decidim-core 0.11.2 → 0.12.0.pre

data/config/routes.rb

@@ -39,7 +39,7 @@ Decidim::Core::Engine.routes.draw do
       end
     end
     resources :conversations, only: [:new, :create, :index, :show, :update], controller: "messaging/conversations"
-    resources :notifications, only: [:index, :destroy] do
+    resources :notifications, only: [:destroy] do
       collection do
         delete :read_all
       end
@@ -49,13 +49,23 @@ Decidim::Core::Engine.routes.draw do
   end
 
   resources :profiles, only: [:show], param: :nickname
+  scope "/profiles/:nickname" do
+    get "notifications", to: "profiles#show", as: "profile_notifications", active: "notifications"
+    get "following", to: "profiles#show", as: "profile_following", active: "following"
+    get "followers", to: "profiles#show", as: "profile_followers", active: "followers"
+  end
 
   resources :pages, only: [:index, :show], format: false
 
+  get "/search", to: "searches#index", as: :search
+
+  get :organization_users, to: "users#index"
+
   get "/scopes/picker", to: "scopes#picker", as: :scopes_picker
 
   get "/static_map", to: "static_map#show", as: :static_map
   get "/cookies/accept", to: "cookie_policy#accept", as: :accept_cookies
+  put "/pages/terms-and-conditions/accept", to: "tos#accept_tos", as: :accept_tos
 
   match "/404", to: "errors#not_found", via: :all
   match "/500", to: "errors#internal_server_error", via: :all

data/db/migrate/20180209122819_create_decidim_searchable_resource.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+class CreateDecidimSearchableResource < ActiveRecord::Migration[5.1]
+  def change
+    create_table :decidim_searchable_resources do |t|
+      t.text :content_a
+      t.text :content_b
+      t.text :content_c
+      t.text :content_d
+      t.string :locale, null: false
+      t.datetime :datetime
+
+      t.belongs_to :decidim_scope
+      t.belongs_to :decidim_participatory_space, polymorphic: true, index: { name: "index_decidim_searchable_resource_on_pspace_type_and_pspace_id" }
+      t.belongs_to :decidim_organization
+
+      t.belongs_to :resource, polymorphic: true, index: { name: "index_decidim_searchable_rsrcs_on_s_type_and_s_id" }
+      t.timestamps null: false
+    end
+  end
+end

data/db/migrate/20180508111640_add_tos_version_to_organization.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+class AddTosVersionToOrganization < ActiveRecord::Migration[5.1]
+  class Organization < ApplicationRecord
+    self.table_name = :decidim_organizations
+  end
+
+  def up
+    add_column :decidim_organizations, :tos_version, :datetime
+    Organization.find_each do |organization|
+      tos_version = Decidim::StaticPage.find_by(slug: "terms-and-conditions", organization: organization).updated_at
+      organization.update(tos_version: tos_version)
+    end
+  end
+
+  def down
+    remove_columns :decidim_organizations, :tos_version
+  end
+end

data/db/migrate/20180508111710_add_accepted_tos_version_field_to_users.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+class AddAcceptedTosVersionFieldToUsers < ActiveRecord::Migration[5.1]
+  class Organization < ApplicationRecord
+    self.table_name = :decidim_organizations
+    has_many :users, foreign_key: "decidim_organization_id", class_name: "Decidim::User", dependent: :destroy
+  end
+  class User < ApplicationRecord
+    self.table_name = :decidim_users
+    belongs_to :organization, foreign_key: "decidim_organization_id", class_name: "Decidim::Organization"
+  end
+
+  def up
+    add_column :decidim_users, :accepted_tos_version, :datetime
+    Organization.find_each do |organization|
+      # rubocop:disable Rails/SkipsModelValidations
+      organization.users.update_all(accepted_tos_version: organization.tos_version)
+      # rubocop:enable Rails/SkipsModelValidations
+    end
+  end
+
+  def down
+    remove_columns :decidim_users, :accepted_tos_version
+  end
+end

data/db/seeds.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 if !Rails.env.production? || ENV["SEED"]
+  print "Creating seeds for decidim-core...\n" unless Rails.env.test?
+
   require "decidim/faker/localized"
 
   seeds_root = File.join(__dir__, "seeds")
@@ -21,37 +23,40 @@ if !Rails.env.production? || ENV["SEED"]
     default_locale: Decidim.default_locale,
     available_locales: Decidim.available_locales,
     reference_prefix: Faker::Name.suffix,
-    available_authorizations: Decidim.authorization_workflows.map(&:name)
+    available_authorizations: Decidim.authorization_workflows.map(&:name),
+    tos_version: Time.current
   )
 
