decidim-core 0.26.4 → 0.27.0.rc1

data/db/migrate/20220524195530_create_decidim_short_links.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+class CreateDecidimShortLinks < ActiveRecord::Migration[6.1]
+  def change
+    create_table :decidim_short_links do |t|
+      t.references :decidim_organization, null: false, index: true
+      t.references :target, polymorphic: true, null: false, index: true
+      t.string :identifier, limit: 10, null: false
+      t.string :mounted_engine_name, index: true
+      t.string :route_name, index: true
+      t.jsonb :params
+
+      t.timestamps
+    end
+
+    add_index(
+      :decidim_short_links,
+      [:decidim_organization_id, :identifier],
+      unique: true,
+      name: "idx_decidim_short_links_organization_id_identifier"
+    )
+  end
+end

data/db/seeds.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-if !Rails.env.production? || ENV["SEED"]
+if !Rails.env.production? || ENV.fetch("SEED", nil)
   print "Creating seeds for decidim-core...\n" unless Rails.env.test?
 
   require "decidim/faker/localized"
@@ -17,8 +17,8 @@ if !Rails.env.production? || ENV["SEED"]
     table.tr("_", "/").classify.safe_constantize
   end.compact.each(&:reset_column_information)
 
-  smtp_label = ENV["SMTP_FROM_LABEL"] || Faker::Twitter.unique.screen_name
-  smtp_email = ENV["SMTP_FROM_EMAIL"] || Faker::Internet.email
+  smtp_label = ENV.fetch("SMTP_FROM_LABEL", Faker::Twitter.unique.screen_name)
+  smtp_email = ENV.fetch("SMTP_FROM_EMAIL", Faker::Internet.email)
 
   organization = Decidim::Organization.first || Decidim::Organization.create!(
     name: Faker::Company.name,
@@ -31,12 +31,12 @@ if !Rails.env.production? || ENV["SEED"]
       from: "#{smtp_label} <#{smtp_email}>",
       from_email: smtp_email,
       from_label: smtp_label,
-      user_name: ENV["SMTP_USERNAME"] || Faker::Twitter.unique.screen_name,
-      encrypted_password: Decidim::AttributeEncryptor.encrypt(ENV["SMTP_PASSWORD"] || Faker::Internet.password(min_length: 8)),
-      address: ENV["SMTP_ADDRESS"] || ENV["DECIDIM_HOST"] || "localhost",
-      port: ENV["SMTP_PORT"] || ENV["DECIDIM_SMTP_PORT"] || "25"
+      user_name: ENV.fetch("SMTP_USERNAME", Faker::Twitter.unique.screen_name),
+      encrypted_password: Decidim::AttributeEncryptor.encrypt(ENV.fetch("SMTP_PASSWORD", Faker::Internet.password(min_length: 8))),
+      address: ENV.fetch("SMTP_ADDRESS", nil) || ENV.fetch("DECIDIM_HOST", "localhost"),
+      port: ENV.fetch("SMTP_PORT", nil) || ENV.fetch("DECIDIM_SMTP_PORT", "25")
     },
-    host: ENV["DECIDIM_HOST"] || "localhost",
+    host: ENV.fetch("DECIDIM_HOST", "localhost"),
     external_domain_whitelist: ["decidim.org", "github.com"],
     description: Decidim::Faker::Localized.wrapped("<p>", "</p>") do
       Decidim::Faker::Localized.sentence(word_count: 15)
@@ -115,12 +115,9 @@ if !Rails.env.production? || ENV["SEED"]
   end
 
   admin = Decidim::User.find_or_initialize_by(email: "admin@example.org")
-
-  admin.update!(
+  admin_hash = {
     name: Faker::Name.name,
     nickname: Faker::Twitter.unique.screen_name,
-    password: "decidim123456",
-    password_confirmation: "decidim123456",
     organization: organization,
     confirmed_at: Time.current,
     locale: I18n.default_locale,
@@ -130,14 +127,16 @@ if !Rails.env.production? || ENV["SEED"]
     about: Faker::Lorem.paragraph(sentence_count: 2),
     accepted_tos_version: organization.tos_version,
     admin_terms_accepted_at: Time.current
-  )
+  }
+  admin_hash.merge!(password: "decidim123456789", password_confirmation: "decidim123456789") if admin.encrypted_password.blank?
+  admin.update!(admin_hash)
 
