decidim-core 0.31.2 → 0.31.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d24b967768820d8eb01abd435e318b7a869af854b0f374ca54c54a6dddbdddb6
-  data.tar.gz: f4374ee02ae0c5c9a580c8ad1c371c6552719be39b40e22cdf3d37018464950c
+  metadata.gz: 513dc9560cc17e12439bcef89efbb034edc6300b791810f2037bbb64191805a6
+  data.tar.gz: 99d7f076a772765592d34f5164659c5f4d0826edb4d146d5917fff28e02dc922
 SHA512:
-  metadata.gz: a4baebaa527bd42897989aee6feeb29b4bf2773872b3bb7f8379a230111a94f0ee8565e15b02599fb6a1c20bb83a24feed96707448eecc70b866d74a8dd34bec
-  data.tar.gz: 47436bb0abfd556afcebe781b153aaaa9e960653be07fdf19486f11d82bfc40b61472dc24cfbc397838b19638a395bbad3dc3af8e1d791b2277412b3b56e719d
+  metadata.gz: d8928571dc994667af951c63981ce2472ce1be5db0c477beb27cadfc2ac43b6cfa87f1a8ab6854483cd00ce46fb1856adacf593ad4e159e7e1a46dc3ae099b87
+  data.tar.gz: e03706f2aadaac2165c6a513a5b1284011bda181ab5a29683fe5983e616c880fd9c7a6ff15cbf1619fb6d6f658eb30df40e4d151cb81f12b0bdbd16c7848b224

data/app/cells/decidim/content_blocks/highlighted_elements_with_cell_for_list_cell.rb

@@ -19,10 +19,14 @@ module Decidim
         @list_cell ||= cell(
           list_cell_path,
           published_components.one? ? published_components.first : published_components,
-          **model.settings.to_h, see_all_path:
+          **model.settings.to_h, **extra_list_cell_options, see_all_path:
         )
       end
 
+      def extra_list_cell_options
+        {}
+      end
+
       def see_all_path; end
     end
   end

data/app/cells/decidim/nav_links/show.erb

@@ -1,12 +1,12 @@
 <div class="participatory-space__nav-container">
-  <button id="dropdown-trigger-participatory-space" data-controller="dropdown" data-target="dropdown-menu-participatory-space" data-auto-close="true" data-scroll-to-menu="true">
+  <button id="dropdown-trigger-participatory-space" data-controller="dropdown" data-target="dropdown-menu-participatory-space" data-auto-close="true" data-scroll-to-menu="true" data-add-aria-roles="false" data-open-md="true">
     <span><%= t("decidim.searches.filters.jump_to") %></span>
     <%= icon "arrow-down-s-line" %>
     <%= icon "arrow-up-s-line" %>
   </button>
-  <ul id="dropdown-menu-participatory-space" class="participatory-space__nav" aria-hidden="true">
+  <ul id="dropdown-menu-participatory-space" class="participatory-space__nav">
     <% model.each do |item| %>
-      <li role="menuitem">
+      <li>
         <%= link_to item[:url], class: "participatory-space__nav-item" do %>
           <%= decidim_escape_translated(item[:name]) %>
           <%= icon "arrow-right-line" %>

data/app/cells/decidim/participatory_space_private_user/show.erb

@@ -1,13 +1,13 @@
-<div class="profile__user">
+<%= link_to profile_url, class: "profile__user" do %>
   <div class="profile__user-avatar-container">
-    <div class="<%= has_profile? ? "profile__user-avatar" : "profile__user-avatar !border-0" %>">
-      <%= image_tag(has_profile? ? model.avatar_url(:big) : model.non_user_avatar_path, alt: "member-avatar") %>
+    <div class="profile__user-avatar">
+      <%= image_tag(model.avatar_url(:big), alt: "member-avatar") %>
     </div>
   </div>
   <div>
-    <div class="<%= has_profile? ? "profile__user-name" : "profile__user-name !no-underline" %>">
+    <span class="profile__user-name">
       <%= name %>
-    </div>
+    </span>
     <% if nickname.present? %>
       <span class="profile__user-nick block">
         <%= nickname %>
@@ -20,4 +20,4 @@
       </span>
     </div>
   </div>
-</div>
+<% end %>

data/app/cells/decidim/participatory_space_private_user_cell.rb

@@ -10,10 +10,6 @@ module Decidim
 
     private
 
-    def has_profile?
-      model.profile_url.present?
-    end
-
     def role_translated
       decidim_html_escape(decidim_sanitize(translated_attribute(role)))
     end

