decidim-budgets 0.31.7 → 0.31.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 85cb8b21564209c733beeaf7aa54fa34c8319bb2137d41b4113fbfe407da83ac
-  data.tar.gz: b01ede74db68557f4935b7cd7701079647cb959148b94347664db55ba2fd82cd
+  metadata.gz: 14f59147f08856c838f48d096f69fba830f7e16271b333c844bf3149943074e4
+  data.tar.gz: 32580fdfe06bf959b07e2f15dfea7778cdc9c32863d1bb99d7a433dccabd3cf6
 SHA512:
-  metadata.gz: 31376ff04ffe9ad3daa9993280cfe74df5ad0557e6074754fde3617a0ccef4b5dc78dd48bb32d731ef7ced68911c6147cfbebb92227c20712ef3250ae7a7cb1d
-  data.tar.gz: 1349be9492ae96a4984474d21b6088ea23060a8988173e82d44c2833f64ab39d9969c401d7083bd6b9d242503f93a03493a23e18c06d1479a98dde113a28e3cf
+  metadata.gz: 3064538c7524d637e23291e13846fab908829bdb783660e3ebfb76bc217ba9395900f264152822f387f76e9da7e677cf2eadec0c9560bef5a28834651655f76c
+  data.tar.gz: 23499f8574368f6bca328249804c9dd41aacb0d68409d2b9729e8110a999cd3de23e6542a104b5f8712f47e9f26804d1b233e215b59f5743e94add7cfb2dcbc4

data/app/controllers/concerns/decidim/budgets/needs_current_order.rb

@@ -18,14 +18,6 @@ module Decidim
           @current_order ||= Order.includes(:projects).find_or_initialize_by(user: current_user, budget:)
         end
 
-        def current_order=(order)
-          @current_order = order
-        end
-
-        def persisted_current_order
-          current_order if current_order&.persisted?
-        end
-
         def can_have_order?
           current_user.present? &&
             voting_open? &&
@@ -37,6 +29,16 @@ module Decidim
         def voted_for?(project)
           current_order && current_order.projects.include?(project)
         end
+
+        private
+
+        def current_order=(order)
+          @current_order = order
+        end
+
+        def persisted_current_order
+          current_order if current_order&.persisted?
+        end
       end
     end
   end

data/app/controllers/decidim/budgets/admin/attachment_collections_controller.rb

@@ -8,6 +8,8 @@ module Decidim
       class AttachmentCollectionsController < Admin::ApplicationController
         include Decidim::Admin::Concerns::HasAttachmentCollections
 
+        protected
+
         def after_destroy_path
           project_attachment_collections_path(project, project.component, current_participatory_space)
         end

data/app/controllers/decidim/budgets/admin/attachments_controller.rb

@@ -9,6 +9,8 @@ module Decidim
       class AttachmentsController < Admin::ApplicationController
         include Decidim::Admin::Concerns::HasAttachments
 
+        protected
+
         def after_destroy_path
           budget_projects_path(project.budget)
         end

data/app/controllers/decidim/budgets/admin/budgets_controller.rb

@@ -76,7 +76,7 @@ module Decidim
         end
 
         def orders
-          @orders ||= Order.where(budget: budgets)
+          @orders ||= Order.where(budget: budgets) # rubocop:disable Decidim/OrganizationScopedFinder -- budgets are scoped to current_component above
         end
 
         def pending_orders

data/app/controllers/decidim/budgets/admin/projects_controller.rb

@@ -14,10 +14,6 @@ module Decidim
 
         helper_method :projects, :finished_orders, :pending_orders, :present, :project_ids
 
-        def collection
-          @collection ||= budget.projects.page(params[:page]).per(15)
-        end
-
         def new
           enforce_permission_to :create, :project
           @form = form(ProjectForm).from_params(
@@ -70,7 +66,7 @@ module Decidim
         def update_taxonomies
           enforce_permission_to :update, :project_taxonomy
 
-          UpdateResourcesTaxonomies.call(params[:taxonomies], Decidim::Budgets::Project.where(id: project_ids), current_organization) do
+          UpdateResourcesTaxonomies.call(params[:taxonomies], budget.projects.where(id: project_ids), current_organization) do
             on(:invalid_taxonomies) do
               flash[:error] = I18n.t(
                 "projects.update_taxonomies.select_a_taxonomy",
@@ -162,6 +158,10 @@ module Decidim
 
         private
 
+        def collection
+          @collection ||= budget.projects.page(params[:page]).per(15)
+        end
+
         def trashable_deleted_resource_type
           :project
         end
@@ -179,7 +179,7 @@ module Decidim
         end
 
         def orders
-          @orders ||= Order.where(budget:)
+          @orders ||= Order.where(budget:) # rubocop:disable Decidim/OrganizationScopedFinder -- budget is scoped to current_component in ApplicationController
         end
 
         def project_ids
@@ -189,7 +189,7 @@ module Decidim
         def reference_budget
           return unless params[:reference_id]
 
-          Budget.find(params[:reference_id])
+          Budget.where(component: current_component).find(params.require(:reference_id))
         end
 
         def pending_orders
@@ -203,7 +203,7 @@ module Decidim
         def sample_project
           return if project_ids.empty?
 