-  province = Decidim::ScopeType.create!(
-    name: Decidim::Faker::Localized.literal("province"),
-    plural: Decidim::Faker::Localized.literal("provinces"),
-    organization: organization
-  )
-
-  municipality = Decidim::ScopeType.create!(
-    name: Decidim::Faker::Localized.literal("municipality"),
-    plural: Decidim::Faker::Localized.literal("municipalities"),
-    organization: organization
-  )
+  if organization.top_scopes.none?
+    province = Decidim::ScopeType.create!(
+      name: Decidim::Faker::Localized.literal("province"),
+      plural: Decidim::Faker::Localized.literal("provinces"),
+      organization: organization
+    )
 
-  3.times do
-    parent = Decidim::Scope.create!(
-      name: Decidim::Faker::Localized.literal(Faker::Address.unique.state),
-      code: Faker::Address.unique.country_code,
-      scope_type: province,
+    municipality = Decidim::ScopeType.create!(
+      name: Decidim::Faker::Localized.literal("municipality"),
+      plural: Decidim::Faker::Localized.literal("municipalities"),
       organization: organization
     )
 
-    5.times do
-      Decidim::Scope.create!(
-        name: Decidim::Faker::Localized.literal(Faker::Address.unique.city),
-        code: parent.code + "-" + Faker::Address.unique.state_abbr,
-        scope_type: municipality,
-        organization: organization,
-        parent: parent
+    3.times do
+      parent = Decidim::Scope.create!(
+        name: Decidim::Faker::Localized.literal(Faker::Address.unique.state),
+        code: Faker::Address.unique.country_code,
+        scope_type: province,
+        organization: organization
       )
+
+      5.times do
+        Decidim::Scope.create!(
+          name: Decidim::Faker::Localized.literal(Faker::Address.unique.city),
+          code: parent.code + "-" + Faker::Address.unique.state_abbr,
+          scope_type: municipality,
+          organization: organization,
+          parent: parent
+        )
+      end
     end
   end
 
@@ -96,7 +101,8 @@ if !Rails.env.production? || ENV["SEED"]
     admin: true,
     tos_agreement: true,
     personal_url: Faker::Internet.url,
-    about: Faker::Lorem.paragraph(2)
+    about: Faker::Lorem.paragraph(2),
+    accepted_tos_version: organization.tos_version
   )
 
   regular_user = Decidim::User.find_or_initialize_by(email: "user@example.org")
@@ -111,7 +117,8 @@ if !Rails.env.production? || ENV["SEED"]
     organization: organization,
     tos_agreement: true,
     personal_url: Faker::Internet.url,
-    about: Faker::Lorem.paragraph(2)
+    about: Faker::Lorem.paragraph(2),
+    accepted_tos_version: organization.tos_version
   )
 
   Decidim::Messaging::Conversation.start!(

data/lib/decidim/component_manifest.rb

@@ -46,8 +46,9 @@ module Decidim
     # as well that allows checking for those permissions.
     attribute :actions, Array[String]
 
-    # The cell path to use to render the card of a resource.
-    attribute :card, String
+    # The name of the class that handles the permissions for this component. It will
+    # probably have the form of `Decidim::<MyComponent>::Permissions`.
+    attribute :permissions_class_name, String, default: "Decidim::DefaultPermissions"
 
     validates :name, presence: true
 
@@ -98,6 +99,7 @@ module Decidim
     #
     # Returns nothing.
     def seed!(participatory_space)
+      print "-- Creating #{name} component seeds for the participatory space with ID: #{participatory_space.id}...\n" unless Rails.env.test?
       @seeds&.call(participatory_space)
     end
 
@@ -122,23 +124,6 @@ module Decidim
       settings
     end
 
-    # Public: Registers a resource inside a component manifest. Exposes a DSL
-    # defined by `Decidim::ResourceManifest`.
-    #
-    # Resource manifests are a way to expose a resource from one engine to
-    # the whole system. This was resoruces can be linked between them.
-    #
-    # block - A Block that will be called to set the Resource attributes.
-    #
-    # Returns nothing.
-    def register_resource
-      manifest = ResourceManifest.new
-      manifest.component_manifest = self
-      yield(manifest)
-      manifest.validate!
-      resource_manifests << manifest
-    end
-
     # Public: Registers an export artifact with a name and its properties
     # defined in `Decidim::Components::ExportManifest`.
     #
@@ -169,14 +154,6 @@ module Decidim
       end
     end
 
