decidim-core 0.30.2 → 0.31.0.rc1

data/lib/decidim/core/test/shared_examples/oauth_application_examples.rb

@@ -0,0 +1,137 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+module OAuthSystemSpecHelpers
+  def visit_oauth_authorization_page(scope = nil)
+    scope ||= self.scope
+    authorization = oauth_authorization_details(scope)
+    visit "/oauth/authorize?#{URI.encode_www_form(authorization[:params])}"
+    expect(page).to have_content("Log in")
+
+    within "#session_new_user" do
+      fill_in :session_user_email, with: user.email
+      fill_in :session_user_password, with: "decidim123456789"
+      find("*[type=submit]").click
+    end
+
+    expect(page).to have_content("Logged in successfully.")
+
+    authorization
+  end
+
+  def oauth_api_authorization(scope)
+    token = oauth_api_token(scope)
+    %w(token_type access_token).map { |key| token[key] }.join(" ")
+  end
+
+  # Runs through the whole OAuth authorization code flow to fetch a valid OAuth
+  # token with the given scopes.
+  def oauth_api_token(scope)
+    authorization = visit_oauth_authorization_page(scope)
+
+    click_on "Authorize application"
+
+    expect(page).to have_content("Authorization code:")
+
+    page_params = Rack::Utils.parse_query(URI.parse(page.current_url).query)
+    raise "Invalid OAuth state returned." if page_params["state"] != authorization[:state]
+
+    code = page_params["code"]
+    oauth_fetch_token(code, authorization[:verifier])
+  end
+
+  def oauth_authorization_details(scope)
+    # https://datatracker.ietf.org/doc/html/rfc6749#appendix-A.5
+    chars = Array(0x20..0x7E).map(&:chr)
+    state = Base64.urlsafe_encode64(oauth_random_string(chars, 36), padding: false)
+
+    # https://datatracker.ietf.org/doc/html/rfc7636#section-4.1
+    chars = Array(0x30..0x39).map(&:chr) + Array(0x41..0x5A).map(&:chr) +
+            Array(0x61..0x7A).map(&:chr) + "-._~".chars
+    verifier = oauth_random_string(chars, 96)
+    challenge = Base64.urlsafe_encode64(Digest::SHA256.digest(verifier), padding: false)
+
+    # https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.1
+    # https://datatracker.ietf.org/doc/html/rfc7636
+    params = {
+      response_type: "code",
+      client_id: oauth_application.uid,
+      redirect_uri:,
+      scope:,
+      state:,
+      code_challenge: challenge,
+      code_challenge_method: "S256"
+    }
+
+    { params:, state:, verifier: }
+  end
+
+  def oauth_fetch_token(code, verifier)
+    # https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
+    # https://datatracker.ietf.org/doc/html/rfc7636
+    uri = URI.parse("#{organization_host}/oauth/token")
+    request = Net::HTTP::Post.new(uri)
+    data = {
+      grant_type: "authorization_code",
+      code:,
+      redirect_uri:,
+      client_id: oauth_application.uid,
+      code_verifier: verifier
+    }
+    data[:client_secret] = oauth_application.secret if confidential
+    request.set_form_data(data)
+
+    http = Net::HTTP.new(uri.host, uri.port)
+    response = http.request(request)
+    raise "Invalid response from token request: #{response.code}" unless response.is_a?(Net::HTTPOK)
+    raise "Unexpected content type from token request: #{response.content_type}" unless response.content_type == "application/json"
+
+    JSON.parse(response.body)
+  end
+
+  def oauth_random_string(chars, length)
+    Array.new(length) { chars[SecureRandom.random_number(chars.length)] }.join
+  end
+end
+
+shared_context "with oauth application" do
+  include OAuthSystemSpecHelpers
+
+  let!(:organization) { create(:organization) }
+  let(:organization_host) { "http://#{organization.host}:#{Capybara.server_port}" }
+  let!(:user) { create(:user, :confirmed, organization:) }
+  let(:available_scopes) { Doorkeeper.config.scopes.to_s }
+  let(:oauth_application) do
+    create(
+      :oauth_application,
+      organization:,
+      scopes: available_scopes,
+      confidential:,
+      redirect_uri:
+    )
+  end
+  # Doorkeeper defines a special action for passing the authorization code back
+  # to native apps. This should be primarily used only with public clients but
+  # for the sake of testing, we use the same redirect URI for testing both types
+  # of OAuth applications.
+  let(:redirect_uri) { "#{organization_host}/oauth/authorize/native" }
+  let(:confidential) { true }
+
+  around do |example|
+    config = WebMock::Config.instance
+    orig_allow = config.allow
+    config.allow << %r{http://[0-9]+\.lvh\.me:#{Capybara.server_port}/}
+
+    example.run
+
+    config.allow = orig_allow
+  end
+
+  before do
+    allow(Doorkeeper.config).to receive(:force_ssl_in_redirect_uri).and_return(false)
+    oauth_application
+
+    switch_to_host(organization.host)
+  end
+end

