decidim-core 0.31.2 → 0.32.1

data/app/helpers/decidim/newsletters_helper.rb

@@ -3,6 +3,9 @@
 module Decidim
   # Helper that provides methods to render links with utm codes, and replaced name
   module NewslettersHelper
+    include Decidim::SanitizeHelper
+    include Decidim::MailerHelper
+
     # If the newsletter body there are some links and the Decidim.track_newsletter_links = true
     # it will be replaced with the utm_codes method described below.
     # for example transform "https://es.lipsum.com/" to "https://es.lipsum.com/?utm_source=localhost&utm_campaign=newsletter_11"
@@ -19,7 +22,7 @@ module Decidim
 
       content = interpret_name(content, user)
       content = track_newsletter_links(content, id, host)
-      transform_image_urls(content, host)
+      decidim_transform_image_urls(content, host)
     end
 
     # this method is used to generate the root link on mail with the utm_codes
@@ -67,27 +70,6 @@ module Decidim
       content.gsub("%{name}", user.name)
     end
 
-    # Find each img HTML tag with relative path in src attribute
-    # For each URL, prepends the decidim.root_url
-    #   If host is not defined it returns full content
-    #
-    # @param content [String] - the string to convert
-    # @param host [String] - the Decidim::Organization host to replace
-    #
-    # @return [String] - the content converted
-    #
-    def transform_image_urls(content, host)
-      return content if host.blank?
-
-      content.scan(/src\s*=\s*"([^"]*)"/).each do |src|
-        root_url = decidim.root_url(host:)[0..-2]
-        src_replaced = "#{root_url}#{src.first}"
-        content = content.gsub(/src\s*=\s*"([^"]*#{src.first})"/, %(src="#{src_replaced}"))
-      end
-
-      content
-    end
-
     # Add tracking query params to each links
     #
     # @param content [String] - the string to convert

data/app/helpers/decidim/paginate_helper.rb

@@ -16,9 +16,22 @@ module Decidim
       content_tag :div, class: "flex flex-col-reverse md:flex-row items-center justify-between gap-1 py-8 md:py-16 md:flex-wrap", data: { pagination: "" } do
         template = ""
         template += render(partial: "decidim/shared/results_per_page", locals: { per_page: }, formats: [:html]) if collection.total_pages.positive?
-        template += paginate collection, window: 2, outer_window: 1, theme: "decidim", params: paginate_params
+        template += paginate collection, window: 2, outer_window: 1, theme: "decidim", params: pagination_params(paginate_params)
         template.html_safe
       end
     end
+
+    private
+
+    def pagination_params(paginate_params)
+      request_params = params.to_unsafe_h.except("locale", :locale)
+      request_params["q"] = request_params["q"].except("locale", :locale) if request_params["q"].is_a?(Hash)
+      request_params[:locale] = nil if admin_controller_with_locale_prefix?
+      request_params.merge(paginate_params)
+    end
+
+    def admin_controller_with_locale_prefix?
+      request.path_parameters[:locale].present? && controller_path.to_s.include?("/admin/")
+    end
   end
 end

data/app/helpers/decidim/sanitize_helper.rb

@@ -131,6 +131,7 @@ module Decidim
     # @param method [Symbol] Method name
     #
     # @return ActiveSupport::SafeBuffer
+    # @param [Object, nil] presenter_class
     def render_sanitized_content(resource, method, presenter_class: nil)
       content = present(resource, presenter_class:).send(method, links: true, strip_tags: !try(:safe_content?))
 

