decidim-core 0.20.0 → 0.23.1.rc1

data/app/scrubbers/decidim/user_input_scrubber.rb

@@ -21,7 +21,7 @@ module Decidim
     private
 
     def custom_allowed_attributes
-      Loofah::HTML5::SafeList::ALLOWED_ATTRIBUTES + %w(frameborder allowfullscreen)
+      Loofah::HTML5::SafeList::ALLOWED_ATTRIBUTES + %w(frameborder allowfullscreen) - %w(onerror)
     end
 
     def custom_allowed_tags

data/app/serializers/decidim/exporters/participatory_space_components_serializer.rb

@@ -23,7 +23,7 @@ module Decidim
             name: component.name,
             participatory_space_id: component.participatory_space_id,
             participatory_space_type: component.participatory_space_type,
-            settings: component.settings.as_json,
+            settings: component[:settings].as_json,
             weight: component.weight,
             permissions: component.permissions,
             published_at: component.published_at

data/app/serializers/decidim/importers/participatory_space_components_importer.rb

@@ -33,10 +33,10 @@ module Decidim
       def import(json_ary, user)
         ActiveRecord::Base.transaction do
           json_ary.collect do |serialized|
-            attributes = serialized.with_indifferent_access
-            # we override the parent participatory sapce
-            attributes["participatory_space_id"] = @participatory_space.id
-            attributes["participatory_space_type"] = @participatory_space.class.name
+            attributes = serialized.with_indifferent_access.except(:id, :participatory_space_id, :participatory_space_type)
+            step_settings = attributes["settings"]["steps"]
+            # we override the parent participatory space steps id
+            override_step_settings_ids(attributes, step_settings)
             import_component_from_attributes(attributes, user)
           end
         end
@@ -49,7 +49,7 @@ module Decidim
         component = Decidim.traceability.perform_action!(:create,
                                                          Decidim::Component,
                                                          user) do
-          c = Decidim::Component.new(attributes.except(:id, :settings, :specific_data))
+          c = Decidim::Component.new({ participatory_space: @participatory_space }.merge(attributes.except(:settings, :specific_data)))
           c[:settings] = attributes[:settings]
           c.save!
           c
@@ -62,6 +62,15 @@ module Decidim
         specific_importer = component.manifest.specific_data_importer_class.new(component)
         specific_importer.import(serialized[:specific_data], user)
       end
+
+      def override_step_settings_ids(attributes, step_settings)
+        return unless @participatory_space.has_steps? && step_settings.present?
+
+        @participatory_space.steps.each do |step|
+          old_id = attributes["settings"]["steps"].keys.first
+          step_settings[step.id.to_s] = step_settings.delete(old_id)
+        end
+      end
     end
   end
 end

data/app/services/decidim/activity_search.rb

@@ -27,6 +27,7 @@ module Decidim
               .where(organization: options.fetch(:organization))
 
       query = query.where(user: options[:user]) if options[:user]
+      query = query.where(resource_type: options[:resource_name]) if options[:resource_name]
 
       query = filter_follows(query)
 

data/app/services/decidim/base_diff_renderer.rb

@@ -5,6 +5,8 @@ module Decidim
   # It is supposed to be a base class for all other diff renderers,
   # as it defines some helpful methods that later diff renderers can use.
   class BaseDiffRenderer
+    include TranslatableAttributes
+
     def initialize(version)
       @version = version
     end
@@ -30,10 +32,12 @@ module Decidim
 
     attr_reader :version
 
-    # Lists which attributes will be diffable and how they should be rendered.
-    # It is supposed to be overwritten by sub classes.
+    # Private: Lists which attributes will be diffable and how they should be rendered.
+    # This method must be overwritten by sub classes.
+    #
+    # Returns Hash.
     def attribute_types
-      {}
+      raise StandardError, "Not implemented"
     end
 
     def parse_i18n_changeset(attribute, values, type, diff)
@@ -55,9 +59,44 @@ module Decidim
       diff
     end
 