   ["user@example.org", "user2@example.org"].each do |email|
     Decidim::User.find_or_initialize_by(email: email).update!(
       name: Faker::Name.name,
       nickname: Faker::Twitter.unique.screen_name,
-      password: "decidim123456",
-      password_confirmation: "decidim123456",
+      password: "decidim123456789",
+      password_confirmation: "decidim123456789",
       confirmed_at: Time.current,
       locale: I18n.default_locale,
       organization: organization,
@@ -155,8 +154,8 @@ if !Rails.env.production? || ENV["SEED"]
   locked_user.update!(
     name: Faker::Name.name,
     nickname: Faker::Twitter.unique.screen_name,
-    password: "decidim123456",
-    password_confirmation: "decidim123456",
+    password: "decidim123456789",
+    password_confirmation: "decidim123456789",
     confirmed_at: Time.current,
     locale: I18n.default_locale,
     organization: organization,
@@ -211,7 +210,7 @@ if !Rails.env.production? || ENV["SEED"]
   Decidim::System::CreateDefaultContentBlocks.call(organization)
 
   hero_content_block = Decidim::ContentBlock.find_by(organization: organization, manifest_name: :hero, scope_name: :homepage)
-  hero_content_block.images_container.background_image = ActiveStorage::Blob.create_after_upload!(
+  hero_content_block.images_container.background_image = ActiveStorage::Blob.create_and_upload!(
     io: File.open(File.join(seeds_root, "homepage_image.jpg")),
     filename: "homepage_image.jpg",
     content_type: "image/jpeg",

data/lib/decidim/acts_as_tree.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module Decidim
+  module ActsAsTree
+    extend ActiveSupport::Concern
+
+    included do
+      @parent_item_foreign_key = :parent_id
+    end
+
+    class_methods do
+      def parent_item_foreign_key(name = nil)
+        return @parent_item_foreign_key unless name
+
+        @parent_item_foreign_key = name
+      end
+
+      def tree_for(item)
+        where(Arel.sql("#{table_name}.id IN (#{tree_sql_for(item)})")).order("#{table_name}.id")
+      end
+
+      def tree_sql_for(item)
+        <<-SQL.squish
+        WITH RECURSIVE search_tree(id, path) AS (
+          SELECT id, ARRAY[id]
+          FROM #{table_name}
+          WHERE id = #{item.id}
+            UNION ALL
+          SELECT #{table_name}.id, path || #{table_name}.id
+            FROM search_tree
+          JOIN #{table_name} ON #{table_name}.#{parent_item_foreign_key} = search_tree.id
+            WHERE NOT #{table_name}.id = ANY(path)
+        )
+        SELECT id FROM search_tree ORDER BY path
+        SQL
+      end
+    end
+
+    def descendants
+      @descendants ||= self_and_descendants.where.not(id: id)
+    end
+
+    def self_and_descendants
+      @self_and_descendants ||= self.class.tree_for(self)
+    end
+  end
+end

data/lib/decidim/api/input_sorts/component_input_sort.rb

@@ -23,7 +23,8 @@ module Decidim
                prepare: lambda { |direction, ctx|
                           lambda { |locale|
                             locale = ctx[:current_organization].default_locale if locale.blank?
-                            [Arel.sql("name->? #{direction.upcase}").to_s, locale]
+                            field = Arel::Nodes::InfixOperation.new("->", Arel.sql("name"), Arel::Nodes.build_quoted(locale))
+                            Arel::Nodes::InfixOperation.new("", field, Arel.sql(direction.upcase))
                           }
                         }
     end