data/app/cells/decidim/report_button/already_reported_modal.erb

@@ -1,7 +1,7 @@
 <%= decidim_modal id: modal_id, class: "flag-modal" do %>
   <div data-dialog-container>
     <%= icon "flag-line" %>
-    <h2 tabindex="-1" data-dialog-title><%= t("decidim.shared.flag_modal.title") %></h2>
+    <h2 id="dialog-title-<%= modal_id %>" tabindex="-1" data-dialog-title><%= t("decidim.shared.flag_modal.title") %></h2>
     <div>
       <div class="form__wrapper flag-modal__form">
         <p class="flag-modal__form-description"><%= t("decidim.shared.flag_modal.already_reported") %></p>

data/app/cells/decidim/report_button/flag_modal.erb

@@ -2,7 +2,7 @@
   <%= decidim_form_for report_form, builder:, url: report_path, method: :post, html: { id: nil, data: { controller: "report-form" } } do |f| %>
     <div data-dialog-container>
       <%= icon "flag-line" %>
-      <h2 tabindex="-1" data-dialog-title><%= t("decidim.shared.flag_modal.title") %></h2>
+      <h2 id="dialog-title-<%= modal_id %>" tabindex="-1" data-dialog-title><%= t("decidim.shared.flag_modal.title") %></h2>
       <div>
         <div class="form__wrapper flag-modal__form">
           <p id="dialog-desc-<%= modal_id %>" class="flag-modal__form-description"><%= t("decidim.shared.flag_modal.description") %></p>

data/app/cells/decidim/report_user_button/already_reported_modal.erb

@@ -1,7 +1,7 @@
 <%= decidim_modal id: modal_id, class: "flag-user-modal" do %>
   <div data-dialog-container>
     <%= icon "flag-line" %>
-    <h2 tabindex="-1" data-dialog-title><%= t("decidim.shared.flag_user_modal.title") %></h2>
+    <h2 id="dialog-title-<%= modal_id %>" tabindex="-1" data-dialog-title><%= t("decidim.shared.flag_user_modal.title") %></h2>
     <div>
       <div class="form__wrapper flag-modal__form">
         <p class="flag-modal__form-description"><%= t("decidim.shared.flag_user_modal.already_reported") %></p>

data/app/cells/decidim/report_user_button/flag_modal.erb

@@ -2,7 +2,7 @@
   <%= decidim_form_for report_form, builder:, url: report_path, method: :post, html: { id: nil, data: { controller: "report-form" } } do |f| %>
     <div data-dialog-container>
       <%= icon "flag-line" %>
-      <h2 tabindex="-1" data-dialog-title><%= t("decidim.shared.flag_user_modal.title") %></h2>
+      <h2 id="dialog-title-<%= modal_id %>" tabindex="-1" data-dialog-title><%= t("decidim.shared.flag_user_modal.title") %></h2>
       <div>
         <div class="form__wrapper flag-modal__form">
           <p class="flag-modal__form-description"><%= t("decidim.shared.flag_user_modal.description") %></p>

data/app/cells/decidim/share_text_widget/modal.erb

@@ -1,6 +1,6 @@
 <%= decidim_modal id: "socialShare", class: "share-modal" do %>
   <div data-dialog-container>
-    <h2 tabindex="-1" data-dialog-title><%= t("share", scope: "decidim.shared.share_modal") %></h2>
+    <h2 id="dialog-title-socialShare" tabindex="-1" data-dialog-title><%= t("share", scope: "decidim.shared.share_modal") %></h2>
 
     <div>
 

data/app/cells/decidim/upload_modal/files.erb

@@ -42,7 +42,11 @@
             <% end %>
           <% end %>
           <% if attachment_blob.present? %>
-            <%= form.hidden_field attribute, value: attachment_blob.signed_id, id: "hidden_#{attribute}_#{attachment_blob.id}" %>
+            <% if is_persisted_attachment %>
+              <%= form.hidden_field attribute, value: attachment.id, id: "hidden_#{attribute}_#{attachment.id}" %>
+            <% else %>
+              <%= form.hidden_field attribute, value: attachment_blob.signed_id, id: "hidden_#{attribute}_#{attachment_blob.id}" %>
+            <% end %>
           <% end %>
         </div>
       <% end %>