+    def parse_user_group_changeset(attribute, values, type, diff)
+      return unless diff
+
+      old_user_group = Decidim::UserGroup.find_by(id: values[0])
+      new_user_group = Decidim::UserGroup.find_by(id: values[1])
+
+      diff.update(
+        attribute => {
+          type: type,
+          label: I18n.t(attribute, scope: i18n_scope),
+          old_value: old_user_group ? translated_attribute(old_user_group.name) : "",
+          new_value: new_user_group ? translated_attribute(new_user_group.name) : ""
+        }
+      )
+    end
+
+    def parse_scope_changeset(attribute, values, type, diff)
+      return unless diff
+
+      old_scope = Decidim::Scope.find_by(id: values[0])
+      new_scope = Decidim::Scope.find_by(id: values[1])
+
+      diff.update(
+        attribute => {
+          type: type,
+          label: I18n.t(attribute, scope: i18n_scope),
+          old_value: old_scope ? translated_attribute(old_scope.name) : "",
+          new_value: new_scope ? translated_attribute(new_scope.name) : ""
+        }
+      )
+    end
+
     def parse_changeset(attribute, values, type, diff)
       return parse_i18n_changeset(attribute, values, type, diff) if [:i18n, :i18n_html].include?(type)
 
+      return parse_scope_changeset(attribute, values, type, diff) if type == :scope
+      return parse_user_group_changeset(attribute, values, type, diff) if type == :user_group
+
       diff.update(
         attribute => {
           type: type,

data/app/services/decidim/data_portability_exporter.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+require "seven_zip_ruby"
+require_relative "zip_stream/zip_stream_writer"
+
+module Decidim
+  # Public: Generates a 7z(seven zip) file with data files ready to be persisted
+  # somewhere so users can download their data.
+  #
+  # In fact, the 7z file wraps a ZIP file which finally contains the data files.
+  class DataPortabilityExporter
+    include ::Decidim::ZipStream::Writer
+
+    DEFAULT_EXPORT_FORMAT = "CSV"
+    ZIP_FILE_NAME = "data-portability.zip"
+
+    # Public: Initializes the class.
+    #
+    # user          - The user to export the data from.
+    # path          - The String path where to write the zip file.
+    # password      - The password to protect the zip file.
+    # export_format - The format of the data files inside the zip file. (CSV by default)
+    def initialize(user, path, password, export_format = DEFAULT_EXPORT_FORMAT)
+      @user = user
+      @path = File.expand_path path
+      @export_format = export_format
+      @password = password
+    end
+
+    def export
+      dirname = File.dirname(@path)
+      FileUtils.mkdir_p(dirname) unless File.directory?(dirname)
+      File.open(@path, "wb") do |file|
+        SevenZipRuby::Writer.open(file, password: @password) do |szw|
+          szw.header_encryption = true
+          szw.add_data(data, ZIP_FILE_NAME)
+        end
+      end
+    end
+
+    private
+
+    def data
+      buffer = Zip::OutputStream.write_buffer do |out|
+        user_data, attachments = data_for(@user, @export_format)
+
+        add_user_data_to_zip_stream(out, user_data)
+        add_attachments_to_zip_stream(out, attachments)
+      end
+
+      buffer.string
+    end
+
+    def data_for(user, format)
+      export_data = []
+      export_attachments = []
+
+      data_portability_entities.each do |object|
+        klass = Object.const_get(object)
+        export_data << [klass.model_name.name.parameterize.pluralize, Exporters.find_exporter(format).new(klass.user_collection(user), klass.export_serializer).export]
+        attachments = klass.data_portability_images(user)
+        export_attachments << [klass.model_name.name.parameterize.pluralize, attachments.flatten] unless attachments.nil?
+      end
+
+      [export_data, export_attachments]
+    end
+
+    def data_portability_entities
+      @data_portability_entities ||= DataPortabilitySerializers.data_entities
+    end
+  end
+end

data/app/services/decidim/events_manager.rb

@@ -18,17 +18,20 @@ module Decidim
     #   event and will receive a notification about it.
     # followers - a collection of `Decidim::Users` that should be notified about
     #   the event, even though it doesn't affect them directly
+    # force_send - boolean indicating if EventPublisherJob should skip the
+    #   `notifiable?` check it performs before notifying. Defaults to __false__.
     # extra - a Hash with extra information to be included in the notification.
     #
     # Returns nothing.
     # rubocop:disable Metrics/ParameterLists
-    def self.publish(event:, event_class: Decidim::Events::BaseEvent, resource:, affected_users: [], followers: [], extra: {})
+    def self.publish(event:, event_class: Decidim::Events::BaseEvent, resource:, affected_users: [], followers: [], extra: {}, force_send: false)
       ActiveSupport::Notifications.publish(
         event,
         event_class: event_class.name,
         resource: resource,
         affected_users: affected_users.uniq.compact,
         followers: followers.uniq.compact,
+        force_send: force_send,
         extra: extra
       )
     end

