decidim-core 0.21.0 → 0.22.0

data/lib/decidim/content_parsers/user_parser.rb

@@ -5,8 +5,7 @@ module Decidim
     # A parser that searches user mentions in content.
     #
     # A word starting with `@` will be considered as a possible mention if
-    # they only contains letters, numbers or underscores. If the `@` is
-    # followed with an underscore, then it is not considered.
+    # they only contains letters, numbers or underscores.
     #
     # @see BaseParser Examples of how to use a content parser
     class UserParser < BaseParser
@@ -16,9 +15,8 @@ module Decidim
       #   @return [Array] an array of Decidim::User mentioned in content
       Metadata = Struct.new(:users)
 
-      # Matches a nickname if it starts with a letter or number
-      # and only contains letters, numbers or underscores.
-      MENTION_REGEX = /\B@([a-zA-Z0-9]\w*)\b/.freeze
+      # Matches a nickname if contains letters, numbers or underscores.
+      MENTION_REGEX = /\B@(\w*)\b/.freeze
 
       # Replaces found mentions matching a nickname of an existing
       # user in the current organization with a global id. Other

data/lib/decidim/content_renderers.rb

@@ -4,6 +4,7 @@ module Decidim
   module ContentRenderers
     autoload :BaseRenderer, "decidim/content_renderers/base_renderer"
     autoload :UserRenderer, "decidim/content_renderers/user_renderer"
+    autoload :UserGroupRenderer, "decidim/content_renderers/user_group_renderer"
     autoload :HashtagRenderer, "decidim/content_renderers/hashtag_renderer"
     autoload :LinkRenderer, "decidim/content_renderers/link_renderer"
   end

data/lib/decidim/content_renderers/user_group_renderer.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Decidim
+  module ContentRenderers
+    # A renderer that searches Global IDs representing users in content
+    # and replaces it with a link to their profile with the nickname.
+    #
+    # e.g. gid://<APP_NAME>/Decidim::UserGroup/1
+    #
+    # @see BaseRenderer Examples of how to use a content renderer
+    class UserGroupRenderer < BaseRenderer
+      # Matches a global id representing a Decidim::UserGroup
+      GLOBAL_ID_REGEX = %r{gid://\S+/Decidim::UserGroup/\d+}.freeze
+
+      # Replaces found Global IDs matching an existing user with
+      # a link to their profile. The Global IDs representing an
+      # invalid Decidim::UserGroup are replaced with an empty string.
+      #
+      # @return [String] the content ready to display (contains HTML)
+      def render
+        content.gsub(GLOBAL_ID_REGEX) do |user_gid|
+          user = GlobalID::Locator.locate(user_gid)
+          Decidim::UserGroupPresenter.new(user).display_mention
+        rescue ActiveRecord::RecordNotFound => _e
+          ""
+        end
+      end
+    end
+  end
+end

data/lib/decidim/core.rb

@@ -81,6 +81,8 @@ module Decidim
   autoload :HasResourcePermission, "decidim/has_resource_permission"
   autoload :PermissionsRegistry, "decidim/permissions_registry"
   autoload :Randomable, "decidim/randomable"
+  autoload :Endorsable, "decidim/endorsable"
+  autoload :ActionAuthorization, "decidim/action_authorization"
 
   include ActiveSupport::Configurable
   # Loads seeds from all engines.
@@ -131,9 +133,19 @@ module Decidim
   # the mails.
   config_accessor :mailer_sender
 
+  # Whether SSL should be enabled or not.
+  config_accessor :force_ssl do
+    true
+  end
+
   # Exposes a configuration option: The application available locales.
   config_accessor :available_locales do
-    %w(en ar ca de el es es-MX es-PY eu fi-pl fi fr gl hu id it nl no pl pt pt-BR ru sv tr uk)
+    %w(en ar ca de el es es-MX es-PY eu fi-pl fi fr gl hu id it nl no pl pt pt-BR ro ru sk sv tr uk)
+  end
+
+  # Exposes a configuration option: The application default locale.
+  config_accessor :default_locale do
+    :en
   end
 
   # Exposes a configuration option: an array of symbols representing processors
@@ -153,11 +165,6 @@ module Decidim
     []
   end
 
