decidim-core 0.32.0 → 0.32.2

data/lib/decidim/core/test/shared_examples/comments_examples.rb

@@ -173,6 +173,16 @@ shared_examples "comments" do
       expect(page).to have_css(".comment-thread")
     end
 
+    it "opens the login modal when clicking the comment button" do
+      visit resource_path
+
+      expect(page).to have_no_css("#loginModal-content", visible: :visible)
+
+      find(".add-comment-mobile").click
+
+      expect(page).to have_css("#loginModal-content", visible: :visible)
+    end
+
     context "when user visit a mobile browser" do
       before do
         driven_by(:iphone)
@@ -202,6 +212,22 @@ shared_examples "comments" do
       expect(page).to have_css(".add-comment form")
     end
 
+    it "does not show login modal when clicking the comment button" do
+      visit resource_path
+
+      find("a.add-comment-mobile").click
+
+      expect(page).to have_no_css("#loginModal-content", visible: :visible)
+    end
+
+    it "guides the user to the comment form when clicking the comment button" do
+      visit resource_path
+
+      find("a.add-comment-mobile").click
+
+      expect(page).to have_css("#add-comment-anchor")
+    end
+
     context "when user visit a computer browser" do
       before do
         switch_to_host(organization.host)

data/lib/decidim/core/test/shared_examples/participatory_space_members_page_examples.rb

@@ -42,5 +42,82 @@ shared_examples "participatory space members page examples" do
         end
       end
     end
+
+    context "when participatory space has paginated members" do
+      let(:users) { create_list(:user, 30, organization: participatory_space.organization) }
+      let!(:members) do
+        users.map do |user|
+          create(:member, participatory_space:, user:, published: true)
+        end
+      end
+
+      context "with default pagination" do
+        it "returns first page with 25 members" do
+          get :index, params: { slug_param => slug, :locale => I18n.locale }
+
+          expect(assigns(:members).count).to eq(25)
+          expect(assigns(:members).current_page).to eq(1)
+          expect(assigns(:members).total_count).to eq(30)
+        end
+      end
+
+      context "with page parameter" do
+        it "returns second page with remaining members" do
+          get :index, params: { slug_param => slug, :locale => I18n.locale, :page => 2 }
+
+          expect(assigns(:members).count).to eq(5)
+          expect(assigns(:members).current_page).to eq(2)
+          expect(assigns(:members).total_count).to eq(30)
+        end
+
+        it "returns empty collection for out-of-range page" do
+          get :index, params: { slug_param => slug, :locale => I18n.locale, :page => 999 }
+
+          expect(assigns(:members).count).to eq(0)
+          expect(assigns(:members).current_page).to eq(999)
+          expect(assigns(:members).total_count).to eq(30)
+        end
+      end
+
+      context "with per_page parameter" do
+        it "returns all members when per_page is 50" do
+          get :index, params: { slug_param => slug, :locale => I18n.locale, :per_page => 50 }
+
+          expect(assigns(:members).count).to eq(30)
+          expect(assigns(:members).current_page).to eq(1)
+          expect(assigns(:members).limit_value).to eq(50)
+          expect(assigns(:members).total_count).to eq(30)
+        end
+
+        it "returns first 25 members when per_page is 25" do
+          get :index, params: { slug_param => slug, :locale => I18n.locale, :per_page => 25 }
+
+          expect(assigns(:members).count).to eq(25)
+          expect(assigns(:members).limit_value).to eq(25)
+        end
+
+        it "limits per_page to maximum allowed value" do
+          get :index, params: { slug_param => slug, :locale => I18n.locale, :per_page => 200 }
+
+          expect(assigns(:members).limit_value).to eq(100)
+        end
+
+        it "limit per_page to minimum allowed value" do
+          get :index, params: { slug_param => slug, :locale => I18n.locale, :per_page => 5 }
+
+          expect(assigns(:members).limit_value).to eq(25)
+        end
+      end
+
+      context "with both page and per_page parameters" do
+        it "returns correct page with custom per_page" do
+          get :index, params: { slug_param => slug, :locale => I18n.locale, :page => 2, :per_page => 50 }
+
+          expect(assigns(:members).count).to eq(0)
+          expect(assigns(:members).current_page).to eq(2)
+          expect(assigns(:members).limit_value).to eq(50)
+        end
+      end
+    end
   end
 end

data/lib/decidim/core/test/shared_examples/participatory_space_members_shared_examples.rb

