decidim-core 0.22.0 → 0.23.0

data/app/models/decidim/static_page.rb

@@ -10,6 +10,9 @@ module Decidim
   class StaticPage < ApplicationRecord
     include Decidim::Traceable
     include Decidim::Loggable
+    include Decidim::TranslatableResource
+
+    translatable_fields :title, :content
 
     belongs_to :organization, foreign_key: "decidim_organization_id", class_name: "Decidim::Organization", inverse_of: :static_pages
     belongs_to :topic, foreign_key: "topic_id", class_name: "Decidim::StaticPageTopic", optional: true
@@ -19,7 +22,7 @@ module Decidim
 
     # These pages will be created by default when registering an organization
     # and cannot be deleted.
-    DEFAULT_PAGES = %w(faq terms-and-conditions accessibility).freeze
+    DEFAULT_PAGES = %w(terms-and-conditions).freeze
 
     after_create :update_organization_tos_version
     before_destroy :can_be_destroyed?

data/app/models/decidim/static_page_topic.rb

@@ -3,6 +3,9 @@
 module Decidim
   class StaticPageTopic < ApplicationRecord
     validates :title, presence: true
+    include Decidim::TranslatableResource
+
+    translatable_fields :title, :description
 
     default_scope { order(arel_table[:weight].asc) }
 

data/app/models/decidim/user_base_entity.rb

@@ -11,15 +11,19 @@ module Decidim
     include Resourceable
     include Decidim::Followable
     include Decidim::Loggable
+    include Decidim::HasUploadValidations
 
     belongs_to :organization, foreign_key: "decidim_organization_id", class_name: "Decidim::Organization"
     has_many :notifications, foreign_key: "decidim_user_id", class_name: "Decidim::Notification", dependent: :destroy
     has_many :following_follows, foreign_key: "decidim_user_id", class_name: "Decidim::Follow", dependent: :destroy
 
-    validates :avatar, file_size: { less_than_or_equal_to: ->(_record) { Decidim.maximum_avatar_size } }
+    # Regex for name & nickname format validations
+    REGEXP_NAME = /\A(?!.*[<>?%&\^*#@\(\)\[\]\=\+\:\;\"\{\}\\\|])/.freeze
+
+    validates_avatar
     mount_uploader :avatar, Decidim::AvatarUploader
 
-    validates :name, :nickname, format: { with: /\A(?!.*[<>?%&\^*#@\(\)\[\]\=\+\:\;\"\{\}\\\|])/ }
+    validates :name, :nickname, format: { with: REGEXP_NAME }
 
     # Public: Returns a collection with all the entities this user is following.
     #

data/app/permissions/decidim/permissions.rb

@@ -46,6 +46,7 @@ module Decidim
                     permission_action.action == :read
 
       return allow! if component.published?
+      return allow! if user_can_preview_component?
       return allow! if user_can_admin_component?
       return allow! if user_can_admin_component_via_space?
 
@@ -152,6 +153,14 @@ module Decidim
       allow! if permission_action.subject == :user_group_invitations
     end
 
+    def user_can_preview_component?
+      return allow! if context[:share_token].present? && Decidim::ShareToken.use!(token_for: component, token: context[:share_token])
+    rescue ActiveRecord::RecordNotFound
+      nil
+    rescue StandardError
+      nil
+    end
+
     def user_can_admin_component?
       new_permission_action = Decidim::PermissionAction.new(
         action: permission_action.action,

data/app/presenters/decidim/log/base_presenter.rb

@@ -190,7 +190,7 @@ module Decidim
       def i18n_params
         {
           user_name: user_presenter.present,
-          resource_name: resource_presenter.present,
+          resource_name: resource_presenter.try(:present),
           space_name: space_presenter.present
         }
       end

data/app/presenters/decidim/log/value_types/default_presenter.rb

@@ -16,7 +16,7 @@ module Decidim
       #
       # Check the other presenters in this folder for more examples.
       class DefaultPresenter
-        # value - the vakue to render, can be of any type.
+        # value - the value to render, can be of any type.
         # view_helpers - an object encapsulating all the view helpers,
         #   it will most likely come from the top of the chain.
         def initialize(value, view_helpers)