-  # Exposes a configuration option: The application default locale.
-  config_accessor :default_locale do
-    :en
-  end
-
   # Exposes a configuration option: an object to configure geocoder
   config_accessor :geocoder
 
@@ -192,6 +199,11 @@ module Decidim
     end
   end
 
+  # Exposes a configuration option: the whitelist ips
+  config_accessor :system_accesslist_ips do
+    []
+  end
+
   # Exposes a configuration option: the currency unit
   config_accessor :currency_unit do
     "€"
@@ -212,7 +224,7 @@ module Decidim
     5.megabytes
   end
 
-  # The number of reports which an object can receive before hiding it
+  # The number of reports which a resource can receive before hiding it
   config_accessor :max_reports_before_hiding do
     3
   end
@@ -247,39 +259,71 @@ module Decidim
     2.days
   end
 
+  # How long can a user remained logged in before the session expires
+  config_accessor :expire_session_after do
+    1.day
+  end
+
   # Exposes a configuration option: an object to configure Etherpad
-  config_accessor :etherpad
+  config_accessor :etherpad do
+    # {
+    #   server: <your url>,
+    #   api_key: <your key>,
+    #   api_version: <your version>
+    # }
+  end
 
   # A base path for the uploads. If set, make sure it ends in a slash.
   # Uploads will be set to `<base_path>/uploads/`. This can be useful if you
   # want to use the same uploads place for both staging and production
   # environments, but in different folders.
-  config_accessor :base_uploads_path
+  config_accessor :base_uploads_path do
+    nil
+  end
 
-  # Exposes a configuration option: an object to deliver SMS codes to users.
-  config_accessor :sms_gateway_service
+  # The name of the class to deliver SMS codes to users.
+  #
+  # Check the example in `decidim-verifications`.
+  config_accessor :sms_gateway_service do
+    # "MyGatewayClass"
+  end
 
-  # Exposes a configuration option: an object to generate a timestamp from a
-  # document
-  config_accessor :timestamp_service
+  # The name of the class used to generate a timestamp from a document.
+  #
+  # Check the example in `decidim-initiatives`
+  config_accessor :timestamp_service do
+    # "MyTimestampService"
+  end
 
-  # Exposes a configuration option: an object to process a pdf and add a
-  # signature to the document
-  config_accessor :pdf_signature_service
+  # The name of the class used to process a pdf and add a signature to the
+  # document.
+  #
+  # Check the example in `decidim-initiatives`
+  config_accessor :pdf_signature_service do
+    # "MyPDFSignatureService"
+  end
 
-  # Exposes a configuration option: Decidim::Exporters::CSV's default column separator
+  # The Decidim::Exporters::CSV's default column separator
   config_accessor :default_csv_col_sep do
     ";"
   end
 
-  # Exposes a configuration option: An Array of Strings with the roles of a Decidim::User.
+  # Exposes a configuration option: HTTP_X_FORWADED_HOST header follow-up.
+  # If a caching system is in place, it can also allow cache and log poisoning attacks,
+  # allowing attackers to control the contents of caches and logs that could be used for other attacks.
+  config_accessor :follow_http_x_forwarded_host do
+    false
+  end
+
+  # The list of roles a user can have, not considering the space-specific roles.
   config_accessor :user_roles do
     %w(admin user_manager)
   end
 
-  # Exposes a configuration option: An Array of Strings that serve both as
-  # locale keys and values to construct the input collection in
+  # The list of visibility options for amendments. An Array of Strings that
+  # serve both as locale keys and values to construct the input collection in
   # Decidim::Amendment::VisibilityStepSetting::options.
+  #
   # This collection is used in Decidim::Admin::SettingsHelper to generate a
   # radio buttons collection input field form for a Decidim::Component
   # step setting :amendments_visibility.

