decidim-core 0.31.6 → 0.32.0.rc1

data/app/commands/decidim/multiple_attachments_methods.rb

@@ -5,16 +5,16 @@ module Decidim
     private
 
     def build_attachments
-      @attachments = []
-      @form.add_attachments.compact_blank.each do |attachment|
+      @documents = []
+      @form.add_documents.compact_blank.each do |attachment|
         if attachment.is_a?(Hash) && attachment.has_key?(:id)
           update_attachment_title_for(attachment)
           next
         end
 
-        @attachments << Attachment.new(
+        @documents << Attachment.new(
           title: title_for(attachment),
-          attached_to: @attached_to || attachments_attached_to,
+          attached_to: @attached_to || documents_attached_to,
           file: signed_id_for(attachment),
           content_type: content_type_for(attachment)
         )
@@ -26,11 +26,11 @@ module Decidim
     end
 
     def attachments_invalid?
-      @attachments.each do |attachment|
-        next if attachment.valid? || !attachment.errors.has_key?(:file)
+      @documents.each do |document|
+        next if document.valid? || !document.errors.has_key?(:file)
 
-        attachment.errors[:file].each do |error|
-          @form.errors.add(:add_attachments, error)
+        document.errors[:file].each do |error|
+          @form.errors.add(:add_documents, error)
         end
 
         return true
@@ -41,38 +41,37 @@ module Decidim
 
     def create_attachments(first_weight: 0)
       weight = first_weight
-      # Add the weights first to the old attachments
-      attachment_ids = keep_ids
-      Decidim::Attachment.where(id: attachment_ids).each do |attachment|
-        attachment.update!(weight:)
+      # Add the weights first to the old documents
+      document_ids = keep_ids
+      Decidim::Attachment.where(id: document_ids).each do |document|
+        document.update!(weight:)
         weight += 1
       end
-      @attachments.map! do |attachment|
-        attachment.weight = weight
-        attachment.attached_to = attachments_attached_to
-        attachment.save!
+      @documents.map! do |document|
+        document.weight = weight
+        document.attached_to = documents_attached_to
+        document.save!
         weight += 1
-        @form.attachments << attachment
+        @form.documents << document
       end
     end
 
-    def attachment_cleanup!(include_all_attachments: false)
-      attachments = include_all_attachments ? attachments_attached_to.attachments.with_attached_file : attachments_attached_to.attachments
+    def document_cleanup!(include_all_attachments: false)
+      documents = include_all_attachments ? documents_attached_to.attachments.with_attached_file : documents_attached_to.documents
 
-      attachments.each do |attachment|
-        attachment.destroy! unless keep_ids.include?(attachment.id)
+      documents.each do |document|
+        document.destroy! unless keep_ids.include?(document.id)
       end
 
-      attachments_attached_to.reload
-      attachments_attached_to.instance_variable_set(:@attachments, nil)
-      attachments_attached_to.instance_variable_set(:@photos, nil)
+      documents_attached_to.reload
+      documents_attached_to.instance_variable_set(:@documents, nil)
     end
 
     def process_attachments?
-      @form.add_attachments.any?
+      @form.add_documents.any?
     end
 
-    def attachments_attached_to
+    def documents_attached_to
       return @attached_to if @attached_to.present?
       return form.current_organization if form.respond_to?(:current_organization)
 
@@ -102,8 +101,8 @@ module Decidim
     end
 
     def keep_ids
-      attachments_array = Array(@form.attachments)
-      attachments_array.map do |doc|
+      documents_array = Array(@form.documents)
+      documents_array.map do |doc|
         case doc
         when Decidim::Attachment
           doc.id

data/app/commands/decidim/search.rb

@@ -7,10 +7,10 @@ module Decidim
 
     # Public: Initializes the command.
     #
-    # @param term: The term to search for.
-    # @param organization: The Organization to which the results are constrained.
-    # @param filters: (optional) A Hash of SearchableResource attributes to filter for.
-    # @param page_params: (optional) A Hash with `page` and `per_page` options to paginate.
+    # @param term [String] -  The term to search for.
+    # @param organization [Decidim::Organization] - The Organization to which the results are constrained.
+    # @param filters [Hash] - (optional) A Hash of SearchableResource attributes to filter for.
+    # @param page_params [Hash] - (optional) A Hash with `page` and `per_page` options to paginate.
     def initialize(term, organization, filters = {}, page_params = {})
       @term = term
       @organization = organization
@@ -91,7 +91,7 @@ module Decidim
         query = query.where(decidim_participatory_space: spaces)
       end
 
-      query = query.order("datetime DESC")
+      query = query.order(datetime: :desc)
       query = query.global_search(I18n.transliterate(term)) if term.present?
       query
     end

data/app/controllers/concerns/decidim/ajax_permission_handler.rb

@@ -15,7 +15,7 @@ module Decidim
     def ajax_user_has_no_permission
       return user_has_no_permission unless request.xhr?
 
