decidim-core 0.20.1 → 0.21.0

data/lib/decidim/core/test/shared_examples/participatory_space_resourcable_interface_examples.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+shared_examples_for "participatory space resourcable interface" do
+  let!(:process1) { create(:participatory_process, organization: model.organization) }
+  let!(:process2) { create(:participatory_process, organization: model.organization) }
+  let!(:process3) { create(:participatory_process, organization: model.organization) }
+  let!(:model) { create(:assembly) }
+
+  context "when linked from the model" do
+    describe "linkedParticipatorySpaces" do
+      let(:query) { "{ linkedParticipatorySpaces { participatorySpace { id } } }" }
+
+      before do
+        model.link_participatory_space_resources([process1, process2], :included_participatory_processes)
+      end
+
+      it "includes the linked resources" do
+        ids = response["linkedParticipatorySpaces"].map { |l| l["participatorySpace"]["id"] }
+        expect(ids).to include(process1.id.to_s, process2.id.to_s)
+        expect(ids).not_to include(process3.id.to_s)
+      end
+    end
+  end
+
+  context "when linked towards the model" do
+    describe "linkedParticipatorySpaces" do
+      let(:query) { "{ linkedParticipatorySpaces { participatorySpace { id } } }" }
+
+      before do
+        process1.link_participatory_space_resources(model, :included_participatory_processes)
+        process2.link_participatory_space_resources(model, :included_participatory_processes)
+      end
+
+      it "includes the linked resources" do
+        ids = response["linkedParticipatorySpaces"].map { |l| l["participatorySpace"]["id"] }
+        expect(ids).to include(process1.id.to_s, process2.id.to_s)
+        expect(ids).not_to include(process3.id.to_s)
+      end
+    end
+  end
+end

data/lib/decidim/core/test/shared_examples/rich_text_editor_examples.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+shared_examples "having a rich text editor" do |css, toolbar|
+  it "has a form with a rich text editor" do
+    within "form.#{css}" do
+      expect(page).to have_selector("input[toolbar='#{toolbar}']", visible: false)
+    end
+  end
+end
+
+shared_context "with rich text editor content" do
+  let(:content) { "<p>" + safe_tags + "</p>" + script }
+  let(:safe_tags) { em + u + strong }
+  let(:em) { "<em>em</em>" }
+  let(:u) { "<u>u</u>" }
+  let(:strong) { "<strong>strong</strong>" }
+  let(:script) { "<script>alert('SCRIPT')</script>" }
+end
+
+shared_examples "rendering safe content" do |css|
+  include_context "with rich text editor content"
+
+  it "renders potentially safe HTML tags unescaped" do
+    within css do
+      expect(page).to have_selector("em", text: "em")
+      expect(page).to have_selector("u", text: "u")
+      expect(page).to have_selector("strong", text: "strong")
+    end
+  end
+
+  it "sanitizes potentially malicious HTML tags" do
+    within css do
+      expect(page).not_to have_selector("script", visible: false)
+      expect(page).to have_content("alert('SCRIPT')")
+    end
+  end
+end
+
+shared_examples "rendering unsafe content" do |css|
+  include_context "with rich text editor content"
+
+  it "sanitizes potentially safe HTML tags" do
+    within css do
+      expect(page).not_to have_selector("em")
+      expect(page).to have_content("em")
+      expect(page).not_to have_selector("u")
+      expect(page).to have_content("u")
+      expect(page).not_to have_selector("strong")
+      expect(page).to have_content("strong")
+    end
+  end
+
+  it "strips potentially malicious HTML tags" do
+    within css do
+      expect(page).not_to have_selector("script", visible: false)
+      expect(page).not_to have_content("alert('SCRIPT')")
+    end
+  end
+end

data/lib/decidim/core/test/shared_examples/timestamps_interface_examples.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+shared_examples_for "timestamps interface" do
+  describe "createdAt" do
+    let(:query) { "{ createdAt }" }
+
+    it "returns when was this query created at" do
+      expect(response["createdAt"]).to eq(model.created_at.to_time.iso8601)
+    end
+  end
+
+  describe "updatedAt" do
+    let(:query) { "{ updatedAt }" }
+
+    it "returns when was this query updated at" do
+      expect(response["updatedAt"]).to eq(model.updated_at.to_time.iso8601)
+    end
+  end
+end

