decidim-core 0.27.0 → 0.27.2

data/lib/decidim/asset_router/pipeline.rb

@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+module Decidim
+  module AssetRouter
+    # The pipeline asset router provides global access to the asset routers for
+    # assets that are precompiled through the Rails assets pipeline (or webpack)
+    # and stored locally or in a remote CDN. This handles the configuration
+    # options for the asset routes so that they don't have to be always manually
+    # created.
+    class Pipeline
+      # Initializes the router.
+      #
+      # @param asset [String] The asset to route to
+      # @param model [ActiveRecord::Base, nil] The model that provides the
+      #   organizational context. When nil, the host will be included in the URL
+      #   when it is available through other configurations. Otherwise, the host
+      #   will not be part of the URL.
+      def initialize(asset, model: nil)
+        @asset = asset
+        @model = model
+      end
+
+      # Generates the correct URL to the asset with the provided options.
+      #
+      # @param options [Hash] The options for the URL that are the normal route
+      #   options Rails route helpers accept
+      # @return [String] The full URL to the asset or when host cannot be
+      #   resolved, the asset path.
+      def url(**options)
+        path = ActionController::Base.helpers.asset_pack_path(asset, **options)
+        "#{asset_host}#{path}"
+      end
+
+      private
+
+      attr_reader :asset, :model
+
+      # Fetches the organization from the model or returns the model itself if
+      # it is an organization.
+      #
+      # @return [Decidim::Organization]
+      def organization
+        @organization ||=
+          if model.is_a?(Decidim::Organization)
+            model
+          else
+            model.try(:organization)
+          end
+      end
+
+      # Resolves the full asset host with the resolved options and also adds the
+      # port at the end of the URL unless it is the default port 80 or 443.
+      #
+      # @return [String] The hostname with protocol and port or an empty string
+      #   when the host cannot be resolved.
+      def asset_host
+        return "" if default_options[:host].blank?
+
+        base_host = ActionController::Base.helpers.compute_asset_host("", **default_options)
+        return "" if base_host.blank?
+        return base_host if option_resolver.default_port?
+
+        "#{base_host}:#{option_resolver.port}"
+      end
+
+      # Determines the default options to be passed to the route helper.
+      #
+      # @return [Hash] The default options hash to pass to the route helper
+      def default_options
+        @default_options ||= option_resolver.options.tap do |opts|
+          opts[:host] = default_host if default_host
+        end
+      end
+
+      # Determines the default host for the pipeline assets. Either the
+      # configured assets host or the organization host when available. When the
+      # default host is not available, the host returned by the
+      # UrlOptionResolver will be used.
+      #
+      # @return [String, nil]
+      def default_host
+        @default_host ||= Rails.configuration.action_controller.asset_host || organization&.host
+      end
+
+      # Stores an instance of UrlOptionResolver for convenience.
+      #
+      # @return [Decidim::UrlOptionResolver]
+      def option_resolver
+        @option_resolver ||= UrlOptionResolver.new
+      end
+    end
+  end
+end

data/lib/decidim/asset_router/storage.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+module Decidim
+  module AssetRouter
+    # Storage asset router provides global access to the asset routes for assets
+    # saved through ActiveStorage. This handles the different cases for routing
+    # to the remote routes when using an assets CDN or to local routes when
+    # using the local disk storage driver.
+    class Storage
+      # Initializes the router.
+      #
+      # @param [ActiveStorage::Attached, ActiveStorage::Blob] The asset to route
+      #   to
+      def initialize(asset)
+        @asset = asset
+      end
+
+      # Generates the correct URL to the asset with the provided options.
+      #
+      # @param options The options for the URL that are the normal route options
+      #   Rails route helpers accept
+      def url(**options)
+        if asset.is_a? ActiveStorage::Attached
+          routes.rails_blob_url(asset.blob, **default_options.merge(options))
+        else
+          routes.rails_representation_url(asset, **default_options.merge(options))
+        end
+      end
+
+      private
+
+      attr_reader :asset
+
+      # Provides the route helpers depending on whether the URL is generated to
+      # the local host or an external CDN (remote).
+      #
+      # @return [Module, Decidim::EngineRouter] The correct route helpers based
+      #   on the configuration
+      def routes
+        @routes ||=
+          if remote?
+            Rails.application.routes.url_helpers
+          else
+            EngineRouter.new("main_app", {})
+          end
+      end
+
+      # Determines whether the assets call should be to a remote CDN or to the
+      # local server based on the storage options.
+      #
+      # @return [Boolean] A boolean indicating whether the assets are served
+      #   through a remote CDN
+      def remote?
+        remote_storage_options.present?
+      end
+
+      # Determines the default options to be passed to the route helper. For the
+      # remote storage, returns the remote storage options and for the local
+      # disk storage returns an empty hash.
+      #
+      # @return [Hash] The default options hash to pass to the route helper
+      def default_options
+        @default_options ||=
+          if remote?
+            remote_storage_options
+          else
+            {}
+          end
+      end
+
+      # The remote storage options when using a remote CDN. An empty hash in
+      # case using the local disk storage.
+      #
+      # @return [Hash] The remote storage options hash
+      def remote_storage_options
+        @remote_storage_options ||= {
+          host: Rails.application.secrets.dig(:storage, :cdn_host)
+        }.compact
+      end
+    end
+  end
+end