data/app/helpers/decidim/short_link_helper.rb

@@ -10,11 +10,11 @@ module Decidim
     # also resolves the current mounted route name to make it possible to refer
     # to the same context when redirecting the short URL to correct full URL.
     #
-    # @option kwargs [Boolean] :route_name the route name to which the short
-    #   link should link to
-    # @option kwargs [Float] :params the URL query parameters that should be
-    #   included in the URL where the short link redirects to
-    # @return [String] The short URL
+    # Accepts keyword arguments such as:
+    #   - `route_name`: the route name to link to
+    #   - `params`: query parameters for the redirect
+    #
+    # @return [String] The short URL.
     def short_url(**)
       target = respond_to?(:current_component) && current_component
       target ||= respond_to?(:current_participatory_space) && current_participatory_space

data/app/helpers/decidim/translations_helper.rb

@@ -30,8 +30,8 @@ module Decidim
     #
     # Returns a Hash with the locales as keys and the empty strings as values.
     def empty_translatable(locales = Decidim.available_locales)
-      locales.each_with_object({}) do |locale, result|
-        result[locale.to_s] = ""
+      locales.to_h do |locale|
+        [locale.to_s, ""]
       end
     end
 
@@ -49,8 +49,8 @@ module Decidim
     def ensure_translatable(value, locales = Decidim.available_locales)
       return empty_translatable(locales) unless value.is_a?(Hash)
 
-      locales.each_with_object({}) do |locale, result|
-        result[locale.to_s] = value[locale.to_s] || value[locale] || ""
+      locales.to_h do |locale|
+        [locale.to_s, value[locale.to_s] || value[locale] || ""]
       end
     end
 

data/app/jobs/decidim/delete_inactive_participants_job.rb

@@ -14,9 +14,9 @@ module Decidim
 
     private
 
-    def enqueue_jobs(users, action, *args)
+    def enqueue_jobs(users, action, *)
       users.find_each do |user|
-        ProcessInactiveParticipantJob.perform_later(user.id, action, *args)
+        ProcessInactiveParticipantJob.perform_later(user.id, action, *)
       end
     end
 

data/app/jobs/decidim/find_and_update_descendants_job.rb

@@ -4,8 +4,14 @@ module Decidim
   # Update search indexes for each descendants of a given element
   class FindAndUpdateDescendantsJob < ApplicationJob
     queue_as :default
+    MAX_DEPTH = 5
+
+    def perform(element, current_depth = 0)
+      if current_depth >= MAX_DEPTH
+        Rails.logger.warn "Max depth of #{MAX_DEPTH} reached for element #{element.class.name} with id #{element.id}. Stopping recursion."
+        return
+      end
 
-    def perform(element)
       descendants_collector = components_for(element)
       descendants_collector << element.comments.to_a if element.respond_to?(:comments)
 
@@ -14,7 +20,7 @@ module Decidim
       descendants_collector.each do |descendants|
         next if descendants.blank?
 
-        Decidim::UpdateSearchIndexesJob.perform_later(descendants)
+        Decidim::UpdateSearchIndexesJob.perform_later(descendants, current_depth + 1)
       end
     end
 

data/app/jobs/decidim/process_inactive_participant_job.rb

@@ -31,13 +31,6 @@ module Decidim
     end
 
     def process_remove_user(user)
-      email = user.email
-      name = user.name
-      locale = user.locale
-      organization = user.organization
-
-      ParticipantsAccountMailer.removal_notification(email, name, locale, organization).deliver_later
-
       Decidim::DestroyAccount.call(
         Decidim::DeleteAccountForm.from_params(
           delete_reason: I18n.t("decidim.account.destroy.inactive_account_removal_reason", inactivity_period: Decidim.delete_inactive_users_after_days)

data/app/jobs/decidim/update_search_indexes_job.rb

@@ -4,8 +4,8 @@ module Decidim
   class UpdateSearchIndexesJob < ApplicationJob
     queue_as :default
 