data/app/presenters/decidim/official_author_presenter.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Decidim
+  #
+  # A dummy presenter to abstract out the author of an official resource.
+  #
+  class OfficialAuthorPresenter
+    def nickname
+      ""
+    end
+
+    def badge
+      ""
+    end
+
+    def profile_path
+      ""
+    end
+
+    def avatar_url
+      ActionController::Base.helpers.asset_path("decidim/default-avatar.svg")
+    end
+
+    def deleted?
+      false
+    end
+
+    def can_be_contacted?
+      false
+    end
+
+    def has_tooltip?
+      false
+    end
+  end
+end

data/app/presenters/decidim/resource_locator_presenter.rb

@@ -2,6 +2,7 @@
 
 module Decidim
   # A presenter to get the url or path from a resource.
+  # resource - a record or array of nested records.
   class ResourceLocatorPresenter
     def initialize(resource)
       @resource = resource
@@ -26,7 +27,7 @@ module Decidim
     #
     # Returns a String.
     def url(options = {})
-      member_route("url", options.merge(host: resource.organization.host))
+      member_route("url", options.merge(host: root_resource.organization.host))
     end
 
     # Builds the index path to the associated collection of resources.
@@ -53,7 +54,9 @@ module Decidim
     #
     # Returns a String.
     def show(options = {})
-      admin_route_proxy.send("#{member_route_name}_path", resource, options)
+      options.merge!(options_for_polymorphic)
+
+      admin_route_proxy.send("#{member_route_name}_path", target, options)
     end
 
     # Builds the admin edit path to the resource.
@@ -62,53 +65,101 @@ module Decidim
     #
     # Returns a String.
     def edit(options = {})
-      admin_route_proxy.send("edit_#{member_route_name}_path", resource, options)
+      options.merge!(options_for_polymorphic)
+
+      admin_route_proxy.send("edit_#{member_route_name}_path", target, options)
     end
 
     private
 
+    def polymorphic?
+      resource.is_a? Array
+    end
+
+    def target
+      if polymorphic?
+        resource.last
+      else
+        resource
+      end
+    end
+
+    def root_resource
+      if polymorphic?
+        resource.first
+      else
+        resource
+      end
+    end
+
     # Private: Build the route to the resource.
     #
     # Returns a String.
     def member_route(route_type, options)
-      route_proxy.send("#{member_route_name}_#{route_type}", resource, options)
+      options.merge!(options_for_polymorphic)
+
+      route_proxy.send("#{member_route_name}_#{route_type}", target, options)
     end
 
     # Private: Build the route to the associated collection of resources.
     #
     # Returns a String.
     def collection_route(route_type, options)
+      options.merge!(options_for_polymorphic)
+
       route_proxy.send("#{collection_route_name}_#{route_type}", options)
     end
 
     def admin_collection_route(route_type, options)
+      options.merge!(options_for_polymorphic)
+
       admin_route_proxy.send("#{collection_route_name}_#{route_type}", options)
     end
 
-    def manifest
-      resource.try(:resource_manifest) ||
-        resource.class.try(:resource_manifest) ||
-        resource.class.try(:participatory_space_manifest)
+    def manifest_for(record)
+      record.try(:resource_manifest) ||
+        record.class.try(:resource_manifest) ||
+        record.class.try(:participatory_space_manifest)
     end
 
     def component
-      resource.component if resource.respond_to?(:component)
+      root_resource.try(:component)
     end
 
     def member_route_name
-      manifest.route_name
+      if polymorphic?
+        polymorphic_member_route_name
+      else
+        manifest_for(target).route_name
+      end
+    end
+
+    def polymorphic_member_route_name
+      return unless polymorphic?
+
+      resource.map { |record| manifest_for(record).route_name }.join("_")
     end
 
     def collection_route_name
       member_route_name.pluralize
     end
 
+    def options_for_polymorphic
+      return {} unless polymorphic?
+
+      parent_resources = {}
+      (resource - [target]).each do |parent|
+        parent_resources["#{manifest_for(parent).route_name}_id"] = parent.id
+      end
+      parent_resources
+    end
+
     def route_proxy
-      @route_proxy ||= EngineRouter.main_proxy(component || resource)
+      @route_proxy ||= EngineRouter.main_proxy(component || target)
     end
 
