decidim-core 0.31.2 → 0.32.1

data/app/cells/decidim/share_widget/qr_code_modal.erb

@@ -2,7 +2,7 @@
   <div data-dialog-container>
     <div data-dialog-title>
       <%= icon "qr-code-line" %>
-      <h2 tabindex="-1"><%= t("decidim.share_widget.qr_code") %></h2>
+      <h2 id="dialog-title-qr-code-dialog" tabindex="-1"><%= t("decidim.share_widget.qr_code") %></h2>
     </div>
     <div class="content">
       <div>

data/app/cells/decidim/tags_cell.rb

@@ -25,7 +25,7 @@ module Decidim
       @taxonomies ||= model.taxonomies.map do |taxonomy|
         {
           name: decidim_sanitize_translated(taxonomy.name),
-          url: resource_locator(model).index(filter: { "with_any_taxonomies[#{taxonomy.root_taxonomy.id}]" => [taxonomy.id.to_s] })
+          url: resource_locator(model).index(filter: { "with_any_taxonomies" => { taxonomy.root_taxonomy.id => [taxonomy.id.to_s] } })
         }
       end
     end

data/app/cells/decidim/upload_modal/files.erb

@@ -42,7 +42,11 @@
             <% end %>
           <% end %>
           <% if attachment_blob.present? %>
-            <%= form.hidden_field attribute, value: attachment_blob.signed_id, id: "hidden_#{attribute}_#{attachment_blob.id}" %>
+            <% if is_persisted_attachment %>
+              <%= form.hidden_field attribute, value: attachment.id, id: "hidden_#{attribute}_#{attachment.id}" %>
+            <% else %>
+              <%= form.hidden_field attribute, value: attachment_blob.signed_id, id: "hidden_#{attribute}_#{attachment_blob.id}" %>
+            <% end %>
           <% end %>
         </div>
       <% end %>

data/app/cells/decidim/upload_modal_cell.rb

@@ -128,7 +128,16 @@ module Decidim
       @attachments = begin
         attachments = options[:attachments] || form.object.send(attribute)
         attachments = Array(attachments).compact_blank
-        attachments.map { |attachment| attachment.is_a?(String) ? ActiveStorage::Blob.find_signed(attachment) : attachment }
+        attachments.map do |attachment|
+          case attachment
+          when String
+            ActiveStorage::Blob.find_signed(attachment)
+          when Integer
+            Decidim::Attachment.find_by(id: attachment)
+          else
+            attachment
+          end
+        end.compact
       end
     end
 
@@ -168,6 +177,11 @@ module Decidim
 
     def file_attachment_path(attachment)
       return unless attachment
+
+      if attachment.respond_to?(:record) && attachment.record.is_a?(Decidim::Authorization) && attachment.name.to_s == "verification_attachment"
+        return decidim.private_download_path(Decidim::PrivateDownload.for(attachment.record, attachment_name: attachment.name).token)
+      end
+
       return Rails.application.routes.url_helpers.rails_blob_url(attachment, only_path: true) if attachment.is_a? ActiveStorage::Blob
 
       if attachment.try(:attached?)

