decidim-core 0.26.10 → 0.27.0.rc1

data/app/controllers/concerns/decidim/needs_password_change.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Decidim
+  # Force user to "Change your password" view when they need to change password
+  module NeedsPasswordChange
+    extend ActiveSupport::Concern
+
+    included do
+      before_action :check_password_update_required
+    end
+
+    private
+
+    def check_password_update_required
+      return unless request.format.html?
+      return unless current_user
+      return unless current_user.admin?
+      return unless Decidim.config.admin_password_strong
+      return unless current_user.needs_password_update?
+      return if password_update_permitted_path?(request.path)
+
+      redirect_to_change_password
+    end
+
+    def password_update_permitted_path?(target_path)
+      permitted_paths = [(tos_path if respond_to?(:tos_path, true)),
+                         decidim.delete_account_path,
+                         decidim.accept_tos_path,
+                         decidim.download_your_data_path,
+                         decidim.export_download_your_data_path,
+                         decidim.download_file_download_your_data_path,
+                         decidim.change_password_path].compact
+      # ensure that path with or without query string pass
+      permitted_paths.find { |el| el.split("?").first == target_path }
+    end
+
+    def redirect_to_change_password
+      flash[:notice] = flash[:notice] if flash[:notice]
+      flash[:secondary] = t("decidim.admin.password_change.alert")
+      redirect_to decidim.change_password_path
+    end
+  end
+end

data/app/controllers/concerns/decidim/needs_tos_accepted.rb

@@ -29,9 +29,9 @@ module Decidim
       permitted_paths = [tos_path,
                          decidim.delete_account_path,
                          decidim.accept_tos_path,
-                         decidim.data_portability_path,
-                         decidim.export_data_portability_path,
-                         decidim.download_file_data_portability_path]
+                         decidim.download_your_data_path,
+                         decidim.export_download_your_data_path,
+                         decidim.download_file_download_your_data_path]
       # ensure that path with or without query string pass
       permitted_paths.find { |el| el.split("?").first == request.path }
     end

data/app/controllers/concerns/decidim/orderable.rb

@@ -30,7 +30,7 @@ module Decidim
       # random seed at the database.
       def random_seed
         @random_seed ||= begin
-          session[:random_seed] ||= rand * 2 - 1
+          session[:random_seed] ||= (rand * 2) - 1
         end.to_f
       end
     end

data/app/controllers/concerns/decidim/participatory_space_context.rb

@@ -17,8 +17,8 @@ module Decidim
       #
       # Returns nothing.
       def participatory_space_layout(options = {})
-        layout :layout, options
-        before_action :authorize_participatory_space, options
+        layout :layout, **options
+        before_action :authorize_participatory_space, **options
       end
     end
 

data/app/controllers/concerns/decidim/resource_versions_concern.rb

@@ -10,10 +10,6 @@ module Decidim
       helper Decidim::TraceabilityHelper
       helper_method :current_version, :versioned_resource
 
-      def show
-        raise ActionController::RoutingError, "Not found" unless current_version
-      end
-
       private
 
       # Overwrite this method in your controller to define how to find the

data/app/controllers/decidim/account_controller.rb

@@ -5,6 +5,8 @@ module Decidim
   class AccountController < Decidim::ApplicationController
     include Decidim::UserProfile
 
+    helper Decidim::PasswordsHelper
+
     def show
       enforce_permission_to :show, :user, current_user: current_user
       @account = form(AccountForm).from_model(current_user)
@@ -56,8 +58,51 @@ module Decidim
       redirect_to decidim.root_path
     end
 