data/lib/decidim/asset_router.rb

@@ -1,80 +1,8 @@
 # frozen_string_literal: true
 
 module Decidim
-  # Asset router provides global access to the asset routes for assets saved
-  # through ActiveStorage. This handles the different cases for routing to the
-  # remote routes when using an assets CDN or to local routes when using the
-  # local disk storage driver.
-  class AssetRouter
-    # Initializes the router.
-    #
-    # @param [ActiveStorage::Attached, ActiveStorage::Blob] The asset to route
-    #   to
-    def initialize(asset)
-      @asset = asset
-    end
-
-    # Generates the correct URL to the asset with the provided options.
-    #
-    # @param options The options for the URL that are the normal route options
-    #   Rails route helpers accept
-    def url(**options)
-      if asset.is_a? ActiveStorage::Attached
-        routes.rails_blob_url(asset.blob, **default_options.merge(options))
-      else
-        routes.rails_representation_url(asset, **default_options.merge(options))
-      end
-    end
-
-    private
-
-    attr_reader :asset
-
-    # Provides the route helpers depending on whether the URL is generated to
-    # the local host or an external CDN (remote).
-    #
-    # @return [Module, Decidim::EngineRouter] The correct route helpers based
-    #   on the configuration
-    def routes
-      @routes ||=
-        if remote?
-          Rails.application.routes.url_helpers
-        else
-          EngineRouter.new("main_app", {})
-        end
-    end
-
-    # Determines whether the assets call should be to a remote CDN or to the
-    # local server based on the storage options.
-    #
-    # @return [Boolean] A boolean indicating whether the assets are served
-    #   through a remote CDN
-    def remote?
-      remote_storage_options.present?
-    end
-
-    # Determines the default options to be passed to the route helper. For the
-    # remote storage, returns the remote storage options and for the local disk
-    # storage returns an empty hash.
-    #
-    # @return [Hash] The default options hash to pass to the route helper
-    def default_options
-      @default_options ||=
-        if remote?
-          remote_storage_options
-        else
-          {}
-        end
-    end
-
-    # The remote storage options when using a remote CDN. An empty hash in case
-    # using the local disk storage.
-    #
-    # @return [Hash] The remote storage options hash
-    def remote_storage_options
-      @remote_storage_options ||= {
-        host: Rails.application.secrets.dig(:storage, :cdn_host)
-      }.compact
-    end
+  module AssetRouter
+    autoload :Pipeline, "decidim/asset_router/pipeline"
+    autoload :Storage, "decidim/asset_router/storage"
   end
 end

data/lib/decidim/attribute_object/form.rb

@@ -48,6 +48,15 @@ module Decidim
               value.attachment.try(:blob)
             when ActiveStorage::Attached::Many
               value.attachments.map(&:blob)
+            when ActiveRecord::Associations::CollectionProxy, ActiveRecord::Relation, Array
+              if attribute_types[key].type == :array
+                value
+              else
+                # This is a sub-form that needs to read the properties directly
+                # from the original model. We cannot pass an array here as it
+                # would be passed to the form constructor causing an error.
+                model
+              end
             else
               value
             end

data/lib/decidim/attributes/localized_date.rb

@@ -16,7 +16,7 @@ module Decidim
 
         Date.strptime(value, I18n.t("date.formats.decidim_short"))
       rescue ArgumentError
-        nil
+        super
       end
     end
   end

data/lib/decidim/attributes/time_with_zone.rb

@@ -4,7 +4,7 @@ module Decidim
   module Attributes
     # Custom attributes value to parse a String representing a Time using
     # the app TimeZone.
-    class TimeWithZone < ActiveModel::Type::Time
+    class TimeWithZone < ActiveModel::Type::DateTime
       def type
         :"decidim/attributes/time_with_zone"
       end
@@ -16,7 +16,10 @@ module Decidim
 
