decidim-core 0.31.4 → 0.31.6

data/app/packs/src/decidim/sw/push-permissions.js

@@ -1,16 +1,38 @@
-window.addEventListener("turbo:load", async () => {
+document.addEventListener("turbo:load", async () => {
   const GRANTED_PERMISSION = "granted"
 
   const hideReminder = function() {
-    const reminder = document.querySelector("#push-notifications-reminder")
+    const reminder = document.querySelector("[data-push-notifications-reminder]")
+    if (!reminder) {
+      return;
+    }
+
     reminder.classList.add("hide")
   }
 
+  const showError = (message) => {
+    const container = document.querySelector("[data-push-notifications-container]")
+    if (!container) {
+      return;
+    }
+
+    const existingError = container.querySelector("[data-push-notifications-error]")
+    if (existingError) {
+      existingError.remove()
+    }
+
+    const errorElement = document.createElement("div")
+    errorElement.dataset.pushNotificationsError = "true"
+    errorElement.classList.add("flash", "alert", "push-notifications__error")
+    errorElement.innerText = message
+    container.prepend(errorElement)
+  }
+
   const subscribeToNotifications = async (registration) => {
     const permission = await window.Notification.requestPermission();
 
     if (registration && permission === GRANTED_PERMISSION) {
-      const vapidElement = document.querySelector("#vapidPublicKey")
+      const vapidElement = document.querySelector("[data-push-vapid-public-key]")
       // element could not exist in DOM
       if (vapidElement) {
         const vapidPublicKeyElement = JSON.parse(vapidElement.value)
@@ -20,7 +42,7 @@ window.addEventListener("turbo:load", async () => {
         });
 
         if (subscription) {
-          await fetch("/notifications_subscriptions", {
+          const response = await fetch("/notifications_subscriptions", {
             headers: {
               "Content-Type": "application/json",
               "X-CSRF-Token": document.querySelector("meta[name=csrf-token]")?.content
@@ -28,6 +50,11 @@ window.addEventListener("turbo:load", async () => {
             method: "POST",
             body: JSON.stringify(subscription)
           });
+
+          if (!response.ok) {
+            const body = await response.json()
+            throw new Error(body.error)
+          }
         }
       }
       hideReminder()
@@ -57,10 +84,13 @@ window.addEventListener("turbo:load", async () => {
       hideReminder()
       if (currentSubscription) {
         const auth = currentSubscription.toJSON().keys.auth
-        const subKeys = JSON.parse(document.querySelector("#subKeys").value)
-        // Subscribed && browser notifications enabled
-        if (subKeys.includes(auth)) {
-          toggleChecked = true
+        const subKeysElement = document.querySelector("[data-push-sub-keys]")
+        if (subKeysElement) {
+          const subKeys = JSON.parse(subKeysElement.value)
+          // Subscribed && browser notifications enabled
+          if (subKeys.includes(auth)) {
+            toggleChecked = true
+          }
         }
       }
     }
@@ -68,7 +98,7 @@ window.addEventListener("turbo:load", async () => {
   }
 
   if ("serviceWorker" in navigator) {
-    const toggle = document.getElementById("allow_push_notifications")
+    const toggle = document.querySelector("[data-push-notifications-toggle]")
 
     if (toggle) {
       const registration = await navigator.serviceWorker.ready
@@ -76,10 +106,15 @@ window.addEventListener("turbo:load", async () => {
       setToggleState(registration, toggle)
 
       toggle.addEventListener("change", async ({ target }) => {
-        if (target.checked) {
-          await subscribeToNotifications(registration);
-        } else {
-          await unsubscribeFromNotifications(registration)
+        try {
+          if (target.checked) {
+            await subscribeToNotifications(registration)
+          } else {
+            await unsubscribeFromNotifications(registration)
+          }
+        } catch (error) {
+          target.checked = false
+          showError(error.message)
         }
       })
     }

data/app/packs/src/decidim/sw/sw.js

@@ -53,7 +53,7 @@ self.addEventListener("notificationclick", (event) => {
 // avoid caching admin or users paths
 registerRoute(
   ({ url }) =>
-    ["/admin/", "/users/"].some((path) => url.pathname.startsWith(path)),
+    ["admin", "users"].some((pathSegment) => url.pathname.split("/").includes(pathSegment)),
   new NetworkOnly()
 );
 

data/app/packs/src/decidim/utilities/text.js

@@ -1,17 +1,17 @@
-export const escapeHtml = (text) => {
+const escapeQuotes = (text) => {
   if (!text) {
     return "";
   }
 
