decidim-core 0.26.2 → 0.27.0.rc1

data/app/controllers/decidim/account_controller.rb

@@ -5,6 +5,8 @@ module Decidim
   class AccountController < Decidim::ApplicationController
     include Decidim::UserProfile
 
+    helper Decidim::PasswordsHelper
+
     def show
       enforce_permission_to :show, :user, current_user: current_user
       @account = form(AccountForm).from_model(current_user)
@@ -56,8 +58,51 @@ module Decidim
       redirect_to decidim.root_path
     end
 
+    def resend_confirmation_instructions
+      enforce_permission_to :update, :user, current_user: current_user
+
+      ResendConfirmationInstructions.call(current_user) do
+        on(:ok) do
+          respond_to do |format|
+            handle_alert(:success, t("resend_successfully", scope: "decidim.account.email_change", unconfirmed_email: current_user.unconfirmed_email))
+            format.js
+          end
+        end
+
+        on(:invalid) do
+          respond_to do |format|
+            handle_alert(:alert, t("resend_error", scope: "decidim.account.email_change"))
+            format.js
+          end
+        end
+      end
+    end
+
+    def cancel_email_change
+      enforce_permission_to :update, :user, current_user: current_user
+
+      if current_user.unconfirmed_email
+        current_user.update(unconfirmed_email: nil)
+
+        respond_to do |format|
+          handle_alert(:success, t("cancel_successfully", scope: "decidim.account.email_change"))
+          format.js
+        end
+      else
+        respond_to do |format|
+          handle_alert(:alert, t("cancel_error", scope: "decidim.account.email_change"))
+          format.js
+        end
+      end
+    end
+
     private
 
+    def handle_alert(alert_class, text)
+      @alert_class = alert_class
+      @text = text
+    end
+
     def account_params
       params[:user].to_unsafe_h
     end

data/app/controllers/decidim/application_controller.rb

@@ -20,13 +20,13 @@ module Decidim
     include NeedsSnippets
     include UserBlockedChecker
     include DisableRedirectionToExternalHost
+    include NeedsPasswordChange
 
     helper Decidim::MetaTagsHelper
     helper Decidim::DecidimFormHelper
     helper Decidim::LanguageChooserHelper
     helper Decidim::ReplaceButtonsHelper
     helper Decidim::TranslationsHelper
-    helper Decidim::CookiesHelper
     helper Decidim::AriaSelectedLinkToHelper
     helper Decidim::MenuHelper
     helper Decidim::ComponentPathHelper

data/app/controllers/decidim/devise/invitations_controller.rb

@@ -7,6 +7,8 @@ module Decidim
       include Decidim::DeviseControllers
       include NeedsTosAccepted
 
+      helper Decidim::PasswordsHelper
+
       before_action :configure_permitted_parameters
 
       # We don't users to create invitations, so we just redirect them to the

data/app/controllers/decidim/devise/passwords_controller.rb

@@ -6,8 +6,41 @@ module Decidim
     class PasswordsController < ::Devise::PasswordsController
       include Decidim::DeviseControllers
 
+      helper Decidim::PasswordsHelper
+
+      prepend_before_action :require_no_authentication, except: [:change_password, :apply_password]
+      skip_before_action :store_current_location
+
       before_action :check_sign_in_enabled
 
+      def change_password
+        self.resource = current_user
+        @send_path = apply_password_path
+
+        flash[:secondary] = t("decidim.admin.password_change.notification", days: Decidim.config.admin_password_expiration_days) if flash[:secondary].blank?
+        render :edit
+      end
+
+      def apply_password
+        self.resource = current_user
+        @send_path = apply_password_path
+
+        @form = Decidim::PasswordForm.from_params(params["user"])
+        Decidim::UpdatePassword.call(current_user, @form) do
+          on(:ok) do
+            flash[:notice] = t("passwords.update.success", scope: "decidim")
+            bypass_sign_in(current_user)
+            redirect_to after_sign_in_path_for current_user
+          end
+
+          on(:invalid) do
+            flash.now[:alert] = t("passwords.update.error", scope: "decidim")
+            resource.errors.errors.concat(@form.errors.errors)
+            render action: "edit"
+          end
+        end
+      end
+
       private
 
       def check_sign_in_enabled

data/app/controllers/decidim/devise/registrations_controller.rb

@@ -9,6 +9,8 @@ module Decidim
       include Decidim::DeviseControllers
       include NeedsTosAccepted
 
