decidim-core 0.29.1 → 0.30.0.rc1

data/lib/decidim/commands/restore_resource.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module Decidim
+  module Commands
+    class RestoreResource < ::Decidim::Command
+      # Initializes the command.
+      #
+      # @param resource [ActiveRecord::Base] the resource to restore.
+      # @param current_user [Decidim::User] the current user.
+      def initialize(resource, current_user)
+        @resource = resource
+        @current_user = current_user
+      end
+
+      # Restores the resource.
+      #
+      # Broadcasts :ok if successful, :invalid otherwise.
+      def call
+        return broadcast(:invalid) if invalid?
+
+        restore_resource
+
+        broadcast(:ok, resource)
+      rescue Decidim::Commands::HookError, StandardError
+        broadcast(:invalid)
+      end
+
+      protected
+
+      attr_reader :resource, :current_user
+
+      def invalid? = false
+
+      def restore_resource
+        Decidim.traceability.perform_action!(
+          "restore",
+          resource,
+          current_user
+        ) do
+          resource.restore
+        end
+      end
+    end
+  end
+end

data/lib/decidim/commands/soft_delete_resource.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+module Decidim
+  module Commands
+    class SoftDeleteResource < ::Decidim::Command
+      # Initializes the command.
+      #
+      # @param resource [ActiveRecord::Base] the resource to soft delete.
+      # @param current_user [Decidim::User] the current user.
+      def initialize(resource, current_user)
+        @resource = resource
+        @current_user = current_user
+      end
+
+      # Soft deletes the resource.
+      #
+      # Broadcasts :ok if successful, :invalid otherwise.
+      def call
+        return broadcast(:invalid) if invalid?
+
+        soft_delete_resource
+        send_notification_to_authors
+
+        broadcast(:ok, resource)
+      rescue Decidim::Commands::HookError, StandardError
+        broadcast(:invalid)
+      end
+
+      protected
+
+      attr_reader :resource, :current_user
+
+      def invalid? = false
+
+      def soft_delete_resource
+        Decidim.traceability.perform_action!(
+          "soft_delete",
+          resource,
+          current_user
+        ) do
+          resource.destroy!
+        end
+      end
+
+      def send_notification_to_authors
+        coauthors = resource.try(:coauthorships)&.map do |coauthorship|
+          coauthorship.decidim_author_type.constantize.find(coauthorship.decidim_author_id)
+        end || []
+
+        recipients = (resource.try(:authors) || [resource.try(:author)]).compact + coauthors
+
+        return if recipients.empty?
+
+        Decidim::EventsManager.publish(
+          event: "decidim.events.resources.soft_deleted",
+          event_class: Decidim::SoftDeleteResourceEvent,
+          resource:,
+          affected_users: recipients.uniq
+        )
+      end
+    end
+  end
+end

data/lib/decidim/component_manifest.rb

@@ -142,6 +142,13 @@ module Decidim
       @seeds&.call(participatory_space)
     end
 
+    # The name of the named Rails route to create the url to the resource.
+    #
+    # Returns a String.
+    def route_name
+      "component"
+    end
+
     # Public: Adds configurable attributes for this component, scoped to a name. It
     # uses the DSL specified under `Decidim::SettingsManifest`.
     #