-  const el = document.createElement("div");
-  el.appendChild(document.createTextNode(text));
-  return el.innerHTML;
+  return text.replace(/"/g, """);
 }
 
-export const escapeQuotes = (text) => {
+export const escapeHtml = (text) => {
   if (!text) {
     return "";
   }
 
-  return text.replace(/"/g, """);
+  const el = document.createElement("div");
+  el.appendChild(document.createTextNode(text));
+  return escapeQuotes(el.innerHTML);
 }

data/app/packs/stylesheets/decidim/_conversations.scss

@@ -88,6 +88,20 @@
   }
 
   &__modal {
+    &-error {
+      [data-dialog-closable] {
+        @apply top-6 right-6;
+      }
+
+      [data-dialog-container] {
+        @apply inline grid-cols-none;
+      }
+
+      [data-dialog-title] {
+        @apply col-span-2 md:col-span-1 md:col-start-2 grid grid-cols-[auto_1fr] items-start md:items-center gap-2 pb-4 text-left text-xl text-gray-2 md:border-b md:border-gray-3;
+      }
+    }
+
     &-results {
       @apply mb-20 flex flex-wrap gap-x-8 gap-y-4;
     }

data/app/packs/stylesheets/decidim/_editor_suggestions.scss

@@ -0,0 +1,49 @@
+.editor-suggestions-props {
+  --editor-suggestions-border-color: #000;
+  --editor-suggestions-background-color: #eee;
+  --editor-suggestions-selected-highlight-color: #ccc;
+}
+
+.editor-suggestions {
+  @apply editor-suggestions-props border-0 bg-[var(--editor-suggestions-background-color)] max-w-sm drop-shadow-md rounded-md;
+
+  &:hover {
+    .editor-suggestions-item[data-selected]:not(:hover) {
+      @apply bg-transparent;
+    }
+  }
+
+  .editor-suggestions-item {
+    @apply flex items-center gap-2 w-full text-left py-[0.375rem] px-1.5 border-0 rounded-none text-sm;
+
+    &:first-child {
+      @apply rounded-t-md;
+    }
+
+    &:last-child {
+      @apply rounded-b-md;
+    }
+
+    &:hover,
+    &[data-selected] {
+      @apply bg-[var(--editor-suggestions-selected-highlight-color)];
+    }
+
+    .editor-suggestions-item-avatar {
+      @apply rounded-full w-6 h-6 object-cover flex-none;
+    }
+
+    .editor-suggestions-item-label {
+      @apply truncate;
+    }
+  }
+
+  .editor-suggestions-item-disabled {
+    @apply cursor-default;
+
+    &:hover,
+    &[data-selected] {
+      @apply bg-transparent;
+    }
+  }
+}

data/app/packs/stylesheets/decidim/_floating_help.scss

@@ -1,5 +1,5 @@
 [data-floating-help] {
-  @apply absolute z-10 top-5 md:top-10 right-0 [&_button]:bg-background [&_button]:px-2 [&_button]:rounded-r-none [&_svg]:text-gray [&_svg]:fill-current;
+  @apply absolute z-10 top-20 md:top-10 right-0 [&_button]:bg-background [&_button]:px-2 [&_button]:rounded-r-none [&_svg]:text-gray [&_svg]:fill-current;
 