data/lib/decidim/core/api.rb

@@ -17,5 +17,6 @@ module Decidim
     autoload :AmendableEntityInterface, "decidim/api/amendable_entity_interface"
     autoload :TraceableInterface, "decidim/api/traceable_interface"
     autoload :TimestampsInterface, "decidim/api/timestamps_interface"
+    autoload :EndorsableInterface, "decidim/api/endorsable_interface"
   end
 end

data/lib/decidim/core/engine.rb

@@ -59,12 +59,14 @@ module Decidim
 
       initializer "decidim.middleware" do |app|
         app.config.middleware.insert_before Warden::Manager, Decidim::CurrentOrganization
+        app.config.middleware.insert_before Warden::Manager, Decidim::StripXForwardedHost
         app.config.middleware.use BatchLoader::Middleware
       end
 
       initializer "decidim.assets" do |app|
         app.config.assets.paths << File.expand_path("../../../app/assets/stylesheets", __dir__)
-        app.config.assets.precompile += %w(decidim_core_manifest.js)
+        app.config.assets.precompile += %w(decidim_core_manifest.js
+                                           decidim/identity_selector_dialog)
 
         Decidim.component_manifests.each do |component|
           app.config.assets.precompile += [component.icon]
@@ -196,7 +198,7 @@ module Decidim
 
       initializer "decidim.content_processors" do |_app|
         Decidim.configure do |config|
-          config.content_processors += [:user, :hashtag, :link]
+          config.content_processors += [:user, :user_group, :hashtag, :link]
         end
       end
 
@@ -240,9 +242,7 @@ module Decidim
           # #call can be used in order to allow conditional checks (to allow non-SSL
           # redirects to localhost for example).
           #
-          # force_ssl_in_redirect_uri !Rails.env.development?
-          #
-          force_ssl_in_redirect_uri false
+          force_ssl_in_redirect_uri !Rails.env.development?
 
           # WWW-Authenticate Realm (default "Doorkeeper").
           realm "Decidim"
@@ -255,6 +255,22 @@ module Decidim
         end
       end
 
+      initializer "SSL and HSTS" do
+        Rails.application.configure do
+          config.force_ssl = Rails.env.production? && Decidim.config.force_ssl
+        end
+      end
+
+      initializer "Disable Rack::Runtime" do
+        Rails.application.configure do
+          config.middleware.delete Rack::Runtime
+        end
+      end
+
+      initializer "Expire sessions" do
+        Rails.application.config.session_store :cookie_store, expire_after: Decidim.config.expire_session_after
+      end
+
       initializer "decidim.core.register_resources" do
         Decidim.register_resource(:user) do |resource|
           resource.model_class_name = "Decidim::User"
@@ -302,7 +318,7 @@ module Decidim
         end
       end
 
-      initializer "decidim.core.content_blocks" do
+      initializer "decidim.core.homepage_content_blocks" do
         Decidim.content_blocks.register(:homepage, :hero) do |content_block|
           content_block.cell = "decidim/content_blocks/hero"
           content_block.settings_form_cell = "decidim/content_blocks/hero_settings_form"
@@ -374,6 +390,68 @@ module Decidim
         end
       end
 
+      initializer "decidim.core.newsletter_templates" do
+        Decidim.content_blocks.register(:newsletter_template, :basic_only_text) do |content_block|
+          content_block.cell = "decidim/newsletter_templates/basic_only_text"
+          content_block.settings_form_cell = "decidim/newsletter_templates/basic_only_text_settings_form"
+          content_block.public_name_key = "decidim.newsletter_templates.basic_only_text.name"
+
+          content_block.settings do |settings|
+            settings.attribute(
+              :body,
+              type: :text,
+              translated: true,
+              preview: -> { I18n.t("decidim.newsletter_templates.basic_only_text.body_preview") }
+            )
+          end
+
+          content_block.default!
+        end
+
+        Decidim.content_blocks.register(:newsletter_template, :image_text_cta) do |content_block|
+          content_block.cell = "decidim/newsletter_templates/image_text_cta"
+          content_block.settings_form_cell = "decidim/newsletter_templates/image_text_cta_settings_form"
+          content_block.public_name_key = "decidim.newsletter_templates.image_text_cta.name"
+
+          content_block.images = [
+            {
+              name: :main_image,
+              uploader: "Decidim::NewsletterTemplateImageUploader",
+              preview: -> { ActionController::Base.helpers.asset_path("decidim/placeholder.jpg") }
+            }
+          ]
+
+          content_block.settings do |settings|
+            settings.attribute(
+              :introduction,
+              type: :text,
+              translated: true,
+              preview: -> { I18n.t("decidim.newsletter_templates.image_text_cta.introduction_preview") }
+            )
+            settings.attribute(
+              :body,
+              type: :text,
+              translated: true,
+              preview: -> { I18n.t("decidim.newsletter_templates.image_text_cta.body_preview") }
+            )
+            settings.attribute(
+              :cta_text,
+              type: :text,
+              translated: true,
+              preview: -> { I18n.t("decidim.newsletter_templates.image_text_cta.cta_text_preview") }
+            )
+            settings.attribute(
+              :cta_url,
+              type: :text,
+              translated: true,
+              preview: -> { "http://decidim.org" }
+            )
+          end
+
+          content_block.default!
+        end
+      end
+
       initializer "decidim.core.add_badges" do
         Decidim::Gamification.register_badge(:invitations) do |badge|
           badge.levels = [1, 5, 10, 30, 50]
@@ -389,6 +467,10 @@ module Decidim
       initializer "nbspw" do
         NOBSPW.configuration.use_ruby_grep = true
       end
+
+      config.to_prepare do
+        FoundationRailsHelper::FlashHelper.send(:include, Decidim::FlashHelperExtensions)
+      end
     end
   end
 end