data/app/services/decidim/open_data_exporter.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "zip"
+
 module Decidim
   # Public: It generates a ZIP file with Open Data CSV files ready
   # to be uploaded somewhere so users can download an organization

data/app/services/decidim/resource_search.rb

@@ -4,6 +4,8 @@ module Decidim
   # This is the base class to be used by other search services.
   # Searchlight documentation: https://github.com/nathanl/searchlight
   class ResourceSearch < Searchlight::Search
+    attr_reader :user, :organization, :component
+
     # Initialize the Searchlight::Search base class with the options provided.
     #
     # scope   - The scope used to create the base query
@@ -13,6 +15,31 @@ module Decidim
     def initialize(scope, options = {})
       super(options)
       @scope = scope
+      @user = options[:current_user] || options[:user]
+      @component = options[:component]
+      @organization = options[:organization] || component&.organization
+    end
+
+    # Public: Companion method to `search_search_text` which defines the
+    # attributes where we should search for text values in a model.
+    def self.text_search_fields(*fields)
+      @text_search_fields = fields if fields.any?
+      @text_search_fields
+    end
+
+    # Handle the search_text filter. We have to cast the JSONB columns
+    # into a `text` type so that we can search.
+    def search_search_text
+      return query unless self.class.text_search_fields.any?
+
+      fields = self.class.text_search_fields.dup
+
+      text_query = query.where(localized_search_text_in("#{query.model_name.plural}.#{fields.shift}"), text: "%#{search_text}%")
+
+      fields.each do |field|
+        text_query = text_query.or(query.where(localized_search_text_in("#{query.model_name.plural}.#{field}"), text: "%#{search_text}%"))
+      end
+      text_query
     end
 
     # Creates the SearchLight base query.
@@ -25,24 +52,24 @@ module Decidim
 
     # Handle the category_id filter
     def search_category_id
+      return query if category_ids.include?("all")
+
       query
         .includes(:categorization)
-        .where(decidim_categorizations: { decidim_category_id: category_ids })
+        .where(decidim_categorizations: { decidim_category_id: all_category_ids })
     end
 
-    # Handles the scope_id filter. When we want to show only those that do not
-    # have a scope_id set, we cannot pass an empty String or nil because Searchlight
+    # Handles the scope_ids filter. When we want to show only those that do not
+    # have a scope_ids set, we cannot pass an empty String or nil because Searchlight
     # will automatically filter out these params, so the method will not be used.
     # Instead, we need to pass a fake ID and then convert it inside. In this case,
-    # in order to select those elements that do not have a scope_id set we use
+    # in order to select those elements that do not have a scope_ids set we use
     # `"global"` as parameter, and in the method we do the needed changes to search
     # properly.
     def search_scope_id
-      clean_scope_ids = if scope_id.is_a?(Hash)
-                          scope_id.values
-                        else
-                          [scope_id].flatten
-                        end
+      return query if scope_ids.include?("all")
+
+      clean_scope_ids = scope_ids
 
       conditions = []
       conditions << "#{query.model_name.plural}.decidim_scope_id IS NULL" if clean_scope_ids.delete("global")
@@ -51,22 +78,100 @@ module Decidim
       query.includes(:scope).references(:decidim_scopes).where(conditions.join(" OR "), *clean_scope_ids.map(&:to_i))
     end
 
+    # Handle the origin filter.
+    def search_origin
+      renamed_origin = Array(origin).map do |search_value|
+        "#{search_value}_origin"
+      end
+      apply_scopes(%w(official_origin citizens_origin user_group_origin meeting_origin), renamed_origin)
+    end
+
+    # We overwrite the `results` method to ensure we only return unique
+    # results. We can't use `#uniq` because it returns an Array and we're
+    # adding scopes in the controller, and `#distinct` doesn't work here
+    # because in the later scopes we're ordering by `RANDOM()` in a DB level,
+    # and `SELECT DISTINCT` doesn't work with `RANDOM()` sorting, so we need
+    # to perform two queries.
+    #
+    # The correct behaviour is backed by tests.
+    def results
+      base_query.model.where(id: super.pluck(:id))
+    end
+
     private
 