data/app/cells/decidim/upload_modal_cell.rb

@@ -128,7 +128,16 @@ module Decidim
       @attachments = begin
         attachments = options[:attachments] || form.object.send(attribute)
         attachments = Array(attachments).compact_blank
-        attachments.map { |attachment| attachment.is_a?(String) ? ActiveStorage::Blob.find_signed(attachment) : attachment }
+        attachments.map do |attachment|
+          case attachment
+          when String
+            ActiveStorage::Blob.find_signed(attachment)
+          when Integer
+            Decidim::Attachment.find_by(id: attachment)
+          else
+            attachment
+          end
+        end.compact
       end
     end
 

data/app/commands/decidim/multiple_attachments_methods.rb

@@ -41,8 +41,9 @@ module Decidim
 
     def create_attachments(first_weight: 0)
       weight = first_weight
-      # Add the weights first to the old document
-      @form.documents.each do |document|
+      # Add the weights first to the old documents
+      document_ids = keep_ids
+      Decidim::Attachment.where(id: document_ids).each do |document|
         document.update!(weight:)
         weight += 1
       end
@@ -59,7 +60,7 @@ module Decidim
       documents = include_all_attachments ? documents_attached_to.attachments.with_attached_file : documents_attached_to.documents
 
       documents.each do |document|
-        document.destroy! if @form.documents.map(&:id).exclude? document.id
+        document.destroy! unless keep_ids.include?(document.id)
       end
 
       documents_attached_to.reload
@@ -98,5 +99,21 @@ module Decidim
     def blob(signed_id)
       ActiveStorage::Blob.find_signed(signed_id)
     end
+
+    def keep_ids
+      documents_array = Array(@form.documents)
+      documents_array.map do |doc|
+        case doc
+        when Decidim::Attachment
+          doc.id
+        when Integer
+          doc
+        when String
+          doc.match?(/\A\d+\z/) ? doc.to_i : nil
+        when Hash
+          (doc[:id] || doc["id"]).to_i
+        end
+      end.compact
+    end
   end
 end

data/app/helpers/decidim/mailer_helper.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Decidim
+  # Helper that provides methods to render order selector and links
+  module MailerHelper
+    # Transforms relative image URLs in HTML content to absolute URLs using the provided host.
+    # This is used in emails (newsletters and notifications) to ensure images display correctly
+    # in email clients.
+    #
+    # @param content [String] - HTML content with img tags
+    # @param host [String] - the Decidim::Organization host to use for the root URL
+    #
+    # @return [String] - the content with transformed image URLs
+    def decidim_transform_image_urls(content, host)
+      return content if host.blank? || content.blank?
+
+      root_url = if Decidim.storage_cdn_host.present?
+                   Decidim.storage_cdn_host.chomp("/")
+                 else
+                   Decidim::EngineRouter.new("decidim", {}).root_url(host:).chomp("/")
+                 end
+
+      content.gsub(/src\s*=\s*(['"])([^'"]*)\1/) do
+        quote = Regexp.last_match(1)
+        src_value = Regexp.last_match(2)
+
+        if src_value.blank? || src_value.start_with?("http://", "https://", "data:", "//", "cid:")
+          %(src=#{quote}#{src_value}#{quote})
+        else
+          normalized_src = src_value.start_with?("/") ? src_value : "/#{src_value}"
+          %(src=#{quote}#{root_url}#{normalized_src}#{quote})
+        end
+      end
+    end
+  end
+end

data/app/helpers/decidim/menu_helper.rb

@@ -57,7 +57,8 @@ module Decidim
         self,
         element_class: "font-semibold underline",
         active_class: "is-active",
-        container_options: { class: "space-y-4 break-inside-avoid", role: :menu },
+        role: false,
+        container_options: { class: "space-y-4 break-inside-avoid" },
         label: t("layouts.decidim.footer.decidim_title")
       )
     end

data/app/helpers/decidim/newsletters_helper.rb

@@ -3,6 +3,9 @@
 module Decidim
   # Helper that provides methods to render links with utm codes, and replaced name
   module NewslettersHelper
+    include Decidim::SanitizeHelper
+    include Decidim::MailerHelper
+
     # If the newsletter body there are some links and the Decidim.track_newsletter_links = true
     # it will be replaced with the utm_codes method described below.
     # for example transform "https://es.lipsum.com/" to "https://es.lipsum.com/?utm_source=localhost&utm_campaign=newsletter_11"
@@ -19,7 +22,7 @@ module Decidim
 
       content = interpret_name(content, user)
       content = track_newsletter_links(content, id, host)
-      transform_image_urls(content, host)
+      decidim_transform_image_urls(content, host)
     end
 