@@ -117,5 +117,63 @@ shared_examples "participatory space members" do
         expect(page).to have_content("Profile")
       end
     end
+
+    context "when there are more members than the pagination per_page limit" do
+      let(:per_page) { Decidim::Paginable::OPTIONS.first }
+      let(:users) { create_list(:user, per_page + 5, organization: participatory_space.organization) }
+      let!(:extra_members) do
+        users.map do |user|
+          create(:member, participatory_space:, user:, published: true)
+        end
+      end
+
+      before do
+        visit members_path
+      end
+
+      it "paginates the members list" do
+        within ".layout-main__section" do
+          expect(page).to have_css(".profile__user", count: per_page)
+        end
+      end
+
+      it "shows pagination controls" do
+        within("div[data-pagination]") do
+          expect(page).to have_css('nav[aria-label="Pagination"]')
+        end
+      end
+
+      it "navigates to the next page" do
+        within "nav[aria-label=\"Pagination\"]" do
+          click_on "Next"
+        end
+
+        within ".layout-main__section" do
+          expect(page).to have_css(".profile__user", count: 6)
+        end
+      end
+
+      it "maintains pagination when navigating back" do
+        within "nav[aria-label=\"Pagination\"]" do
+          click_on "Next"
+        end
+
+        within "nav[aria-label=\"Pagination\"]" do
+          click_on "Prev"
+        end
+
+        within ".layout-main__section" do
+          expect(page).to have_css(".profile__user", count: per_page)
+        end
+      end
+
+      it "shows the correct page number in the URL" do
+        within "nav[aria-label=\"Pagination\"]" do
+          click_on "Next"
+        end
+
+        expect(page).to have_current_path(/page=2/)
+      end
+    end
   end
 end

data/lib/decidim/core/test/shared_examples/versions_controller_examples.rb

@@ -28,7 +28,7 @@ shared_examples "a version of a hidden object" do
   end
 end
 
-shared_examples "versions controller" do
+shared_context "versions controller resource" do
   let(:base_params) do
     if resource.is_a?(Decidim::Participable)
       { :"#{resource.model_name.singular_route_key}_slug" => resource.slug, :locale => I18n.locale }
@@ -45,6 +45,10 @@ shared_examples "versions controller" do
       request.env["decidim.current_component"] = resource.component
     end
   end
+end
+
+shared_examples "versions controller" do
+  include_context "versions controller resource"
 
   describe "GET show" do
     context "with an existing version" do
@@ -64,3 +68,21 @@ shared_examples "versions controller" do
     end
   end
 end
+
+# The versions of a resource must be readable with the same `:read` permission
+# as the resource itself. This ensures that a resource that is hidden, private,
+# deleted or unpublished cannot be reached through its versions.
+#
+# Requires a `resource` that is not readable through its public `:read`
+# permission.
+shared_examples "versions controller denying unreadable resources" do
+  include_context "versions controller resource"
+
+  it "does not expose the versions" do
+    get :show, params: base_params.merge(id: 1)
+
+    expect(response).not_to have_http_status(:ok)
+  rescue ActiveRecord::RecordNotFound
+    # The resource is filtered out before the permission is evaluated.
+  end
+end

data/lib/decidim/core/version.rb

@@ -4,7 +4,7 @@ module Decidim
   # This holds the decidim-core version.
   module Core
     def self.version
-      "0.32.0"
+      "0.32.2"
     end
   end
 end

data/lib/decidim/core.rb

@@ -288,7 +288,7 @@ module Decidim
   mattr_accessor :default_locale, default: (Decidim::Env.new("DECIDIM_DEFAULT_LOCALE", "en").presence || :en).to_s
 
   # Users that have not logged in for this period of time will be deleted
-  mattr_accessor :delete_inactive_users_after_days, default: Decidim::Env.new("DELETE_INACTIVE_USERS_AFTER_DAYS", 365).to_i
+  mattr_accessor :delete_inactive_users_after_days, default: Decidim::Env.new("DECIDIM_DELETE_INACTIVE_USERS_AFTER_DAYS", 365).to_i
 
   # The minimum allowed inactivity period for deleting participants.
   mattr_accessor :minimum_inactivity_period, default: Decidim::Env.new("DECIDIM_MINIMUM_INACTIVITY_PERIOD_IN_DAYS", 30).to_i
@@ -447,6 +447,15 @@ module Decidim
   # Time window in which the throttling is applied.
   mattr_accessor :throttling_period, default: Decidim::Env.new("DECIDIM_THROTTLING_PERIOD", "1").to_i.minutes
 