+      helper Decidim::PasswordsHelper
+
       before_action :check_sign_up_enabled
       before_action :configure_permitted_parameters
 

data/app/controllers/decidim/devise/sessions_controller.rb

@@ -22,6 +22,8 @@ module Decidim
       def after_sign_in_path_for(user)
         if user.present? && user.blocked?
           check_user_block_status(user)
+        elsif user.needs_password_update?
+          change_password_path
         elsif first_login_and_not_authorized?(user) && !user.admin? && !pending_redirect?(user)
           decidim_verifications.first_login_authorizations_path
         else

data/app/controllers/decidim/{data_portability_controller.rb → download_your_data_controller.rb}

@@ -4,7 +4,7 @@ require "zip"
 
 module Decidim
   # The controller to handle the user's download_my_data page.
-  class DataPortabilityController < Decidim::ApplicationController
+  class DownloadYourDataController < Decidim::ApplicationController
     include Decidim::UserProfile
 
     def show
@@ -16,20 +16,20 @@ module Decidim
     def export
       enforce_permission_to :export, :user, current_user: current_user
 
-      DataPortabilityExportJob.perform_later(current_user)
+      DownloadYourDataExportJob.perform_later(current_user)
 
-      flash[:notice] = t("decidim.account.data_portability_export.notice")
-      redirect_back(fallback_location: data_portability_path)
+      flash[:notice] = t("decidim.account.download_your_data_export.notice")
+      redirect_back(fallback_location: download_your_data_path)
     end
 
     def download_file
       enforce_permission_to :download, :user, current_user: current_user
 
-      if current_user.data_portability_file.attached?
-        redirect_to Rails.application.routes.url_helpers.rails_blob_url(current_user.data_portability_file.blob, only_path: true)
+      if current_user.download_your_data_file.attached?
+        redirect_to Rails.application.routes.url_helpers.rails_blob_url(current_user.download_your_data_file.blob, only_path: true)
       else
-        flash[:error] = t("decidim.account.data_portability_export.file_no_exists")
-        redirect_to data_portability_path
+        flash[:error] = t("decidim.account.download_your_data_export.file_no_exists")
+        redirect_to download_your_data_path
       end
     end
   end

data/app/controllers/decidim/groups_controller.rb

@@ -64,6 +64,11 @@ module Decidim
           redirect_back fallback_location: profile_path(accepted_user_group.nickname)
         end
 
+        on(:last_admin) do
+          flash[:alert] = t("groups.leave.last_admin", scope: "decidim")
+          redirect_back fallback_location: profile_path(accepted_user_group.nickname)
+        end
+
         on(:invalid) do
           flash[:alert] = t("groups.leave.error", scope: "decidim")
           redirect_back fallback_location: profile_path(accepted_user_group.nickname)

data/app/controllers/decidim/last_activities_controller.rb

@@ -16,7 +16,7 @@ module Decidim
     def resource_types
       return @resource_types if defined?(@resource_types)
 
-      @resource_types = search.resource_types.sort_by do |klass|
+      @resource_types = ActionLog.public_resource_types.sort_by do |klass|
         klass.constantize.model_name.human
       end
 
@@ -28,19 +28,17 @@ module Decidim
     end
 
     def activities
-      @activities ||= paginate(search.results)
+      @activities ||= paginate(search.result)
     end
 
-    def search_klass
-      HomeActivitySearch
-    end
-
-    def context_params
-      { organization: current_organization }
+    def search_collection
+      ActionLog
+        .where(visibility: %w(public-only all))
+        .where(organization: current_organization)
     end
 
     def default_filter_params
-      { resource_type: "all" }
+      { with_resource_type: "all" }
     end
   end
 end

data/app/controllers/decidim/manifests_controller.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Decidim
+  # A controller to serve the manifest file for PWA
+  class ManifestsController < Decidim::ApplicationController
+    def show
+      organization_presenter = OrganizationPresenter.new(current_organization)
+      render layout: false, locals: { organization_params: organization_presenter }, content_type: "application/manifest+json"
+    end
+  end
+end

data/app/controllers/decidim/newsletters_controller.rb

@@ -26,7 +26,7 @@ module Decidim
       user = User.find_by(decidim_organization_id: current_organization.id, id: decrypted_string.split("-").first)
       sent_at_time = Time.zone.at(decrypted_string.split("-").second.to_i)
 