     # this method is used to generate the root link on mail with the utm_codes
@@ -67,27 +70,6 @@ module Decidim
       content.gsub("%{name}", user.name)
     end
 
-    # Find each img HTML tag with relative path in src attribute
-    # For each URL, prepends the decidim.root_url
-    #   If host is not defined it returns full content
-    #
-    # @param content [String] - the string to convert
-    # @param host [String] - the Decidim::Organization host to replace
-    #
-    # @return [String] - the content converted
-    #
-    def transform_image_urls(content, host)
-      return content if host.blank?
-
-      content.scan(/src\s*=\s*"([^"]*)"/).each do |src|
-        root_url = decidim.root_url(host:)[0..-2]
-        src_replaced = "#{root_url}#{src.first}"
-        content = content.gsub(/src\s*=\s*"([^"]*#{src.first})"/, %(src="#{src_replaced}"))
-      end
-
-      content
-    end
-
     # Add tracking query params to each links
     #
     # @param content [String] - the string to convert

data/app/jobs/decidim/find_and_update_descendants_job.rb

@@ -4,8 +4,14 @@ module Decidim
   # Update search indexes for each descendants of a given element
   class FindAndUpdateDescendantsJob < ApplicationJob
     queue_as :default
+    MAX_DEPTH = 5
+
+    def perform(element, current_depth = 0)
+      if current_depth >= MAX_DEPTH
+        Rails.logger.warn "Max depth of #{MAX_DEPTH} reached for element #{element.class.name} with id #{element.id}. Stopping recursion."
+        return
+      end
 
-    def perform(element)
       descendants_collector = components_for(element)
       descendants_collector << element.comments.to_a if element.respond_to?(:comments)
 
@@ -14,7 +20,7 @@ module Decidim
       descendants_collector.each do |descendants|
         next if descendants.blank?
 
-        Decidim::UpdateSearchIndexesJob.perform_later(descendants)
+        Decidim::UpdateSearchIndexesJob.perform_later(descendants, current_depth + 1)
       end
     end
 

data/app/jobs/decidim/update_search_indexes_job.rb

@@ -4,8 +4,8 @@ module Decidim
   class UpdateSearchIndexesJob < ApplicationJob
     queue_as :default
 
-    def perform(elements)
-      elements.each { |element| element.try(:try_update_index_for_search_resource) }
+    def perform(elements, current_depth = 0)
+      elements.each { |element| element.try(:try_update_index_for_search_resource, current_depth) }
     end
   end
 end

data/app/mailers/decidim/application_mailer.rb

@@ -7,9 +7,13 @@ module Decidim
     include LocalisedMailer
     include MultitenantAssetHost
     include Decidim::SanitizeHelper
+    include Decidim::MailerHelper
     include Decidim::OrganizationHelper
     helper_method :organization_name, :decidim_escape_translated, :decidim_sanitize_translated, :translated_attribute, :decidim_sanitize, :decidim_sanitize_newsletter
 
+    helper Decidim::SanitizeHelper
+    helper Decidim::MailerHelper
+
     after_action :set_smtp
     after_action :set_from
 

data/app/packs/src/decidim/a11y.js

@@ -8,6 +8,13 @@ import Dialogs from "a11y-dialog-component";
  * @return {void}
  */
 const createDialog = (component) => {
+  const getFocusableElements = (container) => {
+    const selectors = "a[href],button:not([disabled]),input:not([disabled]),select:not([disabled]),textarea:not([disabled]),[tabindex]:not([tabindex='-1'])";
+    return Array.from(container.querySelectorAll(selectors)).filter(
+      (el) => el.offsetParent !== null
+    );
+  };
+
   const {
     dataset: { dialog, ...attrs }
   } = component;
@@ -29,11 +36,33 @@ const createDialog = (component) => {
     backdropSelector: `[data-dialog="${dialog}"]`,
     enableAutoFocus: false,
     onOpen: (params, trigger) => {
+      const keyHandler = (event) => {
+        if (event.key !== "Tab") {
+          return;
+        }
+        const focusable = getFocusableElements(params);
+        if (focusable.length === 0) {
+          return;
+        }
+        if (event.shiftKey && document.activeElement === focusable[0]) {
+          event.preventDefault();
+          focusable[focusable.length - 1].focus({ preventScroll: true });
+        } else if (!event.shiftKey && document.activeElement === focusable[focusable.length - 1]) {
+          event.preventDefault();
+          focusable[0].focus({ preventScroll: true });
+        }
+      };
+      params._focusTrapHandler = keyHandler;
+      params.addEventListener("keydown", keyHandler);
       setFocusOnTitle(params);
       window.focusGuard.trap(params, trigger);
       params.dispatchEvent(new CustomEvent("open.dialog"));
     },
     onClose: (params) => {
+      if (params._focusTrapHandler) {
+        params.removeEventListener("keydown", params._focusTrapHandler);
+        Reflect.deleteProperty(params, "_focusTrapHandler");
+      }
       window.focusGuard.disable();
       params.dispatchEvent(new CustomEvent("close.dialog"));
     },