data/lib/decidim/content_parsers/blob_parser.rb

@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+module Decidim
+  module ContentParsers
+    # Parses any blob URLs from the content and replaces them with references
+    # to those blobs.
+    class BlobParser < BaseParser
+      # Matches all possible URLs pointing to ActiveStorage::Blob objects.
+      #
+      # Possible routes:
+      # get "/blobs/redirect/:signed_id/*filename"
+      # get "/blobs/proxy/:signed_id/*filename"
+      # get "/blobs/:signed_id/*filename"
+      # get "/representations/redirect/:signed_blob_id/:variation_key/*filename"
+      # get "/representations/proxy/:signed_blob_id/:variation_key/*filename"
+      # get "/representations/:signed_blob_id/:variation_key/*filename"
+      # get  "/disk/:encoded_key/*filename"
+      #
+      # See:
+      # https://github.com/rails/rails/blob/a7e379896552ce43b822385c03c37f2bd47739d3/activestorage/config/routes.rb#L5-L14
+      BLOB_REGEX = %r{
+        # Group 1: Host part
+        (
+          # Group 2: Domain and subpath part
+          https?://((?!/rails).)+
+        )?
+        /rails/active_storage
+        # Group 3: Blob path, representation path or disk service path
+        /(blobs/redirect|blobs/proxy|blobs|representations/redirect|representations/proxy|representations|disk)
+        # Group 4: Signed ID for blobs or encoded key for disk service
+        /([^/]+)
+        # Group 5: Variation part (only for representations)
+        (
+          # Group 6: Variation key for representations
+          /([\w.=-]+)
+        )?
+        # Group 7: Filename
+        /([\w.=-]+)
+      }x
+
+      def rewrite
+        replace_blobs(content)
+      end
+
+      private
+
+      def replace_blobs(text)
+        text.gsub(BLOB_REGEX) do |match|
+          type_part = Regexp.last_match(3)
+          key_part = Regexp.last_match(4)
+
+          variation_key = nil
+          blob =
+            if type_part == "disk"
+              # Disk service URL
+              decoded = ActiveStorage.verifier.verified(key_part, purpose: :blob_key)
+              ActiveStorage::Blob.find_by(key: decoded[:key]) if decoded
+            else
+              # Representation or blob
+              if type_part.start_with?("representations")
+                # Representation
+                variation_part = Regexp.last_match(6)
+                variation_key = generate_variation_key(variation_part)
+              end
+
+              ActiveStorage::Blob.find_signed(key_part)
+            end
+          next match unless blob
+
+          "#{blob.to_global_id}#{"/#{variation_key}" if variation_key}"
+        end
+      end
+
+      def generate_variation_key(variation_part)
+        # The variation part has to be decoded because it will eventually
+        # expire. This way we can preserve the variation information
+        # longer.
+        variation = ActiveStorage.verifier.verify(variation_part, purpose: :variation)
+        return unless variation
+
+        # Convert to base64 encoded JSON string for better representation within
+        # the URLs. This manually encoded part will not expire as it is
+        # persisted to the database.
+        Base64.strict_encode64(ActiveSupport::JSON.encode(variation))
+      rescue ActiveSupport::MessageVerifier::InvalidSignature
+        # This happens if the variation key is already expired in which
+        # case it cannot be represented and instead a URL to the blob is
+        # created.
+        variation_part
+      end
+    end
+  end
+end

data/lib/decidim/content_parsers.rb

@@ -3,6 +3,7 @@
 module Decidim
   module ContentParsers
     autoload :BaseParser, "decidim/content_parsers/base_parser"
+    autoload :BlobParser, "decidim/content_parsers/blob_parser"
     autoload :UserParser, "decidim/content_parsers/user_parser"
     autoload :UserGroupParser, "decidim/content_parsers/user_group_parser"
     autoload :HashtagParser, "decidim/content_parsers/hashtag_parser"