data/lib/decidim/core/test/shared_examples/participatory_space_dropdown_metadata_cell_examples.rb

@@ -79,21 +79,3 @@ shared_examples_for "participatory space dropdown metadata cell" do
     end
   end
 end
-
-shared_examples_for "participatory space dropdown metadata cell hashtag" do
-  context "when the hashtag is blank" do
-    let(:hashtag) { nil }
-
-    it "does not render the hashtag symbol" do
-      expect(subject).to have_no_content("#")
-    end
-  end
-
-  context "when the hashtag is present" do
-    let(:hashtag) { "space_is_the_place" }
-
-    it "renders the hashtag" do
-      expect(subject).to have_link("#space_is_the_place")
-    end
-  end
-end

data/lib/decidim/core/test/shared_examples/permissions.rb

@@ -5,7 +5,6 @@ require "spec_helper"
 shared_examples_for "general conversation permissions" do
   let(:context) { { conversation: } }
   let(:another_user) { create(:user) }
-  let(:group) { create(:user_group) }
 
   context "when the originator of the conversation is the user" do
     let!(:conversation) do
@@ -64,51 +63,6 @@ shared_examples_for "general conversation permissions" do
       it { is_expected.to eq false }
     end
   end
-
-  context "when the originator of the conversation is a group" do
-    let(:context) { { conversation:, interlocutor: group } }
-    let!(:conversation) do
-      Decidim::Messaging::Conversation.start!(
-        originator: group,
-        interlocutors: [another_user],
-        body: "who wants apples?"
-      )
-    end
-
-    it { is_expected.to eq true }
-  end
-
-  context "when the group is an interlocutor" do
-    let(:context) { { conversation:, interlocutor: group } }
-    let!(:conversation) do
-      Decidim::Messaging::Conversation.start!(
-        originator: another_user,
-        interlocutors: [group],
-        body: "who wants apples?"
-      )
-    end
-
-    it { is_expected.to eq true }
-
-    context "and group is not specified as interlocutor" do
-      let(:context) { { conversation: } }
-
-      it { is_expected.to eq false }
-    end
-  end
-
-  context "when the group is not in the conversation" do
-    let(:context) { { conversation:, interlocutor: group } }
-    let!(:conversation) do
-      Decidim::Messaging::Conversation.start!(
-        originator: another_user,
-        interlocutors: [create(:user_group)],
-        body: "who wants apples?"
-      )
-    end
-
-    it { is_expected.to eq false }
-  end
 end
 
 shared_examples_for "restricted conversation permissions" do

data/lib/decidim/core/test/shared_examples/reports_examples.rb

@@ -185,8 +185,8 @@ shared_examples "reports by user type" do
     include_examples "higher user role reports"
     include_examples "higher user role hides"
   end
-  context "When reporting user is process valuator" do
-    let!(:user) { create(:process_valuator, :confirmed, participatory_process:) }
+  context "When reporting user is process evaluator" do
+    let!(:user) { create(:process_evaluator, :confirmed, participatory_process:) }
     include_examples "higher user role reports"
     include_examples "higher user role does not have hide"
   end

data/lib/decidim/core/test/shared_examples/{resource_endorsed_event_examples.rb → resource_liked_event_examples.rb}

@@ -2,14 +2,14 @@
 
 require "spec_helper"
 