-    # Public: Finds all the registered resource manifest's via the
-    # `register_resource` method.
-    #
-    # Returns an Array[ResourceManifest].
-    def resource_manifests
-      @resource_manifests ||= []
-    end
-
     # Public: Stores an instance of StatsRegistry
     def stats
       @stats ||= StatsRegistry.new
@@ -194,5 +171,36 @@ module Decidim
     def register_stat(name, options = {}, &block)
       stats.register(name, options, &block)
     end
+
+    # Public: Finds the permission class from its name, using the
+    # `permissions_class_name` attribute. If the class does not exist,
+    # it raises an exception. If the class name is not set, it returns nil.
+    #
+    # Returns a Class.
+    def permissions_class
+      permissions_class_name&.constantize
+    end
+
+    # Public: Registers a resource. Exposes a DSL defined by
+    # `Decidim::ResourceManifest`. Automatically sets the component manifest
+    # for that resource to the current one.
+    #
+    # Resource manifests are a way to expose a resource from one engine to
+    # the whole system. This way resources can be linked between them.
+    #
+    # name - A name for that resource. Should be singular (ie not plural).
+    # block - A Block that will be called to set the Resource attributes.
+    #
+    # Returns nothing.
+    def register_resource(name)
+      my_component_manifest = self
+
+      my_block = proc do |resource|
+        resource.component_manifest = my_component_manifest
+        yield(resource)
+      end
+
+      Decidim.register_resource(name, &my_block)
+    end
   end
 end

data/lib/decidim/content_processor.rb

@@ -30,6 +30,10 @@ module Decidim
   #   rendered = Decidim::ContentProcessor.render(content)
   #   puts rendered
   module ContentProcessor
+    extend ActionView::Helpers::SanitizeHelper
+    extend ActionView::Helpers::TagHelper
+    extend ActionView::Helpers::TextHelper
+
     # Class that represents the result of processing a text
     #
     # @!attribute rewrite
@@ -61,9 +65,23 @@ module Decidim
     #
     # @return [String] the content processed and ready to display (it is expected to include HTML)
     def self.render(content)
-      Decidim.content_processors.reduce(content) do |result, type|
-        renderer_klass(type).constantize.new(result).render
-      end
+      simple_format(
+        Decidim.content_processors.reduce(content) do |result, type|
+          renderer_klass(type).constantize.new(result).render
+        end
+      )
+    end
+
+    # This method overwrites the views `sanitize` method. This is required to
+    # ensure the content does not include any weird HTML that could harm the end
+    # user.
+    #
+    # @return [String] sanitized content.
+    def self.sanitize(text, options = {})
+      Rails::Html::WhiteListSanitizer.new.sanitize(
+        text,
+        { scrubber: Decidim::UserInputScrubber.new }.merge(options)
+      ).try(:html_safe)
     end
 
     # Guess the class name of the parser for a processor

data/lib/decidim/core.rb

@@ -45,15 +45,18 @@ module Decidim
   autoload :MenuRegistry, "decidim/menu_registry"
   autoload :Messaging, "decidim/messaging"
   autoload :ManifestRegistry, "decidim/manifest_registry"
-  autoload :Abilities, "decidim/abilities"
   autoload :EngineRouter, "decidim/engine_router"
   autoload :Events, "decidim/events"
   autoload :ViewHooks, "decidim/view_hooks"
   autoload :NewsletterEncryptor, "decidim/newsletter_encryptor"
+  autoload :Searchable, "decidim/searchable"
+  autoload :SearchResourceFieldsMapper, "decidim/search_resource_fields_mapper"
   autoload :QueryExtensions, "decidim/query_extensions"
   autoload :ParticipatorySpaceResourceable, "decidim/participatory_space_resourceable"
   autoload :HasPrivateUsers, "decidim/has_private_users"
   autoload :ViewModel, "decidim/view_model"
+  autoload :FingerprintCalculator, "decidim/fingerprint_calculator"
+  autoload :Fingerprintable, "decidim/fingerprintable"
 
   include ActiveSupport::Configurable
 
@@ -82,20 +85,6 @@ module Decidim
   # the mails.
   config_accessor :mailer_sender
 