-      if sent_at_time > (Time.current - 15.days)
+      if sent_at_time > (15.days.ago)
         UnsubscribeSettings.call(user) do
           on(:ok) do
             flash.now[:notice] = t("newsletters.unsubscribe.success", scope: "decidim")

data/app/controllers/decidim/notifications_subscriptions_controller.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Decidim
+  # The controller to handle the subscriptions to push notifications
+  class NotificationsSubscriptionsController < Decidim::ApplicationController
+    def create
+      Decidim::NotificationsSubscriptionsPersistor.new(current_user).add_subscription(params)
+      head :ok
+    end
+
+    def destroy
+      Decidim::NotificationsSubscriptionsPersistor.new(current_user).delete_subscription(params[:auth])
+      head :ok
+    end
+  end
+end

data/app/controllers/decidim/offline_controller.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Decidim
+  class OfflineController < Decidim::ApplicationController
+    def show; end
+  end
+end

data/app/controllers/decidim/profiles_controller.rb

@@ -83,7 +83,7 @@ module Decidim
     def profile_holder
       return if params[:nickname].blank?
 
-      @profile_holder ||= Decidim::UserBaseEntity.find_by(nickname: params[:nickname], organization: current_organization)
+      @profile_holder ||= Decidim::UserBaseEntity.find_by("LOWER(nickname) = ? AND decidim_organization_id = ?", params[:nickname].downcase, current_organization.id)
     end
   end
 end

data/app/controllers/decidim/searches_controller.rb

@@ -2,7 +2,7 @@
 
 module Decidim
   class SearchesController < Decidim::ApplicationController
-    include Rectify::ControllerHelpers
+    include Decidim::ControllerHelpers
     include FormFactory
     include FilterResource
     include Paginable
@@ -24,8 +24,9 @@ module Decidim
     def default_filter_params
       {
         term: params[:term],
-        resource_type: nil,
-        decidim_scope_id: nil
+        with_resource_type: nil,
+        with_space_state: nil,
+        decidim_scope_id_eq: nil
       }
     end
 

data/app/controllers/decidim/short_links_controller.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Decidim
+  # Redirects users with short links to the correct location on the site.
+  class ShortLinksController < Decidim::ApplicationController
+    skip_before_action :store_current_location
+
+    # The index action redirects the user to the application root in case
+    # someone tries to request the short link URL without an identifier.
+    def index
+      redirect_to decidim.root_path, status: :moved_permanently
+    end
+
+    # Redirects the user to the target URL that the short link is set to
+    # redirect to. Raises an ActionController::RoutingError in case a short link
+    # does not exist with the given identifier.
+    #
+    # @raise [ActionController::RoutingError] if a short link does not exist
+    #   with the given identifier
+    def show
+      raise ActionController::RoutingError, "Not Found" unless link
+
+      redirect_to link.target_url, status: :moved_permanently
+    end
+
+    private
+
+    # Fetches the link based on the provided identifier in the parameters.
+    #
+    # @return [Decidim::ShortLink] The short link matching the identifier
+    def link
+      @link ||= Decidim::ShortLink.find_by(identifier: params[:id])
+    end
+  end
+end

data/app/controllers/decidim/upload_validations_controller.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Decidim
+  # The controller to handle upload validations
+  class UploadValidationsController < Decidim::ApplicationController
+    include FormFactory
+
+    skip_before_action :verify_organization
+
+    before_action :underscore_params!
+
+    def create
+      @form = form(Decidim::UploadValidationForm).from_params(params)
+
+      ValidateUpload.call(@form) do
+        on(:ok) do
+          render json: []
+        end
+
+        on(:invalid) do |errors|
+          render json: errors
+        end
+      end
+    end
+
+    def organization_time_zone
+      return Rails.application.config.time_zone unless current_organization
+
+      super
+    end
+
+    private
+
+    def ensure_authenticated!
+      return true unless current_organization
+
+      super
+    end
+
+    def underscore_params!
+      params.transform_keys!(&:underscore)
+    end
+  end
+end

data/app/controllers/decidim/user_activities_controller.rb

@@ -19,34 +19,50 @@ module Decidim
     private
 
     def user
-      @user ||= current_organization.users.find_by(nickname: params[:nickname])
+      return unless params[:nickname]
+
+      @user ||= current_organization.users.find_by("LOWER(nickname) = ?", params[:nickname].downcase)
     end
 
     def activities
       @activities ||= paginate(
-        ActivitySearch.new(
-          organization: current_organization,
-          user: user,
-          current_user: current_user,
-          resource_type: "all",
-          resource_name: filter.resource_type
-        ).run
+        if own_activities?
+          OwnActivities.new(current_organization, **activity_options).query.with_private_resources
+        else
+          PublicActivities.new(current_organization, **activity_options).query.with_all_resources
+        end
       )
     end
 
