decidim-core 0.13.1 → 0.14.1

data/app/controllers/concerns/decidim/needs_permission.rb

@@ -8,7 +8,7 @@ module Decidim
     extend ActiveSupport::Concern
 
     included do
-      helper_method :allowed_to?
+      helper_method :allowed_to?, :admin_allowed_to?
 
       class ::Decidim::ActionForbidden < StandardError
       end
@@ -37,15 +37,19 @@ module Decidim
       end
 
       def enforce_permission_to(action, subject, extra_context = {})
-        Rails.logger.debug "==========="
-        Rails.logger.debug [permission_scope, action, subject, permission_class_chain].map(&:inspect).join("\n")
-        Rails.logger.debug "==========="
+        if Rails.env.development?
+          Rails.logger.debug "==========="
+          Rails.logger.debug [permission_scope, action, subject, permission_class_chain].map(&:inspect).join("\n")
+          Rails.logger.debug "==========="
+        end
 
         raise Decidim::ActionForbidden unless allowed_to?(action, subject, extra_context)
       end
 
-      def allowed_to?(action, subject, extra_context = {}, chain = permission_class_chain, user = current_user)
-        permission_action = Decidim::PermissionAction.new(scope: permission_scope, action: action, subject: subject)
+      # rubocop:disable Metrics/ParameterLists
+      def allowed_to?(action, subject, extra_context = {}, chain = permission_class_chain, user = current_user, scope = nil)
+        scope ||= permission_scope
+        permission_action = Decidim::PermissionAction.new(scope: scope, action: action, subject: subject)
 
         chain.inject(permission_action) do |current_permission_action, permission_class|
           permission_class.new(
@@ -57,6 +61,11 @@ module Decidim
       rescue Decidim::PermissionAction::PermissionNotSetError
         false
       end
+      # rubocop:enable Metrics/ParameterLists
+
+      def admin_allowed_to?(action, subject, extra_context = {}, chain = permission_class_chain, user = current_user)
+        allowed_to?(action, subject, extra_context, chain, user, :admin)
+      end
 
       def permission_class_chain
         raise "Please, make this method return an array of permission classes"

data/app/controllers/decidim/application_controller.rb

@@ -10,6 +10,7 @@ module Decidim
     include ImpersonateUsers
     include NeedsTosAccepted
     include HttpCachingDisabler
+    include ActionAuthorization
 
     helper Decidim::MetaTagsHelper
     helper Decidim::DecidimFormHelper

data/app/controllers/decidim/authorization_modals_controller.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Decidim
+  class AuthorizationModalsController < Decidim::ApplicationController
+    helper_method :status, :authorize_action_path
+    layout false
+
+    def show; end
+
+    private
+
+    def resource
+      @resource ||= if params[:resource_name] && params[:resource_id]
+                      manifest = Decidim.find_resource_manifest(params[:resource_name])
+                      manifest&.resource_scope(current_component)&.find_by(id: params[:resource_id])
+                    end
+    end
+
+    def current_component
+      @current_component ||= Decidim::Component.find(params[:component_id])
+    end
+
+    def authorization_action
+      @authorization_action ||= params[:authorization_action]
+    end
+
+    def authorize_action_path
+      status.current_path(redirect_url: URI(request.referer).path)
+    end
+
+    def status
+      @status ||= action_authorized_to(authorization_action, resource: resource)
+    end
+  end
+end

data/app/controllers/decidim/components/base_controller.rb

@@ -7,7 +7,6 @@ module Decidim
     # fooling the engine into thinking it's isolated.
     class BaseController < Decidim::ApplicationController
       include Settings
-      include ActionAuthorization
       include Decidim::NeedsPermission
 
       include ParticipatorySpaceContext

data/app/controllers/decidim/devise/invitations_controller.rb

@@ -25,9 +25,10 @@ module Decidim
       # When a managed user accepts the invitation is promoted to non-managed user.
       def accept_resource
         resource = resource_class.accept_invitation!(update_resource_params)
-        resource.update!(newsletter_notifications_at: Time.zone.now) if update_resource_params[:newsletter_notifications]
+        resource.update!(newsletter_notifications_at: Time.current) if update_resource_params[:newsletter_notifications]
         resource.update!(managed: false) if resource.managed?
         resource.update!(accepted_tos_version: resource.organization.tos_version)
+        Decidim::Gamification.increment_score(resource.invited_by, :invitations) if resource.invited_by
         resource
       end
 

data/app/controllers/decidim/messaging/conversations_controller.rb

@@ -11,7 +11,7 @@ module Decidim
 
       before_action :authenticate_user!
 