-shared_examples_for "resource endorsed event" do
+shared_examples_for "resource liked event" do
   include_context "when a simple event"
 
-  let(:event_name) { "decidim.events.resource_endorsed" }
+  let(:event_name) { "decidim.events.resource_liked" }
   let(:author) { create(:user, organization: resource.organization) }
 
-  let(:extra) { { endorser_id: author.id } }
-  let(:endorsement) { create(:endorsement, resource:, author:) }
+  let(:extra) { { liker_id: author.id } }
+  let(:like) { create(:like, resource:, author:) }
   let(:resource_path) { resource_locator(resource).path }
   let(:follower) { create(:user, organization: resource.organization) }
   let(:follow) { create(:follow, followable: author, user: follower) }
@@ -30,7 +30,7 @@ shared_examples_for "resource endorsed event" do
 
   describe "email_subject" do
     it "is generated correctly" do
-      expect(subject.email_subject).to eq("#{author_presenter.nickname} has performed a new endorsement")
+      expect(subject.email_subject).to eq("#{author_presenter.nickname} has performed a new like")
     end
   end
 
@@ -39,7 +39,7 @@ shared_examples_for "resource endorsed event" do
     it "is generated correctly" do
       expect(subject.email_intro)
         .to eq("#{author.name} #{author_presenter.nickname}, who you are following, " \
-               "has just endorsed \"#{resource_title}\" and we think it may be interesting to you. Check it out and contribute:")
+               "has just liked \"#{resource_title}\" and we think it may be interesting to you. Check it out and contribute:")
     end
   end
 
@@ -48,7 +48,7 @@ shared_examples_for "resource endorsed event" do
 
     it "is generated correctly" do
       expect(subject.notification_title)
-        .to include("The <a href=\"#{resource_path}\">#{resource_title}</a> #{resource_type} has been endorsed by ")
+        .to include("The <a href=\"#{resource_path}\">#{resource_title}</a> #{resource_type} has been liked by ")
 
       expect(subject.notification_title)
         .to include("<a href=\"/profiles/#{author.nickname}\">#{author.name} #{author_presenter.nickname}</a>.")

data/lib/decidim/core/test/shared_examples/resource_search_examples.rb

@@ -225,7 +225,6 @@ shared_examples_for "a resource search with origin" do |factory_name|
 
   describe "results" do
     let!(:official_resource) { create(factory_name, :official, { component: }.merge(factory_params)) }
-    let!(:user_group_resource) { create(factory_name, :user_group_author, { component: }.merge(factory_params)) }
     let!(:participant_resource) { create(factory_name, :participant_author, { component: }.merge(factory_params)) }
 
     if FactoryBot.factories[factory_name].defined_traits.map(&:name).include?(:meeting_resource)
@@ -246,7 +245,6 @@ shared_examples_for "a resource search with origin" do |factory_name|
       it "returns only official resources" do
         expect(subject).to have_escaped_html(translated(official_resource.try(:title) || official_resource.try(:name)))
         expect(subject).not_to have_escaped_html(translated(participant_resource.try(:title) || participant_resource.try(:name)))
-        expect(subject).not_to have_escaped_html(translated(user_group_resource.try(:title) || user_group_resource.try(:name)))
       end
     end
 
@@ -256,17 +254,6 @@ shared_examples_for "a resource search with origin" do |factory_name|
       it "returns only citizen resources" do
         expect(subject).not_to have_escaped_html(translated(official_resource.try(:title) || official_resource.try(:name)))
         expect(subject).to have_escaped_html(translated(participant_resource.try(:title) || participant_resource.try(:name)))
-        expect(subject).not_to have_escaped_html(translated(user_group_resource.try(:title) || user_group_resource.try(:name)))
-      end
-    end
-
-    context "when filtering user groups resources" do
-      let(:origins) { %w(user_group) }
-
-      it "returns only user groups resources" do
-        expect(subject).not_to have_escaped_html(translated(official_resource.try(:title) || official_resource.try(:name)))
-        expect(subject).not_to have_escaped_html(translated(participant_resource.try(:title) || participant_resource.try(:name)))
-        expect(subject).to have_escaped_html(translated(user_group_resource.try(:title) || user_group_resource.try(:name)))
       end
     end
 