   &:hover {
     @apply [&_svg]:text-white [&_button]:text-white [&_button]:bg-secondary [&_button]:no-underline;

data/app/packs/stylesheets/decidim/_tom_select.scss

@@ -0,0 +1,23 @@
+@use "tom-select/dist/scss/tom-select";
+
+.ts {
+  &-control {
+    @apply border-gray text-md min-h-[40px];
+
+    input {
+      @apply font-normal text-black text-md;
+    }
+  }
+
+  &-dropdown {
+    @apply text-md text-gray-2 font-normal;
+
+    .option img {
+      @apply inline;
+    }
+
+    .active {
+      @apply bg-gray-3;
+    }
+  }
+}

data/app/packs/stylesheets/decidim/application.scss

@@ -6,6 +6,8 @@
 // Datepicker
 @use "stylesheets/decidim/vendor/datepicker_light";
 @use "stylesheets/decidim/datepicker";
+// TomSelect
+@use "stylesheets/decidim/tom_select";
 // On the other hand, the following styles match with specific routes
 @use "stylesheets/decidim/header";
 @use "stylesheets/decidim/footer";

data/app/packs/stylesheets/decidim/editor.scss

@@ -1,3 +1,5 @@
+@use "stylesheets/decidim/editor_suggestions";
+
 .editor-props {
   --editor-active-color: #487bda;
   --editor-disabled-color: #eee;
@@ -5,12 +7,6 @@
   --editor-bubble-shadow-color: #333;
 }
 
-.editor-suggestions-props {
-  --editor-suggestions-border-color: #000;
-  --editor-suggestions-background-color: #eee;
-  --editor-suggestions-selected-highlight-color: #ccc;
-}
-
 .editor-active {
   @apply outline outline-4 outline-[var(--editor-active-color)];
 }
@@ -186,30 +182,3 @@
     }
   }
 }
-
-.editor-suggestions {
-  @apply editor-suggestions-props border-0 bg-[var(--editor-suggestions-background-color)] max-w-sm drop-shadow-md rounded-md;
-
-  &:hover {
-    .editor-suggestions-item[data-selected]:not(:hover) {
-      @apply bg-transparent;
-    }
-  }
-
-  .editor-suggestions-item {
-    @apply block w-full text-left py-[0.375rem] px-1.5 border-0 rounded-none truncate text-sm;
-
-    &:first-child {
-      @apply rounded-t-md;
-    }
-
-    &:last-child {
-      @apply rounded-b-md;
-    }
-
-    &:hover,
-    &[data-selected] {
-      @apply bg-[var(--editor-suggestions-selected-highlight-color)];
-    }
-  }
-}

data/app/packs/stylesheets/decidim/geocoding_addons.scss

@@ -1,5 +1,13 @@
-.geocoding-container {
-  .user-device-location button {
+.geocoding {
+  &__locate .geocoding__button {
     @apply mt-4;
+
+    &--locating {
+      @apply opacity-70 cursor-wait;
+    }
+
+    .geocoding__spinner {
+      @apply inline-block w-4 h-4 rounded-full animate-spin border-2 border-l-transparent border-y-transparent border-r-secondary align-middle;
+    }
   }
 }

data/app/presenters/decidim/menu_item_presenter.rb

@@ -29,9 +29,9 @@ module Decidim
     delegate :content_tag, :safe_join, :link_to, :active_link_to_class, :is_active_link?, :icon, to: :@view
 
     def render
-      content_tag :li, role: menuitem_role, class: link_wrapper_classes do
+      content_tag :li, role: wrapper_role, class: link_wrapper_classes do
         output = if url == "#"
-                   [content_tag(:span, composed_label, class: "sidebar-menu__item-disabled")]
+                   [content_tag(:span, composed_label, class: "sidebar-menu__item-disabled", role: menuitem_role)]
                  else
                    [link_to(composed_label, url, link_options)]
                  end
@@ -52,7 +52,7 @@ module Decidim
         { aria: { current: "page" } }
       else
         {}
-      end.merge({ class: link_classes })
+      end.merge({ class: link_classes, role: menuitem_role })
     end
 
     def composed_label
@@ -75,6 +75,12 @@ module Decidim
       @options.role || :menuitem
     end
 