data/app/packs/src/decidim/a11y.test.js

@@ -0,0 +1,81 @@
+/* global jest */
+
+import { createDialog } from "src/decidim/a11y"
+
+describe("a11y dialog focus trap", () => {
+  const dialogHtml = `
+    <button id="open-btn" data-dialog-open="testDialog">Open</button>
+    <div id="test-dialog" data-dialog="testDialog">
+      <div data-dialog-container>
+        <h2 id="dialog-title-testDialog" tabindex="-1" data-dialog-title>Test Dialog</h2>
+        <a href="#">Link 1</a>
+        <button>Button 1</button>
+        <input type="text" />
+        <button>Button 2</button>
+        <a href="#">Link 2</a>
+      </div>
+      <div data-dialog-actions>
+        <button data-dialog-close="testDialog">Close</button>
+      </div>
+    </div>
+  `;
+
+  beforeEach(() => {
+    document.body.innerHTML = dialogHtml;
+    window.Decidim = {
+      currentDialogs: {}
+    };
+    window.focusGuard = {
+      trap: jest.fn(),
+      disable: jest.fn()
+    };
+  });
+
+  describe("keydown handler", () => {
+    let dialogEl = null;
+
+    beforeEach(() => {
+      const component = document.querySelector("[data-dialog]");
+      createDialog(component);
+      dialogEl = document.querySelector("[data-dialog='testDialog']");
+      // Get the dialog from Decidim.currentDialogs and open it
+      const dialog = window.Decidim.currentDialogs.testDialog;
+      dialog.open();
+    });
+
+    it("adds keydown handler on open", () => {
+      expect(dialogEl._focusTrapHandler).toBeDefined();
+    });
+
+    it("handles Tab key", () => {
+      const selectors = "a[href],button:not([disabled]),input:not([disabled]),select:not([disabled]),textarea:not([disabled]),[tabindex]:not([tabindex='-1'])";
+      const tabbableElements = Array.from(dialogEl.querySelectorAll(selectors)).filter(
+        (el) => el.offsetParent || el.offsetParent === null
+      );
+      tabbableElements[tabbableElements.length - 1].focus();
+
+      const event = new KeyboardEvent("keydown", { key: "Tab", bubbles: true });
+      const preventDefault = jest.fn();
+      event.preventDefault = preventDefault;
+
+      dialogEl.dispatchEvent(event);
+
+      expect(preventDefault).toHaveBeenCalled();
+    });
+  });
+
+  describe("onClose cleanup", () => {
+    it("removes the keydown handler on close", () => {
+      const component = document.querySelector("[data-dialog]");
+      createDialog(component);
+      const dialogEl = document.querySelector("[data-dialog='testDialog']");
+
+      const dialog = window.Decidim.currentDialogs.testDialog;
+      dialog.open();
+      expect(dialogEl._focusTrapHandler).toBeDefined();
+
+      dialog.close();
+      expect(dialogEl._focusTrapHandler).toBeUndefined();
+    });
+  });
+});

data/app/packs/src/decidim/confirm.js

@@ -169,7 +169,9 @@ export const initializeConfirm = () => {
     return handleDocumentEvent(ev, [
       Rails.linkClickSelector,
       Rails.buttonClickSelector,
-      Rails.formInputClickSelector
+      Rails.formInputClickSelector,
+      'button[data-confirm][type="button"]',
+      "form button[data-confirm]"
     ]);
   });
   document.addEventListener("change", (ev) => {
@@ -187,6 +189,11 @@ export const initializeConfirm = () => {
     $(Rails.formInputClickSelector).on("click.confirm", (ev) => {
       handleConfirm(ev, getMatchingEventTarget(ev, Rails.formInputClickSelector));
     });
+
+    // Handle button[type="button"] with data-confirm inside forms
+    $('button[data-confirm][type="button"]').on("click.confirm", (ev) => {
+      handleConfirm(ev, ev.currentTarget);
+    });
   });
 };