-          Decidim::Budgets::Project.find(project_ids.first)
+          budget.projects.find(project_ids.first)
         end
 
         def project

data/app/controllers/decidim/budgets/admin/proposals_imports_controller.rb

@@ -34,7 +34,7 @@ module Decidim
           component = current_participatory_space.components.find_by(id: params[:origin_id])
 
           if component
-            states = Decidim::Proposals::ProposalState
+            states = Decidim::Proposals::ProposalState # rubocop:disable Decidim/OrganizationScopedFinder -- component is scoped above via current_participatory_space
                      .where(component:)
                      .map { |s| { token: s.token, title: translated_attribute(s.title) } }
             states << { token: "not_answered", title: I18n.t("decidim.proposals.answers.not_answered") }

data/app/controllers/decidim/budgets/application_controller.rb

@@ -8,7 +8,7 @@ module Decidim
     # Note that it inherits from `Decidim::Components::BaseController`, which
     # override its layout and provide all kinds of useful methods.
     class ApplicationController < Decidim::Components::BaseController
-      helper_method :current_workflow, :voting_finished?, :voting_open?, :show_votes_count?
+      helper_method :current_workflow, :voting_finished?, :voting_open?, :show_votes_count?, :resource_added?
 
       def current_workflow
         @current_workflow ||= Decidim::Budgets.workflows[workflow_name].new(current_component, current_user)

data/app/controllers/decidim/budgets/budgets_controller.rb

@@ -9,9 +9,13 @@ module Decidim
       include Decidim::Budgets::Orderable
       include Decidim::TranslatableAttributes
 
-      def index; end
+      def index
+        enforce_permission_to :read, :budget
+      end
 
       def show
+        enforce_permission_to(:read, :budget, budget:)
+
         raise ActionController::RoutingError, "Not Found" unless budget
 
         redirect_to budget_projects_path(budget)

data/app/controllers/decidim/budgets/line_items_controller.rb

@@ -35,6 +35,8 @@ module Decidim
       end
 
       def destroy
+        enforce_permission_to :vote, :project, project:, budget:, workflow: current_workflow
+
         respond_to do |format|
           RemoveLineItem.call(current_order, project) do
             on(:ok) do |_order|

data/app/controllers/decidim/budgets/orders_controller.rb

@@ -26,6 +26,8 @@ module Decidim
       end
 
       def destroy
+        enforce_permission_to :destroy, :order, order: current_order
+
         CancelOrder.call(current_order) do
           on(:ok) do
             flash[:notice] = I18n.t("orders.destroy.success", scope: "decidim")
@@ -40,6 +42,8 @@ module Decidim
       end
 
       def status
+        enforce_permission_to :read, :order, order: current_order
+
         redirect_to redirect_path unless current_order.persisted?
       end
 

data/app/controllers/decidim/budgets/projects_controller.rb

@@ -14,12 +14,16 @@ module Decidim
       before_action :set_focus_mode_if_voting_open
 
       def index
+        enforce_permission_to :read, :project
+
         raise ActionController::RoutingError, "Not Found" unless budget
       end
 
       def show
         raise ActionController::RoutingError, "Not Found" unless budget
         raise ActionController::RoutingError, "Not Found" unless project
+
+        enforce_permission_to :read, :project, project:
       end
 
       private

data/app/packs/stylesheets/budgets.scss

@@ -1,6 +1,6 @@
 .budget {
   &-list__map {
-    @apply lg:-ml-16 -mt-6 lg:-mt-12 mb-6 aspect-square lg:aspect-[21/9] [&>*]:h-full [&+*]:mt-6 lg:[&+*]:mt-12;
+    @apply lg:-ml-16 -mt-6 lg:-mt-8 mb-0 lg:mb-4 aspect-square lg:aspect-[21/9] [&>*]:h-full [&+*]:mt-6 lg:[&+*]:mt-12;
   }
 
   &-summary {

data/app/permissions/decidim/budgets/permissions.rb

@@ -4,6 +4,7 @@ module Decidim
   module Budgets
     class Permissions < Decidim::DefaultPermissions
       def permissions
+        return permission_action if permission_action.scope == :public && public_action_allowed?
         return permission_action unless user
 
         # Delegate the admin permission checks to the admin permissions class
@@ -15,12 +16,14 @@ module Decidim
           can_vote?(false) if can_vote_project?(project || order&.projects&.first)
         when [:report, :project]
           permission_action.allow!
-        when [:read, :project]
-          toggle_allow(project.visible?)
         when [:create, :order]
           can_vote?(true)
         when [:export_pdf, :order]
           can_export_pdf?
+        when [:destroy, :order]
+          can_destroy_order?
+        when [:read, :order]
+          can_read_order?
         end
 
         permission_action
@@ -44,6 +47,17 @@ module Decidim
         @workflow ||= context.fetch(:workflow, nil)
       end
 