-    def perform(elements)
-      elements.each { |element| element.try(:try_update_index_for_search_resource) }
+    def perform(elements, current_depth = 0)
+      elements.each { |element| element.try(:try_update_index_for_search_resource, current_depth) }
     end
   end
 end

data/app/mailers/decidim/application_mailer.rb

@@ -7,8 +7,13 @@ module Decidim
     include LocalisedMailer
     include MultitenantAssetHost
     include Decidim::SanitizeHelper
+    include Decidim::MailerHelper
     include Decidim::OrganizationHelper
-    helper_method :organization_name, :decidim_escape_translated, :decidim_sanitize_translated, :translated_attribute, :decidim_sanitize, :decidim_sanitize_newsletter
+
+    helper Decidim::SanitizeHelper
+    helper Decidim::MailerHelper
+    helper_method :organization_name, :current_locale, :decidim_escape_translated, :decidim_sanitize_translated, :translated_attribute, :decidim_sanitize,
+                  :decidim_sanitize_newsletter
 
     after_action :set_smtp
     after_action :set_from
@@ -20,10 +25,14 @@ module Decidim
 
     attr_reader :organization
 
+    def current_locale
+      I18n.locale || I18n.default_locale
+    end
+
     def set_smtp
       return if organization.nil? || organization.smtp_settings.blank? || organization.smtp_settings.except("from", "from_label", "from_email").all?(&:blank?)
 
-      mail.reply_to = mail.reply_to || Decidim.config.mailer_reply
+      mail.reply_to = mail.reply_to || Decidim.config.mailer_sender
       mail.delivery_method.settings.merge!(
         address: organization.smtp_settings["address"],
         port: organization.smtp_settings["port"],

data/app/mailers/decidim/decidim_devise_mailer.rb

@@ -6,6 +6,7 @@ module Decidim
   class DecidimDeviseMailer < ::Devise::Mailer
     include LocalisedMailer
     include Decidim::SanitizeHelper
+
     helper_method :decidim_escape_translated, :decidim_sanitize_translated, :translated_attribute
 
     layout "decidim/mailer"

data/app/mailers/decidim/delete_user_mailer.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module Decidim
+  class DeleteUserMailer < ApplicationMailer
+    # This email is being sent when a user deletes his own account, or when the user was inactive for too long.
+    def delete(user_email:, user_name:, locale:, organization:)
+      I18n.with_locale(locale) do
+        @user_name = user_name
+        @organization = organization
+        mail(to: user_email, subject: I18n.t("decidim.delete_user_mailer.subject"))
+      end
+    end
+  end
+end

data/app/mailers/decidim/participants_account_mailer.rb

@@ -18,21 +18,5 @@ module Decidim
         mail(to: user.email, subject:)
       end
     end
-
-    # Notify user about account removal due to inactivity
-    def removal_notification(email, name, locale, organization)
-      @email = email
-      @user_name = name
-      @organization = organization
-
-      I18n.with_locale(locale) do
-        subject = I18n.t(
-          "decidim.participants_account_mailer.removal_notification.subject",
-          organization_name: organization_name(@organization)
-        )
-
-        mail(to: email, subject:)
-      end
-    end
   end
 end

data/app/mailers/decidim/reported_mailer.rb

@@ -72,7 +72,10 @@ module Decidim
     end
 
     def author_profile_url
-      @author_profile_url ||= @author.is_a?(Decidim::UserBaseEntity) && !@author.deleted? ? decidim.profile_url(@author.nickname, host: @organization.host) : nil
+      @author_profile_url ||= if @author.is_a?(Decidim::UserBaseEntity) && !@author.deleted?
+                                decidim.profile_url(@author.nickname,
+                                                    host: @organization.host)
+                              end
     end
 
     def original_language(reportable)

data/app/models/decidim/action_log.rb

@@ -262,7 +262,7 @@ module Decidim
         participatory_space_lazy.present? &&
         !resource_lazy.try(:deleted?) &&
         !resource_lazy.try(:hidden?) &&
-        (participatory_space_lazy.try(:is_transparent?) || !resource_lazy.respond_to?(:can_participate?) || resource_lazy.try(:can_participate?, user))
+        (participatory_space_lazy.try(:transparent?) || !resource_lazy.respond_to?(:can_participate?) || resource_lazy.try(:can_participate?, user))
     rescue NameError => e
       Rails.logger.warn "Failed resource for #{self.class.name}(id=#{id}): #{e.message}"
 