data/app/cells/decidim/versions_list/show.erb

@@ -1,3 +1,28 @@
 <% reverse_ordered_versions.each_with_index do |version, index| %>
   <%= cell("decidim/versions_list_item", version, index:, versioned_resource:, version_path:, i18n_scope:, total:) %>
 <% end %>
+
+<% if versioned_resource.class.include?(Decidim::Fingerprintable) %>
+  <% fingerprint_id = dom_id(versioned_resource, :fingerprint_dialog) %>
+  <section class="mt-4 ml-2">
+    <%= content_tag :button, t("decidim.fingerprint.check"), class: "button button__lg button__text-secondary font-normal text-sm underline", data: { dialog_open: fingerprint_id } %>
+  </section>
+  <%= decidim_modal id: fingerprint_id, class: "fingerprint-modal" do %>
+    <div data-dialog-container>
+      <%= icon "fingerprint-line" %>
+      <h2 id="dialog-title-<%= fingerprint_id %>" tabindex="-1" data-dialog-title><%= t "decidim.fingerprint.title" %></h2>
+      <div class="fingerprint-modal__container">
+        <p id="dialog-desc-<%= fingerprint_id %>"><%= t "decidim.fingerprint.explanation" %></p>
+        <div>
+          <span class="fingerprint-modal__span"><%= t "decidim.fingerprint.value" %>:</span>
+          <code class="fingerprint-modal__code"><%= decidim_html_escape versioned_resource.fingerprint.value %></code>
+        </div>
+        <div>
+          <span class="fingerprint-modal__span"><%= t "decidim.fingerprint.source" %>:</span>
+          <code class="fingerprint-modal__code"><%= decidim_html_escape versioned_resource.fingerprint.source %></code>
+        </div>
+        <p><%= t("decidim.fingerprint.replicate_help", online_calculator_link: link_to(t("decidim.fingerprint.online_calculator_name"), "https://www.md5calc.com/sha256", target: "_blank", rel: "noopener")).html_safe %></p>
+      </div>
+    </div>
+  <% end %>
+<% end %>

data/app/commands/decidim/create_follow.rb

@@ -20,6 +20,7 @@ module Decidim
     # Returns nothing.
     def call
       return broadcast(:invalid) if form.invalid?
+      return broadcast(:invalid) unless current_user.is_a?(Decidim::User)
 
       create_follow!
       increment_score
@@ -32,13 +33,10 @@ module Decidim
     attr_reader :follow, :form
 
     def create_follow!
-      @follow = Follow.find_by(
+      @follow = Follow.where(
         followable: form.followable,
         user: current_user
-      ) || Follow.create!(
-        followable: form.followable,
-        user: current_user
-      )
+      ).first_or_create!
     end
 
     def increment_score

data/app/commands/decidim/create_user_report.rb

@@ -58,7 +58,7 @@ module Decidim
       current_user.organization.admins.each do |admin|
         next unless admin.email_on_moderations
 
-        Decidim::UserReportJob.perform_later(admin, report)
+        UserReportMailer.notify(admin, report).deliver_later
       end
     end
 

data/app/commands/decidim/destroy_account.rb

@@ -15,7 +15,7 @@ module Decidim
     def call
       return broadcast(:invalid) unless @form.valid?
 
-      Decidim::User.transaction do
+      with_events(with_transaction: true) do
         destroy_user_account!
         destroy_user_identities
         destroy_follows
@@ -28,7 +28,7 @@ module Decidim
         destroy_user_badges
         destroy_user_likes
         destroy_user_reports
-        destroy_participatory_space_private_user
+        destroy_member
         delegate_destroy_to_participatory_spaces
       end
 
@@ -101,8 +101,8 @@ module Decidim
       Decidim::Follow.where(user: current_user).find_each(&:destroy)
     end
 
-    def destroy_participatory_space_private_user
-      Decidim::ParticipatorySpacePrivateUser.where(user: current_user).find_each(&:destroy)
+    def destroy_member
+      Decidim::ParticipatorySpace::Member.where(user: current_user).find_each(&:destroy)
     end
 
     def delegate_destroy_to_participatory_spaces
@@ -110,5 +110,16 @@ module Decidim
         space_manifest.invoke_on_destroy_account(current_user)
       end
     end
+
+    # We use memoization in this particular email, as we want to have the data available before the actual anonymization
+    def event_arguments
+      @event_arguments ||= {
+        user_id: current_user.id,
+        user_email: current_user.email,
+        user_name: current_user.name,
+        locale: current_user.locale,
+        organization: current_user.organization
+      }
+    end
   end
 end

data/app/commands/decidim/multiple_attachments_methods.rb

@@ -5,16 +5,16 @@ module Decidim
     private
 
     def build_attachments
-      @documents = []
-      @form.add_documents.compact_blank.each do |attachment|
+      @attachments = []
+      @form.add_attachments.compact_blank.each do |attachment|
         if attachment.is_a?(Hash) && attachment.has_key?(:id)
           update_attachment_title_for(attachment)
           next
         end
 
