decidim-core 0.26.10 → 0.27.0.rc1

data/app/services/decidim/resource_search.rb

@@ -1,177 +1,30 @@
 # frozen_string_literal: true
 
 module Decidim
-  # This is the base class to be used by other search services.
-  # Searchlight documentation: https://github.com/nathanl/searchlight
-  class ResourceSearch < Searchlight::Search
-    attr_reader :user, :organization, :component
+  # This is the base class to be used by other search services. This helps the
+  # searches to work with context attributes that are not passed from the user
+  # interface.
+  class ResourceSearch < Ransack::Search
+    attr_reader :user, :organization, :component, :search_context
 
-    # Initialize the Searchlight::Search base class with the options provided.
-    #
-    # scope   - The scope used to create the base query
-    # options - A hash of options to modify the search. These options will be
-    #          converted to methods by SearchLight so they can be used on filter
-    #          methods. (Default {})
-    def initialize(scope, options = {})
-      super(options)
-      @scope = scope
+    def initialize(object, params = {}, options = {})
       @user = options[:current_user] || options[:user]
       @component = options[:component]
       @organization = options[:organization] || component&.organization
-    end
-
-    # Public: Companion method to `search_search_text` which defines the
-    # attributes where we should search for text values in a model.
-    def self.text_search_fields(*fields)
-      @text_search_fields = fields if fields.any?
-      @text_search_fields
-    end
-
-    # Handle the search_text filter. We have to cast the JSONB columns
-    # into a `text` type so that we can search.
-    def search_search_text
-      return query unless self.class.text_search_fields.any?
-
-      fields = self.class.text_search_fields.dup
-
-      text_query = query.where(localized_search_text_in("#{query.model_name.plural}.#{fields.shift}"), text: "%#{search_text}%")
-
-      fields.each do |field|
-        text_query = text_query.or(query.where(localized_search_text_in("#{query.model_name.plural}.#{field}"), text: "%#{search_text}%"))
-      end
-      text_query
-    end
-
-    # Creates the SearchLight base query.
-    # Check if the option component was provided.
-    def base_query
-      raise "Missing component" unless component
-
-      @scope.where(component: component)
-    end
-
-    # Handle the category_id filter
-    def search_category_id
-      return query if category_ids.include?("all")
-
-      query
-        .includes(:categorization)
-        .where(decidim_categorizations: { decidim_category_id: all_category_ids })
-    end
-
-    # Handles the scope_ids filter. When we want to show only those that do not
-    # have a scope_ids set, we cannot pass an empty String or nil because Searchlight
-    # will automatically filter out these params, so the method will not be used.
-    # Instead, we need to pass a fake ID and then convert it inside. In this case,
-    # in order to select those elements that do not have a scope_ids set we use
-    # `"global"` as parameter, and in the method we do the needed changes to search
-    # properly.
-    def search_scope_id
-      return query if scope_ids.include?("all")
-
-      clean_scope_ids = scope_ids
-
-      conditions = []
-      conditions << "#{query.model_name.plural}.decidim_scope_id IS NULL" if clean_scope_ids.delete("global")
-      conditions.concat(["? = ANY(decidim_scopes.part_of)"] * clean_scope_ids.count) if clean_scope_ids.any?
-
-      query.includes(:scope).references(:decidim_scopes).where(Arel.sql(conditions.join(" OR ")).to_s, *clean_scope_ids.map(&:to_i))
-    end
-
-    # Handle the origin filter.
-    def search_origin
-      renamed_origin = Array(origin).map do |search_value|
-        "#{search_value}_origin"
-      end
-      apply_scopes(%w(official_origin citizens_origin user_group_origin meeting_origin), renamed_origin)
-    end
-
-    # We overwrite the `results` method to ensure we only return unique
-    # results. We can't use `#uniq` because it returns an Array and we're
-    # adding scopes in the controller, and `#distinct` doesn't work here
-    # because in the later scopes we're ordering by `RANDOM()` in a DB level,
-    # and `SELECT DISTINCT` doesn't work with `RANDOM()` sorting, so we need
-    # to perform two queries.
-    #
-    # The correct behaviour is backed by tests.
-    def results
-      base_query.model.where(id: super.pluck(:id))
-    end
-
-    private
-
-    # Private: To be used by classes that inherit from ResourceSearch.
-    #
-    # This method is useful when the values of the filters match the names of
-    # defined scopes in a model, it applies those scopes that are included in
-    # the search values.
-    #
-    # Example:
-    #   Consider you want to filter by state, and your model has an `open` and
-    #   a `closed` ActiveRecord scope.
-    #
-    #   def search_state
-    #     apply_scopes(%w(open closed), state)
-    #   end
-    #
-    #   In this scenario, the `state` variable has the input by the use, who
-    #   has selected which states they want to see. `states` here is an array
-    #   of strings.
-    #
-    # Returns an ActiveRecord::Relation.
-    def apply_scopes(scopes, search_values)
-      search_values = Array(search_values)
-
-      conditions = scopes.map do |scope|
-        search_values.member?(scope.to_s) ? query.try(scope) : nil
-      end.compact
-
-      return query unless conditions.any?
-
-      scoped_query = query.where(id: conditions.shift)
-
-      conditions.each do |condition|
-        scoped_query = scoped_query.or(query.where(id: condition))
-      end
-
-      scoped_query
-    end
-
-    # Private: Creates an array of category ids.
-    # It contains categories' subcategories ids as well.
-    def all_category_ids
-      cat_ids = category_ids.without("without")
-
-      component
-        .categories
-        .where(id: cat_ids)
-        .or(component.categories.where(parent_id: cat_ids))
-        .pluck(:id).tap { |ids| ids.prepend(nil) if category_ids.include?("without") }
-    end
-
-    # Private: Returns an array with checked category ids.
-    def category_ids
-      Array(category_id)
-    end
+      @search_context = options[:search_context] || :participants
+      configure(options)
 