data/lib/decidim/content_renderers/blob_renderer.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+module Decidim
+  module ContentRenderers
+    # A renderer that searches Global IDs representing blobs in content and
+    # replaces it with a URL to these blobs.
+    #
+    # e.g. gid://<APP_NAME>/ActiveStorage::Blob/1
+    #
+    # OR for representations
+    #
+    # e.g. gid://<APP_NAME>/ActiveStorage::Blob/1/<encoded variant transformations>
+    #
+    # The `<encoded variant transformations>` part of the URL is a Base64
+    # encoded string that contains an unencrypted JSON-encoded value about the
+    # blob transformations. This way the specific representations can be stored
+    # in the database without having these values expiring.
+    #
+    # @see BaseRenderer Examples of how to use a content renderer
+    class BlobRenderer < BaseRenderer
+      # Matches a global id representing a Decidim::User
+      GLOBAL_ID_REGEX = %r{(gid://[\w-]+/ActiveStorage::Blob/\d+)(/([\w=-]+))?}
+
+      # Replaces found Global IDs matching an existing blob with a URL to
+      # that blob. The Global IDs representing an invalid ActiveStorage::Blob
+      # are replaced with an empty string.
+      #
+      # @return [String] the content ready to display (contains HTML)
+      def render(_options = nil)
+        replace_pattern(content, GLOBAL_ID_REGEX)
+      end
+
+      protected
+
+      def replace_pattern(text, pattern)
+        return text unless text.respond_to?(:gsub)
+
+        text.gsub(pattern) do
+          blob_gid = Regexp.last_match(1)
+          variation_key = Regexp.last_match(3)
+
+          blob = GlobalID::Locator.locate(blob_gid)
+          if variation_key
+            variation = begin
+              ActiveSupport::JSON.decode(Base64.strict_decode64(variation_key))
+            rescue JSON::ParseError
+              variation_key
+            end
+            blob_url(blob, variation)
+          else
+            blob_url(blob)
+          end
+        rescue ActiveRecord::RecordNotFound => _e
+          ""
+        end
+      end
+
+      def blob_url(blob, variation = nil)
+        url = begin
+          if variation
+            blob.variant(variation).url
+          else
+            blob.url
+          end
+        rescue ArgumentError
+          # ArgumentError is raised in case the blob's service is set to
+          # ActiveStorage::Service::DiskService and
+          # `ActiveStorage::Current.url_options` is not set.
+        end
+        raise URI::InvalidURIError if url.blank?
+
+        url
+      rescue URI::InvalidURIError
+        local_blob_url(blob, variation)
+      end
+
+      def local_blob_url(blob, variation = nil)
+        if variation
+          routes.rails_representation_url(blob.variant(variation), only_path: true)
+        else
+          routes.rails_blob_url(blob, only_path: true)
+        end
+      end
+
+      def routes
+        @routes ||= Rails.application.routes.url_helpers
+      end
+    end
+  end
+end

data/lib/decidim/content_renderers.rb

@@ -3,6 +3,7 @@
 module Decidim
   module ContentRenderers
     autoload :BaseRenderer, "decidim/content_renderers/base_renderer"
+    autoload :BlobRenderer, "decidim/content_renderers/blob_renderer"
     autoload :UserRenderer, "decidim/content_renderers/user_renderer"
     autoload :UserGroupRenderer, "decidim/content_renderers/user_group_renderer"
     autoload :HashtagRenderer, "decidim/content_renderers/hashtag_renderer"

data/lib/decidim/core/api.rb

@@ -18,6 +18,7 @@ module Decidim
     autoload :AreaTypeType, "decidim/api/types/area_type_type"
     autoload :AttachmentType, "decidim/api/types/attachment_type"
     autoload :CategoryType, "decidim/api/types/category_type"
+    autoload :TaxonomyType, "decidim/api/types/taxonomy_type"
     autoload :ComponentType, "decidim/api/types/component_type"
     autoload :CoordinatesType, "decidim/api/types/coordinates_type"
     autoload :DecidimType, "decidim/api/types/decidim_type"
@@ -64,6 +65,7 @@ module Decidim
     autoload :AuthorableInterface, "decidim/api/interfaces/authorable_interface"
     autoload :CoauthorableInterface, "decidim/api/interfaces/coauthorable_interface"
     autoload :CategoriesContainerInterface, "decidim/api/interfaces/categories_container_interface"
+    autoload :TaxonomizableInterface, "decidim/api/interfaces/taxonomizable_interface"
     autoload :CategorizableInterface, "decidim/api/interfaces/categorizable_interface"
     autoload :ScopableInterface, "decidim/api/interfaces/scopable_interface"
     autoload :AttachableInterface, "decidim/api/interfaces/attachable_interface"

data/lib/decidim/core/engine.rb

@@ -11,7 +11,6 @@ require "acts_as_list"
 require "devise"
 require "devise-i18n"
 require "devise_invitable"
-require "foundation_rails_helper"
 require "active_link_to"
 require "rails-i18n"
 require "date_validator"
@@ -37,6 +36,7 @@ require "mime-types"
 require "diffy"
 require "ransack"
 require "wisper"
+require "chartkick"
 require "shakapacker"
 
