Gem::Requirement
@@ -94,56 +94,56 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.7
+        version: 0.31.8
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.7
+        version: 0.31.8
 - !ruby/object:Gem::Dependency
   name: decidim-comments
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.7
+        version: 0.31.8
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.7
+        version: 0.31.8
 - !ruby/object:Gem::Dependency
   name: decidim-dev
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.7
+        version: 0.31.8
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.7
+        version: 0.31.8
 - !ruby/object:Gem::Dependency
   name: decidim-participatory_processes
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.7
+        version: 0.31.8
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.31.7
+        version: 0.31.8
 description: API engine for decidim
 email:
 - josepjaume@gmail.com