-    # Private: Returns an array with checked scope ids.
-    def scope_ids
-      if scope_id.is_a?(Hash)
-        scope_id.values
-      else
-        Array(scope_id)
-      end
+      # The super method calls the build method in the super class, which can be
+      # overridden by the individual search implementations, so call this as the
+      # last thing at the initialize method. The params are passed to the
+      # build method as the only argument.
+      super
     end
 
-    # Internal: builds the needed query to search for a text in the organization's
-    # available locales. Note that it is intended to be used as follows:
-    #
-    # Example:
-    #   Resource.where(localized_search_text_for(:title, text: "my_query"))
-    #
-    # The Hash with the `:text` key is required or it won't work.
-    def localized_search_text_in(field)
-      organization.available_locales.map { |l| "#{field} ->> '#{l}' ILIKE :text" }.join(" OR ")
+    def configure(options)
+      # This can be overridden by the search implementations in order to set
+      # extra variables based on the options passed to the search class before
+      # calling the build method below.
     end
   end
 end

data/app/services/decidim/send_push_notification.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require "webpush"
+
+module Decidim
+  # This class generates a notification based on the given event, for the given
+  # resource/recipient couple. It is intended to be used by the
+  # `Decidim::NotificationGenerator` class, which schedules a job for each recipient
+  # of the event, so that we can easily control which jobs fail.
+
+  class SendPushNotification
+    include ActionView::Helpers::UrlHelper
+
+    # Send the push notification. Returns `nil` if the user didn't allowed push notifications
+    # or if the subscription to push notifications doesn't exist
+    #
+    # Returns the result of the dispatch or nil if user or subscription are empty
+    def perform(notification)
+      return unless Rails.application.secrets.vapid[:enabled]
+
+      notification.user.notifications_subscriptions.values.map do |subscription|
+        message_params = notification_params(Decidim::PushNotificationPresenter.new(notification))
+        payload = build_payload(message_params, subscription)
+        # Capture webpush exceptions in order to avoid this call to be repeated by the background job runner
+        # Webpush::Error class is the parent class of all defined errors
+        begin
+          Webpush.payload_send(**payload)
+        rescue Webpush::Error => e
+          Rails.logger.warn("[ERROR] Push notification delivery failed due to #{e.message}")
+          nil
+        end
+      end.compact
+    end
+
+    private
+
+    def notification_params(notification)
+      {
+        title: notification.title,
+        body: notification.body,
+        icon: notification.icon,
+        data: { url: notification.url }
+      }
+    end
+
+    def build_payload(message_params, subscription)
+      {
+        message: JSON.generate(message_params),
+        endpoint: subscription["endpoint"],
+        p256dh: subscription["p256dh"],
+        auth: subscription["auth"],
+        vapid: {
+          public_key: Rails.application.secrets.vapid[:public_key],
+          private_key: Rails.application.secrets.vapid[:private_key]
+        }
+      }
+    end
+  end
+end