data/app/models/decidim/attachment.rb

@@ -88,7 +88,7 @@ module Decidim
     # Returns String.
     def file_type
       if file?
-        url&.split(".")&.last&.split("&")&.first&.downcase
+        file.filename.extension&.downcase
       elsif link?
         "link"
       end
@@ -100,7 +100,13 @@ module Decidim
     def url
       @url ||=
         if file?
-          attached_uploader(:file).url
+          if private_download_required?
+            Decidim::Core::Engine.routes.url_helpers.private_download_path(
+              Decidim::PrivateDownload.for(self, attachment_name: :file).token
+            )
+          else
+            attached_uploader(:file).url
+          end
         elsif link?
           link
         end
@@ -144,5 +150,17 @@ module Decidim
 
       attached_to.can_participate?(user)
     end
+
+    def private_download_authorized?(user, requested_attachment_name)
+      return false unless requested_attachment_name.to_s == "file"
+
+      can_participate?(user)
+    end
+
+    def private_download_required?
+      return attached_to.restricted? if attached_to.respond_to?(:restricted?)
+
+      attached_to.respond_to?(:component) && attached_to.component&.restricted_space?
+    end
   end
 end

data/app/models/decidim/authorization.rb

@@ -91,6 +91,13 @@ module Decidim
       Decidim::AuthorizationTransfer.perform!(self, handler)
     end
 
+    def private_download_authorized?(user, requested_attachment_name)
+      return false unless requested_attachment_name.to_s == "verification_attachment"
+      return true if user&.admin? && user.organization == organization
+
+      user == self.user
+    end
+
     private
 
     def active_handler?

data/app/models/decidim/authorization_transfer.rb

@@ -214,7 +214,7 @@ module Decidim
     #     }
     #   }
     #
-    # @return [Hash<String => Hash<Symbol => Integer, ActiveModel::Name>>] The
+    # @return [Hash{String => Hash{Symbol => Integer, ActiveModel::Name}}] The
     #   information hash created for the transfer.
     def information
       {}.tap do |types|

data/app/models/decidim/component.rb

@@ -64,6 +64,7 @@ module Decidim
       {
         :host => organization.host,
         :component_id => id,
+        :locale => I18n.locale,
         :"#{participatory_space.underscored_name}_slug" => participatory_space.slug
       }
     end
@@ -102,22 +103,18 @@ module Decidim
     def can_participate_in_space?(user)
       return false unless published?
       return false unless participatory_space.published?
-      return true unless participatory_space.try(:private_space?)
+
+      return true unless participatory_space.respond_to?(:restricted?) && participatory_space.restricted?
       return false unless user
 
       participatory_space.can_participate?(user)
     end
     alias can_participate? can_participate_in_space?
 
-    def private_non_transparent_space?
-      return false unless participatory_space.respond_to?(:private_space?)
-      return false unless participatory_space.private_space?
+    def restricted_space?
+      return false unless participatory_space.respond_to?(:restricted?)
 
-      if participatory_space.respond_to?(:is_transparent?)
-        !participatory_space.is_transparent?
-      else
-        true
-      end
+      participatory_space.restricted?
     end
 
     # Public: Public URL for component with given share token as query parameter

data/app/models/decidim/content_block.rb

@@ -36,7 +36,7 @@ module Decidim
     # Returns an object that responds to the settings defined in the content
     # block manifest.
     def settings
-      manifest.settings.schema.new(self[:settings])
+      manifest.settings.schema.new(self[:settings], organization&.default_locale)
     end
 
     def reload(*)
@@ -123,8 +123,8 @@ module Decidim
     private
 
     def manifest_attachments
-      @manifest_attachments ||= manifest.images.each_with_object({}) do |attachment_config, list|
-        list[attachment_config[:name]] = attachments.find_or_initialize_by(name: attachment_config[:name])
+      @manifest_attachments ||= manifest.images.to_h do |attachment_config|
+        [attachment_config[:name], attachments.find_or_initialize_by(name: attachment_config[:name])]
       end
     end
 