+    def resend_confirmation_instructions
+      enforce_permission_to :update, :user, current_user: current_user
+
+      ResendConfirmationInstructions.call(current_user) do
+        on(:ok) do
+          respond_to do |format|
+            handle_alert(:success, t("resend_successfully", scope: "decidim.account.email_change", unconfirmed_email: current_user.unconfirmed_email))
+            format.js
+          end
+        end
+
+        on(:invalid) do
+          respond_to do |format|
+            handle_alert(:alert, t("resend_error", scope: "decidim.account.email_change"))
+            format.js
+          end
+        end
+      end
+    end
+
+    def cancel_email_change
+      enforce_permission_to :update, :user, current_user: current_user
+
+      if current_user.unconfirmed_email
+        current_user.update(unconfirmed_email: nil)
+
+        respond_to do |format|
+          handle_alert(:success, t("cancel_successfully", scope: "decidim.account.email_change"))
+          format.js
+        end
+      else
+        respond_to do |format|
+          handle_alert(:alert, t("cancel_error", scope: "decidim.account.email_change"))
+          format.js
+        end
+      end
+    end
+
     private
 
+    def handle_alert(alert_class, text)
+      @alert_class = alert_class
+      @text = text
+    end
+
     def account_params
       params[:user].to_unsafe_h
     end

data/app/controllers/decidim/application_controller.rb

@@ -20,13 +20,13 @@ module Decidim
     include NeedsSnippets
     include UserBlockedChecker
     include DisableRedirectionToExternalHost
+    include NeedsPasswordChange
 
     helper Decidim::MetaTagsHelper
     helper Decidim::DecidimFormHelper
     helper Decidim::LanguageChooserHelper
     helper Decidim::ReplaceButtonsHelper
     helper Decidim::TranslationsHelper
-    helper Decidim::CookiesHelper
     helper Decidim::AriaSelectedLinkToHelper
     helper Decidim::MenuHelper
     helper Decidim::ComponentPathHelper

data/app/controllers/decidim/authorization_modals_controller.rb

@@ -17,7 +17,7 @@ module Decidim
     end
 
     def current_component
-      @current_component ||= Decidim::Component.where(participatory_space: current_organization.participatory_spaces).find(params[:component_id])
+      @current_component ||= Decidim::Component.find(params[:component_id])
     end
 
     def authorization_action

data/app/controllers/decidim/devise/invitations_controller.rb

@@ -7,6 +7,8 @@ module Decidim
       include Decidim::DeviseControllers
       include NeedsTosAccepted
 
+      helper Decidim::PasswordsHelper
+
       before_action :configure_permitted_parameters
 
       # We don't users to create invitations, so we just redirect them to the
@@ -19,7 +21,7 @@ module Decidim
       # invitation. Using the param `invite_redirect` we can redirect the user
       # to a custom path after it has accepted the invitation.
       def after_accept_path_for(resource)
-        invite_redirect_path || after_sign_in_path_for(resource)
+        params[:invite_redirect] || after_sign_in_path_for(resource)
       end
 
       # When a managed user accepts the invitation is promoted to non-managed user.
@@ -30,6 +32,7 @@ module Decidim
           resource.update!(newsletter_notifications_at: Time.current) if update_resource_params[:newsletter_notifications]
           resource.update!(managed: false) if resource.managed?
           resource.update!(accepted_tos_version: resource.organization.tos_version)
+          Decidim::Gamification.increment_score(resource.invited_by, :invitations) if resource.invited_by
         end
 
         resource
@@ -37,14 +40,6 @@ module Decidim
 
       protected
 
-      def invite_redirect_path
-        path = params[:invite_redirect]
-        return unless path
-        return unless path.starts_with?(%r{^/[a-z0-9]+})
-
-        path
-      end
-
       def configure_permitted_parameters
         devise_parameter_sanitizer.permit(:accept_invitation, keys: [:nickname, :tos_agreement, :newsletter_notifications])
       end

data/app/controllers/decidim/devise/passwords_controller.rb

@@ -6,8 +6,41 @@ module Decidim
     class PasswordsController < ::Devise::PasswordsController
       include Decidim::DeviseControllers
 
+      helper Decidim::PasswordsHelper
+
+      prepend_before_action :require_no_authentication, except: [:change_password, :apply_password]
+      skip_before_action :store_current_location
+
       before_action :check_sign_in_enabled
 