-      helper_method :username_list, :conversation
+      helper_method :conversation
 
       def new
         enforce_permission_to :create, :conversation
@@ -30,10 +30,7 @@ module Decidim
 
         StartConversation.call(@form) do
           on(:ok) do |conversation|
-            render action: :create, locals: {
-              conversation: conversation,
-              form: MessageForm.new
-            }
+            redirect_to conversation_path(conversation)
           end
 
           on(:invalid) do
@@ -52,8 +49,6 @@ module Decidim
         enforce_permission_to :read, :conversation, conversation: conversation
 
         @conversation.mark_as_read(current_user)
-
-        @form = MessageForm.new
       end
 
       def update
@@ -77,10 +72,6 @@ module Decidim
       def conversation
         @conversation ||= Conversation.find(params[:id])
       end
-
-      def username_list(users)
-        users.pluck(:name).join(", ")
-      end
     end
   end
 end

data/app/controllers/decidim/newsletters_controller.rb

@@ -13,12 +13,10 @@ module Decidim
       @user = current_user
       @organization = current_organization
 
-      if newsletter.sent?
-        @encrypted_token = Decidim::NewsletterEncryptor.sent_at_encrypted(@user.id, newsletter.sent_at) if @user.present?
-        @body = parse_interpolations(newsletter.body[I18n.locale.to_s], @user, newsletter.id)
-      else
-        redirect_to "/404"
-      end
+      raise ActionController::RoutingError, "Not Found" unless newsletter.sent?
+
+      @encrypted_token = Decidim::NewsletterEncryptor.sent_at_encrypted(@user.id, newsletter.sent_at) if @user.present?
+      @body = parse_interpolations(newsletter.body[I18n.locale.to_s], @user, newsletter.id)
     end
 
     def unsubscribe

data/app/controllers/decidim/notifications_controller.rb

@@ -3,6 +3,10 @@
 module Decidim
   # The controller to handle the user's notifications deletion.
   class NotificationsController < Decidim::ApplicationController
+    def index
+      enforce_permission_to :read, :notification
+    end
+
     def destroy
       notification = notifications.find(params[:id])
       enforce_permission_to :destroy, :notification, notification: notification

data/app/controllers/decidim/pages_controller.rb

@@ -19,19 +19,15 @@ module Decidim
       enforce_permission_to :read, :public_page, page: page
       if params[:id] == "home"
         render :home
-      else
+      elsif page
         render :decidim_page
+      else
+        raise ActionController::RoutingError, "Not Found"
       end
     end
 
     def page
       @page ||= current_organization.static_pages.find_by(slug: params[:id])
     end
-
-    private
-
-    def stats
-      @stats ||= HomeStatsPresenter.new(organization: current_organization)
-    end
   end
 end

data/app/controllers/decidim/profiles_controller.rb

@@ -8,8 +8,23 @@ module Decidim
     helper_method :user, :active_content
 
     def show
-      return redirect_to profile_notifications_path(nickname: params[:nickname]) if current_user == user && params[:active].blank?
-      return redirect_to profile_path(nickname: params[:nickname]) if current_user != user && params[:active] == "notifications"
+      return redirect_to notifications_path if current_user == user
+      @content_cell = "decidim/following"
+    end
+
+    def following
+      @content_cell = "decidim/following"
+      render :show
+    end
+
+    def followers
+      @content_cell = "decidim/followers"
+      render :show
+    end
+
+    def badges
+      @content_cell = "decidim/badges"
+      render :show
     end
 
     private
@@ -20,10 +35,5 @@ module Decidim
         organization: current_organization
       )
     end
-
-    def active_content
-      return "following" if current_user != user && params[:active].blank?
-      params[:active].presence
-    end
   end
 end

data/app/forms/decidim/notifications_settings_form.rb

@@ -14,7 +14,7 @@ module Decidim
 
     def newsletter_notifications_at
       return nil unless newsletter_notifications
-      Time.zone.now
+      Time.current
     end
   end
 end

data/app/forms/decidim/registration_form.rb

@@ -42,7 +42,7 @@ module Decidim
 
     def newsletter_at
       return nil unless newsletter?
-      Time.zone.now
+      Time.current
     end
 
     private

data/app/helpers/decidim/action_authorization_helper.rb

@@ -2,18 +2,6 @@
 
 module Decidim
   module ActionAuthorizationHelper
-    # Public: Renders a modal that explains why she can't perform an action,
-    # if that's the case. The modal isn't shown by default, and it's usually
-    # triggered by `action_authorized_link_to` or `action_authorized_button_to`.
-    #
-    # action - The action to authenticate against.
-    #
-    # Returns a String with the modal.
-    def action_authorization_modal(action)
-      render partial: "decidim/shared/action_authorization_modal",
-             locals: { action: action.to_s }
-    end
-
     # Public: Emulates a `link_to` but conditionally renders a popup modal
     # blocking the action in case the user isn't allowed to perform it.
     #
@@ -23,28 +11,7 @@ module Decidim
     #
     # Returns a String with the link.
     def action_authorized_link_to(action, *arguments, &block)
-      if block_given?
-        body = block
-        url = arguments[0]
-        html_options = arguments[1]
-      else
-        body = arguments[0]
-        url = arguments[1]
-        html_options = arguments[2]
-      end
-
-      unless current_user_authorized?(action)
-        html_options ||= {}
-        html_options["onclick"] = "event.preventDefault();"
-        html_options["data-open"] = current_user ? "#{action.to_s.underscore}AuthorizationModal" : "loginModal"
-        url = ""
-      end
-
-      if block_given?
-        link_to(url, html_options, &body)
-      else
-        link_to(body, url, html_options)
-      end
+      authorized_to(:link, action, arguments, block)
     end
 