data/lib/decidim/api/interfaces/authorable_interface.rb

@@ -12,11 +12,12 @@ module Decidim
       end
 
       def author
-        if object.respond_to?(:normalized_author)
-          object&.normalized_author
-        elsif object.respond_to?(:creator_identity)
-          object&.creator_identity
-        end
+        author = if object.respond_to?(:normalized_author)
+                   object&.normalized_author
+                 elsif object.respond_to?(:creator_identity)
+                   object&.creator_identity
+                 end
+        author if author.is_a?(Decidim::UserBaseEntity)
       end
     end
   end

data/lib/decidim/asset_router.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+module Decidim
+  # Asset router provides global access to the asset routes for assets saved
+  # through ActiveStorage. This handles the different cases for routing to the
+  # remote routes when using an assets CDN or to local routes when using the
+  # local disk storage driver.
+  class AssetRouter
+    # Initializes the router.
+    #
+    # @param [ActiveStorage::Attached, ActiveStorage::Blob] The asset to route
+    #   to
+    def initialize(asset)
+      @asset = asset
+    end
+
+    # Generates the correct URL to the asset with the provided options.
+    #
+    # @param options The options for the URL that are the normal route options
+    #   Rails route helpers accept
+    def url(**options)
+      if asset.is_a? ActiveStorage::Attached
+        routes.rails_blob_url(asset.blob, **default_options.merge(options))
+      else
+        routes.rails_representation_url(asset, **default_options.merge(options))
+      end
+    end
+
+    private
+
+    attr_reader :asset
+
+    # Provides the route helpers depending on whether the URL is generated to
+    # the local host or an external CDN (remote).
+    #
+    # @return [Module, Decidim::EngineRouter] The correct route helpers based
+    #   on the configuration
+    def routes
+      @routes ||=
+        if remote?
+          Rails.application.routes.url_helpers
+        else
+          EngineRouter.new("main_app", {})
+        end
+    end
+
+    # Determines whether the assets call should be to a remote CDN or to the
+    # local server based on the storage options.
+    #
+    # @return [Boolean] A boolean indicating whether the assets are served
+    #   through a remote CDN
+    def remote?
+      remote_storage_options.present?
+    end
+
+    # Determines the default options to be passed to the route helper. For the
+    # remote storage, returns the remote storage options and for the local disk
+    # storage returns an empty hash.
+    #
+    # @return [Hash] The default options hash to pass to the route helper
+    def default_options
+      @default_options ||=
+        if remote?
+          remote_storage_options
+        else
+          {}
+        end
+    end
+
+    # The remote storage options when using a remote CDN. An empty hash in case
+    # using the local disk storage.
+    #
+    # @return [Hash] The remote storage options hash
+    def remote_storage_options
+      @remote_storage_options ||= {
+        host: Rails.application.secrets.dig(:storage, :cdn_host)
+      }.compact
+    end
+  end
+end

data/lib/decidim/attachment_attributes.rb

@@ -3,14 +3,14 @@
 require "active_support/concern"
 
 module Decidim
-  # A set of convenience methods to deal with attachment attributes for Virtus
+  # A set of convenience methods to deal with attachment attributes for
   # models that may set the attachment records through the original model
   # (Decidim::Attachment) or through the user submitted form data (String).
   module AttachmentAttributes
     extend ActiveSupport::Concern
 
     class_methods do
-      # Public: Mirrors Virtus' `attribute` interface to define attachment
+      # Public: Mirrors the `attribute` interface to define attachment
       # attributes for form objects.
       #
       # name - The attribute's name
@@ -20,14 +20,14 @@ module Decidim
       #
       #   attachment_attribute :photos
       #   # This will create two attributes of the following types:
-      #   #   attribute :photos, Array[String]
+      #   #   attribute :photos, Array[Integer]
       #   #   attribute :add_photos, Array
       #   # In addition, it will generate the getter method for the attribute
       #   # returning an array of the Decidim::Attachment records.
       #
       # Returns nothing.
       def attachments_attribute(name)
-        attribute name, Array[String]
+        attribute name, Array[Integer]
         attribute "add_#{name}".to_sym, Array
 