 require "decidim/api"
@@ -56,7 +56,8 @@ module Decidim
 
       initializer "decidim_core.register_icons", after: "decidim_core.add_social_share_services" do
         Decidim.icons.register(name: "phone-line", icon: "phone-line", category: "system", description: "", engine: :core)
-
+        Decidim.icons.register(name: "more-2-fill", icon: "more-2-fill", category: "system", description: "Resource Action button", engine: :core)
+        Decidim.icons.register(name: "more-fill", icon: "more-fill", category: "system", description: "Resource Action button", engine: :core)
         Decidim.icons.register(name: "upload-cloud-2-line", icon: "upload-cloud-2-line", category: "system",
                                description: "Upload cloud 2 line used in attachments form", engine: :core)
         Decidim.icons.register(name: "arrow-right-line", icon: "arrow-right-line", category: "system",
@@ -104,6 +105,7 @@ module Decidim
         Decidim.icons.register(name: "account-pin-circle-line", icon: "account-pin-circle-line", category: "system", description: "", engine: :core)
         Decidim.icons.register(name: "award-line", icon: "award-line", category: "system", description: "", engine: :core)
         Decidim.icons.register(name: "eye-2-line", icon: "eye-2-line", category: "system", description: "", engine: :core)
+        Decidim.icons.register(name: "eye-close", icon: "eye-close-line", category: "system", description: "", engine: :core)
         Decidim.icons.register(name: "group-line", icon: "group-line", category: "system", description: "", engine: :core)
         Decidim.icons.register(name: "team-line", icon: "team-line", category: "system", description: "", engine: :core)
         Decidim.icons.register(name: "apps-2-line", icon: "apps-2-line", category: "system", description: "", engine: :core)
@@ -151,6 +153,8 @@ module Decidim
         Decidim.icons.register(name: "arrow-up-s-fill", icon: "arrow-up-s-fill", category: "system", description: "", engine: :core)
         Decidim.icons.register(name: "treasure-map-line", icon: "treasure-map-line", category: "system", description: "", engine: :core)
         Decidim.icons.register(name: "chat-new-line", icon: "chat-new-line", category: "system", description: "", engine: :core)
+        Decidim.icons.register(name: "history", icon: "history-line", category: "system", description: "History timeline", engine: :core)
+        Decidim.icons.register(name: "survey-line", icon: "survey-line", category: "system", description: "Survey line", engine: :core)
         Decidim.icons.register(name: "draft-line", icon: "draft-line", category: "system", description: "", engine: :core)
         Decidim.icons.register(name: "user-voice-line", icon: "user-voice-line", category: "system", description: "", engine: :core)
 
@@ -169,19 +173,22 @@ module Decidim
         Decidim.icons.register(name: "calendar-todo-line", icon: "calendar-todo-line", category: "system", description: "", engine: :core)
         Decidim.icons.register(name: "home-8-line", icon: "home-8-line", category: "system", description: "", engine: :core)
 
-        Decidim.icons.register(name: "like", icon: "heart-add-line", description: "Like", category: "action", engine: :core)
-        Decidim.icons.register(name: "dislike", icon: "dislike-line", description: "Dislike", category: "action", engine: :core)
+        Decidim.icons.register(name: "like", icon: "heart-line", description: "Like", category: "action", engine: :core)
+        Decidim.icons.register(name: "dislike", icon: "heart-fill", description: "Dislike", category: "action", engine: :core)
         Decidim.icons.register(name: "drag-move-2-line", icon: "drag-move-2-line", category: "system", description: "", engine: :core)
         Decidim.icons.register(name: "drag-move-2-fill", icon: "drag-move-2-fill", category: "system", description: "", engine: :core)
+        Decidim.icons.register(name: "draggable", icon: "draggable", category: "system", description: "", engine: :core)
         Decidim.icons.register(name: "login-circle-line", icon: "login-circle-line", category: "system", description: "", engine: :core)
         Decidim.icons.register(name: "list-check", icon: "list-check", category: "system", description: "", engine: :core)
         Decidim.icons.register(name: "add-fill", icon: "add-fill", category: "system", description: "", engine: :core)
         Decidim.icons.register(name: "clipboard-line", icon: "clipboard-line", category: "system", description: "", engine: :initiatives)
+        Decidim.icons.register(name: "user-forbid-line", icon: "user-forbid-line", category: "system", description: "", engine: :core)
 