+    def wrapper_role
+      return if menuitem_role.blank?
+
+      :presentation
+    end
+
     def active_class
       active_link_to_class(
         url,

data/app/presenters/decidim/stats_presenter.rb

@@ -15,7 +15,7 @@ module Decidim
             hash[name][:data][idx] += value
           end
         else
-          hash[name] = stat
+          hash[name] = stat.merge(data: stat[:data].dup)
         end
       end.values
     end

data/app/services/decidim/notifications_subscriptions_persistor.rb

@@ -4,6 +4,10 @@ module Decidim
   # This class manages the creation and deletion of user notifications
 
   class NotificationsSubscriptionsPersistor
+    include PushSubscriptionEndpointValidator
+
+    class UnsupportedPushSubscriptionEndpointError < StandardError; end
+
     attr_reader :user
 
     def initialize(user)
@@ -11,6 +15,8 @@ module Decidim
     end
 
     def add_subscription(params)
+      raise UnsupportedPushSubscriptionEndpointError unless supported_push_subscription_endpoint?(params[:endpoint])
+
       subscriptions = user.notification_settings["subscriptions"] || {}
       filtered_params = filter_params(params)
       new_subscription = { filtered_params[:auth] => filtered_params }

data/app/services/decidim/push_subscription_endpoint_validator.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module Decidim
+  # Shared validation for browser push subscription endpoints.
+  module PushSubscriptionEndpointValidator
+    private
+
+    def supported_push_subscription_endpoint?(endpoint)
+      return false if endpoint.blank?
+
+      uri = URI.parse(endpoint)
+      return false unless uri.is_a?(URI::HTTPS)
+
+      host = uri.host&.downcase
+      return false if host.blank?
+
+      allowed_push_subscription_endpoint_patterns.any? { |pattern| pattern.match?(host) }
+    rescue URI::InvalidURIError
+      false
+    end
+
+    # Override this method to customize the browser push endpoint allowlist.
+    def allowed_push_subscription_endpoint_patterns
+      [
+        /\A(?:.*\.)?push\.services\.mozilla\.com\z/,
+        /\A(?:.*\.)?fcm\.googleapis\.com\z/,
+        /\A(?:.*\.)?android\.googleapis\.com\z/,
+        /\A(?:.*\.)?push\.apple\.com\z/,
+        /\A(?:.*\.)?opera\.com\z/,
+        /\A(?:.*\.)?notify\.windows\.com\z/
+      ]
+    end
+  end
+end

data/app/services/decidim/send_push_notification.rb

@@ -10,6 +10,7 @@ module Decidim
 
   class SendPushNotification
     include ActionView::Helpers::UrlHelper
+    include PushSubscriptionEndpointValidator
 
     # Send the push notification. Returns `nil` if the user did not allowed push notifications
     # or if the subscription to push notifications does not exist
@@ -24,9 +25,12 @@ module Decidim
       raise ArgumentError, "Need to provide a title if the notification is a PushNotificationMessage" if notification.is_a?(Decidim::PushNotificationMessage) && title.nil?
 
       user = notification.user
+      subscriptions = user.notifications_subscriptions.values.select do |subscription|
+        supported_push_subscription_endpoint?(subscription["endpoint"])
+      end
 
       I18n.with_locale(user.locale || user.organization.default_locale) do
-        user.notifications_subscriptions.values.map do |subscription|
+        subscriptions.map do |subscription|
           payload = build_payload(message_params(notification, title), subscription)
           # Capture webpush exceptions in order to avoid this call to be repeated by the background job runner
           # Webpush::Error class is the parent class of all defined errors

data/app/uploaders/decidim/image_uploader.rb

@@ -8,7 +8,7 @@ module Decidim
     end
 
     def content_type_allowlist
-      extension_allowlist.map { |ext| MiniMime.lookup_by_extension(ext).content_type }.uniq
+      extension_allowlist.filter_map { |ext| MiniMime.lookup_by_extension(ext)&.content_type }.uniq
     end
 
     # Fetches info about different variants, their processors and dimensions

data/app/views/decidim/delete_user_mailer/delete.html.erb

@@ -0,0 +1,6 @@
+<p class="email-greeting"><%= t(".hello", username: @user_name) %></p>
+
+<p class="email-instructions"><%= t ".body_1" %></p>
+<p class="email-instructions"><%= t ".body_2" %></p>
+
+<p class="email-closing"><%= t(".greetings_html", organization_name: organization_name(@organization), organization_url: decidim.root_url(host: @organization.host)) %></p>

data/app/views/decidim/gamification/badges/index.html.erb

@@ -3,7 +3,7 @@
   description: t(".page_description")
 ) %>
 
-<main class="layout-1col cols-10">
+<main class="layout-1col cols-10" role="main">
 