+  # Max failed attempts for verification code confirmation before lockout.
+  mattr_accessor :verification_max_failed_attempts, default: Decidim::Env.new("DECIDIM_VERIFICATION_MAX_FAILED_ATTEMPTS", "5").to_i
+
+  # Time window after which a locked verification is automatically unlocked.
+  mattr_accessor :verification_unlock_in, default: Decidim::Env.new("DECIDIM_VERIFICATION_UNLOCK_IN", "30").to_i.minutes
+
+  # Time window (in minutes) after which a verification code expires (SMS only).
+  mattr_accessor :verification_code_expiry_minutes, default: Decidim::Env.new("DECIDIM_VERIFICATION_CODE_EXPIRY_MINUTES", "10").to_i
+
   # Time window were users can access the website even if their email is not confirmed.
   mattr_accessor :unconfirmed_access_for, default: Decidim::Env.new("DECIDIM_UNCONFIRMED_ACCESS_FOR", "0").to_i.days
 

data/lib/decidim/form_builder.rb

@@ -886,12 +886,20 @@ module Decidim
         upload_dialog_selector: "##{upload_options[:modal_id]}"
       }.transform_keys { |key| key.to_s.camelize(:lower) }
 
-      editor_options[:mention] = options.delete(:mentionable)
+      mentionable = options.delete(:mentionable)
+      editor_options[:mention] = mention_options(mentionable) if mentionable
       editor_options[:emoji] = options.delete(:emojiable)
 
       { editor: editor_options, upload: upload_options }
     end
 
+    def mention_options(mentionable)
+      mention_options = mentionable.is_a?(Hash) ? mentionable.dup : {}
+      mention_options[:searchPromptMessage] ||= I18n.t("decidim.shared.mentions.search_prompt")
+
+      mention_options
+    end
+
     # Private: creates an upload modal for the editor that we use to dynamically
     # upload the images to the editor.
     def editor_upload(editor_image, options = {})

data/lib/decidim/has_upload_validations.rb

@@ -15,6 +15,7 @@ module Decidim
           file_size: { less_than_or_equal_to: max_size },
           organization_present: true,
           uploader_content_type: true,
+          uploader_image_content: true,
           uploader_image_dimensions: true
         )
 

data/lib/decidim/legacy_form_builder.rb

@@ -32,6 +32,10 @@ module Decidim
         options[:data][:controller] ||= ""
         options[:data][:controller] += " date-picker"
 
+        if (default_time = options.delete(:default_time))
+          options[:data][:default_time] = default_time
+        end
+
         field(attribute, options) do |opts|
           super(attribute, opts)
         end