         # Refactor later: Some of the icons here are duplicated, and it would be a greater refactor to remove the duplicates
         Decidim.icons.register(name: "Decidim::Amendment", icon: "git-branch-line", category: "activity", description: "Amendment", engine: :core)
         Decidim.icons.register(name: "Decidim::Category", icon: "price-tag-3-line", description: "Category", category: "activity", engine: :core)
         Decidim.icons.register(name: "Decidim::Scope", icon: "scan-line", description: "Scope", category: "activity", engine: :core)
+        Decidim.icons.register(name: "Decidim::Taxonomy", icon: "scan-line", description: "Taxonomy", category: "activity", engine: :core)
         Decidim.icons.register(name: "Decidim::User", icon: "user-line", description: "User", category: "activity", engine: :core)
         Decidim.icons.register(name: "Decidim::UserGroup", icon: "group-line", description: "User Group", category: "activity", engine: :core)
         Decidim.icons.register(name: "follow", icon: "notification-3-line", description: "Follow", category: "action", engine: :core)
@@ -192,6 +199,7 @@ module Decidim
         Decidim.icons.register(name: "profile", icon: "team-line", description: "Groups", category: "profile", engine: :core)
         Decidim.icons.register(name: "user_group", icon: "team-line", description: "Groups", category: "profile", engine: :core)
         Decidim.icons.register(name: "link", icon: "link", description: "web / URL", category: "profile", engine: :core)
+        Decidim.icons.register(name: "unlink", icon: "link-unlink-m", description: "Unlink", category: "profile", engine: :core)
         Decidim.icons.register(name: "following", icon: "eye-2-line", description: "Following", category: "profile", engine: :core)
         Decidim.icons.register(name: "activity", icon: "bubble-chart-line", description: "Activity", category: "profile", engine: :core)
         Decidim.icons.register(name: "followers", icon: "group-line", description: "Followers", category: "profile", engine: :core)
@@ -239,6 +247,34 @@ module Decidim
         app.config.action_mailer.deliver_later_queue_name = :mailers
       end
 
+      initializer "decidim_core.active_storage", before: "active_storage.configs" do |app|
+        next if app.config.active_storage.service_urls_expire_in.present?
+
+        # Ensure that the ActiveStorage URLs are valid long enough because with
+        # the default configuration they would expire in 5 minutes which is a
+        # problem:
+        #   a) for the backend blob URL replacement
+        #   and
+        #   b) for caching
+        #
+        # Note the limitations for each storage service regarding the signed URL
+        # expiration times. This limitation has to be also considered when
+        # defining a caching strategy, otherwise e.g. images or files may not
+        # display correctly when caching is enabled.
+        #
+        # ActiveStorage disk service (default): no limitation
+        #
+        # S3: maximum is 7 days from the creation of the URL
+        # https://docs.aws.amazon.com/AmazonS3/latest/userguide/PresignedUrlUploadObject.html
+        #
+        # Google: maximum is 7 days (604800 seconds)
+        # https://cloud.google.com/storage/docs/access-control/signed-urls
+        #
+        # Azure: no limitation
+        # https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview#best-practices-when-using-sas
+        app.config.active_storage.service_urls_expire_in = 7.days
+      end
+
       initializer "decidim_core.signed_global_id", after: "global_id" do |app|
         next if app.config.global_id.fetch(:expires_in, nil).present?
 
@@ -307,10 +343,14 @@ module Decidim
           value_presence = ->(v) { v.present? }
           minute_start = ->(v) { v.to_time.strftime("%Y-%m-%dT%H:%M:00") }
           minute_end = ->(v) { v.to_time.strftime("%Y-%m-%dT%H:%M:59") }
+          integer_presence = ->(v) { v.to_i.positive? }
+          array_cast = ->(v) { Arel.sql("ARRAY[#{v.to_i}]") }
           config.add_predicate("dtgt", arel_predicate: "gt", formatter: minute_start, validator: value_presence, type: :datetime)
           config.add_predicate("dtlt", arel_predicate: "lt", formatter: minute_end, validator: value_presence, type: :datetime)
           config.add_predicate("dtgteq", arel_predicate: "gteq", formatter: minute_start, validator: value_presence, type: :datetime)
           config.add_predicate("dtlteq", arel_predicate: "lteq", formatter: minute_end, validator: value_presence, type: :datetime)
+          # this allows to search for an integer inside a column that is an array
+          config.add_predicate("contains", arel_predicate: "contains", formatter: array_cast, validator: integer_presence)
         end
       end
 