data/lib/decidim/core/test/shared_examples/traceable_interface_examples.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+shared_examples_for "traceable interface" do
+  describe "traceable", versioning: true do
+    before do
+      Decidim.traceability.update!(model, model.creator_identity, title: "test")
+    end
+
+    context "when field createdAt" do
+      let(:query) { "{ versions { createdAt } }" }
+
+      it "returns created_at field of the version to iso format" do
+        dates = response["versions"].map { |version| version["createdAt"] }
+        expect(dates).to include(*model.versions.map { |version| version.created_at.to_time.iso8601 })
+      end
+    end
+
+    context "when field id" do
+      let(:query) { "{ versions { id } }" }
+
+      it "returns ID field of the version" do
+        ids = response["versions"].map { |version| version["id"].to_i }
+        expect(ids).to include(*model.versions.map(&:id))
+      end
+    end
+
+    context "when field editor" do
+      let(:query) { "{ versions { editor { name } } }" }
+
+      it "returns editor field of the versions" do
+        editors = response["versions"].map { |version| version["editor"]["name"] if version["editor"] }
+        expect(editors).to include(*model.versions.map { |version| version.editor.name if version.respond_to? :editor })
+      end
+    end
+
+    context "when field changeset" do
+      let(:query) { "{ versions { changeset } }" }
+
+      it "returns changeset field of the versions" do
+        changesets = response["versions"].map { |version| version["changeset"] }
+        expect(changesets).to include(*model.versions.map(&:changeset))
+      end
+    end
+  end
+end

data/lib/decidim/core/version.rb

@@ -4,7 +4,7 @@ module Decidim
   # This holds the decidim-core version.
   module Core
     def self.version
-      "0.20.1"
+      "0.21.0"
     end
   end
 end

data/lib/decidim/deprecations.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Decidim
+  #
+  # This class handles all logic regarding deprecated methods.
+  #
+  module Deprecations
+    # Define a deprecated alias for a method
+    #
+    # @param [Symbol] old_name - name of the method to deprecate
+    # @param [Symbol] replacement - name of the new method to use
+    def deprecated_alias(old_name, replacement)
+      define_method(old_name) do |*args, &block|
+        ActiveSupport::Deprecation.warn "##{old_name} deprecated (please use ##{replacement})"
+        send replacement, *args, &block
+      end
+    end
+  end
+end

data/lib/decidim/diffy_extension.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Decidim
+  # Extending Diffy gem to accomodate the needs of app/cells/decidim/diff_cell.rb
+  module DiffyExtension
+    # HtmlFormatter that returns basic html output (no inline highlighting)
+    # and does not escape HTML tags.
+    class UnescapedHtmlFormatter < Diffy::HtmlFormatter
+      # We exclude the tags `del` and `ins` so the diffy styling does not apply.
+      TAGS = (UserInputScrubber.new.tags.to_a - %w(del ins)).freeze
+
+      def to_s
+        str = wrap_lines(@diff.map { |line| wrap_line(line) })
+        ActionView::Base.new.sanitize(str, tags: TAGS)
+      end
+    end
+
+    # Adding a new method to Diffy::Format so we can pass the
+    # `:unescaped_html` option when calling Diffy::Diff#to_s.
+    Diffy::Format.module_eval do
+      def unescaped_html
+        UnescapedHtmlFormatter.new(self, options).to_s
+      end
+    end
+  end
+end

data/lib/decidim/exporters/export_manifest.rb

@@ -40,8 +40,12 @@ module Decidim
       # `export.collection.call(artifact_type)` and, when evaluated,
       # will get passed an instance of the parent artifact type,
       # `Decidim::ParticipatorySpace` or `Decidim::Component` for example,
-      # so you can easily find the elements to export. The +collection block+
-      # in the end should return the collection of elements to be serialized.
+      # so you can easily find the elements to export.  It also receives, as a
+      # second parameter, the user triggering the action, in case you need to
+      # filter the collection based on the user.
+      #
+      # The +collection block+ in the end should return the collection of
+      # elements to be serialized.
       #
       # &block - An optional block that returns the collection once evaluated.
       #