data/app/services/decidim/traceability.rb

@@ -64,7 +64,7 @@ module Decidim
           result = block_given? ? yield : nil
           loggable_resource = resource.is_a?(Class) ? result : resource
           log(action, author, loggable_resource, extra_log_info)
-          return result
+          result
         end
       end
     end
@@ -117,7 +117,6 @@ module Decidim
       return unless user.is_a?(Decidim::User)
       # If the record is not valid, it may not yet have an ID causing an
       # exception when trying to save the log record.
-      return if resource.nil?
       return unless resource.valid?
 
       Decidim::ActionLogger.log(

data/app/uploaders/decidim/application_uploader.rb

@@ -47,11 +47,7 @@ module Decidim
       return unless attached?
 
       representable = variant(key)
-      if representable.is_a? ActiveStorage::Attached
-        Rails.application.routes.url_helpers.rails_blob_url(representable.blob, **protocol_option.merge(options))
-      else
-        Rails.application.routes.url_helpers.rails_representation_url(representable, **protocol_option.merge(options))
-      end
+      AssetRouter.new(representable).url(**options)
     end
 
     def path(options = {})
@@ -68,18 +64,12 @@ module Decidim
     def remote_url=(url)
       uri = URI.parse(url)
       filename = File.basename(uri.path)
-      file = URI.open(url)
+      file = URI.parse(url).open
       model.send(mounted_as).attach(io: file, filename: filename)
     rescue URI::InvalidURIError
       model.errors.add(mounted_as, :invalid)
     end
 
-    def protocol_option
-      return {} unless Rails.application.config.force_ssl
-
-      { protocol: "https" }
-    end
-
     class << self
       # Each class inherits variants from parents and can define their own
       # variants with the set_variants class method

data/app/uploaders/decidim/cw/attachment_uploader.rb

@@ -47,7 +47,7 @@ module Decidim::Cw
       return unless image?(self)
 
       manipulate! do |image|
-        raise CarrierWave::IntegrityError, I18n.t("carrierwave.errors.image_too_big") if image.dimensions.any? { |dimension| dimension > max_image_height_or_width }
+        raise CarrierWave::IntegrityError, I18n.t("carrierwave.errors.file_resolution_too_large") if image.dimensions.any? { |dimension| dimension > max_image_height_or_width }
 
         image
       end

data/app/uploaders/decidim/cw/{data_portability_uploader.rb → download_your_data_uploader.rb}

@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 
 module Decidim::Cw
-  # This class deals with saving data portability Zip Files to App
-  class DataPortabilityUploader < ApplicationUploader
+  # This class deals with saving download your data Zip Files to App
+  class DownloadYourDataUploader < ApplicationUploader
     # Override the directory where uploaded files will be stored.
     def store_dir
-      default_path = "uploads/data-portability/"
+      default_path = "uploads/download-your-data/"
 
       return File.join(Decidim.base_uploads_path, default_path) if Decidim.base_uploads_path.present?
 

data/app/uploaders/decidim/cw/image_uploader.rb

@@ -48,14 +48,14 @@ module Decidim::Cw
     # See https://hackerone.com/reports/390
     def validate_dimensions
       manipulate! do |image|
-        validation_error!(I18n.t("carrierwave.errors.image_too_big")) if image.dimensions.any? { |dimension| dimension > max_image_height_or_width }
+        validation_error!(I18n.t("carrierwave.errors.file_resolution_too_large")) if image.dimensions.any? { |dimension| dimension > max_image_height_or_width }
         image
       end
     end
 
     def validate_size
       manipulate! do |image|
-        validation_error!(I18n.t("carrierwave.errors.image_too_big")) if image.size > maximum_upload_size
+        validation_error!(I18n.t("carrierwave.errors.file_size_too_large")) if image.size > maximum_upload_size
         image
       end
     end