data/lib/decidim/core/test.rb

@@ -5,6 +5,7 @@ require "decidim/core/test/shared_examples/authorable"
 require "decidim/core/test/shared_examples/coauthorable"
 require "decidim/core/test/shared_examples/publicable"
 require "decidim/core/test/shared_examples/localised_email"
+require "decidim/core/test/shared_examples/logo_email"
 require "decidim/core/test/shared_examples/has_attachments"
 require "decidim/core/test/shared_examples/has_attachment_collections"
 require "decidim/core/test/shared_examples/has_component"
@@ -28,6 +29,7 @@ require "decidim/core/test/shared_examples/searchable_results_examples"
 require "decidim/core/test/shared_examples/has_space_in_mcell_examples"
 require "decidim/core/test/shared_examples/railtie_examples"
 require "decidim/core/test/shared_examples/edit_link_shared_examples"
+require "decidim/core/test/shared_examples/endorsements_controller_shared_context"
 require "decidim/core/test/shared_examples/amendable/create_amendment_draft_examples"
 require "decidim/core/test/shared_examples/amendable/update_amendment_draft_examples"
 require "decidim/core/test/shared_examples/amendable/destroy_amendment_draft_examples"
@@ -46,4 +48,10 @@ require "decidim/core/test/shared_examples/uncommentable_component_examples"
 require "decidim/core/test/shared_examples/searchable_resources_shared_context"
 require "decidim/core/test/shared_examples/searchable_participatory_space_examples"
 require "decidim/core/test/shared_examples/has_private_users"
+require "decidim/core/test/shared_examples/with_endorsable_permissions_examples"
+require "decidim/core/test/shared_examples/system_endorse_resource_examples"
 require "decidim/core/test/shared_examples/rich_text_editor_examples"
+require "decidim/core/test/shared_examples/back_to_list_button_examples"
+require "decidim/core/test/shared_examples/permissions"
+require "decidim/core/test/shared_examples/admin_resource_gallery_examples"
+require "decidim/core/test/shared_examples/metric_manage_shared_context"

data/lib/decidim/core/test/factories.rb

@@ -335,8 +335,9 @@ FactoryBot.define do
 
     trait :with_one_step do
       step_settings do
+        participatory_space_with_steps if participatory_space.active_step.nil?
         {
-          1 => { dummy_step_setting: true }
+          participatory_space.active_step.id => { dummy_step_setting: true }
         }
       end
     end
@@ -360,6 +361,44 @@ FactoryBot.define do
     trait :with_permissions do
       settings { { Random.rand => Random.new.bytes(5) } }
     end
+
+    transient do
+      participatory_space_with_steps do
+        create(:participatory_process_step,
+               active: true,
+               end_date: 1.month.from_now,
+               participatory_process: participatory_space)
+        participatory_space.reload
+        participatory_space.steps.reload
+      end
+    end
+
+    trait :with_endorsements_enabled do
+      step_settings do
+        participatory_space_with_steps if participatory_space.active_step.nil?
+        {
+          participatory_space.active_step.id => { endorsements_enabled: true }
+        }
+      end
+    end
+
+    trait :with_endorsements_disabled do
+      step_settings do
+        participatory_space_with_steps if participatory_space.active_step.nil?
+        {
+          participatory_space.active_step.id => { endorsements_enabled: false }
+        }
+      end
+    end
+
+    trait :with_endorsements_blocked do
+      step_settings do
+        participatory_space_with_steps if participatory_space.active_step.nil?
+        {
+          participatory_space.active_step.id => { endorsements_blocked: true }
+        }
+      end
+    end
   end
 