-      render json: { message: I18n.t("actions.unauthorized", scope: "decidim.core") }, status: :unprocessable_entity
+      render json: { message: I18n.t("actions.unauthorized", scope: "decidim.core") }, status: :unprocessable_content
     end
   end
 end

data/app/controllers/concerns/decidim/devise_controllers.rb

@@ -41,10 +41,6 @@ module Decidim
 
       layout "layouts/decidim/application"
 
-      # Ensure locale is set before Devise's own prepended callbacks and reset
-      # after the request finishes.
-      prepend_around_action :set_current_locale
-
       # Saves the location before loading each page so we can return to the
       # right page.
       before_action :store_current_location
@@ -62,12 +58,6 @@ module Decidim
 
         store_location_for(:user, redirect_url)
       end
-
-      def set_current_locale(&)
-        locale = detect_locale
-        locale = default_locale unless available_locales.include?(locale)
-        I18n.with_locale(locale, &)
-      end
     end
   end
 end

data/app/controllers/concerns/decidim/direct_upload.rb

@@ -6,6 +6,7 @@ module Decidim
 
     included do
       include Decidim::NeedsOrganization
+
       skip_before_action :verify_organization
 
       before_action :check_organization!,
@@ -18,14 +19,14 @@ module Decidim
       # We skip the validation if we are in system panel. `current_admin` refers to the main system admin user.
       return if current_admin.present?
 
-      head :unprocessable_entity unless [
+      head :unprocessable_content unless [
         maximum_allowed_size.try(:to_i) >= blob_args[:byte_size].try(:to_i),
         content_types.any? { |pattern| pattern.match?(blob_args[:content_type]) },
         content_types.any? { |pattern| pattern.match?(MiniMime.lookup_by_extension(extension)&.content_type) },
         allowed_extensions.any? { |pattern| pattern.match?(extension) }
       ].all?
     rescue NoMethodError
-      head :unprocessable_entity
+      head :unprocessable_content
     end
 
     def extension

data/app/controllers/concerns/decidim/ephemeral_session_checker.rb

@@ -78,7 +78,7 @@ module Decidim
                    end
       paths_list.prepend(
         pending_authorizations_path,
-        decidim.page_path(terms_of_service_page)
+        decidim.page_path(terms_of_service_page, locale: current_locale)
       )
 
       paths_list.find { |el| /\A#{URI.parse(el).path}/.match?(request.path) }

data/app/controllers/concerns/decidim/force_authentication.rb

@@ -38,12 +38,21 @@ module Decidim
       default_unauthorized_paths + Decidim::StaticPage.where(
         organization: current_organization,
         allow_public_access: true
-      ).pluck(Arel.sql("CONCAT('/pages/', slug)"))
+      ).pluck(
+        Arel::Nodes::Concat.new(
+          Arel::Nodes.build_quoted("/#{current_locale}/pages/"),
+          Arel::Table.new(Decidim::StaticPage.table_name)[:slug]
+        )
+      )
     end
 
     def default_unauthorized_paths
       # /locale is for changing the locale and /manifest.webmanifest to request PWA manifest
       %w(/locale /manifest.webmanifest)
     end
+
+    def current_locale
+      @current_locale ||= I18n.locale.to_s
+    end
   end
 end

data/app/controllers/concerns/decidim/impersonate_users.rb

@@ -71,6 +71,10 @@ module Decidim
         # Prevent redirect on non-HTML responses, because we want redirect AFTER impersonation.js inits a reload.
         return if request && request.negotiate_mime([Mime[:html]]).blank?
         return unless can_impersonate_users?
+
+        # Keep the expiration check in sync with the active impersonation log so
+        # the redirect happens in the same request when the session just expired.
+        impersonation_log&.ensure_not_expired!
         return unless expired_log
 
         expired_log.update!(ended_at: Time.current)

data/app/controllers/concerns/decidim/locale_switcher.rb

@@ -9,7 +9,7 @@ module Decidim
 
     included do
       around_action :switch_locale
-      helper_method :current_locale, :available_locales, :default_locale
+      helper_method :current_locale, :available_locales, :default_locale, :canonical_url
 
       # Sets the locale for the current session.
       # Saves current locale in a session variable in case some links are locale-orphaned
@@ -21,6 +21,7 @@ module Decidim
         else
           locale = default_locale
         end
+
         I18n.with_locale(locale, &)
       end
 
@@ -29,7 +30,7 @@ module Decidim
       #
       # Returns a Hash.
       def default_url_options
-        return {} if current_locale == default_locale.to_s
+        return {} if locale_in_script_name?
 