data/app/uploaders/decidim/organization_favicon_uploader.rb

@@ -4,8 +4,9 @@ module Decidim
   # This class deals with uploading an organization's favicon.
   class OrganizationFaviconUploader < ImageUploader
     SIZES = {
-      big: 152,
-      medium: 64,
+      huge: 512,
+      big: 192,
+      medium: 180,
       small: 32
     }.freeze
 

data/app/validators/etiquette_validator.rb

@@ -3,16 +3,12 @@
 # This validator takes care of ensuring the validated content is
 # respectful, doesn't use caps, and overall is meaningful.
 class EtiquetteValidator < ActiveModel::EachValidator
-  include ActionView::Helpers::SanitizeHelper
-
   def validate_each(record, attribute, value)
     return if value.blank?
 
-    text_value = strip_tags(value)
-
-    validate_caps(record, attribute, text_value)
-    validate_marks(record, attribute, text_value)
-    validate_caps_first(record, attribute, text_value)
+    validate_caps(record, attribute, value)
+    validate_marks(record, attribute, value)
+    validate_caps_first(record, attribute, value)
   end
 
   private

data/app/validators/passthru_validator.rb

@@ -18,6 +18,9 @@
 #     validates :image, passthru: { to: Person, attribute: :avatar_image }
 #   end
 class PassthruValidator < ActiveModel::EachValidator
+  # record - Form object (e.g. Decidim::UploadValidationForm)
+  # attribute - The attribute to validate (e.g. :avatar)
+  # value - Blob's signed id (e.g. "eyJfcmFpbHMi...")
   def validate_each(record, attribute, value)
     return unless target_class
 
@@ -25,12 +28,20 @@ class PassthruValidator < ActiveModel::EachValidator
 
     # Create a dummy record for which the validations are actually run on
     dummy = validation_record(record)
+    if dummy.respond_to?(dummy_attr) && !(value.class <= ActiveStorage::Attached)
+      dummy.public_send("#{dummy_attr}=", value)
+      value = dummy.public_send(dummy_attr)
+    elsif dummy.respond_to? :file
+      dummy.public_send("file=", value)
+      value = dummy.public_send(:file)
+    end
 
     target_validators(attribute).each do |validator|
       next unless validator.is_a?(ActiveModel::EachValidator)
       next unless check_validator_conditions(dummy, validator)
 
       dummy.errors.clear
+
       validator.validate_each(dummy, dummy_attr, value)
       dummy.errors[dummy_attr].each do |err|
         record.errors.add(attribute, err)
@@ -67,13 +78,12 @@ class PassthruValidator < ActiveModel::EachValidator
   end
 
   def target_instance(record)
-    instance_attributes = begin
-      if options[:with].respond_to?(:call)
-        options[:with].call(record)
-      else
-        options[:with] || {}
-      end
-    end
+    instance_attributes = if options[:with].respond_to?(:call)
+                            options[:with].call(record)
+                          else
+                            options[:with] || {}
+                          end
+
     instance_attributes.each do |key, val|
       instance_attributes[key] = val.call(record) if val.respond_to?(:call)
     end
@@ -85,24 +95,22 @@ class PassthruValidator < ActiveModel::EachValidator
 
   def check_validator_conditions(record, validator)
     if (condition = validator.options[:if])
-      if_result = begin
-        if condition.respond_to?(:call)
-          condition.call(record)
-        else
-          record.public_send(condition)
-        end
-      end
+      if_result = if condition.respond_to?(:call)
+                    condition.call(record)
+                  else
+                    record.public_send(condition)
+                  end
+
       return false unless if_result
     end
 
     if (condition = validator.options[:unless])
-      unless_result = begin
-        if condition.respond_to?(:call)
-          condition.call(record)
-        else
-          record.public_send(condition)
-        end
-      end
+      unless_result = if condition.respond_to?(:call)
+                        condition.call(record)
+                      else
+                        record.public_send(condition)
+                      end
+
       return false if unless_result
     end
 

data/app/validators/password_validator.rb

@@ -6,6 +6,8 @@ class PasswordValidator < ActiveModel::EachValidator
   MAX_LENGTH = 256
   MIN_UNIQUE_CHARACTERS = 5
   IGNORE_SIMILARITY_SHORTER_THAN = 4
+  ADMIN_MINIMUM_LENGTH = Decidim.config.admin_password_min_length
+  ADMIN_REPETITION_TIMES = Decidim.config.admin_password_repetition_times
   VALIDATION_METHODS = [
     :password_too_short?,
     :password_too_long?,
@@ -15,9 +17,16 @@ class PasswordValidator < ActiveModel::EachValidator
     :email_included_in_password?,
     :domain_included_in_password?,
     :password_too_common?,
-    :blacklisted?
+    :blacklisted?,
+    :password_repeated?
   ].freeze
 