-        @documents << Attachment.new(
+        @attachments << Attachment.new(
           title: title_for(attachment),
-          attached_to: @attached_to || documents_attached_to,
+          attached_to: @attached_to || attachments_attached_to,
           file: signed_id_for(attachment),
           content_type: content_type_for(attachment)
         )
@@ -26,11 +26,11 @@ module Decidim
     end
 
     def attachments_invalid?
-      @documents.each do |document|
-        next if document.valid? || !document.errors.has_key?(:file)
+      @attachments.each do |attachment|
+        next if attachment.valid? || !attachment.errors.has_key?(:file)
 
-        document.errors[:file].each do |error|
-          @form.errors.add(:add_documents, error)
+        attachment.errors[:file].each do |error|
+          @form.errors.add(:add_attachments, error)
         end
 
         return true
@@ -41,36 +41,38 @@ module Decidim
 
     def create_attachments(first_weight: 0)
       weight = first_weight
-      # Add the weights first to the old document
-      @form.documents.each do |document|
-        document.update!(weight:)
+      # Add the weights first to the old attachments
+      attachment_ids = keep_ids
+      Decidim::Attachment.where(id: attachment_ids).each do |attachment|
+        attachment.update!(weight:)
         weight += 1
       end
-      @documents.map! do |document|
-        document.weight = weight
-        document.attached_to = documents_attached_to
-        document.save!
+      @attachments.map! do |attachment|
+        attachment.weight = weight
+        attachment.attached_to = attachments_attached_to
+        attachment.save!
         weight += 1
-        @form.documents << document
+        @form.attachments << attachment
       end
     end
 
-    def document_cleanup!(include_all_attachments: false)
-      documents = include_all_attachments ? documents_attached_to.attachments.with_attached_file : documents_attached_to.documents
+    def attachment_cleanup!(include_all_attachments: false)
+      attachments = include_all_attachments ? attachments_attached_to.attachments.with_attached_file : attachments_attached_to.attachments
 
-      documents.each do |document|
-        document.destroy! if @form.documents.map(&:id).exclude? document.id
+      attachments.each do |attachment|
+        attachment.destroy! unless keep_ids.include?(attachment.id)
       end
 
-      documents_attached_to.reload
-      documents_attached_to.instance_variable_set(:@documents, nil)
+      attachments_attached_to.reload
+      attachments_attached_to.instance_variable_set(:@attachments, nil)
+      attachments_attached_to.instance_variable_set(:@photos, nil)
     end
 
     def process_attachments?
-      @form.add_documents.any?
+      @form.add_attachments.any?
     end
 
-    def documents_attached_to
+    def attachments_attached_to
       return @attached_to if @attached_to.present?
       return form.current_organization if form.respond_to?(:current_organization)
 
@@ -98,5 +100,21 @@ module Decidim
     def blob(signed_id)
       ActiveStorage::Blob.find_signed(signed_id)
     end
+
+    def keep_ids
+      attachments_array = Array(@form.attachments)
+      attachments_array.map do |doc|
+        case doc
+        when Decidim::Attachment
+          doc.id
+        when Integer
+          doc
+        when String
+          doc.match?(/\A\d+\z/) ? doc.to_i : nil
+        when Hash
+          (doc[:id] || doc["id"]).to_i
+        end
+      end.compact
+    end
   end
 end

data/app/commands/decidim/search.rb

@@ -7,10 +7,10 @@ module Decidim
 
     # Public: Initializes the command.
     #
-    # @param term: The term to search for.
-    # @param organization: The Organization to which the results are constrained.
-    # @param filters: (optional) A Hash of SearchableResource attributes to filter for.
-    # @param page_params: (optional) A Hash with `page` and `per_page` options to paginate.
+    # @param term [String] -  The term to search for.
+    # @param organization [Decidim::Organization] - The Organization to which the results are constrained.
+    # @param filters [Hash] - (optional) A Hash of SearchableResource attributes to filter for.
+    # @param page_params [Hash] - (optional) A Hash with `page` and `per_page` options to paginate.
     def initialize(term, organization, filters = {}, page_params = {})
       @term = term
       @organization = organization
@@ -91,7 +91,7 @@ module Decidim
         query = query.where(decidim_participatory_space: spaces)
       end
 
-      query = query.order("datetime DESC")
+      query = query.order(datetime: :desc)
       query = query.global_search(I18n.transliterate(term)) if term.present?
       query
     end

data/app/controllers/concerns/decidim/ajax_permission_handler.rb

@@ -15,7 +15,7 @@ module Decidim
     def ajax_user_has_no_permission
       return user_has_no_permission unless request.xhr?
 