+      def change_password
+        self.resource = current_user
+        @send_path = apply_password_path
+
+        flash[:secondary] = t("decidim.admin.password_change.notification", days: Decidim.config.admin_password_expiration_days) if flash[:secondary].blank?
+        render :edit
+      end
+
+      def apply_password
+        self.resource = current_user
+        @send_path = apply_password_path
+
+        @form = Decidim::PasswordForm.from_params(params["user"])
+        Decidim::UpdatePassword.call(current_user, @form) do
+          on(:ok) do
+            flash[:notice] = t("passwords.update.success", scope: "decidim")
+            bypass_sign_in(current_user)
+            redirect_to after_sign_in_path_for current_user
+          end
+
+          on(:invalid) do
+            flash.now[:alert] = t("passwords.update.error", scope: "decidim")
+            resource.errors.errors.concat(@form.errors.errors)
+            render action: "edit"
+          end
+        end
+      end
+
       private
 
       def check_sign_in_enabled

data/app/controllers/decidim/devise/registrations_controller.rb

@@ -9,6 +9,8 @@ module Decidim
       include Decidim::DeviseControllers
       include NeedsTosAccepted
 
+      helper Decidim::PasswordsHelper
+
       before_action :check_sign_up_enabled
       before_action :configure_permitted_parameters
 
@@ -37,7 +39,7 @@ module Decidim
           end
 
           on(:invalid) do
-            flash.now[:alert] = t("error", scope: "decidim.devise.registrations.create")
+            flash.now[:alert] = @form.errors[:base].join(", ") if @form.errors[:base].any?
             render :new
           end
         end
@@ -58,10 +60,6 @@ module Decidim
         super(hash)
         resource.organization = current_organization
       end
-
-      def devise_mapping
-        ::Devise.mappings[:user]
-      end
     end
   end
 end

data/app/controllers/decidim/devise/sessions_controller.rb

@@ -22,6 +22,8 @@ module Decidim
       def after_sign_in_path_for(user)
         if user.present? && user.blocked?
           check_user_block_status(user)
+        elsif user.needs_password_update?
+          change_password_path
         elsif first_login_and_not_authorized?(user) && !user.admin? && !pending_redirect?(user)
           decidim_verifications.first_login_authorizations_path
         else

data/app/controllers/decidim/{data_portability_controller.rb → download_your_data_controller.rb}

@@ -4,7 +4,7 @@ require "zip"
 
 module Decidim
   # The controller to handle the user's download_my_data page.
-  class DataPortabilityController < Decidim::ApplicationController
+  class DownloadYourDataController < Decidim::ApplicationController
     include Decidim::UserProfile
 
     def show
@@ -16,20 +16,20 @@ module Decidim
     def export
       enforce_permission_to :export, :user, current_user: current_user
 
-      DataPortabilityExportJob.perform_later(current_user)
+      DownloadYourDataExportJob.perform_later(current_user)
 
-      flash[:notice] = t("decidim.account.data_portability_export.notice")
-      redirect_back(fallback_location: data_portability_path)
+      flash[:notice] = t("decidim.account.download_your_data_export.notice")
+      redirect_back(fallback_location: download_your_data_path)
     end
 
     def download_file
       enforce_permission_to :download, :user, current_user: current_user
 
-      if current_user.data_portability_file.attached?
-        redirect_to Rails.application.routes.url_helpers.rails_blob_url(current_user.data_portability_file.blob, only_path: true)
+      if current_user.download_your_data_file.attached?
+        redirect_to Rails.application.routes.url_helpers.rails_blob_url(current_user.download_your_data_file.blob, only_path: true)
       else
-        flash[:error] = t("decidim.account.data_portability_export.file_no_exists")
-        redirect_to data_portability_path
+        flash[:error] = t("decidim.account.download_your_data_export.file_no_exists")
+        redirect_to download_your_data_path
       end
     end
   end

data/app/controllers/decidim/groups_controller.rb

@@ -7,7 +7,6 @@ module Decidim
     include UserGroups
 
     before_action :enforce_user_groups_enabled
-    before_action :ensure_user_group_not_blocked
 
     def new
       enforce_permission_to :create, :user_group, current_user: current_user
@@ -65,6 +64,11 @@ module Decidim
           redirect_back fallback_location: profile_path(accepted_user_group.nickname)
         end
 