         { locale: current_locale }
       end
@@ -99,6 +100,55 @@ module Decidim
         end
         lang == "*" ? nil : lang
       end
+
+      def canonical_url(desired_url, target_locale = default_locale)
+        uri = URI(desired_url)
+        desired_locale = available_locales.include?(target_locale) ? target_locale : default_locale
+
+        path_segments = uri.path.split("/").compact_blank
+        locale_segment = path_segments.first
+
+        query = uri.query.to_s.gsub(/locale=[a-zA-Z-]{2,5}/, "")
+
+        if available_locales.include?(locale_segment)
+          path_segments[0] = desired_locale
+
+          uri.path = "/#{path_segments.join("/")}"
+
+          if query.present?
+            params = URI.decode_www_form(query)
+            uri.query = URI.encode_www_form(params)
+          else
+            uri.query = nil
+          end
+        elsif uri.host.blank? || uri.host == request.host
+          uri.path = if uri.path == "/"
+                       "/#{desired_locale}"
+                     else
+                       "/#{desired_locale}#{uri.path}"
+                     end
+
+          if query.present?
+            params = URI.decode_www_form(query)
+            uri.query = URI.encode_www_form(params)
+          else
+            uri.query = nil
+          end
+        else
+          params = URI.decode_www_form(query) << ["locale", desired_locale]
+          uri.query = URI.encode_www_form(params)
+        end
+
+        uri.to_s
+      end
+
+      def locale_in_script_name?
+        script_name = request&.script_name.to_s
+        return false if script_name.blank?
+
+        locale_segment = script_name.split("/").compact_blank.first
+        available_locales.include?(locale_segment)
+      end
       # rubocop: enable Metrics/CyclomaticComplexity
       # rubocop: enable Metrics/PerceivedComplexity
     end

data/app/controllers/concerns/decidim/needs_tos_accepted.rb

@@ -43,7 +43,7 @@ module Decidim
     end
 
     def tos_path
-      decidim.page_path terms_of_service_page
+      decidim.page_path terms_of_service_page, locale: current_locale
     end
 
     def redirect_to_tos

data/app/controllers/concerns/decidim/participatory_space/has_members_page.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module Decidim
+  module ParticipatorySpace
+    module HasMembersPage
+      extend ActiveSupport::Concern
+
+      included do
+        helper_method :collection
+
+        private
+
+        def can_visit_index?
+          current_user_can_visit_space? && current_participatory_space.members_public_page?
+        end
+
+        def members
+          @members ||= current_participatory_space.members.published
+        end
+
+        alias_method :collection, :members
+      end
+    end
+  end
+end

data/app/controllers/concerns/decidim/participatory_space_context.rb

@@ -36,8 +36,6 @@ module Decidim
     #           title of the space (mandatory).
     # * url - The url of the resource (optional).
     # * active - Whether the item is active (optional).
-    # * dropdown_cell - When this value is present is used to generate a dropdown
-    #                   associated to the item (optional).
     # * resource - The resource of the item. This value is passed to the
     #              dropdown cell, so it is mandatory if the dropdown cell is
     #              present.
@@ -48,7 +46,6 @@ module Decidim
         label: current_participatory_space.title,
         url: Decidim::ResourceLocatorPresenter.new(current_participatory_space).path,
         active: true,
-        dropdown_cell: current_participatory_space_manifest.breadcrumb_cell,
         resource: current_participatory_space
       }
     end
@@ -79,8 +76,7 @@ module Decidim
 
     # Method for current user can visit the space (assembly or process)
     def current_user_can_visit_space?
-      return true unless current_participatory_space.try(:private_space?) &&
-                         !current_participatory_space.try(:is_transparent?)
+      return true unless current_participatory_space.respond_to?(:restricted?) && current_participatory_space.restricted?
       return false unless current_user
       return true if current_user.admin?
       return true if user_has_any_role?(current_user, current_participatory_space, broad_check: true)

data/app/controllers/decidim/account_controller.rb

@@ -31,7 +31,7 @@ module Decidim
         on(:invalid) do |password|
           fetch_entered_password(password)
           flash[:alert] = t("account.update.error", scope: "decidim")
-          render action: :show, status: :unprocessable_entity
+          render action: :show, status: :unprocessable_content
         end
       end
     end