-      render json: { message: I18n.t("actions.unauthorized", scope: "decidim.core") }, status: :unprocessable_entity
+      render json: { message: I18n.t("actions.unauthorized", scope: "decidim.core") }, status: :unprocessable_content
     end
   end
 end

data/app/controllers/concerns/decidim/devise_controllers.rb

@@ -41,6 +41,10 @@ module Decidim
 
       layout "layouts/decidim/application"
 
+      # Ensure locale is set before Devise's own prepended callbacks and reset
+      # after the request finishes.
+      prepend_around_action :set_current_locale
+
       # Saves the location before loading each page so we can return to the
       # right page.
       before_action :store_current_location
@@ -58,6 +62,11 @@ module Decidim
 
         store_location_for(:user, redirect_url)
       end
+
+      def set_current_locale(&)
+        locale = Decidim::LocaleRouterDetector.new(request, params).locale
+        I18n.with_locale(locale, &)
+      end
     end
   end
 end

data/app/controllers/concerns/decidim/direct_upload.rb

@@ -6,6 +6,7 @@ module Decidim
 
     included do
       include Decidim::NeedsOrganization
+
       skip_before_action :verify_organization
 
       before_action :check_organization!,
@@ -18,14 +19,14 @@ module Decidim
       # We skip the validation if we are in system panel. `current_admin` refers to the main system admin user.
       return if current_admin.present?
 
-      head :unprocessable_entity unless [
+      head :unprocessable_content unless [
         maximum_allowed_size.try(:to_i) >= blob_args[:byte_size].try(:to_i),
         content_types.any? { |pattern| pattern.match?(blob_args[:content_type]) },
         content_types.any? { |pattern| pattern.match?(MiniMime.lookup_by_extension(extension)&.content_type) },
         allowed_extensions.any? { |pattern| pattern.match?(extension) }
       ].all?
     rescue NoMethodError
-      head :unprocessable_entity
+      head :unprocessable_content
     end
 
     def extension

data/app/controllers/concerns/decidim/ephemeral_session_checker.rb

@@ -78,7 +78,7 @@ module Decidim
                    end
       paths_list.prepend(
         pending_authorizations_path,
-        decidim.page_path(terms_of_service_page)
+        decidim.page_path(terms_of_service_page, locale: current_locale)
       )
 
       paths_list.find { |el| /\A#{URI.parse(el).path}/.match?(request.path) }

data/app/controllers/concerns/decidim/force_authentication.rb

@@ -38,12 +38,21 @@ module Decidim
       default_unauthorized_paths + Decidim::StaticPage.where(
         organization: current_organization,
         allow_public_access: true
-      ).pluck(Arel.sql("CONCAT('/pages/', slug)"))
+      ).pluck(
+        Arel::Nodes::Concat.new(
+          Arel::Nodes.build_quoted("/#{current_locale}/pages/"),
+          Arel::Table.new(Decidim::StaticPage.table_name)[:slug]
+        )
+      )
     end
 
     def default_unauthorized_paths
       # /locale is for changing the locale and /manifest.webmanifest to request PWA manifest
       %w(/locale /manifest.webmanifest)
     end
+
+    def current_locale
+      @current_locale ||= I18n.locale.to_s
+    end
   end
 end

data/app/controllers/concerns/decidim/impersonate_users.rb

@@ -71,6 +71,10 @@ module Decidim
         # Prevent redirect on non-HTML responses, because we want redirect AFTER impersonation.js inits a reload.
         return if request && request.negotiate_mime([Mime[:html]]).blank?
         return unless can_impersonate_users?
+
+        # Keep the expiration check in sync with the active impersonation log so
+        # the redirect happens in the same request when the session just expired.
+        impersonation_log&.ensure_not_expired!
         return unless expired_log
 
         expired_log.update!(ended_at: Time.current)

data/app/controllers/concerns/decidim/locale_switcher.rb

@@ -9,7 +9,7 @@ module Decidim
 
     included do
       around_action :switch_locale
-      helper_method :current_locale, :available_locales, :default_locale
+      helper_method :current_locale, :available_locales, :default_locale, :canonical_url
 