+        on(:last_admin) do
+          flash[:alert] = t("groups.leave.last_admin", scope: "decidim")
+          redirect_back fallback_location: profile_path(accepted_user_group.nickname)
+        end
+
         on(:invalid) do
           flash[:alert] = t("groups.leave.error", scope: "decidim")
           redirect_back fallback_location: profile_path(accepted_user_group.nickname)
@@ -74,10 +78,6 @@ module Decidim
 
     private
 
-    def ensure_user_group_not_blocked
-      raise ActionController::RoutingError, "Blocked User Group" if user_group&.blocked?
-    end
-
     def accepted_user_group
       @accepted_user_group ||= Decidim::UserGroups::AcceptedUserGroups.for(current_user).find_by(nickname: params[:id])
     end

data/app/controllers/decidim/last_activities_controller.rb

@@ -16,7 +16,7 @@ module Decidim
     def resource_types
       return @resource_types if defined?(@resource_types)
 
-      @resource_types = search.resource_types.sort_by do |klass|
+      @resource_types = ActionLog.public_resource_types.sort_by do |klass|
         klass.constantize.model_name.human
       end
 
@@ -28,19 +28,17 @@ module Decidim
     end
 
     def activities
-      @activities ||= paginate(search.results)
+      @activities ||= paginate(search.result)
     end
 
-    def search_klass
-      HomeActivitySearch
-    end
-
-    def context_params
-      { organization: current_organization }
+    def search_collection
+      ActionLog
+        .where(visibility: %w(public-only all))
+        .where(organization: current_organization)
     end
 
     def default_filter_params
-      { resource_type: "all" }
+      { with_resource_type: "all" }
     end
   end
 end

data/app/controllers/decidim/links_controller.rb

@@ -7,11 +7,9 @@ module Decidim
     skip_before_action :store_current_location
 
     helper Decidim::ExternalDomainHelper
-    helper_method :external_url
 
     before_action :parse_url
     rescue_from Decidim::InvalidUrlError, with: :invalid_url
-    rescue_from URI::InvalidURIError, with: :invalid_url
 
     def new
       headers["X-Robots-Tag"] = "noindex"
@@ -21,21 +19,24 @@ module Decidim
 
     def invalid_url
       flash[:alert] = I18n.t("decidim.links.invalid_url")
-      if request.xhr?
-        render "invalid_url"
-      else
-        redirect_to decidim.root_path
-      end
+      redirect_to decidim.root_path
     end
 
     def parse_url
-      raise Decidim::InvalidUrlError if params[:external_url].blank?
       raise Decidim::InvalidUrlError unless external_url
-      raise Decidim::InvalidUrlError unless %w(http https).include?(external_url.scheme)
+
+      parts = external_url.match %r{^(([a-z]+):)?//([^/]+)(/.*)?$}
+      raise Decidim::InvalidUrlError unless parts
+
+      @url_parts = {
+        protocol: parts[1],
+        domain: parts[3],
+        path: parts[4]
+      }
     end
 
     def external_url
-      @external_url ||= URI.parse(URI::Parser.new.escape(params[:external_url]))
+      @external_url ||= params[:external_url]
     end
   end
 end

data/app/controllers/decidim/manifests_controller.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Decidim
+  # A controller to serve the manifest file for PWA
+  class ManifestsController < Decidim::ApplicationController
+    def show
+      organization_presenter = OrganizationPresenter.new(current_organization)
+      render layout: false, locals: { organization_params: organization_presenter }, content_type: "application/manifest+json"
+    end
+  end
+end

data/app/controllers/decidim/newsletters_controller.rb

@@ -26,7 +26,7 @@ module Decidim
       user = User.find_by(decidim_organization_id: current_organization.id, id: decrypted_string.split("-").first)
       sent_at_time = Time.zone.at(decrypted_string.split("-").second.to_i)
 