@@ -277,7 +264,6 @@ shared_examples_for "a resource search with origin" do |factory_name|
         it "returns only meeting resources" do
           expect(subject).not_to have_escaped_html(translated(official_resource.try(:title) || official_resource.try(:name)))
           expect(subject).not_to have_escaped_html(translated(participant_resource.try(:title) || participant_resource.try(:name)))
-          expect(subject).not_to have_escaped_html(translated(user_group_resource.try(:title) || user_group_resource.try(:name)))
           expect(subject).to have_escaped_html(translated(meeting_resource.try(:title) || meeting_resource.try(:name)))
         end
       end

data/lib/decidim/core/test/shared_examples/searchable_results_examples.rb

@@ -20,22 +20,9 @@ shared_examples "searchable results" do
       find(search_input_selector).native.send_keys :enter
 
       expect(page).to have_current_path decidim.search_path, ignore_query: true
-      expect(page).to have_content(%(Results for the search: "#{term}"))
+      expect(page).to have_content(%(results for the search: "#{term}"))
       expect(page).to have_css(".filter-search.filter-container")
-      expect(page.find("#search-count h1").text.to_i).to be_positive
-    end
-
-    it "finds content by hashtag" do
-      if respond_to?(:hashtag)
-        fill_in "term", with: hashtag
-        find(search_input_selector).native.send_keys :enter
-
-        expect(page.find("#search-count h1").text.to_i).to be_positive
-
-        within "#results" do
-          expect(page).to have_content(hashtag)
-        end
-      end
+      expect(page.find("#search-count h2").text.to_i).to be_positive
     end
 
     context "when moderation is involved" do
@@ -47,9 +34,9 @@ shared_examples "searchable results" do
         find(search_input_selector).native.send_keys :enter
 
         expect(page).to have_current_path decidim.search_path, ignore_query: true
-        expect(page).to have_content(%(Results for the search: "#{term}"))
+        expect(page).to have_content(%(results for the search: "#{term}"))
         expect(page).to have_css(".filter-search.filter-container")
-        expect(page.find("#search-count h1").text.to_i).to be_positive
+        expect(page.find("#search-count h2").text.to_i).to be_positive
 
         searchables.each do |searchable|
           next unless searchable.is_a?(Decidim::Reportable)
@@ -66,9 +53,9 @@ shared_examples "searchable results" do
         find(search_input_selector).native.send_keys :enter
 
         expect(page).to have_current_path decidim.search_path, ignore_query: true
-        expect(page).to have_content(%(Results for the search: "#{term}"))
+        expect(page).to have_content(%(results for the search: "#{term}"))
         expect(page).to have_css(".filter-search.filter-container")
-        expect(page.find("#search-count h1").text.to_i).not_to be_positive
+        expect(page.find("#search-count h2").text.to_i).not_to be_positive
       end
     end
 
@@ -82,22 +69,9 @@ shared_examples "searchable results" do
           find(search_input_selector).native.send_keys :enter
 
           expect(page).to have_current_path decidim.search_path, ignore_query: true
-          expect(page).to have_content(%(Results for the search: "#{term}"))
+          expect(page).to have_content(%(results for the search: "#{term}"))
           expect(page).to have_css(".filter-search.filter-container")
-          expect(page.find("#search-count h1").text.to_i).not_to be_positive
-        end
-
-        it "does not find content by hashtag" do
-          if respond_to?(:hashtag)
-            fill_in "term", with: hashtag
-            find(search_input_selector).native.send_keys :enter
-
-            expect(page.find("#search-count h1").text.to_i).not_to be_positive
-
-            within "#results" do
-              expect(page).to have_no_content(hashtag)
-            end
-          end
+          expect(page.find("#search-count h2").text.to_i).not_to be_positive
         end
       end
 