   <header class="text-center py-10">
     <h1 class="title-decorator inline-block text-left mb-12">

data/app/views/decidim/homepage/show.html.erb

@@ -7,7 +7,7 @@
   )
 %>
 
-<main class="home">
+<main class="home" role="main">
   <% Decidim::ContentBlock.published.for_scope(:homepage, organization: current_organization).each do |content_block| %>
     <% next unless content_block.manifest %>
 

data/app/views/decidim/last_activities/index.html.erb

@@ -1,7 +1,7 @@
 <% add_decidim_page_title(t("last_activity", scope: "decidim.last_activities.index")) %>
 
 <%# NOTE: this page does not use a regular layout %>
-<main class="container">
+<main class="container" role="main">
   <h1 class="title-decorator my-12"><%= t("last_activity", scope: "decidim.last_activities.index") %></h1>
 
   <div class="profile__activity pb-16">

data/app/views/decidim/messaging/conversations/_error_modal.html.erb

@@ -1,21 +1,13 @@
-<div id="messageErrorModal" data-reveal>
-  <div>
-    <h2><%= error %></h2>
-    <button class="close-button" data-close aria-label="<%= t(".close") %>"
-      type="button">
-      <span aria-hidden="true">&times;</span>
-    </button>
-  </div>
-  <div class="reveal__body">
-    <p><%= t(".intro") %></p>
-    <p>
-      <%= messages.join("<br>") %>
-    </p>
-    <p><%= t(".correct_errors") %></p>
-  </div>
-  <div>
-    <div>
-      <a class="button" role="button" href="#" data-close aria-label="<%= t(".ok") %>"><%= t(".ok") %></a>
+<%= decidim_modal id: "messageErrorModal", class: "conversation__modal-error" do %>
+  <div data-dialog-container>
+    <h2 id="dialog-title-messageErrorModal" tabindex="-1" data-dialog-title><%= error %></h2>
+    <div id="dialog-desc-messageErrorModal" class="mt-4">
+      <p><%= t(".intro") %></p>
+      <p><%= safe_join(messages, tag.br) %></p>
+      <p><%= t(".correct_errors") %></p>
+    </div>
+    <div data-dialog-actions>
+      <button type="button" class="button button__sm lg:button__lg button__secondary" data-dialog-close="messageErrorModal" aria-label="<%= t(".ok") %>"><%= t(".ok") %></button>
     </div>
   </div>
-</div>
+<% end %>

data/app/views/decidim/messaging/conversations/error.js.erb

@@ -1,10 +1,15 @@
-var $messageError = $("#messageErrorModal");
-if ($messageError.length > 0) {
-  $messageError.foundation("_destroy").remove();
+var messageError = document.getElementById("messageErrorModal")
+
+if (messageError) {
+  messageError.remove();
 }
+document.body.insertAdjacentHTML("beforeend", "<%= j(render "error_modal", error:, messages:).html_safe %>");
 
-$("#messages").append("<%= j(render "error_modal", error:, messages:).html_safe %>");
-$messageError = $("#messageErrorModal");
+messageError = document.getElementById("messageErrorModal")
+if (messageError) {
+  window.createDialog(messageError);
 
-var messageErrorReveal = new Foundation.Reveal($messageError);
-messageErrorReveal.open();
+  if (Decidim.currentDialogs.messageErrorModal) {
+    window.Decidim.currentDialogs.messageErrorModal.open();
+  }
+}

data/app/views/decidim/newsletters/unsubscribe.html.erb

@@ -1,4 +1,4 @@
-<main class="layout-1col cols-6">
+<main class="layout-1col cols-6" role="main">
   <div class="text-center py-12">
     <h1 class="h1 decorator inline-block text-left"><%= t ".unsubscribe" %></h1>
   </div>