-      if sent_at_time > (Time.current - 15.days)
+      if sent_at_time > (15.days.ago)
         UnsubscribeSettings.call(user) do
           on(:ok) do
             flash.now[:notice] = t("newsletters.unsubscribe.success", scope: "decidim")

data/app/controllers/decidim/notifications_subscriptions_controller.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Decidim
+  # The controller to handle the subscriptions to push notifications
+  class NotificationsSubscriptionsController < Decidim::ApplicationController
+    def create
+      Decidim::NotificationsSubscriptionsPersistor.new(current_user).add_subscription(params)
+      head :ok
+    end
+
+    def destroy
+      Decidim::NotificationsSubscriptionsPersistor.new(current_user).delete_subscription(params[:auth])
+      head :ok
+    end
+  end
+end

data/app/controllers/decidim/offline_controller.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Decidim
+  class OfflineController < Decidim::ApplicationController
+    def show; end
+  end
+end

data/app/controllers/decidim/profiles_controller.rb

@@ -13,7 +13,7 @@ module Decidim
     before_action :ensure_profile_holder
     before_action :ensure_profile_holder_is_a_group, only: [:members]
     before_action :ensure_profile_holder_is_a_user, only: [:groups, :following]
-    before_action :ensure_user_not_blocked
+    before_action :ensure_user_not_blocked, only: [:following, :followers, :badges]
 
     def show
       return redirect_to profile_timeline_path(nickname: params[:nickname]) if profile_holder == current_user
@@ -83,7 +83,7 @@ module Decidim
     def profile_holder
       return if params[:nickname].blank?
 
-      @profile_holder ||= Decidim::UserBaseEntity.find_by(nickname: params[:nickname], organization: current_organization)
+      @profile_holder ||= Decidim::UserBaseEntity.find_by("LOWER(nickname) = ? AND decidim_organization_id = ?", params[:nickname].downcase, current_organization.id)
     end
   end
 end

data/app/controllers/decidim/searches_controller.rb

@@ -2,7 +2,7 @@
 
 module Decidim
   class SearchesController < Decidim::ApplicationController
-    include Rectify::ControllerHelpers
+    include Decidim::ControllerHelpers
     include FormFactory
     include FilterResource
     include Paginable
@@ -24,8 +24,9 @@ module Decidim
     def default_filter_params
       {
         term: params[:term],
-        resource_type: nil,
-        decidim_scope_id: nil
+        with_resource_type: nil,
+        with_space_state: nil,
+        decidim_scope_id_eq: nil
       }
     end
 

data/app/controllers/decidim/short_links_controller.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Decidim
+  # Redirects users with short links to the correct location on the site.
+  class ShortLinksController < Decidim::ApplicationController
+    skip_before_action :store_current_location
+
+    # The index action redirects the user to the application root in case
+    # someone tries to request the short link URL without an identifier.
+    def index
+      redirect_to decidim.root_path, status: :moved_permanently
+    end
+
+    # Redirects the user to the target URL that the short link is set to
+    # redirect to. Raises an ActionController::RoutingError in case a short link
+    # does not exist with the given identifier.
+    #
+    # @raise [ActionController::RoutingError] if a short link does not exist
+    #   with the given identifier
+    def show
+      raise ActionController::RoutingError, "Not Found" unless link
+
+      redirect_to link.target_url, status: :moved_permanently
+    end
+
+    private
+
+    # Fetches the link based on the provided identifier in the parameters.
+    #
+    # @return [Decidim::ShortLink] The short link matching the identifier
+    def link
+      @link ||= Decidim::ShortLink.find_by(identifier: params[:id])
+    end
+  end
+end

data/app/controllers/decidim/upload_validations_controller.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Decidim
+  # The controller to handle upload validations
+  class UploadValidationsController < Decidim::ApplicationController
+    include FormFactory
+
+    skip_before_action :verify_organization
+
+    before_action :underscore_params!
+
+    def create
+      @form = form(Decidim::UploadValidationForm).from_params(params)
+
+      ValidateUpload.call(@form) do
+        on(:ok) do
+          render json: []
+        end
+
+        on(:invalid) do |errors|
+          render json: errors
+        end
+      end
+    end
+
+    def organization_time_zone
+      return Rails.application.config.time_zone unless current_organization
+
+      super
+    end
+
+    private
+
+    def ensure_authenticated!
+      return true unless current_organization
+
+      super
+    end
+
+    def underscore_params!
+      params.transform_keys!(&:underscore)
+    end
+  end
+end