         # Define the getter method that fetches the attachment records based on
@@ -37,13 +37,13 @@ module Decidim
         define_method name do
           return instance_variable_get(variable_name) if instance_variable_defined?(variable_name)
 
-          original = instance_variable_get("@#{name}")
-          return original unless original.is_a?(Array)
+          original = @attributes[name.to_s].value_before_type_cast
+          return original if original && !original.is_a?(Array)
 
           instance_variable_set(
             variable_name,
-            original.map do |attachment|
-              if attachment.is_a?(String) || attachment.is_a?(Integer)
+            super().map do |attachment|
+              if attachment.is_a?(Integer)
                 Decidim::Attachment.find_by(id: attachment)
               else
                 attachment

data/lib/decidim/attribute_object/form.rb

@@ -0,0 +1,174 @@
+# frozen_string_literal: true
+
+module Decidim
+  module AttributeObject
+    # This is the main Form class that provides the functionality for all core
+    # forms that take in user input from the user interface forms and converts
+    # the inputs to expected formats.
+    #
+    # This replaces the Rectify::Form classes in Decidim which used to provide
+    # similar functionality. The API provided by this class is largely
+    # compatible with `Rectify::Form`.
+    class Form
+      include Decidim::AttributeObject::Model
+      include ActiveModel::Validations
+
+      attr_reader :context
+
+      def self.mimic(model_name)
+        @model_name = model_name.to_s.underscore.to_sym
+      end
+
+      def self.mimicked_model_name
+        @model_name || infer_model_name
+      end
+
+      def self.infer_model_name
+        return :form unless name
+
+        class_name = name.split("::").last
+        return :form if class_name == "Form"
+
+        class_name.chomp("Form").underscore.to_sym
+      end
+
+      # Converts the mimicked name to ActiveModel naming.
+      def self.model_name
+        ActiveModel::Name.new(self, nil, mimicked_model_name.to_s)
+      end
+
+      def self.from_model(model)
+        form_attributes = attribute_types.keys.each_with_object({}) do |key, attrs|
+          next unless model.respond_to?(key)
+
+          value = model.send(key)
+          attrs[key] =
+            case value
+            when ActiveStorage::Attached::One
+              value.attachment.try(:blob)
+            when ActiveStorage::Attached::Many
+              value.attachments.map(&:blob)
+            else
+              value
+            end
+        end
+
+        form = new(form_attributes)
+        form.map_model(model)
+
+        form
+      end
+
+      def self.from_params(params, additional_params = {})
+        params_hash = hash_from(params)
+        mimicked_params = ensure_hash(params_hash[mimicked_model_name])
+
+        attributes_hash = params_hash.merge(mimicked_params).merge(additional_params)
+
+        new(attributes_hash)
+      end
+
+      def self.hash_from(params)
+        params = params.to_unsafe_h if params.respond_to?(:to_unsafe_h)
+        params.with_indifferent_access
+      end
+
+      def self.ensure_hash(object)
+        if object.is_a?(Hash)
+          object
+        else
+          {}
+        end
+      end
+
+      def persisted?
+        id.present? && id.to_i.positive?
+      end
+
+      def to_key
+        [id]
+      end
+
+      # Required for the active model naming to work correctly to form the HTML
+      # class attributes for the form elements (e.g. edit_account instead
+      # of edit_account_form).
+      def to_model
+        self
+      end
+
+      def to_param
+        id.to_s
+      end
+
+      # Use the map_model method within the form implementations to map any
+      # custom form-specific attributes from the model to the form.
+      def map_model(_model); end
+
+      def with_context(new_context)
+        @context = if new_context.is_a?(Hash)
+                     OpenStruct.new(new_context)
+                   else
+                     new_context
+                   end
+
+        attributes.each do |_name, value|
+          case value
+          when Array
+            value.each do |v|
+              next unless v.respond_to?(:with_context)
+
+              v.with_context(context)
+            end
+          else
+            next unless value.respond_to?(:with_context)
+
+            value.with_context(context)
+          end
+        end
+
+        self
+      end
+
+      # Although we are running the nested attributes validations through the
+      # NestedValidator, we still need to check for the errors in the nested
+      # attributes after the main validations are run in case the main
+      # validations are adding errors to some of the nested attributes.
+      #
+      # An example of such form is the Decidim::Budgets::Admin::ComponentForm
+      # which adds errors to the sub-attribute "settings" during its own
+      # validations. Because these errors are not added to the main form object,
+      # the main form object would be interpreted as valid without checking the
+      # sub-attribute validations.
+      #
+      # This preserves the backwards compatibility with Rectify::Form which
+      # did the validations in this order and fails the main record validation
+      # in case one of the nested attributes is not valid. This is needed e.g.
+      # for the customized component validations (e.g. Budgets component form).
+      def valid?(_context = nil)
+        super && self.class.attribute_types.none? do |name, type|
+          value = public_send(name)
+
+          if value.is_a?(Decidim::AttributeObject::Model) || (type.respond_to?(:validate_nested?) && type.validate_nested?)
+            _value_has_errors?(value)
+          else
+            false
+          end
+        end
+      end
+
+      private
+
+      def _value_has_errors?(value)
+        if value.is_a?(Array)
+          value.any? { |v| _value_has_errors?(v) }
+        elsif value.is_a?(Hash)
+          _value_has_errors?(value.values)
+        elsif value.respond_to?(:errors)
+          value.errors.any?
+        else
+          false
+        end
+      end
+    end
+  end
+end