data/app/views/decidim/notifications_settings/show.html.erb

@@ -167,20 +167,20 @@
       <% end %>
 
       <% if @notifications_settings.meet_push_notifications_requirements? %>
-        <div class="push-notifications js-sw-mandatory">
+        <div class="push-notifications js-sw-mandatory" data-push-notifications-container>
           <label>
             <%= t("push_notifications", scope: "decidim.notifications_settings.show") %>
           </label>
-          <p id="push-notifications-reminder" class="push-notifications__reminder block my-4">
+          <p id="push-notifications-reminder" class="push-notifications__reminder block my-4" data-push-notifications-reminder>
             <%= t("push_notifications_reminder", scope: "decidim.notifications_settings.show") %>
           </p>
           <div class="toggle__switch-trigger">
             <label class="toggle__switch-toggle" for="allow_push_notifications">
               <span>
                 <input
-                  <%== %(checked="checked") if @notifications_settings.meet_push_notifications_requirements? %>
                   id="allow_push_notifications"
                   type="checkbox"
+                  data-push-notifications-toggle
                   name="allow_push_notifications">
                 <span class="toggle__switch-toggle-content">
                 </span>
@@ -194,8 +194,8 @@
           </div>
         </div>
 
-        <input id="vapidPublicKey" name="vapid_public_key" type="hidden" value="<%= Base64.urlsafe_decode64(Decidim.vapid_public_key.to_s).bytes %>">
-        <input id="subKeys" name="sub_key" type="hidden" value="<%= current_user.notifications_subscriptions.keys %>">
+        <input id="vapidPublicKey" name="vapid_public_key" data-push-vapid-public-key type="hidden" value="<%= Base64.urlsafe_decode64(Decidim.vapid_public_key.to_s).bytes.to_json %>">
+        <input id="subKeys" name="sub_key" data-push-sub-keys type="hidden" value="<%= current_user.notifications_subscriptions.keys.to_json %>">
       <% end %>
 
       <div class="form__wrapper-block">

data/app/views/decidim/offline/show.html.erb

@@ -1,6 +1,6 @@
 <% add_decidim_page_title(t("decidim.offline.name")) %>
 
-<main id="offline-fallback-html" class="text-center my-8">
+<main id="offline-fallback-html" class="text-center my-8" role="main">
   <div class="flex justify-center">
     <svg xmlns="http://www.w3.org/2000/svg" width="5rem" height="r5em" viewBox="0 0 25 25">
       <path

data/app/views/decidim/pages/index.html.erb

@@ -42,7 +42,7 @@ edit_link(
                 <div id="accordion-panel-<%= ix %>" class="page__accordion-panel" aria-hidden="true">
                   <ul role="menu">
                     <% topic.pages.each do |page| %>
-                      <li role="menuitem"><%= link_to translated_attribute(page.title), page_path(page), class: "text-secondary" %></li>
+                      <li role="presentation"><%= link_to translated_attribute(page.title), page_path(page), class: "text-secondary", role: "menuitem" %></li>
                     <% end %>
                   </ul>
                 </div>

data/app/views/decidim/profiles/show.html.erb

@@ -6,6 +6,6 @@
 <% end %>
 
 <%# NOTE: this page does not use a regular layout %>
-<main>
+<main role="main">
   <%= cell "decidim/profile", profile_holder, context: { content_cell: @content_cell } %>
 </main>

data/app/views/decidim/shared/_resource_actions.html.erb

@@ -12,12 +12,12 @@
     <ul class="dropdown dropdown__bottom divide-y divide-gray-3" role="menu">
       <%= yield %>
       <% unless defined?(skip_report) && skip_report %>
-        <li role="menuitem" class="dropdown__item">
-          <%= cell "decidim/report_button", resource, button_classes: "dropdown__button" %>
+        <li role="presentation" class="dropdown__item">
+          <%= cell "decidim/report_button", resource, button_classes: "dropdown__button", html_options: { role: "menuitem" } %>
         </li>
       <% end %>
-      <li role="menuitem" class="dropdown__item">
-        <%= cell "decidim/follow_button", resource, large: false, button_classes: "dropdown__button" %>
+      <li role="presentation" class="dropdown__item">
+        <%= cell "decidim/follow_button", resource, large: false, button_classes: "dropdown__button", html_options: { role: "menuitem" } %>
       </li>
     </ul>
   </div>

data/app/views/decidim/user_activities/index.html.erb

@@ -6,7 +6,7 @@
 <% end %>
 
 <%# NOTE: this page does not use a regular layout %>
-<main>
+<main role="main">
   <%= cell "decidim/profile", user, context: {
         content_cell: "decidim/user_activity",
         activities:,