data/app/models/decidim/moderation.rb

@@ -32,7 +32,7 @@ module Decidim
     end
 
     def self.ransackable_attributes(_auth_object = nil)
-      %w(reported_id_string reported_content created_at)
+      %w(reported_id_string reported_content created_at report_count)
     end
 
     def self.ransackable_associations(_auth_object = nil)

data/app/models/decidim/newsletter.rb

@@ -50,8 +50,8 @@ module Decidim
       extended_data["participatory_space_types"]
     end
 
-    def sent_to_private_members?
-      extended_data["send_to_private_members"]
+    def sent_to_members?
+      extended_data["send_to_members"]
     end
 
     def template

data/app/models/decidim/participatory_space/member.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module Decidim
+  module ParticipatorySpace
+    # This class gives a given User access to a given private Member
+    class Member < ApplicationRecord
+      include Decidim::DownloadYourData
+      include ParticipatorySpaceUser
+      include Decidim::TranslatableResource
+
+      belongs_to :participatory_space, polymorphic: true
+
+      translatable_fields :role
+
+      delegate :email, :name, to: :user
+
+      validates :user, uniqueness: { scope: [:participatory_space_id, :participatory_space_type] }
+
+      scope :by_participatory_space, ->(participatory_space) { where(participatory_space_id: participatory_space.id, participatory_space_type: participatory_space.class.to_s) }
+      scope :published, -> { where(published: true) }
+
+      def self.user_collection(user)
+        where(decidim_user_id: user.id)
+      end
+
+      def self.member_ids_for_participatory_spaces(spaces)
+        joins(:user).where(participatory_space: spaces).distinct.pluck(:decidim_user_id)
+      end
+
+      def self.export_serializer
+        Decidim::DownloadYourDataSerializers::DownloadYourDataMemberSerializer
+      end
+
+      def self.log_presenter_class_for(_log)
+        Decidim::AdminLog::ParticipatorySpace::MemberPresenter
+      end
+
+      ransacker :invitation_sent_at do
+        Arel.sql(%{("invitation_sent_at")::text})
+      end
+
+      def self.ransackable_attributes(auth_object = nil)
+        return [] unless auth_object&.admin?
+
+        %w(name nickname email invitation_accepted_at last_sign_in_at invitation_sent_at role published)
+      end
+
+      def self.ransackable_associations(_auth_object = nil)
+        %w(user)
+      end
+
+      def target_space_association = :participatory_space
+    end
+  end
+end

data/app/models/decidim/private_download.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+module Decidim
+  class PrivateDownload
+    class InvalidTokenError < StandardError; end
+
+    VERIFIER_PURPOSE = :private_download
+
+    def self.for(record, attachment_name:)
+      new(record:, attachment_name:)
+    end
+
+    def self.from_token(token)
+      payload = verifier.verify(token, purpose: VERIFIER_PURPOSE).with_indifferent_access
+      record = GlobalID::Locator.locate(payload[:gid])
+
+      raise InvalidTokenError if record.blank?
+
+      new(record:, attachment_name: payload[:attachment_name])
+    rescue ActiveSupport::MessageVerifier::InvalidSignature, TypeError
+      raise InvalidTokenError
+    end
+
+    def self.verifier
+      @verifier ||= ActiveSupport::MessageVerifier.new(Rails.application.secret_key_base, serializer: JSON)
+    end
+
+    def initialize(record:, attachment_name:)
+      @record = record
+      @attachment_name = attachment_name.to_s
+    end
+
+    def token
+      self.class.verifier.generate(
+        {
+          gid: record.to_global_id.to_s,
+          attachment_name:
+        },
+        purpose: VERIFIER_PURPOSE
+      )
+    end
+
+    def attachment
+      record.public_send(attachment_name)
+    end
+
+    def attached?
+      attachment.respond_to?(:attached?) && attachment.attached?
+    end
+
+    def authorized_for?(user)
+      return false unless record.respond_to?(:private_download_authorized?)
+
+      record.private_download_authorized?(user, attachment_name)
+    end
+
+    private
+
+    attr_reader :record, :attachment_name
+  end
+end