data/lib/decidim/filter_form_builder.rb

@@ -8,7 +8,7 @@ module Decidim
     # Wrap the radio buttons collection in a custom fieldset.
     # It also renders the inputs inside its labels.
     def collection_radio_buttons(method, collection, value_method, label_method, options = {}, html_options = {})
-      fieldset_wrapper options[:legend_title] do
+      fieldset_wrapper(options[:legend_title], "#{method}_collection_radio_buttons_filter") do
         super(method, collection, value_method, label_method, options, html_options) do |builder|
           if block_given?
             yield builder
@@ -22,7 +22,7 @@ module Decidim
     # Wrap the check_boxes collection in a custom fieldset.
     # It also renders the inputs inside its labels.
     def collection_check_boxes(method, collection, value_method, label_method, options = {}, html_options = {})
-      fieldset_wrapper options[:legend_title] do
+      fieldset_wrapper(options[:legend_title], "#{method}_collection_check_boxes_filter") do
         super(method, collection, value_method, label_method, options, html_options) do |builder|
           if block_given?
             yield builder
@@ -33,23 +33,37 @@ module Decidim
       end
     end
 
+    # Wrap the dependant check_boxes in a custom fieldset.
+    # checked parent checks its children
+    def check_boxes_tree(method, collection, options = {})
+      fieldset_wrapper(options[:legend_title], "#{method}_check_boxes_tree_filter") do
+        @template.render("decidim/shared/check_boxes_tree",
+                         form: self,
+                         attribute: method,
+                         collection: collection,
+                         check_boxes_tree_id: check_boxes_tree_id(method),
+                         hide_node: "false",
+                         options: options).html_safe
+      end
+    end
+
     # Wrap the category select in a custom fieldset.
     def categories_select(method, collection, options = {})
-      fieldset_wrapper options[:legend_title] do
+      fieldset_wrapper(options[:legend_title], "#{method}_categories_select_filter") do
         super(method, collection, options)
       end
     end
 
     # Wrap the areas select in a custom fieldset.
     def areas_select(method, collection, options = {})
-      fieldset_wrapper options[:legend_title] do
+      fieldset_wrapper(options[:legend_title], "#{method}_areas_select_filter") do
         super(method, collection, options)
       end
     end
 
     # Wrap the scopes picker in a custom fieldset.
     def scopes_picker(method, options = { checkboxes_on_top: true })
-      fieldset_wrapper options[:legend_title] do
+      fieldset_wrapper(options[:legend_title], "#{method}_scopes_picker_filter") do
         super(method, options)
       end
     end
@@ -57,8 +71,8 @@ module Decidim
     private
 
     # Private: Renders a custom fieldset and execute the given block.
-    def fieldset_wrapper(legend_title)
-      @template.content_tag(:div, "", class: "filters__section") do
+    def fieldset_wrapper(legend_title, extra_class)
+      @template.content_tag(:div, "", class: "filters__section #{extra_class}") do
         @template.content_tag(:fieldset) do
           @template.content_tag(:legend) do
             @template.content_tag(:h6, legend_title, class: "heading6")
@@ -66,5 +80,9 @@ module Decidim
         end
       end
     end
+
+    def check_boxes_tree_id(attribute)
+      "#{attribute}-#{object_id}"
+    end
   end
 end

data/lib/decidim/form_builder.rb

@@ -95,7 +95,7 @@ module Decidim
     end
 
     def translated_one_locale(type, name, locale, options = {})
-      return hashtaggable_text_field(type, name, locale, options.merge(value: options[:value])) if options[:hashtaggable]
+      return hashtaggable_text_field(type, name, locale, options) if options[:hashtaggable]
 
       send(
         type,
@@ -181,7 +181,7 @@ module Decidim
 
       content_tag(:div, class: "editor #{"hashtags__container" if options[:hashtaggable]}") do
         template = ""
-        template += label(name, options[:label].to_s || name) if options[:label] != false
+        template += label(name, options[:label].to_s || name) + required_for_attribute(name) if options[:label] != false
         template += hidden_field(name, options)
         template += content_tag(:div, nil, class: "editor-container #{"js-hashtags" if options[:hashtaggable]}", data: {
                                   toolbar: options[:toolbar],

data/lib/decidim/has_settings.rb

@@ -10,6 +10,14 @@ module Decidim
       after_initialize :default_values
     end
 
+    class_methods do
+      # Returns a Class with the attributes sanitized, coerced  and filtered
+      # to the right type. See Decidim::SettingsManifest#schema.
+      def build_settings(manifest, settings_name, data, organization)
+        manifest.settings(settings_name).schema.new(data, organization.default_locale)
+      end
+    end
+
     def settings
       new_settings_schema(:global, self[:settings]["global"])
     end
@@ -59,12 +67,10 @@ module Decidim
       step_settings.fetch(active_step.id.to_s)
     end
 