         Time.zone.strptime(value, I18n.t("time.formats.decidim_short"))
       rescue ArgumentError
-        nil
+        fallback = super
+        return fallback unless fallback.is_a?(Time)
+
+        ActiveSupport::TimeWithZone.new(fallback, Time.zone)
       end
     end
   end

data/lib/decidim/core/engine.rb

@@ -253,6 +253,13 @@ module Decidim
         end
       end
 
+      initializer "decidim.validators" do
+        config.to_prepare do
+          # Decidim overrides to the file content type validator
+          require "file_content_type_validator"
+        end
+      end
+
       initializer "decidim.content_processors" do |_app|
         Decidim.configure do |config|
           config.content_processors += [:user, :user_group, :hashtag, :link]
@@ -542,11 +549,6 @@ module Decidim
       end
 
       initializer "decidim.core.add_badges" do
-        Decidim::Gamification.register_badge(:invitations) do |badge|
-          badge.levels = [1, 5, 10, 30, 50]
-          badge.reset = ->(user) { Decidim::User.where(invited_by: user.id).count }
-        end
-
         Decidim::Gamification.register_badge(:followers) do |badge|
           badge.levels = [1, 15, 30, 60, 100]
           badge.reset = ->(user) { user.followers.count }

data/lib/decidim/core/test/factories.rb

@@ -234,13 +234,20 @@ FactoryBot.define do
       confirmed_at { Time.current }
     end
 
+    trait :blocked do
+      blocked { true }
+      blocked_at { Time.current }
+      extended_data { { user_name: generate(:name) } }
+      name { "Blocked user group" }
+    end
+
     after(:build) do |user_group, evaluator|
-      user_group.extended_data = {
-        document_number: evaluator.document_number,
-        phone: evaluator.phone,
-        rejected_at: evaluator.rejected_at,
-        verified_at: evaluator.verified_at
-      }
+      user_group.extended_data = user_group.extended_data.merge({
+                                                                  document_number: evaluator.document_number,
+                                                                  phone: evaluator.phone,
+                                                                  rejected_at: evaluator.rejected_at,
+                                                                  verified_at: evaluator.verified_at
+                                                                })
     end
 
     after(:create) do |user_group, evaluator|

data/lib/decidim/core/test/shared_examples/comments_examples.rb

@@ -761,7 +761,7 @@ shared_examples "comments" do
 
         it "replaces the mention with a link to the user's profile" do
           expect(page).to have_comment_from(user, "A valid user mention: @#{mentioned_user.nickname}", wait: 20)
-          expect(page).to have_link "@#{mentioned_user.nickname}", href: "http://#{mentioned_user.organization.host}/profiles/#{mentioned_user.nickname}"
+          expect(page).to have_link "@#{mentioned_user.nickname}", href: "http://#{mentioned_user.organization.host}:#{Capybara.server_port}/profiles/#{mentioned_user.nickname}"
         end
       end
 

data/lib/decidim/core/test/shared_examples/editor_shared_examples.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+shared_examples_for "has embedded video in description" do |description_attribute_name|
+  let(description_attribute_name) { { en: %(Description <iframe class="ql-video" allowfullscreen="true" src="#{iframe_src}" frameborder="0"></iframe>) } }
+  let(:iframe_src) { "http://www.example.org" }
+
+  context "when cookies are rejected" do
+    before do
+      click_link "Cookie settings"
+      click_button "Accept only essential"
+    end
+
+    it "disables iframe" do
+      expect(page).to have_content("You need to enable all cookies in order to see this content")
+      expect(page).not_to have_selector("iframe")
+    end
+  end
+
+  context "when cookies are accepted" do
+    before do
+      click_link "Cookie settings"
+      click_button "Accept all"
+    end
+
+    it "shows iframe" do
+      expect(page).not_to have_content("You need to enable all cookies in order to see this content")
+      expect(page).to have_selector("iframe", count: 1)
+    end
+  end
+end