+    # Private: To be used by classes that inherit from ResourceSearch.
+    #
+    # This method is useful when the values of the filters match the names of
+    # defined scopes in a model, it applies those scopes that are included in
+    # the search values.
+    #
+    # Example:
+    #   Consider you want to filter by state, and your model has an `open` and
+    #   a `closed` ActiveRecord scope.
+    #
+    #   def search_state
+    #     apply_scopes(%w(open closed), state)
+    #   end
+    #
+    #   In this scenario, the `state` variable has the input by the use, who
+    #   has selected which states they want to see. `states` here is an array
+    #   of strings.
+    #
+    # Returns an ActiveRecord::Relation.
+    def apply_scopes(scopes, search_values)
+      search_values = Array(search_values)
+
+      conditions = scopes.map do |scope|
+        search_values.member?(scope.to_s) ? query.try(scope) : nil
+      end.compact
+
+      return query unless conditions.any?
+
+      scoped_query = query.where(id: conditions.shift)
+
+      conditions.each do |condition|
+        scoped_query = scoped_query.or(query.where(id: condition))
+      end
+
+      scoped_query
+    end
+
     # Private: Creates an array of category ids.
     # It contains categories' subcategories ids as well.
-    def category_ids
+    def all_category_ids
+      cat_ids = category_ids.without("without")
+
       component
         .categories
-        .where(id: category_id)
-        .or(component.categories.where(parent_id: category_id))
-        .pluck(:id)
+        .where(id: cat_ids)
+        .or(component.categories.where(parent_id: cat_ids))
+        .pluck(:id).tap { |ids| ids.prepend(nil) if category_ids.include?("without") }
+    end
+
+    # Private: Returns an array with checked category ids.
+    def category_ids
+      Array(category_id)
     end
 
-    # Private: Since component is not used by a search method we need
-    # to define the method manually.
-    def component
-      options[:component]
+    # Private: Returns an array with checked scope ids.
+    def scope_ids
+      if scope_id.is_a?(Hash)
+        scope_id.values
+      else
+        Array(scope_id)
+      end
+    end
+
+    # Internal: builds the needed query to search for a text in the organization's
+    # available locales. Note that it is intended to be used as follows:
+    #
+    # Example:
+    #   Resource.where(localized_search_text_for(:title, text: "my_query"))
+    #
+    # The Hash with the `:text` key is required or it won't work.
+    def localized_search_text_in(field)
+      organization.available_locales.map { |l| "#{field} ->> '#{l}' ILIKE :text" }.join(" OR ")
     end
   end
 end

data/app/services/decidim/static_map_generator.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require "httparty"
-
 module Decidim
   # This class generates a url to create a static map image for a geocoded resource
   class StaticMapGenerator
@@ -15,34 +13,25 @@ module Decidim
     end
 
     def data
-      return if Decidim.geocoder.nil? || @resource.blank?
+      return if @resource.blank? || map_utility.nil?
 
       Rails.cache.fetch(@resource.cache_key) do
-        request = HTTParty.get(uri, headers: { "Referer" => organization.host })
-        request.body
+        map_utility.image_data(
+          latitude: @resource.latitude,
+          longitude: @resource.longitude,
+          options: @options
+        )
       end
     end
 
     private
 
-    def uri
-      params = {
-        c: "#{@resource.latitude}, #{@resource.longitude}",
-        z: @options[:zoom],
-        w: @options[:width],
-        h: @options[:height],
-        f: "1",
-        app_id: Decidim.geocoder.fetch(:here_app_id),
-        app_code: Decidim.geocoder.fetch(:here_app_code)
-      }
-
-      URI.parse(Decidim.geocoder.fetch(:static_map_url)).tap do |uri|
-        uri.query = URI.encode_www_form params
-      end
-    end
-
     def organization
       @organization ||= @resource.component.organization
     end
+
+    def map_utility
+      @map_utility ||= Decidim::Map.static(organization: organization)
+    end
   end
 end