data/lib/decidim/attribute_object/model.rb

@@ -0,0 +1,148 @@
+# frozen_string_literal: true
+
+# Make sure the custom attributes are defined
+require "decidim/attributes"
+
+module Decidim
+  module AttributeObject
+    # This provides a dummy model implementation for replacing the Virtus models
+    # using ActiveModel. This class is a lightweight version of
+    # `ActiveModel::Model` with the `ActiveModel::Attributes` module and its
+    # overridden methods.
+    #
+    # The main purpose of this class is to provide a backwards compatible API
+    # for defining classes that hold attributes, such as the form classes.
+    #
+    # Usage:
+    #   Replace all instances of `Virtus.model` with `Decidim::AttributeObject::Model`.
+    module Model
+      extend ActiveSupport::Concern
+
+      include ActiveModel::AttributeAssignment
+      include ActiveModel::Attributes
+      include Decidim::AttributeObject::TypeMap
+
+      included do
+        extend ActiveModel::Naming
+        extend ActiveModel::Translation
+
+        # Default attributes for all models
+        attribute :id
+      end
+
+      class_methods do
+        def attribute(name, type = ActiveModel::Type::Value.new, **options)
+          typedef = AttributeObject.types.resolve(type, **options)
+
+          super(name, typedef[:type], **typedef[:options])
+
+          # Create the boolean method alias with the question mark at the end
+          # which is used in some places. This was a default behavior of
+          # Virtus but not a feature in ActiveModel::Attributes.
+          alias_method :"#{name}?", name if typedef[:type] == :boolean
+
+          # Add the nested validation in case validations module is loaded and
+          # the type reports it needs nested validations.
+          return unless include?(ActiveModel::Validations)
+
+          # The nested validator should be only added for those attributes that
+          # inherit from the AttributeObject::Model type. Otherwise this would
+          # be also added e.g. for ActiveRecord objects which would cause
+          # unexpected validation errors.
+          finaltype = attribute_types[name.to_s]
+          return unless finaltype.respond_to?(:validate_nested?)
+          return unless finaltype.validate_nested?
+
+          validates_with(
+            Decidim::AttributeObject::NestedValidator,
+            _merge_attributes([name])
+          )
+        end
+      end
+
+      def initialize(attributes = {})
+        # Parentheses needed not to pass the arguments.
+        super()
+
+        return unless attributes
+
+        # Make sure the attributes is a hash
+        base_attributes =
+          if attributes.is_a?(Hash)
+            attributes
+          else
+            attributes.to_h
+          end
+
+        # Only pass the existing attribute keys to assign_attributes
+        # The regular expression matching makes sure we also include the "multi"
+        # parameters, such as date fields passed from the view which are
+        # formatted as date(1i), date(2i), date(3i). These are converted to
+        # hashes below which are handled by the ActiveModel::Attributes types,
+        # such as :date.
+        correct_attributes = {}.tap do |attrs|
+          base_attributes.each do |k, v|