data/lib/decidim/core/test/shared_examples/mcell_examples.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+shared_examples_for "m-cell" do |model_name|
+  context "with decorated title" do
+    let(:cell_model) { send(model_name) }
+
+    before do
+      cell_model.update!(title: { en: "Model <strong>decorated title</strong>" })
+    end
+
+    it "renders the escaped title correctly" do
+      expect(cell_html.to_s).to include("Model &lt;strong&gt;decorated title&lt;/strong&gt;")
+    end
+  end
+end

data/lib/decidim/core/test.rb

@@ -4,6 +4,7 @@ require "decidim/core/test/shared_examples/acts_as_author_examples"
 require "decidim/core/test/shared_examples/admin_log_presenter_examples"
 require "decidim/core/test/shared_examples/authorable"
 require "decidim/core/test/shared_examples/coauthorable"
+require "decidim/core/test/shared_examples/editor_shared_examples"
 require "decidim/core/test/shared_examples/endorsable"
 require "decidim/core/test/shared_examples/publicable"
 require "decidim/core/test/shared_examples/localised_email"
@@ -73,3 +74,4 @@ require "decidim/core/test/shared_examples/translated_event_examples"
 require "decidim/core/test/shared_examples/conversations_examples"
 require "decidim/core/test/shared_examples/resource_endorsed_event_examples"
 require "decidim/core/test/shared_examples/versions_controller_examples"
+require "decidim/core/test/shared_examples/mcell_examples"

data/lib/decidim/core/version.rb

@@ -4,7 +4,7 @@ module Decidim
   # This holds the decidim-core version.
   module Core
     def self.version
-      "0.27.0"
+      "0.27.2"
     end
   end
 end

data/lib/decidim/dependency_resolver.rb

@@ -28,11 +28,9 @@ module Decidim
     # specs which means any gems available in the gem install folder.
     #
     # @param gem [String] The name for the gem to be looked up.
-    # @return [Bundler::LazySpecification, Gem::Specification, nil] When bundler
-    #   is available, returns `Bundler::LazySpecification`. When bundler is not
-    #   available, returns `Gem::Specification`. Both of these implement the
-    #   necessary methods for the other checks. In both cases returns nil if
-    #   the gem is not found.
+    # @return [Gem::Specification, nil] Returns the gem specification for the
+    #   given gem name. The specification implements the necessary methods for
+    #   the other checks. In both cases returns nil if the gem is not found.
     def lookup(gem)
       # In case the lookup method is called with a spec definition, return the
       # definition itself.
@@ -217,10 +215,18 @@ module Decidim
       # Gemfile, e.g. when the Decidim gems are installed through git.
       #
       # @param name [String] The name of the gem to find.
-      # @return [Bundler::LazySpecification, nil] The specification for the gem
-      #   or nil if the gem is not listed in the locked gems.
+      # @return [Gem::Specification, nil] The specification for the gem
+      #   or nil if the gem is not listed in the locked gems or nil when the
+      #   returned spec is not installed in the current gem environment.
       def spec(name)
-        Bundler.definition.locked_gems.specs.find { |s| s.name == name }
+        sp = Bundler.definition.locked_gems.specs.find { |s| s.name == name }
+
+        # Fetching the gem through Gem.loaded_specs ensures we are not returning
+        # a lazy specification which does not respond to `#full_gem_path` which
+        # is needed for the resolver.
+        return Gem.loaded_specs[sp.name] if sp
+
+        nil
       end
 
       private

data/lib/decidim/file_validator_humanizer.rb

@@ -49,7 +49,7 @@ module Decidim
       if (extensions = extension_allowlist)
         messages << I18n.t(
           "allowed_file_extensions",
-          extensions: extensions.join(" "),
+          extensions: extensions.sort.join(" "),
           scope: "decidim.forms.file_validation"
         )
       end