     def admin_route_proxy
-      @admin_route_proxy ||= EngineRouter.admin_proxy(component || resource)
+      @admin_route_proxy ||= EngineRouter.admin_proxy(component || target)
     end
   end
 end

data/app/queries/decidim/similar_emendations.rb

@@ -30,8 +30,8 @@ module Decidim
                 .not_hidden
                 .where(
                   "GREATEST(#{title_similarity}, #{body_similarity}) >= ?",
-                  emendation.title,
-                  emendation.body,
+                  translated_attribute(emendation.title),
+                  translated_attribute(emendation.body),
                   amendable_module.similarity_threshold
                 )
                 .limit(amendable_module.similarity_limit)
@@ -46,11 +46,11 @@ module Decidim
     end
 
     def title_similarity
-      "similarity(title, ?)"
+      "similarity(title::text, ?)"
     end
 
     def body_similarity
-      "similarity(body, ?)"
+      "similarity(body::text, ?)"
     end
   end
 end

data/app/scrubbers/decidim/user_input_scrubber.rb

@@ -21,7 +21,7 @@ module Decidim
     private
 
     def custom_allowed_attributes
-      Loofah::HTML5::SafeList::ALLOWED_ATTRIBUTES + %w(frameborder allowfullscreen)
+      Loofah::HTML5::SafeList::ALLOWED_ATTRIBUTES + %w(frameborder allowfullscreen) - %w(onerror)
     end
 
     def custom_allowed_tags

data/app/serializers/decidim/importers/participatory_space_components_importer.rb

@@ -64,7 +64,7 @@ module Decidim
       end
 
       def override_step_settings_ids(attributes, step_settings)
-        return if step_settings.nil?
+        return unless @participatory_space.has_steps? && step_settings.present?
 
         @participatory_space.steps.each do |step|
           old_id = attributes["settings"]["steps"].keys.first

data/app/services/decidim/base_diff_renderer.rb

@@ -59,6 +59,22 @@ module Decidim
       diff
     end
 
+    def parse_user_group_changeset(attribute, values, type, diff)
+      return unless diff
+
+      old_user_group = Decidim::UserGroup.find_by(id: values[0])
+      new_user_group = Decidim::UserGroup.find_by(id: values[1])
+
+      diff.update(
+        attribute => {
+          type: type,
+          label: I18n.t(attribute, scope: i18n_scope),
+          old_value: old_user_group ? translated_attribute(old_user_group.name) : "",
+          new_value: new_user_group ? translated_attribute(new_user_group.name) : ""
+        }
+      )
+    end
+
     def parse_scope_changeset(attribute, values, type, diff)
       return unless diff
 
@@ -79,6 +95,7 @@ module Decidim
       return parse_i18n_changeset(attribute, values, type, diff) if [:i18n, :i18n_html].include?(type)
 
       return parse_scope_changeset(attribute, values, type, diff) if type == :scope
+      return parse_user_group_changeset(attribute, values, type, diff) if type == :user_group
 
       diff.update(
         attribute => {

data/app/services/decidim/open_data_exporter.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "zip"
+
 module Decidim
   # Public: It generates a ZIP file with Open Data CSV files ready
   # to be uploaded somewhere so users can download an organization