+            # Handle "multi" parameter attributes, such as date(1i), date(2i),
+            # date(3i). This converts these three attributes to a single hash
+            # attribute formatted as:
+            #   { "date" => { 1 => ..., 2 => ..., 3 => ...  } }
+            mp = k.to_s.match(/(.*)\(([0-9]+i)\)$/)
+            if mp
+              next unless attribute_names.include?(mp[1])
+
+              attrs[mp[1]] ||= {}
+              attrs[mp[1]][mp[2].to_i] = v
+            else
+              next unless attribute_names.include?(k.to_s)
+
+              attrs[k] = v
+            end
+          end
+        end
+
+        assign_attributes(correct_attributes)
+      end
+
+      # This provides backwards compatibility for accessing the attributes
+      # through symbols by calling `obj.attributes[:key]` or
+      # `obj.attributes.slice(:key1, :key2)`. In the legacy Virtus models, this
+      # returned a hash with symbol keys.
+      #
+      # Deprecated:
+      # Attributes access through symbols is deprecated and may be removed in
+      # future versions. Please refactor all your attributes calls to access the
+      # attributes through string keys.
+      def attributes
+        super.with_indifferent_access
+      end
+
+      # Convenience method for accessing the attributes through
+      # model[:attr_name] which is used in multiple places across the code.
+      def [](attribute_name)
+        public_send(attribute_name) if respond_to?(attribute_name)
+      end
+
+      # Convenience method for settings the attributes through
+      # model[:attr_name] = "foo" which is used in some places across the code.
+      def []=(attribute_name, value)
+        public_send("#{attribute_name}=", value) if respond_to?("#{attribute_name}=")
+      end
+
+      # Convenience method used in initiatives
+      def attributes_with_values
+        to_h.compact
+      end
+
+      def to_h
+        hash = attributes.to_h.symbolize_keys
+        hash.delete(:id) if hash.has_key?(:id) && hash[:id].blank?
+
+        hash
+      end
+
+      # The to_hash alias is needed for the as_json call which calls this method
+      # if defined.
+      alias to_hash to_h
+    end
+  end
+end

data/lib/decidim/attribute_object/nested_validator.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module Decidim
+  module AttributeObject
+    class NestedValidator < ActiveModel::EachValidator # :nodoc:
+      def validate_each(record, attribute, value)
+        value = value.values if value.is_a?(Hash)
+        return unless Array(value).reject { |r| valid_object?(r) }.any?
+
+        record.errors.add(attribute, :invalid, **options.merge(value: value))
+      end
+
+      private
+
+      def valid_object?(record)
+        return true unless record.respond_to?(:valid?)
+
+        record.valid?
+      end
+    end
+  end
+end

data/lib/decidim/attribute_object/type_map.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module Decidim
+  module AttributeObject
+    # Backwards compatibility for legacy types. Provides accessors for the
+    # legacy Virtus type classes that are mapped to ActiveModel types.
+    module TypeMap
+      # rubocop:disable Naming/ConstantName
+      Boolean = :boolean
+      Decimal = :decimal
+      # rubocop:enable Naming/ConstantName
+    end
+  end
+end