data/lib/decidim/core/test/shared_examples/social_share_examples.rb

@@ -40,7 +40,86 @@ shared_examples "a social share widget" do
       expect(page).to have_css('a[title="Share to Facebook"]')
       expect(page).to have_css('a[title="Share to WhatsApp"]')
       expect(page).to have_css('a[title="Share to Telegram"]')
+      expect(page).to have_css('a[title="Share to QR"]')
       expect(page).to have_css(".share-modal__input")
     end
   end
 end
+
+shared_examples "a social share via QR code" do
+  let(:title) { resource.presenter.title }
+  let(:parameterized_title) { CGI.escapeHTML(title) }
+  let!(:card_image) { nil }
+
+  it "properly generates a resolvable url" do
+    visit_resource
+    click_on "Share"
+
+    execute_script("window.location.href = document.getElementById('urlShareLink').value")
+
+    expect(page).to have_current_path(resource_locator(resource).path, ignore_query: true)
+  end
+
+  context "when the url is malformed" do
+    it_behaves_like "a 404 page" do
+      let(:target_path) { decidim.qr_path(resource: "Missing") }
+    end
+  end
+
+  it "has the QR code" do
+    visit_resource
+    click_on "Share"
+    click_on "Share to QR"
+
+    expect(page).to have_content("QR Code")
+    within "#QRCodeDialog" do
+      expect(page).to have_css(%(img[alt="QR Code"]))
+      expect(page).to have_link("Print poster")
+      expect(page).to have_content(title)
+      expect(page).to have_link("Download")
+    end
+  end
+
+  it "downloads the QR code", download: true do
+    visit_resource
+    click_on "Share"
+    click_on "Share to QR"
+    click_on "Download"
+
+    wait_for_download
+
+    expect(downloads.length).to eq(1)
+    expect(download_path).to match(/.*\.png/)
+  end
+
+  it "displays the QR code page" do
+    visit_resource
+    click_on "Share"
+    click_on "Share to QR"
+    click_on "Print poster"
+    expect(page).to have_content("Scan the QR code")
+    expect(page).to have_css(%(img[alt="QR Code for #{parameterized_title}"]))
+
+    expect(page).to have_css(%(img[src*="#{card_image}"])) unless card_image.nil?
+    expect(page).to have_content(title)
+
+    expect(page).to have_content(translated(organization.name))
+  end
+
+  it "generates the same QR code" do
+    visit_resource
+    click_on "Share"
+    click_on "Share to QR"
+
+    image = "Avoid comparing empty strings"
+
+    within "#QRCodeDialog" do
+      image = find("img")[:src]
+    end
+
+    click_on "Print poster"
+    new_image = find(%(img[alt="QR Code for #{parameterized_title}"]))[:src]
+
+    expect(image).to eq(new_image)
+  end
+end