data/app/services/decidim/resource_search.rb

@@ -4,6 +4,8 @@ module Decidim
   # This is the base class to be used by other search services.
   # Searchlight documentation: https://github.com/nathanl/searchlight
   class ResourceSearch < Searchlight::Search
+    attr_reader :user, :organization, :component
+
     # Initialize the Searchlight::Search base class with the options provided.
     #
     # scope   - The scope used to create the base query
@@ -13,6 +15,31 @@ module Decidim
     def initialize(scope, options = {})
       super(options)
       @scope = scope
+      @user = options[:current_user] || options[:user]
+      @component = options[:component]
+      @organization = options[:organization] || component&.organization
+    end
+
+    # Public: Companion method to `search_search_text` which defines the
+    # attributes where we should search for text values in a model.
+    def self.text_search_fields(*fields)
+      @text_search_fields = fields if fields.any?
+      @text_search_fields
+    end
+
+    # Handle the search_text filter. We have to cast the JSONB columns
+    # into a `text` type so that we can search.
+    def search_search_text
+      return query unless self.class.text_search_fields.any?
+
+      fields = self.class.text_search_fields.dup
+
+      text_query = query.where(localized_search_text_in("#{query.model_name.plural}.#{fields.shift}"), text: "%#{search_text}%")
+
+      fields.each do |field|
+        text_query = text_query.or(query.where(localized_search_text_in("#{query.model_name.plural}.#{field}"), text: "%#{search_text}%"))
+      end
+      text_query
     end
 
     # Creates the SearchLight base query.
@@ -51,8 +78,65 @@ module Decidim
       query.includes(:scope).references(:decidim_scopes).where(conditions.join(" OR "), *clean_scope_ids.map(&:to_i))
     end
 
+    # Handle the origin filter.
+    def search_origin
+      renamed_origin = Array(origin).map do |search_value|
+        "#{search_value}_origin"
+      end
+      apply_scopes(%w(official_origin citizens_origin user_group_origin meeting_origin), renamed_origin)
+    end
+
+    # We overwrite the `results` method to ensure we only return unique
+    # results. We can't use `#uniq` because it returns an Array and we're
+    # adding scopes in the controller, and `#distinct` doesn't work here
+    # because in the later scopes we're ordering by `RANDOM()` in a DB level,
+    # and `SELECT DISTINCT` doesn't work with `RANDOM()` sorting, so we need
+    # to perform two queries.
+    #
+    # The correct behaviour is backed by tests.
+    def results
+      base_query.model.where(id: super.pluck(:id))
+    end
+
     private
 
+    # Private: To be used by classes that inherit from ResourceSearch.
+    #
+    # This method is useful when the values of the filters match the names of
+    # defined scopes in a model, it applies those scopes that are included in
+    # the search values.
+    #
+    # Example:
+    #   Consider you want to filter by state, and your model has an `open` and
+    #   a `closed` ActiveRecord scope.
+    #
+    #   def search_state
+    #     apply_scopes(%w(open closed), state)
+    #   end
+    #
+    #   In this scenario, the `state` variable has the input by the use, who
+    #   has selected which states they want to see. `states` here is an array
+    #   of strings.
+    #
+    # Returns an ActiveRecord::Relation.
+    def apply_scopes(scopes, search_values)
+      search_values = Array(search_values)
+
+      conditions = scopes.map do |scope|
+        search_values.member?(scope.to_s) ? query.try(scope) : nil
+      end.compact
+
+      return query unless conditions.any?
+
+      scoped_query = query.where(id: conditions.shift)
+
+      conditions.each do |condition|
+        scoped_query = scoped_query.or(query.where(id: condition))
+      end
+
+      scoped_query
+    end
+
     # Private: Creates an array of category ids.
     # It contains categories' subcategories ids as well.
     def all_category_ids
@@ -67,7 +151,7 @@ module Decidim
 
     # Private: Returns an array with checked category ids.
     def category_ids
-      [category_id].flatten
+      Array(category_id)
     end
 
     # Private: Returns an array with checked scope ids.
@@ -75,14 +159,19 @@ module Decidim
       if scope_id.is_a?(Hash)
         scope_id.values
       else
-        [scope_id].flatten
+        Array(scope_id)
       end
     end
 
-    # Private: Since component is not used by a search method we need
-    # to define the method manually.
-    def component
-      options[:component]
+    # Internal: builds the needed query to search for a text in the organization's
+    # available locales. Note that it is intended to be used as follows:
+    #
+    # Example:
+    #   Resource.where(localized_search_text_for(:title, text: "my_query"))
+    #
+    # The Hash with the `:text` key is required or it won't work.
+    def localized_search_text_in(field)
+      organization.available_locales.map { |l| "#{field} ->> '#{l}' ILIKE :text" }.join(" OR ")
     end
   end
 end