   factory :scope_type, class: "Decidim::ScopeType" do
@@ -403,6 +442,11 @@ FactoryBot.define do
   end
 
   factory :dummy_resource, class: "Decidim::DummyResources::DummyResource" do
+    transient do
+      users { nil }
+      # user_groups correspondence to users is by sorting order
+      user_groups { [] }
+    end
     title { generate(:name) }
     component { create(:component, manifest_name: "dummy") }
     author { create(:user, :confirmed, organization: component.organization) }
@@ -411,6 +455,33 @@ FactoryBot.define do
     trait :published do
       published_at { Time.current }
     end
+
+    trait :with_endorsements do
+      after :create do |resource|
+        5.times.collect do
+          create(:endorsement, resource: resource, author: build(:user, organization: resource.component.organization))
+        end
+      end
+    end
+  end
+
+  factory :coauthorable_dummy_resource, class: "Decidim::DummyResources::CoauthorableDummyResource" do
+    title { generate(:name) }
+    component { create(:component, manifest_name: "dummy") }
+
+    transient do
+      authors_list { [create(:user, organization: component.organization)] }
+    end
+
+    after :build do |resource, evaluator|
+      evaluator.authors_list.each do |coauthor|
+        resource.coauthorships << if coauthor.is_a?(::Decidim::UserGroup)
+                                    build(:coauthorship, author: coauthor.users.first, user_group: coauthor, coauthorable: resource, organization: evaluator.component.organization)
+                                  else
+                                    build(:coauthorship, author: coauthor, coauthorable: resource, organization: evaluator.component.organization)
+                                  end
+      end
+    end
   end
 
   factory :resource_link, class: "Decidim::ResourceLink" do
@@ -420,12 +491,25 @@ FactoryBot.define do
   end
 
   factory :newsletter, class: "Decidim::Newsletter" do
+    transient do
+      body { Decidim::Faker::Localized.wrapped("<p>", "</p>") { generate_localized_title } }
+    end
+
     author { build(:user, :confirmed, organization: organization) }
     organization
 
     subject { generate_localized_title }
 
-    body { Decidim::Faker::Localized.wrapped("<p>", "</p>") { generate_localized_title } }
+    after(:create) do |newsletter, evaluator|
+      create(
+        :content_block,
+        :newsletter_template,
+        organization: evaluator.organization,
+        scoped_resource_id: newsletter.id,
+        manifest_name: "basic_only_text",
+        settings: evaluator.body.transform_keys { |key| "body_#{key}" }
+      )
+    end
 
     trait :sent do
       sent_at { Time.current }
@@ -547,10 +631,15 @@ FactoryBot.define do
 
   factory :content_block, class: "Decidim::ContentBlock" do
     organization
-    scope { :homepage }
+    scope_name { :homepage }
     manifest_name { :hero }
     weight { 1 }
     published_at { Time.current }
+
+    trait :newsletter_template do
+      scope_name { :newsletter_template }
+      manifest_name { :basic_only_text }
+    end
   end
 
   factory :hashtag, class: "Decidim::Hashtag" do
@@ -583,4 +672,15 @@ FactoryBot.define do
       state { "rejected" }
     end
   end
+
+  factory :endorsement, class: "Decidim::Endorsement" do
+    resource { build(:dummy_resource) }
+    author { resource.try(:creator_author) || resource.try(:author) || build(:user, organization: resource.organization) }
+  end
+
+  factory :user_group_endorsement, class: "Decidim::Endorsement" do
+    resource { build(:dummy_resource) }
+    author { build(:user, organization: resource.organization) }
+    user_group { create(:user_group, verified_at: Time.current, organization: resource.organization, users: [author]) }
+  end
 end