data/app/controllers/decidim/amendments_controller.rb

@@ -5,6 +5,7 @@ module Decidim
     include Decidim::ApplicationHelper
     include FormFactory
     include HasSpecificBreadcrumb
+
     helper Decidim::ResourceReferenceHelper
 
     before_action :authenticate_user!
@@ -38,7 +39,7 @@ module Decidim
 
         on(:invalid) do
           flash.now[:alert] = t("created.error", scope: "decidim.amendments")
-          render :new, status: :unprocessable_entity
+          render :new, status: :unprocessable_content
         end
       end
     end
@@ -62,7 +63,7 @@ module Decidim
 
         on(:invalid) do
           flash.now[:alert] = t("error", scope: "decidim.amendments.update_draft")
-          render :edit_draft, status: :unprocessable_entity
+          render :edit_draft, status: :unprocessable_content
         end
       end
     end
@@ -100,7 +101,7 @@ module Decidim
 
         on(:invalid) do
           flash.now[:alert] = t("error", scope: "decidim.amendments.publish_draft")
-          render :edit_draft, status: :unprocessable_entity
+          render :edit_draft, status: :unprocessable_content
         end
       end
     end
@@ -160,7 +161,7 @@ module Decidim
 
         on(:invalid) do
           flash.now[:alert] = t("accepted.error", scope: "decidim.amendments")
-          render :review, status: :unprocessable_entity
+          render :review, status: :unprocessable_content
         end
       end
     end

data/app/controllers/decidim/components/base_controller.rb

@@ -10,6 +10,7 @@ module Decidim
       include Decidim::NeedsPermission
 
       include ParticipatorySpaceContext
+
       before_action :authorize_participatory_space
 
       helper Decidim::FiltersHelper
@@ -35,7 +36,7 @@ module Decidim
 
       before_action :redirect_unless_feature_private
 
-      before_action :set_component_breadcrumb_item
+      before_action :set_breadcrumb_items
 
       def current_participatory_space
         request.env["decidim.current_participatory_space"]
@@ -66,14 +67,30 @@ module Decidim
         raise ActionController::RoutingError, "Not Found" unless current_user_can_visit_space?
       end
 
-      def set_component_breadcrumb_item
-        context_breadcrumb_items << {
+      def set_breadcrumb_items
+        context_breadcrumb_items << add_current_component
+        context_breadcrumb_items << add_parent_breadcrumb_item
+        context_breadcrumb_items << add_breadcrumb_item
+      end
+
+      private
+
+      def add_current_component
+        {
           label: current_component.name,
           url: Decidim::EngineRouter.main_proxy(current_component).root_path,
           active: false,
           resource: current_component
         }
       end
+
+      def add_parent_breadcrumb_item
+        {}
+      end
+
+      def add_breadcrumb_item
+        {}
+      end
     end
   end
 end

data/app/controllers/decidim/devise/omniauth_registrations_controller.rb

@@ -34,7 +34,7 @@ module Decidim
 
           on(:invalid) do
             set_flash_message :notice, :success, kind: @form.provider.capitalize
-            render :new, status: :unprocessable_entity
+            render :new, status: :unprocessable_content
           end
 
           on(:add_tos_errors) do

data/app/controllers/decidim/devise/passwords_controller.rb

@@ -36,7 +36,7 @@ module Decidim
           on(:invalid) do
             flash.now[:alert] = t("passwords.update.error", scope: "decidim")
             resource.errors.errors.concat(@form.errors.errors)
-            render action: "edit", status: :unprocessable_entity
+            render action: "edit", status: :unprocessable_content
           end
         end
       end

data/app/controllers/decidim/devise/registrations_controller.rb

@@ -40,7 +40,7 @@ module Decidim
 
           on(:invalid) do
             flash.now[:alert] = t("error", scope: "decidim.devise.registrations.create")
-            render :new, status: :unprocessable_entity
+            render :new, status: :unprocessable_content
           end
         end
       end

data/app/controllers/decidim/devise/sessions_controller.rb

@@ -48,7 +48,7 @@ module Decidim
 
       def redirect_to_referer_or_path
         set_flash_message(:alert, "csrf_token", scope: "devise.failure")
-        redirect_back(fallback_location: root_path) && return
+        redirect_back_or_to(root_path) && return
       end
 
       def check_sign_in_enabled

data/app/controllers/decidim/download_your_data_controller.rb

@@ -37,7 +37,7 @@ module Decidim
       DownloadYourDataExportJob.perform_later(current_user)
 
       flash[:notice] = t("decidim.account.download_your_data_export.notice")
-      redirect_back(fallback_location: download_your_data_path)
+      redirect_back_or_to(download_your_data_path)
     end
 