-  # Exposes a configuration option: an Array of `cancancan`'s Ability classes
-  # that will be automatically included to the base `Decidim::Abilities::BaseAbility`
-  # class.
-  config_accessor :abilities do
-    []
-  end
-
-  # Exposes a configuration option: an Array of `cancancan`'s Ability classes
-  # that will be automatically included to the `Decidim::Admin::Abilities::BaseAbility`
-  # class.
-  config_accessor :admin_abilities do
-    []
-  end
-
   # Exposes a configuration option: The application available locales.
   config_accessor :available_locales do
     %w(en ca es eu fi fr gl it nl pt pt-BR ru sv uk)
@@ -187,6 +176,16 @@ module Decidim
     true
   end
 
+  # Max requests in a time period to prevent DoS attacks. Only applied on production.
+  config_accessor :throttling_max_requests do
+    100
+  end
+
+  # Time window in which the throttling is applied.
+  config_accessor :throttling_period do
+    1.minute
+  end
+
   # A base path for the uploads. If set, make sure it ends in a slash.
   # Uploads will be set to `<base_path>/uploads/`. This can be useful if you
   # want to use the same uploads place for both staging and production
@@ -259,6 +258,13 @@ module Decidim
     participatory_space_registry.register(name, &block)
   end
 
+  # Public: Registers a resource.
+  #
+  # Returns nothing.
+  def self.register_resource(name, &block)
+    resource_registry.register(name, &block)
+  end
+
   # Public: Finds all registered component manifest's via the `register_component`
   # method.
   #
@@ -301,7 +307,7 @@ module Decidim
   #
   # Returns a ResourceManifest if found, nil otherwise.
   def self.find_resource_manifest(resource_name_or_klass)
-    component_registry.find_resource_manifest(resource_name_or_klass)
+    resource_registry.find(resource_name_or_klass)
   end
 
   # Public: Stores the registry of components
@@ -314,6 +320,11 @@ module Decidim
     @participatory_space_registry ||= ManifestRegistry.new(:participatory_spaces)
   end
 
+  # Public: Stores the registry of resource spaces
+  def self.resource_registry
+    @resource_registry ||= ManifestRegistry.new(:resources)
+  end
+
   # Public: Stores an instance of StatsRegistry
   def self.stats
     @stats ||= StatsRegistry.new

data/lib/decidim/core/engine.rb

@@ -22,11 +22,9 @@ require "rectify"
 require "decidim/rectify_ext"
 
 require "carrierwave"
-require "high_voltage"
 require "rails-i18n"
 require "date_validator"
 require "sprockets/es6"
-require "cancancan"
 require "truncato"
 require "file_validators"
 require "omniauth"
@@ -39,6 +37,7 @@ require "geocoder"
 require "paper_trail"
 require "cells/rails"
 require "cells-erb"
+require "kaminari"
 require "doorkeeper"
 require "doorkeeper-i18n"
 
@@ -72,12 +71,6 @@ module Decidim
         app.config.assets.debug = true if Rails.env.test?
       end
 
-      initializer "decidim.high_voltage" do |_app|
-        HighVoltage.configure do |config|
-          config.routes = false
-        end
-      end
-
       initializer "decidim.default_form_builder" do |_app|
         ActionView::Base.default_form_builder = Decidim::FormBuilder
       end
@@ -86,17 +79,6 @@ module Decidim
         app.config.exceptions_app = Decidim::Core::Engine.routes
       end
 
-      initializer "decidim.inject_abilities_to_user" do |_app|
-        Decidim.configure do |config|
-          config.abilities << "Decidim::Abilities::EveryoneAbility"
-          config.abilities << "Decidim::Abilities::AdminAbility"
-          config.abilities << "Decidim::Abilities::UserManagerAbility"
-          config.abilities << "Decidim::Abilities::ParticipatoryProcessAdminAbility"
-          config.abilities << "Decidim::Abilities::ParticipatoryProcessCollaboratorAbility"
-          config.abilities << "Decidim::Abilities::ParticipatoryProcessModeratorAbility"
-        end
-      end
-
       initializer "decidim.locales" do |app|
         app.config.i18n.fallbacks = true
       end
@@ -280,6 +262,13 @@ module Decidim
           inflect.acronym "OAuth"
         end
       end
+
+      initializer "decidim.core.register_resources" do
+        Decidim.register_resource(:user) do |resource|
+          resource.model_class_name = "Decidim::User"
+          resource.card = "decidim/user_profile"
+        end
+      end
     end
   end
 end