+  def self.minimum_length_for(record)
+    return ADMIN_MINIMUM_LENGTH if record.try(:admin?) && Decidim.config.admin_password_strong
+
+    MINIMUM_LENGTH
+  end
+
   # Check if user's password is strong enough
   #
   # record - Instance of a form (e.g. Decidim::RegistrationForm) or model
@@ -35,7 +44,7 @@ class PasswordValidator < ActiveModel::EachValidator
     return true if strong?
 
     @weak_password_reasons.each do |reason|
-      record.errors[attribute] << get_message(reason)
+      record.errors.add attribute, get_message(reason)
     end
 
     false
@@ -67,7 +76,7 @@ class PasswordValidator < ActiveModel::EachValidator
   end
 
   def password_too_short?
-    value.length < MINIMUM_LENGTH
+    value.length < self.class.minimum_length_for(record)
   end
 
   def password_too_long?
@@ -82,7 +91,7 @@ class PasswordValidator < ActiveModel::EachValidator
     return false if !record.respond_to?(:name) || record.name.blank?
     return true if value.include?(record.name.delete(" "))
 
-    record.name.split(" ").each do |part|
+    record.name.split.each do |part|
       next if part.length < IGNORE_SIMILARITY_SHORTER_THAN
 
       return true if value.include?(part)
@@ -129,4 +138,16 @@ class PasswordValidator < ActiveModel::EachValidator
   def password_too_common?
     Decidim::CommonPasswords.instance.passwords.include?(value)
   end
+
+  def password_repeated?
+    return false unless Decidim.config.admin_password_strong
+    return false unless record.try(:admin?)
+    return false unless record.try(:encrypted_password_changed?)
+
+    [record.encrypted_password_was, *record.previous_passwords].compact_blank.take(ADMIN_REPETITION_TIMES).each do |encrypted_password|
+      return true if Devise::Encryptor.compare(Decidim::User, encrypted_password, value)
+    end
+
+    false
+  end
 end

data/app/validators/uploader_image_dimensions_validator.rb

@@ -28,7 +28,7 @@ class UploaderImageDimensionsValidator < ActiveModel::Validations::FileContentTy
     return unless uploader.validable_dimensions
     return if (image = extract_image(file)).blank?
 
-    record.errors.add attribute, I18n.t("carrierwave.errors.image_too_big") if image.dimensions.any? { |dimension| dimension > uploader.max_image_height_or_width }
+    record.errors.add attribute, I18n.t("carrierwave.errors.file_resolution_too_large") if image.dimensions.any? { |dimension| dimension > uploader.max_image_height_or_width }
   end
 
   def extract_image(file)

data/app/views/decidim/account/_account_notification.js.erb

@@ -0,0 +1,20 @@
+var existingNotification = document.querySelector("main > .flash.callout");
+if (existingNotification) {
+  existingNotification.classList.add("hide");
+}
+
+var accountNotification = document.querySelector(".account-notification");
+document.querySelector("main").prepend(accountNotification);
+
+if (accountNotification.querySelector(".account-message")) {
+  accountNotification.querySelector(".account-message").remove();
+}
+var messageDiv = document.createElement("div");
+messageDiv.classList.add("account-message");
+
+accountNotification.appendChild(messageDiv);
+messageDiv.innerHTML = <%== @text.to_json %>;
+
+accountNotification.classList.add("<%= @alert_class %>");
+accountNotification.classList.remove("hide");
+accountNotification.removeAttribute("style");