data/lib/decidim/form_builder.rb

@@ -47,7 +47,7 @@ module Decidim
     # rubocop:enable Metrics/ParameterLists
 
     def create_language_selector(locales, tabs_id, name)
-      if Decidim.available_locales.count > 4
+      if locales.count > 4
         language_selector_select(locales, tabs_id, name)
       else
         language_tabs(locales, tabs_id, name)
@@ -387,7 +387,14 @@ module Decidim
     def datetime_field(attribute, options = {})
       value = object.send(attribute)
       data = { datepicker: "", timepicker: "" }
-      data[:startdate] = I18n.l(value, format: :decidim_short) if value.present? && value.is_a?(ActiveSupport::TimeWithZone)
+      if value.present?
+        case value
+        when ActiveSupport::TimeWithZone
+          data[:startdate] = I18n.l(value, format: :decidim_short)
+        when Time, DateTime
+          data[:startdate] = I18n.l(value.in_time_zone(Time.zone), format: :decidim_short)
+        end
+      end
       datepicker_format = ruby_format_to_datepicker(I18n.t("time.formats.decidim_short"))
       data[:"date-format"] = datepicker_format
 
@@ -417,7 +424,7 @@ module Decidim
         max_file_size: max_file_size(record, :file),
         label: I18n.t("decidim.forms.upload.labels.add_attachment"),
         button_edit_label: I18n.t("decidim.forms.upload.labels.edit_image"),
-        extension_allowlist: Decidim.organization_settings(Decidim::Attachment).upload_allowed_file_extensions
+        extension_allowlist: Decidim.organization_settings(record).upload_allowed_file_extensions
       }.merge(options)
 
       # Upload help uses extension allowlist from the options so we need to call this AFTER setting the defaults.
@@ -844,7 +851,7 @@ module Decidim
     end
 
     def extension_allowlist_help(extension_allowlist)
-      ["#{I18n.t("extension_allowlist", scope: "decidim.forms.files")} #{extension_allowlist.map { |ext| ext }.join(", ")}"]
+      [I18n.t("extension_allowlist", scope: "decidim.forms.files", extensions: extension_allowlist.map { |ext| ext }.join(", "))]
     end
 
     def image_dimensions_help(dimensions_info)

data/lib/decidim/participatory_space_resourceable.rb

@@ -47,7 +47,13 @@ module Decidim
              .joins(:participatory_space_resource_links_to)
              .where(decidim_participatory_space_links: { name: link_name, from_id: id, from_type: self.class.name })
 
-        klass.where(id: from).or(klass.where(id: to))
+        query = klass.where(id: from).or(klass.where(id: to)).published
+
+        if klass.column_names.include?("weight")
+          query.order(:weight)
+        else
+          query.order(created_at: :desc)
+        end
       end
 
       def participatory_space_sibling_scope(participatory_space_name)

data/lib/decidim/resourceable.rb

@@ -36,8 +36,8 @@ module Decidim
       # link_name     - The String name of the link between this model and the target resource.
       #
       # Returns an ActiveRecord::Relation.
-      def linked_resources(resource_name, link_name)
-        scope = sibling_scope(resource_name)
+      def linked_resources(resource_name, link_name, component_published: true)
+        scope = sibling_scope(resource_name, component_published: component_published)
 
         from = scope
                .joins(:resource_links_from)
@@ -56,14 +56,15 @@ module Decidim
       # resource_name - The String name of the resource manifest exposed by a component.
       #
       # Returns an ActiveRecord::Relation.
-      def sibling_scope(resource_name)
+      def sibling_scope(resource_name, component_published: true)
         manifest = Decidim.find_resource_manifest(resource_name)
         return self.class.none unless manifest
 
         scope = manifest.resource_scope(component)
         scope = scope.where("#{self.class.table_name}.id != ?", id) if manifest.model_class == self.class
         scope = scope.not_hidden if manifest.model_class.respond_to?(:not_hidden)
-        scope.includes(:component).where.not(decidim_components: { published_at: nil })
+        scope = scope.includes(:component).where.not(decidim_components: { published_at: nil }) if component_published
+        scope
       end
 
       # Links the given resources to this model, replaces any previous links with the same name.

data/lib/decidim/settings_manifest.rb

@@ -97,7 +97,7 @@ module Decidim
         enum: { klass: String, default: nil },
         select: { klass: String, default: nil },
         scope: { klass: Integer, default: nil },
-        time: { klass: DateTime, default: nil }
+        time: { klass: Decidim::Attributes::TimeWithZone, default: nil }
       }.freeze
 
       attribute :type, Symbol, default: :boolean