       # Sets the locale for the current session.
       # Saves current locale in a session variable in case some links are locale-orphaned
@@ -21,6 +21,7 @@ module Decidim
         else
           locale = default_locale
         end
+
         I18n.with_locale(locale, &)
       end
 
@@ -29,7 +30,7 @@ module Decidim
       #
       # Returns a Hash.
       def default_url_options
-        return {} if current_locale == default_locale.to_s
+        return {} if locale_in_script_name?
 
         { locale: current_locale }
       end
@@ -99,6 +100,55 @@ module Decidim
         end
         lang == "*" ? nil : lang
       end
+
+      def canonical_url(desired_url, target_locale = default_locale)
+        uri = URI(desired_url)
+        desired_locale = available_locales.include?(target_locale) ? target_locale : default_locale
+
+        path_segments = uri.path.split("/").compact_blank
+        locale_segment = path_segments.first
+
+        query = uri.query.to_s.gsub(/locale=[a-zA-Z-]{2,5}/, "")
+
+        if available_locales.include?(locale_segment)
+          path_segments[0] = desired_locale
+
+          uri.path = "/#{path_segments.join("/")}"
+
+          if query.present?
+            params = URI.decode_www_form(query)
+            uri.query = URI.encode_www_form(params)
+          else
+            uri.query = nil
+          end
+        elsif uri.host.blank? || uri.host == request.host
+          uri.path = if uri.path == "/"
+                       "/#{desired_locale}"
+                     else
+                       "/#{desired_locale}#{uri.path}"
+                     end
+
+          if query.present?
+            params = URI.decode_www_form(query)
+            uri.query = URI.encode_www_form(params)
+          else
+            uri.query = nil
+          end
+        else
+          params = URI.decode_www_form(query) << ["locale", desired_locale]
+          uri.query = URI.encode_www_form(params)
+        end
+
+        uri.to_s
+      end
+
+      def locale_in_script_name?
+        script_name = request&.script_name.to_s
+        return false if script_name.blank?
+
+        locale_segment = script_name.split("/").compact_blank.first
+        available_locales.include?(locale_segment)
+      end
       # rubocop: enable Metrics/CyclomaticComplexity
       # rubocop: enable Metrics/PerceivedComplexity
     end

data/app/controllers/concerns/decidim/needs_tos_accepted.rb

@@ -43,7 +43,7 @@ module Decidim
     end
 
     def tos_path
-      decidim.page_path terms_of_service_page
+      decidim.page_path terms_of_service_page, locale: current_locale
     end
 
     def redirect_to_tos

data/app/controllers/concerns/decidim/participatory_space/has_members_page.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module Decidim
+  module ParticipatorySpace
+    module HasMembersPage
+      extend ActiveSupport::Concern
+
+      included do
+        helper_method :collection
+
+        private
+
+        def can_visit_index?
+          current_user_can_visit_space? && current_participatory_space.members_public_page?
+        end
+
+        def members
+          @members ||= current_participatory_space.members.published
+        end
+
+        alias_method :collection, :members
+      end
+    end
+  end
+end

data/app/controllers/concerns/decidim/participatory_space_context.rb

@@ -36,8 +36,6 @@ module Decidim
     #           title of the space (mandatory).
     # * url - The url of the resource (optional).
     # * active - Whether the item is active (optional).
-    # * dropdown_cell - When this value is present is used to generate a dropdown
-    #                   associated to the item (optional).
     # * resource - The resource of the item. This value is passed to the
     #              dropdown cell, so it is mandatory if the dropdown cell is
     #              present.
@@ -48,7 +46,6 @@ module Decidim
         label: current_participatory_space.title,
         url: Decidim::ResourceLocatorPresenter.new(current_participatory_space).path,
         active: true,
-        dropdown_cell: current_participatory_space_manifest.breadcrumb_cell,
         resource: current_participatory_space
       }
     end
@@ -79,8 +76,7 @@ module Decidim
 