data/lib/decidim/map/dynamic_map.rb

@@ -30,7 +30,9 @@ module Decidim
       def builder_options
         {
           marker_color: organization.colors.fetch("primary", "#e02d2d"),
-          tile_layer: tile_layer_configuration
+          tile_layer: tile_layer_configuration,
+          zoom_in_text: I18n.t("zoom_in", scope: "decidim.map.dynamic"),
+          zoom_out_text: I18n.t("zoom_out", scope: "decidim.map.dynamic")
         }
       end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: decidim-core
 version: !ruby/object:Gem::Version
-  version: 0.32.0
+  version: 0.32.2
 platform: ruby
 authors:
 - Josep Jaume Rey Peroy
@@ -681,6 +681,26 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '6.9'
+- !ruby/object:Gem::Dependency
+  name: rack-proxy
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.8.3
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.8.3
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '1.0'
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
@@ -893,28 +913,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.32.0
+        version: 0.32.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.32.0
+        version: 0.32.2
 - !ruby/object:Gem::Dependency
   name: decidim-dev
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.32.0
+        version: 0.32.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.32.0
+        version: 0.32.2
 description: Adds core features so other engines can hook into the framework.
 email:
 - josepjaume@gmail.com
@@ -1637,6 +1657,7 @@ files:
 - app/packs/src/decidim/attachments/file_or_link_tabs.js
 - app/packs/src/decidim/attachments/index.js
 - app/packs/src/decidim/callout.js
+- app/packs/src/decidim/callout.test.js
 - app/packs/src/decidim/confirm.js
 - app/packs/src/decidim/confirm.test.js
 - app/packs/src/decidim/controllers/.keep
@@ -1646,6 +1667,7 @@ files:
 - app/packs/src/decidim/controllers/account_form/controller.js
 - app/packs/src/decidim/controllers/assign_role/assign_role.test.js
 - app/packs/src/decidim/controllers/assign_role/controller.js
+- app/packs/src/decidim/controllers/autofocus/controller.js
 - app/packs/src/decidim/controllers/breadcrumb_truncate/breadcrumb_truncate.test.js
 - app/packs/src/decidim/controllers/breadcrumb_truncate/controller.js
 - app/packs/src/decidim/controllers/character_counter/controller.js
@@ -1788,6 +1810,8 @@ files:
 - app/packs/src/decidim/map/provider/default.js
 - app/packs/src/decidim/map/provider/here.js
 - app/packs/src/decidim/notifications.js
+- app/packs/src/decidim/refactor/implementation/autofocus.js
+- app/packs/src/decidim/refactor/implementation/autofocus.test.js
 - app/packs/src/decidim/refactor/implementation/configuration.js
 - app/packs/src/decidim/refactor/implementation/external_domain_warning.js
 - app/packs/src/decidim/refactor/implementation/external_link.js
@@ -1796,6 +1820,7 @@ files:
 - app/packs/src/decidim/refactor/moved/check_boxes_tree.js
 - app/packs/src/decidim/refactor/moved/delayed.js
 - app/packs/src/decidim/refactor/moved/focus_guard.js
+- app/packs/src/decidim/refactor/moved/focus_guard.test.js
 - app/packs/src/decidim/refactor/moved/history.js
 - app/packs/src/decidim/refactor/moved/i18n.js
 - app/packs/src/decidim/refactor/moved/i18n.test.js
@@ -2014,6 +2039,7 @@ files:
 - app/services/decidim/send_push_notification.rb
 - app/services/decidim/settings_change.rb
 - app/services/decidim/static_map_generator.rb
+- app/services/decidim/svg_content_validator.rb
 - app/services/decidim/tokenizer.rb
 - app/services/decidim/traceability.rb
 - app/uploaders/decidim/application_uploader.rb
@@ -2041,6 +2067,7 @@ files:
 - app/validators/translatable_presence_validator.rb
 - app/validators/translated_etiquette_validator.rb
 - app/validators/uploader_content_type_validator.rb
+- app/validators/uploader_image_content_validator.rb
 - app/validators/uploader_image_dimensions_validator.rb
 - app/validators/url_validator.rb
 - app/views/decidim/account/_account_notification.js.erb
@@ -2589,6 +2616,7 @@ files:
 - db/migrate/20260208201407_remove_user_group_organizations.rb
 - db/migrate/20260217152425_remove_enable_participatory_space_filters_from_decidim_organizations.rb
 - db/migrate/20260314081619_add_index_on_decidim_members.rb
+- db/migrate/20260909000000_add_failed_attempts_and_locked_at_to_decidim_authorizations.rb
 - db/seeds.rb
 - db/seeds/Exampledocument.pdf
 - db/seeds/avatars/001.jpg
@@ -2838,7 +2866,6 @@ files:
 - lib/decidim/content_parsers.rb
 - lib/decidim/content_parsers/base_parser.rb
 - lib/decidim/content_parsers/blob_parser.rb
-- lib/decidim/content_parsers/inline_images_parser.rb
 - lib/decidim/content_parsers/link_parser.rb
 - lib/decidim/content_parsers/mention_resource_parser.rb
 - lib/decidim/content_parsers/newline_parser.rb
@@ -3158,7 +3185,6 @@ files:
 - lib/tasks/decidim_taxonomies.rake
 - lib/tasks/upgrade/clean.rake
 - lib/tasks/upgrade/decidim_action_log_valuation_assignment.rake
-- lib/tasks/upgrade/decidim_active_storage_migration_tasks.rake
 - lib/tasks/upgrade/decidim_attachments.rake
 - lib/tasks/upgrade/decidim_change_valuator_tasks.rake
 - lib/tasks/upgrade/decidim_content_blocks_tasks.rake

data/lib/decidim/content_parsers/inline_images_parser.rb

@@ -1,68 +0,0 @@
-# frozen_string_literal: true
-
-module Decidim
-  module ContentParsers
-    # A parser that searches for inline images in an html content and
-    # replaces them with EditorImage attachments. Note that rewrite method may
-    # create EditorImage instances
-    #
-    # @see BaseParser Examples of how to use a content parser
-    class InlineImagesParser < BaseParser
-      # @return [String] the content with the inline images replaced.
-      def rewrite
-        return content unless inline_images?
-
-        replace_inline_images
-        parsed_content.to_html
-      end
-
-      def inline_images?
-        parsed_content.search(:img).find do |image|
-          image.attr(:src).start_with?(%r{data:image/[a-z]{3,4};base64,})
-        end
-      end
-
-      private
-
-      def parsed_content
-        @parsed_content ||= Nokogiri::HTML(content)
-      end
-
-      def replace_inline_images
-        parsed_content.search(:img).each do |image|
-          next unless image.attr(:src).start_with?(%r{data:image/[a-z]{3,4};base64,})
-
-          file = base64_tempfile(image.attr(:src))
-          editor_image = EditorImage.create!(
-            decidim_author_id: context[:user]&.id,
-            organization: context[:user].organization,
-            file:
-          )
-
-          image.set_attribute(:src, editor_image.attached_uploader(:file).path)
-        end
-      end
-
-      def base64_tempfile(base64_data, filename = nil)
-        return base64_data unless base64_data.is_a? String
-
-        start_regex = %r{data:image/[a-z]{3,4};base64,}
-        filename ||= SecureRandom.hex
-
-        regex_result = start_regex.match(base64_data)
-
-        return unless base64_data && regex_result
-
-        start = regex_result.to_s
-        tempfile = Tempfile.new(filename)
-        tempfile.binmode
-        tempfile.write(Base64.decode64(base64_data[start.length..-1]))
-        ActionDispatch::Http::UploadedFile.new(
-          tempfile:,
-          filename:,
-          original_filename: filename
-        )
-      end
-    end
-  end
-end