     def download_file
@@ -50,7 +50,7 @@ module Decidim
         flash[:error] = t("decidim.account.download_your_data_export.export_expired")
         redirect_to download_your_data_path
       elsif private_export.file.attached?
-        redirect_to private_download_path(Decidim::PrivateDownload.for(private_export, attachment_name: :file).token)
+        redirect_to Rails.application.routes.url_helpers.rails_blob_url(private_export.file.blob, only_path: true)
       else
         flash[:error] = t("decidim.account.download_your_data_export.file_no_exists")
         redirect_to download_your_data_path

data/app/controllers/decidim/editor_images_controller.rb

@@ -16,7 +16,7 @@ module Decidim
         end
 
         on(:invalid) do |_message|
-          render json: { message: I18n.t("error", scope: "decidim.editor_images.create") }, status: :unprocessable_entity
+          render json: { message: I18n.t("error", scope: "decidim.editor_images.create") }, status: :unprocessable_content
         end
       end
     end

data/app/controllers/decidim/follows_controller.rb

@@ -3,6 +3,7 @@
 module Decidim
   class FollowsController < Decidim::ApplicationController
     include FormFactory
+
     before_action :authenticate_user!
     helper_method :resource, :button_cell, :button_cell_mobile
 
@@ -16,7 +17,7 @@ module Decidim
         end
 
         on(:invalid) do
-          render json: { error: I18n.t("follows.destroy.error", scope: "decidim") }, status: :unprocessable_entity
+          render json: { error: I18n.t("follows.destroy.error", scope: "decidim") }, status: :unprocessable_content
         end
       end
     end
@@ -31,7 +32,7 @@ module Decidim
         end
 
         on(:invalid) do
-          render json: { error: I18n.t("follows.create.error", scope: "decidim") }, status: :unprocessable_entity
+          render json: { error: I18n.t("follows.create.error", scope: "decidim") }, status: :unprocessable_content
         end
       end
     end
@@ -43,7 +44,7 @@ module Decidim
     end
 
     def button_options
-      params.require(:follow).permit(:button_classes).to_h.symbolize_keys
+      params.expect(follow: [:button_classes]).to_h.symbolize_keys
     end
 
     def button_cell_mobile

data/app/controllers/decidim/geolocation_controller.rb

@@ -8,7 +8,7 @@ module Decidim
       enforce_permission_to :locate, :geolocation
 
       unless Decidim::Map.configured?
-        return render(json: { message: I18n.t("not_configured", scope: "decidim.application.geocoding"), found: false }, status: :unprocessable_entity)
+        return render(json: { message: I18n.t("not_configured", scope: "decidim.application.geocoding"), found: false }, status: :unprocessable_content)
       end
 
       geocoder = Decidim::Map.utility(:geocoding, organization: current_organization)

data/app/controllers/decidim/likes_controller.rb

@@ -5,6 +5,7 @@ module Decidim
   class LikesController < Decidim::Components::BaseController
     # we need to +include+ to be able to call :like_button from the view
     include Decidim::LikeableHelper
+
     helper_method :like_button
     # we need to declare with +helper+ to be able to call :render_like_identity from the views
     helper Decidim::LikeableHelper
@@ -22,7 +23,7 @@ module Decidim
         end
 
         on(:invalid) do
-          render json: { error: I18n.t("resource_likes.create.error", scope: "decidim") }, status: :unprocessable_entity
+          render json: { error: I18n.t("resource_likes.create.error", scope: "decidim") }, status: :unprocessable_content
         end
       end
     end

data/app/controllers/decidim/locales_controller.rb

@@ -7,20 +7,12 @@ module Decidim
 
     def create
       enforce_permission_to :create, :locales
-      current_user.update!(locale: params["locale"]) if current_user && params["locale"] && available_locales.include?(params["locale"])
-
-      redirect_to referer_with_new_locale
-    end
 
-    private
+      desired_locale = params["locale"] if params["locale"] && available_locales.include?(params["locale"])
 
-    def referer_with_new_locale
-      uri = URI(request.referer || "/")
-      query = uri.query.to_s.gsub(/locale=[a-zA-Z-]{2,5}/, "")
-      params = URI.decode_www_form(query) << ["locale", current_locale]
-      uri.query = URI.encode_www_form(params)
+      current_user.update!(locale: params["locale"]) if current_user && params["locale"] && available_locales.include?(params["locale"])
 
-      uri.to_s
+      redirect_to canonical_url(request.referer || "/", desired_locale || default_locale)
     end
   end
 end