@@ -387,8 +427,8 @@ module Decidim
         Decidim.stats.register :processes_count, priority: StatsRegistry::HIGH_PRIORITY do |organization, start_at, end_at|
           processes = ParticipatoryProcesses::OrganizationPrioritizedParticipatoryProcesses.new(organization)
 
-          processes = processes.where("created_at >= ?", start_at) if start_at.present?
-          processes = processes.where("created_at <= ?", end_at) if end_at.present?
+          processes = processes.where(created_at: start_at..) if start_at.present?
+          processes = processes.where(created_at: ..end_at) if end_at.present?
           processes.count
         end
       end
@@ -414,7 +454,7 @@ module Decidim
 
       initializer "decidim_core.content_processors" do |_app|
         Decidim.configure do |config|
-          config.content_processors += [:user, :user_group, :hashtag, :link]
+          config.content_processors += [:user, :user_group, :hashtag, :link, :blob]
         end
       end
 
@@ -736,7 +776,9 @@ module Decidim
       end
 
       config.to_prepare do
-        FoundationRailsHelper::FlashHelper.include Decidim::FlashHelperExtensions
+        ActiveSupport.on_load(:action_view) do
+          include Decidim::FlashHelperExtensions
+        end
       end
     end
   end

data/lib/decidim/core/menu.rb

@@ -56,11 +56,6 @@ module Decidim
                           position: 1.3
           end
 
-          menu.add_item :user_interests,
-                        t("my_interests", scope: "layouts.decidim.user_profile"),
-                        decidim.user_interests_path,
-                        position: 1.4
-
           menu.add_item :download_your_data,
                         t("my_data", scope: "layouts.decidim.user_profile"),
                         decidim.download_your_data_path,

data/lib/decidim/core/seeds.rb

@@ -14,10 +14,50 @@ module Decidim
         Rails.application.reloader.reload! if Rails.application.reloader.check!
         reset_column_information
 
-        ActiveJob::Base.queue_adapter = :inline
-
         organization = create_organization!
 
+        if organization.taxonomies.none?
+          taxonomy = create_taxonomy!(name: "Scopes", parent: nil)
+          3.times do
+            sub_taxonomy = create_taxonomy!(name: ::Faker::Address.state, parent: taxonomy)
+
+            5.times do
+              create_taxonomy!(name: ::Faker::Address.city, parent: sub_taxonomy)
+            end
+          end
+          # filters for all participatory spaces
+          create_taxonomy_filter!(root_taxonomy: taxonomy,
+                                  taxonomies: taxonomy.all_children,
+                                  participatory_space_manifests: Decidim.participatory_space_manifests.pluck(:name))
+
+          taxonomy = create_taxonomy!(name: "Areas", parent: nil)
+          sub_taxonomy = create_taxonomy!(name: "Territorial", parent: taxonomy)
+          3.times do
+            create_taxonomy!(name: ::Faker::Lorem.word, parent: sub_taxonomy)
+          end
+
+          sub_taxonomy = create_taxonomy!(name: "Sectorial", parent: taxonomy)
+          5.times do
+            create_taxonomy!(name: ::Faker::Lorem.word, parent: sub_taxonomy)
+          end
+          # filters for all participatory except conferences
+          create_taxonomy_filter!(root_taxonomy: taxonomy,
+                                  taxonomies: taxonomy.all_children,
+                                  participatory_space_manifests: Decidim.participatory_space_manifests.pluck(:name) - [:conferences])
+
+          taxonomy = create_taxonomy!(name: "Categories", parent: nil)
+          3.times do
+            sub_taxonomy = create_taxonomy!(name: ::Faker::Lorem.sentence(word_count: 5), parent: taxonomy)
+
+            5.times do
+              create_taxonomy!(name: ::Faker::Lorem.sentence(word_count: 5), parent: sub_taxonomy)
+            end
+          end
+          # filters not available for participatory spaces
+          create_taxonomy_filter!(root_taxonomy: taxonomy,
+                                  taxonomies: taxonomy.all_children)
+        end
+
         if organization.top_scopes.none?
           province = create_scope_type!(name: "province", plural: "provinces")
           municipality = create_scope_type!(name: "municipality", plural: "municipalities")