data/app/views/decidim/account/_password_fields.html.erb

@@ -1,2 +1,2 @@
-<%= form.password_field :password, value: form.object.password, autocomplete: "off", help_text: t("devise.passwords.edit.password_help", minimun_characters: ::PasswordValidator::MINIMUM_LENGTH) %>
-<%= form.password_field :password_confirmation, value: form.object.password_confirmation, autocomplete: "off" %>
+<%= form.password_field :password, password_field_options_for(current_user).merge(value: form.object.password) %>
+<%= form.password_field :password_confirmation, password_field_options_for(current_user).except(:help_text).merge(value: form.object.password_confirmation) %>

data/app/views/decidim/account/cancel_email_change.js.erb

@@ -0,0 +1,6 @@
+<%= render partial: "account_notification" %>
+
+if ("<%= @alert_class %>" === "success") {
+  document.querySelector("#email-change-pending").classList.add("hide");
+  document.querySelector("#user_email").disabled = false;
+}

data/app/views/decidim/account/resend_confirmation_instructions.erb

@@ -0,0 +1 @@
+<%= render partial: "account_notification" %>

data/app/views/decidim/account/show.html.erb

@@ -1,20 +1,33 @@
+<%= alert_box("", "account-notification hide", true) %>
 <% add_decidim_page_title(t("profile", scope: "layouts.decidim.user_menu")) %>
 <% content_for(:subtitle) { t("profile", scope: "layouts.decidim.user_menu") } %>
 
 <div class="row">
-  <%= decidim_form_for(@account, url: account_path, method: :put, html: { autocomplete: "off" }) do |f| %>
-    <input autocomplete="off" name="hidden" type="password" style="display:none;">
+  <%= decidim_form_for(@account, url: account_path, method: :put, html: { autocomplete: "on" }) do |f| %>
     <div class="columns large-4">
       <%= f.upload :avatar %>
     </div>
 
     <div class="columns large-8 end">
+      <% if current_user.unconfirmed_email.present? %>
+        <div id="email-change-pending" class="callout secondary">
+          <p><strong><%= t("decidim.account.email_change.title") %></strong></p>
+          <p><%= t("decidim.account.email_change.body1", unconfirmed_email: current_user.unconfirmed_email) %></p>
+          <p>
+            <%== t(
+              "decidim.account.email_change.body2",
+              resend_link: link_to(t("decidim.account.email_change.send_again"), resend_confirmation_instructions_account_path, role: :button, method: :post, remote: true),
+              cancel_link: link_to(t("decidim.account.email_change.cancel"), cancel_email_change_account_path, role: :button, method: :post, remote: true)) %>
+          </p>
+        </div>
+      <% end %>
+
       <%= form_required_explanation %>
 
-      <%= f.text_field :name %>
-      <%= f.text_field :nickname %>
-      <%= f.email_field :email %>
-      <%= f.url_field :personal_url %>
+      <%= f.text_field :name, autocomplete: "name" %>
+      <%= f.text_field :nickname, autocomplete: "nickname" %>
+      <%= f.email_field :email, disabled: current_user.unconfirmed_email.present?, autocomplete: "email" %>
+      <%= f.url_field :personal_url, autocomplete: "url" %>
       <%= f.text_area :about, rows: 5 %>
 
       <%= f.collection_select(

data/app/views/decidim/application/{_attachments.html.erb → _attachments.erb}

@@ -1,12 +1,12 @@
 <% if attached_to.attachments.any? %>
   <div class="row attachments">
     <div class="columns large-12">
-      <%= render partial: "decidim/application/documents.html", locals: { documents: attached_to.documents } %>
+      <%= render partial: "decidim/application/documents", locals: { documents: attached_to.documents } %>
     </div>
   </div>
   <div class="row attachments">
     <div class="columns large-12">
-      <%= render partial: "decidim/application/photos.html", locals: { photos: attached_to.photos } %>
+      <%= render partial: "decidim/application/photos", locals: { photos: attached_to.photos } %>
     </div>
   </div>
 <% end %>

data/app/views/decidim/application/_collection.html.erb

@@ -12,7 +12,7 @@
 
       <div class="card card--list">
         <% documents.each do |document| %>
-          <%= render partial: "decidim/application/document.html", locals: { document: document } %>
+          <%= render partial: "decidim/application/document", locals: { document: document } %>
         <% end %>
       </div>
     </div>