+    def activity_options
+      {
+        user: user,
+        current_user: current_user,
+        resource_name: filter.resource_type
+      }
+    end
+
+    def own_activities?
+      @own_activities ||= current_user == user
+    end
+
     def default_filter_params
       { resource_type: nil }
     end
 
     def resource_types
-      @resource_types = %w(Decidim::Proposals::CollaborativeDraft
-                           Decidim::Comments::Comment
-                           Decidim::Debates::Debate
-                           Decidim::Initiative
-                           Decidim::Meetings::Meeting
-                           Decidim::Blogs::Post
-                           Decidim::Proposals::Proposal
-                           Decidim::Consultations::Question)
+      @resource_types = begin
+        array = %w(Decidim::Proposals::CollaborativeDraft
+                   Decidim::Comments::Comment
+                   Decidim::Debates::Debate
+                   Decidim::Initiative
+                   Decidim::Meetings::Meeting
+                   Decidim::Blogs::Post
+                   Decidim::Proposals::Proposal
+                   Decidim::Consultations::Question)
+        array << "Decidim::Budgets::Order" if own_activities?
+        array
+      end
     end
   end
 end

data/app/controllers/decidim/user_interests_controller.rb

@@ -5,8 +5,6 @@ module Decidim
   class UserInterestsController < Decidim::ApplicationController
     include Decidim::UserProfile
 
-    helper_method :scopes
-
     def show
       enforce_permission_to :read, :user, current_user: current_user
       @user_interests = form(UserInterestsForm).from_model(current_user)

data/app/controllers/decidim/user_timeline_controller.rb

@@ -18,21 +18,19 @@ module Decidim
     private
 
     def user
-      @user ||= Decidim::User.find_by(
-        organization: current_organization,
-        nickname: params[:nickname]
-      )
+      return unless params[:nickname]
+
+      @user ||= current_organization.users.find_by("LOWER(nickname) = ?", params[:nickname].downcase)
     end
 
     def activities
       @activities ||= paginate(
-        ActivitySearch.new(
-          organization: current_organization,
-          resource_type: "all",
+        PublicActivities.new(
+          current_organization,
           scopes: current_user.interested_scopes,
           follows: follows,
           resource_name: filter.resource_type
-        ).run
+        ).query.with_resource_type("all")
       )
     end
 

data/app/events/decidim/change_nickname_event.rb

@@ -0,0 +1,21 @@
+# frozen-string_literal: true
+
+module Decidim
+  class ChangeNicknameEvent < Decidim::Events::SimpleEvent
+    include Decidim::Events::NotificationEvent
+    delegate :organization, to: :user, prefix: false
+    delegate :url_helpers, to: "Decidim::Core::Engine.routes"
+
+    i18n_attributes :link_to_account_settings
+
+    def notification_title
+      I18n.t("decidim.events.nickname_event.notification_body", **i18n_options).to_s.html_safe
+    end
+
+    def i18n_options
+      {
+        link_to_account_settings: url_helpers.account_path
+      }
+    end
+  end
+end

data/app/forms/decidim/account_form.rb

@@ -2,7 +2,7 @@
 
 module Decidim
   # The form object that handles the data behind updating a user's
-  # account in her profile page.
+  # account in their profile page.
   class AccountForm < Form
     include Decidim::HasUploadValidations
 
@@ -20,7 +20,7 @@ module Decidim
     attribute :about
 
     validates :name, presence: true
-    validates :email, presence: true, 'valid_email_2/email': { disposable: true }
+    validates :email, presence: true, "valid_email_2/email": { disposable: true }
     validates :nickname, presence: true, format: Decidim::User::REGEXP_NICKNAME
 
     validates :nickname, length: { maximum: Decidim::User.nickname_max_length, allow_blank: true }
@@ -50,7 +50,7 @@ module Decidim
     end
 
     def unique_email
-      return true if Decidim::User.where(
+      return true if Decidim::UserBaseEntity.where(
         organization: context.current_organization,
         email: email
       ).where.not(id: context.current_user.id).empty?
@@ -60,9 +60,10 @@ module Decidim
     end
 
     def unique_nickname
-      return true if Decidim::User.where(
-        organization: context.current_organization,
-        nickname: nickname
+      return true if Decidim::UserBaseEntity.where(
+        "decidim_organization_id = ? AND LOWER(nickname) = ? ",
+        context.current_organization.id,
+        nickname.downcase
       ).where.not(id: context.current_user.id).empty?
 