+      def public_action_allowed?
+        return unless permission_action.action == :read
+
+        case permission_action.subject
+        when :project
+          toggle_allow(project.nil? || (project.visible? && !project.deleted? && !project.budget.deleted?))
+        when :budget
+          toggle_allow(budget.nil? || !budget.deleted?)
+        end
+      end
+
       def can_vote?(active_allow)
         is_allowed = workflow.vote_allowed?(budget)
 
@@ -65,6 +79,18 @@ module Decidim
 
         toggle_allow(is_allowed)
       end
+
+      def can_destroy_order?
+        is_allowed = user.present? &&
+                     order&.user == user &&
+                     current_settings&.votes == "enabled"
+
+        toggle_allow(is_allowed)
+      end
+
+      def can_read_order?
+        toggle_allow(user.present? && order&.user == user)
+      end
     end
   end
 end

data/config/locales/bg.yml

@@ -36,6 +36,7 @@ bg:
     budgets:
       actions:
         edit: Редактирай
+        edit_projects: Добави проекти
         import: Импортиране на предложения в проекти
         new_budget: Нов бюджет
         new_project: Нов проект
@@ -137,6 +138,7 @@ bg:
         cancel_order:
           more_than_one: да изтриете гласа си за %{name} и да започнете отначало
           only_one: изтрийте гласа си и започнете отначало.
+        completed: Приключен
         count:
           one: "%{count} бюджет"
           other: "%{count} бюджети"
@@ -182,6 +184,7 @@ bg:
           subject: Гласувахте в пространството за участие %{space_name}
           voted_on_space: Гласувахте за бюджета %{budget_name} за пространството за участие %{space_name}.
       projects:
+        back_to_budgets: Обратно към проектите
         budget_confirm:
           are_you_sure: Ако размислите, може да промените гласа си по-късно.
           cancel: Отказ
@@ -250,6 +253,7 @@ bg:
           added: Добавено
           all: Всички
         projects_for: Проекти за %{name}
+        select_projects: Добави проекти
         show:
           budget: Бюджет
       prompt: Изберете бюджет

data/config/locales/ca.yml

@@ -368,7 +368,7 @@ ca:
             vote_rule_selected_projects_enabled: 'Activar regla: número mínim i màxim de projectes a votar'
             vote_rule_threshold_percent_enabled: 'Activar norma: percentatge mínim del pressupost'
             vote_selected_projects_maximum: Número màxim de projectes a seleccionar
-            vote_selected_projects_minimum: Número màxim de projectes a seleccionar
+            vote_selected_projects_minimum: Número mínim de projectes a seleccionar
             vote_threshold_percent: Percentatge del pressupost mínim per fer el vot
             voting_rule: Normes per a la votació
             voting_rule_choices:

data/config/locales/de.yml

@@ -145,6 +145,8 @@ de:
             default_budget: Standardbudget
             no_components: Es gibt keine weiteren Vorschlagskomponenten in diesem partizipativen Raum, um die Vorschläge in Projekte zu importieren.
             origin_component_id: Ursprungskomponente
+            proposal_states: Vorschlagsstatus
+            proposal_states_help: Wählen Sie einen oder mehrere Vorschlagsstatus aus, die in Projekte importiert werden sollen. Wenn Sie keinen auswählen, werden alle veröffentlichten Vorschläge importiert, die noch nicht in andere Budgets dieser Komponente importiert wurden.
             select_component: Bitte wählen Sie eine Komponente aus
             title: Vorschläge bei Projekten importieren
         reminders:
@@ -345,6 +347,7 @@ de:
             announcement: Ankündigung
             clear_all: Alles löschen
             comments_enabled: Kommentare aktiviert
+            comments_max_length: Maximale Zeichenanzahl pro Kommentar (0 für Standardwert)
             define_taxonomy_filters: Bitte definieren Sie einige Filter für diesen partizipativen Bereich, bevor Sie diese Einstellung verwenden.
             form:
               errors:
@@ -424,7 +427,7 @@ de:
           id: Die eindeutige Bezeichnung des Projekts
           latitude: Der Breitengrad des Projekts, falls es einen verortet wurde
           longitude: Der Längengrad des Projekts, falls es verortet wurde
-          participatory_space: Zu welchem Bereich dieses Projekt gehört (z.B. Partizipationsprozesse oder Gremien)
+          participatory_space: Zu welchem Bereich dieses Projekt gehört (z.B. Partizipationsprozesse oder Versammlungen)
           reference: Die eindeutige Referenz des Projekts
           related_proposal_titles: Titel der verknüpften Vorschläge
           related_proposal_urls: URLs der verknüpften Vorschläge