data/lib/tasks/upgrade/decidim_active_storage_migration_tasks.rake

@@ -1,79 +0,0 @@
-# frozen_string_literal: true
-
-namespace :decidim do
-  namespace :upgrade do
-    namespace :active_storage_migrations do
-      desc "Migrates inline images to ActiveStorage editor_image attachments"
-      task :migrate_inline_images_to_active_storage, [:admin_email] => :environment do |_t, args|
-        user = Decidim::User.find_by(email: args[:admin_email])
-
-        raise "Invalid admin. Please, provide the email of an admin with permissions to create editor images" unless user&.admin? && user.admin_terms_accepted?
-
-        inline_images_available_attributes.each do |model, attributes|
-          puts "=== Updating model #{model.name} (attributes: #{attributes.join(", ")})..."
-          model.all.each do |item|
-            attributes.each do |attribute|
-              item.update(attribute => rewrite_value(item.send(attribute), user))
-            end
-          end
-          puts "=== Finished update of model #{model.name}\n\n"
-        end
-      end
-
-      def rewrite_value(value, user)
-        if value.is_a?(Hash)
-          value.transform_values do |nested_value|
-            rewrite_value(nested_value, user)
-          end
-        else
-          parser = Decidim::ContentParsers::InlineImagesParser.new(value, user:)
-          parser.rewrite
-        end
-      end
-
-      def inline_images_available_attributes
-        {
-          "Decidim::Accountability::Result" => %w(description),
-          "Decidim::Proposals::Proposal" => %w(body answer cost_report execution_period),
-          "Decidim::Votings::Voting" => %w(description),
-          "Decidim::Elections::Question" => %w(description),
-          "Decidim::Elections::Answer" => %w(description),
-          "Decidim::Elections::Election" => %w(description),
-          "Decidim::Initiative" => %w(description answer),
-          "Decidim::InitiativesType" => %w(description extra_fields_legal_information),
-          "Decidim::Assembly" => %w(short_description description purpose_of_action composition internal_organisation announcement closing_date_reason special_features),
-          "Decidim::Forms::Questionnaire" => %w(description tos),
-          "Decidim::Forms::Question" => %w(description),
-          "Decidim::Organization" => %w(
-            welcome_notification_body
-            admin_terms_of_use_body
-            admin_terms_of_service_body
-            description
-            highlighted_content_banner_short_description
-            id_documents_explanation_text
-          ),
-          "Decidim::StaticPage" => %w(content),
-          "Decidim::ContextualHelpSection" => %w(content),
-          "Decidim::Category" => %w(description),
-          "Decidim::Blogs::Post" => %w(body),
-          "Decidim::Pages::Page" => %w(body),
-          "Decidim::Debates::Debate" => %w(description instructions information_updates conclusions),
-          "Decidim::Budgets::Budget" => %w(description),
-          "Decidim::Budgets::Project" => %w(description),
-          "Decidim::ConferenceSpeaker" => %w(short_bio),
-          "Decidim::Conferences::RegistrationType" => %w(description),
-          "Decidim::Conference" => %w(short_description description objectives registration_terms),
-          "Decidim::ParticipatoryProcessGroup" => %w(description),
-          "Decidim::ParticipatoryProcess" => %w(short_description description announcement),
-          "Decidim::ParticipatoryProcessStep" => %w(description),
-          "Decidim::Meetings::AgendaItem" => %w(description),
-          "Decidim::Meetings::Meeting" => %w(registration_terms description registration_email_custom_content closing_report)
-        }.each_with_object({}) do |(main_model, attributes), hash|
-          hash[main_model.constantize] = attributes
-        rescue NameError
-          hash
-        end
-      end
-    end
-  end
-end