       errors.add :nickname, :taken

data/app/forms/decidim/form.rb

@@ -3,7 +3,7 @@
 module Decidim
   # A base form object to hold common logic, like automatically adding as
   # public method the params sent as context by the `FormFactory` concern.
-  class Form < Rectify::Form
+  class Form < Decidim::AttributeObject::Form
     delegate :current_organization,
              :current_user,
              :current_component,

data/app/forms/decidim/messaging/conversation_form.rb

@@ -7,7 +7,7 @@ module Decidim
       mimic :conversation
 
       attribute :body, Decidim::Attributes::CleanString
-      attribute :recipient_id, Integer
+      attribute :recipient_id, [Integer]
 
       validates :body, :recipient, presence: true, length: { maximum: Decidim.config.maximum_conversation_message_length }
       validate :check_recipient

data/app/forms/decidim/notifications_settings_form.rb

@@ -2,22 +2,24 @@
 
 module Decidim
   # The form object that handles the data behind updating a user's
-  # notifications settings in her profile page.
+  # notifications settings in their profile page.
   class NotificationsSettingsForm < Form
     mimic :user
 
-    attribute :email_on_notification, Boolean
     attribute :email_on_moderations, Boolean
     attribute :newsletter_notifications, Boolean
     attribute :notifications_from_followed, Boolean
     attribute :notifications_from_own_activity, Boolean
     attribute :allow_public_contact, Boolean
+    attribute :notification_settings, Hash
+    attribute :notifications_sending_frequency, String
 
     def map_model(user)
       self.newsletter_notifications = user.newsletter_notifications_at.present?
       self.notifications_from_followed = ["all", "followed-only"].include? user.notification_types
       self.notifications_from_own_activity = ["all", "own-only"].include? user.notification_types
       self.allow_public_contact = user.direct_message_types == "all"
+      self.notifications_sending_frequency = user.notifications_sending_frequency
     end
 
     def newsletter_notifications_at
@@ -49,5 +51,9 @@ module Decidim
       end
       false
     end
+
+    def meet_push_notifications_requirements?
+      Rails.application.secrets.vapid[:enabled]
+    end
   end
 end

data/app/forms/decidim/password_form.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module Decidim
+  class PasswordForm < Form
+    attribute :password
+    attribute :password_confirmation
+
+    validates :password, confirmation: true
+  end
+end

data/app/forms/decidim/registration_form.rb

@@ -15,8 +15,8 @@ module Decidim
     attribute :current_locale, String
 
     validates :name, presence: true
-    validates :nickname, presence: true, format: /\A[\w\-]+\z/, length: { maximum: Decidim::User.nickname_max_length }
-    validates :email, presence: true, 'valid_email_2/email': { disposable: true }
+    validates :nickname, presence: true, format: Decidim::User::REGEXP_NICKNAME, length: { maximum: Decidim::User.nickname_max_length }
+    validates :email, presence: true, "valid_email_2/email": { disposable: true }
     validates :password, confirmation: true
     validates :password, password: { name: :name, email: :email, username: :nickname }
     validates :password_confirmation, presence: true
@@ -35,11 +35,17 @@ module Decidim
     private
 
     def email_unique_in_organization
-      errors.add :email, :taken if User.no_active_invitation.find_by(email: email, organization: current_organization).present?
+      errors.add :email, :taken if valid_users.find_by(email: email, organization: current_organization).present?
     end
 
     def nickname_unique_in_organization
-      errors.add :nickname, :taken if User.no_active_invitation.find_by(nickname: nickname, organization: current_organization).present?
+      return false unless nickname
+
+      errors.add :nickname, :taken if valid_users.find_by("LOWER(nickname)= ? AND decidim_organization_id = ?", nickname.downcase, current_organization.id).present?
+    end
+
+    def valid_users
+      UserBaseEntity.where(invitation_token: nil)
     end
 
     def no_pending_invitations_exist