     # Method for current user can visit the space (assembly or process)
     def current_user_can_visit_space?
-      return true unless current_participatory_space.try(:private_space?) &&
-                         !current_participatory_space.try(:is_transparent?)
+      return true unless current_participatory_space.respond_to?(:restricted?) && current_participatory_space.restricted?
       return false unless current_user
       return true if current_user.admin?
       return true if user_has_any_role?(current_user, current_participatory_space, broad_check: true)

data/app/controllers/decidim/account_controller.rb

@@ -31,7 +31,7 @@ module Decidim
         on(:invalid) do |password|
           fetch_entered_password(password)
           flash[:alert] = t("account.update.error", scope: "decidim")
-          render action: :show, status: :unprocessable_entity
+          render action: :show, status: :unprocessable_content
         end
       end
     end

data/app/controllers/decidim/amendments_controller.rb

@@ -5,6 +5,7 @@ module Decidim
     include Decidim::ApplicationHelper
     include FormFactory
     include HasSpecificBreadcrumb
+
     helper Decidim::ResourceReferenceHelper
 
     before_action :authenticate_user!
@@ -38,7 +39,7 @@ module Decidim
 
         on(:invalid) do
           flash.now[:alert] = t("created.error", scope: "decidim.amendments")
-          render :new, status: :unprocessable_entity
+          render :new, status: :unprocessable_content
         end
       end
     end
@@ -62,7 +63,7 @@ module Decidim
 
         on(:invalid) do
           flash.now[:alert] = t("error", scope: "decidim.amendments.update_draft")
-          render :edit_draft, status: :unprocessable_entity
+          render :edit_draft, status: :unprocessable_content
         end
       end
     end
@@ -100,7 +101,7 @@ module Decidim
 
         on(:invalid) do
           flash.now[:alert] = t("error", scope: "decidim.amendments.publish_draft")
-          render :edit_draft, status: :unprocessable_entity
+          render :edit_draft, status: :unprocessable_content
         end
       end
     end
@@ -160,7 +161,7 @@ module Decidim
 
         on(:invalid) do
           flash.now[:alert] = t("accepted.error", scope: "decidim.amendments")
-          render :review, status: :unprocessable_entity
+          render :review, status: :unprocessable_content
         end
       end
     end

data/app/controllers/decidim/components/base_controller.rb

@@ -10,6 +10,7 @@ module Decidim
       include Decidim::NeedsPermission
 
       include ParticipatorySpaceContext
+
       before_action :authorize_participatory_space
 
       helper Decidim::FiltersHelper
@@ -35,7 +36,7 @@ module Decidim
 
       before_action :redirect_unless_feature_private
 
-      before_action :set_component_breadcrumb_item
+      before_action :set_breadcrumb_items
 
       def current_participatory_space
         request.env["decidim.current_participatory_space"]
@@ -66,14 +67,30 @@ module Decidim
         raise ActionController::RoutingError, "Not Found" unless current_user_can_visit_space?
       end
 
-      def set_component_breadcrumb_item
-        context_breadcrumb_items << {
+      def set_breadcrumb_items
+        context_breadcrumb_items << add_current_component
+        context_breadcrumb_items << add_parent_breadcrumb_item
+        context_breadcrumb_items << add_breadcrumb_item
+      end
+
+      private
+
+      def add_current_component
+        {
           label: current_component.name,
           url: Decidim::EngineRouter.main_proxy(current_component).root_path,
           active: false,
           resource: current_component
         }
       end
+
+      def add_parent_breadcrumb_item
+        {}
+      end
+
+      def add_breadcrumb_item
+        {}
+      end
     end
   end
 end