data/app/models/decidim/private_export.rb

@@ -24,5 +24,11 @@ module Decidim
       self.content_type = file.content_type
       self.file_size = file.byte_size
     end
+
+    def private_download_authorized?(user, requested_attachment_name)
+      return false unless requested_attachment_name.to_s == "file"
+
+      attached_to == user
+    end
   end
 end

data/app/models/decidim/resource_link.rb

@@ -7,7 +7,7 @@ module Decidim
   # In order to group the relations between resources you need to specify a name.
   #
   # Some examples could be: proposals that have been created in a meeting or
-  # projects that are a result of merging different proposals.
+  # results that are the merge of different proposals.
   class ResourceLink < ApplicationRecord
     belongs_to :from, polymorphic: true
     belongs_to :to, polymorphic: true

data/app/models/decidim/short_link.rb

@@ -94,7 +94,7 @@ module Decidim
     #
     # @return [String] The target full URL that the short link should link to.
     def target_url
-      url_helpers.send("#{route_name}_url", **params)
+      url_helpers.send("#{route_name}_url", { locale: I18n.locale }.reverse_merge(params))
     end
 
     private

data/app/models/decidim/user.rb

@@ -21,8 +21,8 @@ module Decidim
 
     devise :invitable, :database_authenticatable, :registerable, :confirmable, :timeoutable,
            :recoverable, :trackable, :lockable,
-           :decidim_validatable, :decidim_newsletterable, :jwt_authenticatable,
-           :omniauthable, omniauth_providers: Decidim::OmniauthProvider.available.keys, jwt_revocation_strategy: Decidim::Api::JwtDenylist,
+           :decidim_validatable, :decidim_newsletterable,
+           :omniauthable, omniauth_providers: Decidim::OmniauthProvider.available.keys,
                           request_keys: [:env], reset_password_keys: [:decidim_organization_id, :email],
                           confirmation_keys: [:decidim_organization_id, :email]
     devise :rememberable if Decidim.enable_remember_me

data/app/models/decidim/user_base_entity.rb

@@ -69,12 +69,27 @@ module Decidim
       Decidim::UserBaseEntity.joins(:follows).where(decidim_follows: { user: self }).blocked.exists?
     end
 
+    ransacker :role do
+      Arel.sql(%{CASE WHEN "decidim_users"."admin" = true THEN 'admin' ELSE cast("decidim_users"."roles" as text) END})
+    end
+
+    ransacker :user_moderation_report_count do
+      query = <<~SQL.squish
+        (
+            SELECT COALESCE(MAX(decidim_user_moderations.report_count), 0)
+            FROM decidim_user_moderations
+            WHERE decidim_user_moderations.decidim_user_id = decidim_users.id
+        )
+      SQL
+      Arel.sql(query)
+    end
+
     def self.ransackable_attributes(auth_object = nil)
-      base = %w(name email nickname last_sign_in_at)
+      base = %w(name email nickname last_sign_in_at created_at)
 
       return base unless auth_object&.admin?
 
-      base + %w(invitation_sent_at invitation_accepted_at officialized_at)
+      base + %w(invitation_sent_at invitation_accepted_at officialized_at role user_moderation_report_count)
     end
 
     def self.ransackable_associations(_auth_object = nil)

data/app/models/decidim/user_moderation.rb

@@ -19,7 +19,7 @@ module Decidim
     end
 
     def self.ransackable_attributes(_auth_object = nil)
-      []
+      %w(created_at report_count)
     end
 
     def self.ransackable_associations(_auth_object = nil)