-    # Returns a Class with the attributes sanitized, coerced  and filtered
-    # to the right type. See Decidim::SettingsManifest#schema.
-    def new_settings_schema(name, data)
+    def new_settings_schema(settings_name, data)
       return {} unless manifest && participatory_space
 
-      manifest.settings(name).schema.new(data, participatory_space.organization.default_locale)
+      self.class.build_settings(manifest, settings_name, data, participatory_space.organization)
     end
 
     def default_values

data/lib/decidim/participatory_space_manifest.rb

@@ -24,6 +24,8 @@ module Decidim
     attribute :route_name, String
 
     attribute :query_type, String, default: "Decidim::Core::ParticipatorySpaceType"
+    attribute :query_finder, String, default: "Decidim::Core::ParticipatorySpaceFinder"
+    attribute :query_list, String, default: "Decidim::Core::ParticipatorySpaceList"
 
     # An array with the name of the classes that will be exported with
     # the data portability feature for this component. For example, `Decidim::<MyModule>::<MyClass>``
@@ -113,6 +115,24 @@ module Decidim
       permissions_class_name&.constantize
     end
 
+    # Public: Stores an instance of StatsRegistry
+    def stats
+      @stats ||= StatsRegistry.new
+    end
+
+    # Public: Registers a stat inside a participatory_space manifest.
+    #
+    # name - The name of the stat
+    # options - A hash of options
+    #         * primary: Whether the stat is primary or not.
+    #         * priority: The priority of the stat used for render issues.
+    # block - A block that receive the components to filter out the stat.
+    #
+    # Returns nothing.
+    def register_stat(name, options = {}, &block)
+      stats.register(name, options, &block)
+    end
+
     # Public: Registers a resource. Exposes a DSL defined by
     # `Decidim::ResourceManifest`.
     #

data/lib/decidim/participatory_space_resourceable.rb

@@ -20,6 +20,8 @@ module Decidim
     extend ActiveSupport::Concern
 
     included do
+      extend Decidim::Deprecations
+
       # An association with all the links that point to this model.
       has_many :participatory_space_resource_links_to, as: :to, class_name: "Decidim::ParticipatorySpaceLink"
 
@@ -64,7 +66,7 @@ module Decidim
       # data      - An optional Hash to add to the link.
       #
       # Returns nothing.
-      def link_participatory_spaces_resources(resources, link_name, data = {})
+      def link_participatory_space_resources(resources, link_name, data = {})
         transaction do
           participatory_space_resource_links_from.where(name: link_name).delete_all
           Array.wrap(resources).each do |resource|
@@ -77,6 +79,7 @@ module Decidim
           end
         end
       end
+      deprecated_alias :link_participatory_spaces_resources, :link_participatory_space_resources
 
       # Public: This method will be used to represent this participatory space in other contexts, like cards
       # or search results.
@@ -97,6 +100,37 @@ module Decidim
       def visible?
         published? && !try(:private_space?)
       end
+
+      # Defines a way to get the user roles for the current participatory space.
+      # You should overwrite this method in the implementer class to define how
+      # to get the correct values.
+      #
+      # role_name - A symbol or string identifying the role name
+      #
+      # Returns an ActiveRecord::Relation with one role for each combination of
+      # `ParticipatorySpace` and `*UserRole`. `*` meaning that the concrete
+      # implementation of the `UserRole` may change depending on the
+      # `ParticipatorySpace` where it belongs to.
+      def user_roles(_role_name = nil)
+        self.class.none
+      end
+
+      def user_role_config_for(user, role_name)
+        case role_name.to_sym
+        when :organization_admin
+          Decidim::ParticipatorySpaceRoleConfig::Admin.new(user)
+        when :admin # ParticipatorySpace admin
+          Decidim::ParticipatorySpaceRoleConfig::ParticipatorySpaceAdmin.new(user)
+        when :valuator
+          Decidim::ParticipatorySpaceRoleConfig::Valuator.new(user)
+        when :moderator
+          Decidim::ParticipatorySpaceRoleConfig::Moderator.new(user)
+        when :collaborator
+          Decidim::ParticipatorySpaceRoleConfig::Collaborator.new(user)
+        else
+          Decidim::ParticipatorySpaceRoleConfig::NullObject.new(user)
+        end
+      end
     end
 
     class_methods do