     # Public: Emulates a `button_to` but conditionally renders a popup modal
@@ -56,34 +23,72 @@ module Decidim
     #
     # Returns a String with the button.
     def action_authorized_button_to(action, *arguments, &block)
-      if block_given?
+      authorized_to(:button, action, arguments, block)
+    end
+
+    # Public: Emulates a `link_to` but conditionally renders a popup modal
+    # blocking the action in case the user isn't logged id.
+    #
+    # *arguments - A regular set of arguments that would be provided to
+    #              `link_to`.
+    #
+    # Returns a String with the link.
+    def logged_link_to(*arguments, &block)
+      authorized_to(:link, nil, arguments, block)
+    end
+
+    # Public: Emulates a `button_to` but conditionally renders a popup modal
+    # blocking the action in case the user isn't logged id.
+    #
+    # *arguments - A regular set of arguments that would be provided to
+    #              `button_to`.
+    #
+    # Returns a String with the button.
+    def logged_button_to(*arguments, &block)
+      authorized_to(:button, nil, arguments, block)
+    end
+
+    private
+
+    def authorized_to(tag, action, arguments, block)
+      if block
         body = block
         url = arguments[0]
-        html_options = arguments[1] || {}
+        html_options = arguments[1]
       else
         body = arguments[0]
         url = arguments[1]
-        html_options = arguments[2] || {}
+        html_options = arguments[2]
       end
 
-      unless current_user_authorized?(action)
-        html_options["data-open"] = current_user ? "#{action.to_s.underscore}AuthorizationModal" : "loginModal"
+      html_options ||= {}
+      resource = html_options.delete(:resource)
+
+      if !current_user
+        html_options["data-open"] = "loginModal"
+        url = ""
+      elsif action && !action_authorized_to(action, resource: resource).ok?
+        html_options["data-open"] = "authorizationModal"
+        html_options["data-open-url"] = modal_path(action, resource)
         url = ""
       end
 
       html_options["onclick"] = "event.preventDefault();" if url == ""
 
-      if block_given?
-        button_to(url, html_options, &body)
+      if block
+        send("#{tag}_to", url, html_options, &body)
       else
-        button_to(body, url, html_options)
+        send("#{tag}_to", body, url, html_options)
       end
     end
 
-    private
-
-    def current_user_authorized?(action)
-      current_user && action_authorization(action).ok?
+    def modal_path(action, resource)
+      resource_params = if resource
+                          { resource_name: resource.resource_manifest.name, resource_id: resource.id }
+                        else
+                          {}
+                        end
+      decidim.authorization_modal_path(authorization_action: action, component_id: current_component.id, **resource_params)
     end
   end
 end

data/app/helpers/decidim/application_helper.rb

@@ -32,5 +32,23 @@ module Decidim
 
       presenter
     end
+
+    # Generates a link to be added to the global Edit link so admins
+    # can easily manage data without having to look for it at the admin
+    # panel when they're at a public page.
+    #
+    # link          - The String with the URL.
+    # action        - The Symbol action to check the permissions for.
+    # subject       - The Symbol subject to perform the action to.
+    # extra_context - An optional Hash to check the permissions.
+    #
+    # Returns nothing.
+    def edit_link(link, action, subject, extra_context = {})
+      return unless current_user
+      return unless admin_allowed_to?(action, subject, extra_context)
+      return if content_for?(:edit_link)
+
+      content_for(:edit_link, link)
+    end
   end
 end

data/app/helpers/decidim/card_helper.rb

@@ -10,7 +10,7 @@ module Decidim
     #
     # Returns an HTML.
     def card_for(model, options = {})
-      options = { context: { current_user: current_user } }.merge(options)
+      options = { context: { current_user: current_user } }.deep_merge(options)
 
       cell "decidim/card", model, options
     end

data/app/helpers/decidim/cells_helper.rb

@@ -10,6 +10,10 @@ module Decidim
       context[:controller].class.to_s == "Decidim::Proposals::ProposalsController"
     end
 
+    def collaborative_drafts_controller?
+      context[:controller].class.to_s == "Decidim::Proposals::CollaborativeDraftsController"
+    end
+
     def posts_controller?
       context[:controller].class.to_s == "Decidim::Blogs::PostsController"
     end
@@ -35,9 +39,9 @@ module Decidim
 
     def flagable?
       return unless from_context
-      return unless proposals_controller?
+      return unless proposals_controller? || collaborative_drafts_controller?
       return if index_action?
-      return if from_context.official?
+      return if from_context.try(:official?)
       true
     end
   end