data/lib/decidim/core/test/shared_examples/system_like_resource_examples.rb

@@ -0,0 +1,192 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+shared_context "with resources to be liked or not" do
+  include_context "with a component"
+
+  # Should be overridden and create one main resource
+  let!(:resource) { nil }
+  # the name of the resource to be clicked from the component view
+  let(:resource_name) { nil }
+  # Should be overridden and create 3 extra resources in the current component
+  let!(:resources) { nil }
+end
+
+shared_examples "Like resource system specs" do
+  def expect_page_not_to_include_likes
+    expect(page).to have_no_button("Like")
+    expect(page).to have_no_css("#resource-#{resource.id}-likes-count")
+  end
+
+  def visit_resource
+    visit_component
+    click_on resource_name
+  end
+
+  context "when likes are not enabled" do
+    let(:component_traits) { [:with_likes_disabled] }
+
+    context "when the user is not logged in" do
+      it "does not show the like resource button and counts" do
+        visit_resource
+        expect_page_not_to_include_likes
+      end
+    end
+
+    context "when the user is logged in" do
+      before do
+        login_as user, scope: :user
+      end
+
+      it "does not show the like resource button and counts" do
+        visit_resource
+        expect_page_not_to_include_likes
+      end
+    end
+  end
+
+  context "when likes are enabled but blocked" do
+    let(:component_traits) { [:with_likes_enabled, :with_likes_blocked] }
+
+    it "shows the likes count and the like button is disabled" do
+      visit_resource
+      expect(page).to have_css("#resource-#{resource.id}-like-block button[disabled='true']")
+    end
+  end
+
+  context "when likes are enabled" do
+    let(:component_traits) { [:with_likes_enabled] }
+
+    context "when the user is not logged in" do
+      it "is given the option to sign in" do
+        visit_resource
+        within "#resource-#{resource.id}-like-block" do
+          click_on "Like"
+        end
+
+        expect(page).to have_css("#loginModal", visible: :visible)
+      end
+    end
+
+    context "when the user is logged in" do
+      before do
+        login_as user, scope: :user
+      end
+
+      context "when the resource is not liked yet" do
+        it "is able to like the resource" do
+          visit_resource
+          within "#resource-#{resource.id}-like-block" do
+            click_on "Like"
+            expect(page).to have_button("Like")
+            expect(page).to have_css('svg use[href*="ri-heart-fill"]')
+            expect(page).to have_css('#like-button[aria-label="Undo the like"]')
+          end
+        end
+
+        it "has likes from other users" do
+          author = create(:user, :confirmed, organization: resource.organization)
+          create(:like, resource:, author:)
+          visit_resource
+          within "#liker-list-#{resource.id}" do
+            expect(page).to have_content("Liked by #{author.name}")
+            click_on author.name
+          end
+          expect(page).to have_content("Liked by")
+          within "#likesModal-#{resource.id}" do
+            expect(page).to have_content(author.name)
+            expect(page).to have_no_content(user.name)
+          end
+        end
+      end
+
+      context "when the resource is already liked" do
+        let!(:like) { create(:like, resource:, author: user) }
+
+        it "is not able to like it again" do
+          visit_resource
+          within "#resource-#{resource.id}-like-block" do
+            expect(page).to have_css('svg use[href*="ri-heart-fill"]')
+            expect(page).to have_css('#like-button[aria-label="Undo the like"]')
+            expect(page).to have_no_css('svg use[href*="ri-heart-line"]')
+          end
+        end
+
+        it "is able to undo the like" do
+          visit_resource
+          within "#resource-#{resource.id}-like-block" do
+            expect(page).to have_css('svg use[href*="ri-heart-fill"]')
+            expect(page).to have_css('#like-button[aria-label="Undo the like"]')
+            click_on "Like"
+            expect(page).to have_css('svg use[href*="ri-heart-line"]')
+            expect(page).to have_css('#like-button[aria-label="Like"]')
+            expect(page).to have_button("Like")
+          end
+        end
+
+        it "can show the likes pop-up" do
+          visit_resource
+          within "#liker-list-#{resource.id}" do
+            expect(page).to have_content("Liked by you")
+            click_on "you"
+          end
+          expect(page).to have_content("Liked by")
+          within "#likesModal-#{resource.id}" do
+            expect(page).to have_content(user.name)
+          end
+        end
+      end
+
+      context "when verification is required" do
+        let(:permissions) do
+          {
+            like: {
+              authorization_handlers: {
+                "dummy_authorization_handler" => { "options" => {} }
+              }
+            }
+          }
+        end
+
+        before do
+          organization.available_authorizations = ["dummy_authorization_handler"]
+          organization.save!
+          component.update(permissions:)
+        end
+
+        context "when user is NOT verified" do
+          it "is NOT able to like" do
+            visit_resource
+            within "#resource-#{resource.id}-like-block" do
+              click_on "Like"
+            end
+            expect(page).to have_css("#authorizationModal", visible: :visible)
+          end
+        end
+
+        context "when user IS verified" do
+          before do
+            handler_params = { user: }
+            handler_name = "dummy_authorization_handler"
+            handler = Decidim::AuthorizationHandler.handler_for(handler_name, handler_params)
+
+            Decidim::Authorization.create_or_update_from(handler)
+          end
+
+          it "IS able to like", :slow do
+            visit_resource
+            within "#resource-#{resource.id}-like-block" do
+              expect(page).to have_css('svg use[href*="ri-heart-line"]')
+              expect(page).to have_css('#like-button[aria-label="Like"]')
+              click_on "Like"
+              expect(page).to have_button("Like")
+              expect(page).to have_css('#like-button[aria-label="Undo the like"]')
+              expect(page).to have_css('svg use[href*="ri-heart-fill"]')
+            end
+          end
+        end
+      end
+    end
+  end
+end