decidim-decidim_awesome 0.10.2 → 0.11.2

data/app/controllers/concerns/decidim/decidim_awesome/proposals/proposal_votes_controller_override.rb

@@ -13,7 +13,7 @@ module Decidim
           # rubocop:enable Rails/LexicallyScopedActionFilter
 
           def create
-            enforce_permission_to :vote, :proposal, proposal: proposal
+            enforce_permission_to(:vote, :proposal, proposal:)
             @from_proposals_list = params[:from_proposals_list] == "true"
 
             Decidim::Proposals::VoteProposal.call(proposal, current_user) do
@@ -27,7 +27,7 @@ module Decidim
                   proposal: Decidim::Proposals::Proposal.where(component: current_component)
                 ).map(&:proposal)
 
-                expose(proposals: proposals)
+                expose(proposals:)
                 render :update_buttons_and_counters
               end
 
@@ -47,7 +47,7 @@ module Decidim
           end
 
           def current_vote
-            @current_vote ||= Decidim::Proposals::ProposalVote.find_by(author: current_user, proposal: proposal)
+            @current_vote ||= Decidim::Proposals::ProposalVote.find_by(author: current_user, proposal:)
           end
 
           def vote_manifest

data/app/controllers/decidim/decidim_awesome/admin/admin_accountability_controller.rb

@@ -5,7 +5,7 @@ module Decidim
     module Admin
       class AdminAccountabilityController < DecidimAwesome::Admin::ApplicationController
         include NeedsAwesomeConfig
-        include Decidim::DecidimAwesome::AdminAccountability::Admin::Filterable
+        include AdminAccountability::Admin::Filterable
 
         helper_method :admin_actions, :collection, :export_params, :global?, :global_users_missing_date
 
@@ -20,9 +20,9 @@ module Decidim
         def export
           filters = export_params[:q]
 
-          Decidim::DecidimAwesome::ExportAdminActionsJob.perform_later(current_user,
-                                                                       params[:format].to_s,
-                                                                       admin_actions.ransack(filters).result.ids)
+          ExportAdminActionsJob.perform_later(current_user,
+                                              params[:format].to_s,
+                                              admin_actions.ransack(filters).result.ids)
 
           redirect_back fallback_location: decidim_admin_decidim_awesome.admin_accountability_path,
                         notice: t("decidim.decidim_awesome.admin.admin_accountability.exports.notice")
@@ -39,11 +39,11 @@ module Decidim
         end
 
         def space_role_actions
-          @space_role_actions ||= Decidim::DecidimAwesome::PaperTrailVersion.space_role_actions(current_organization)
+          @space_role_actions ||= PaperTrailVersion.space_role_actions(current_organization)
         end
 
         def admin_role_actions
-          @admin_role_actions ||= Decidim::DecidimAwesome::PaperTrailVersion.in_organization(current_organization).admin_role_actions(params[:admin_role_type])
+          @admin_role_actions ||= PaperTrailVersion.in_organization(current_organization).admin_role_actions(PaperTrailVersion.safe_admin_role_type(params[:admin_role_type]))
         end
 
         def export_params
@@ -61,7 +61,7 @@ module Decidim
           return unless global?
 
           @global_users_missing_date ||= begin
-            first_version = Decidim::DecidimAwesome::PaperTrailVersion.where(item_type: "Decidim::UserBaseEntity").last
+            first_version = PaperTrailVersion.where(item_type: "Decidim::UserBaseEntity").last
             first_user = Decidim::User.first
             first_version.created_at if first_user && first_version && (first_version.created_at > first_user.created_at + 1.second)
           end

data/app/controllers/decidim/decidim_awesome/admin/application_controller.rb

@@ -9,6 +9,8 @@ module Decidim
       # Note that it inherits from `Decidim::Admin::Components::BaseController`, which
       # override its layout and provide all kinds of useful methods.
       class ApplicationController < Decidim::Admin::ApplicationController
+        layout "decidim/decidim_awesome/admin/application"
+
         def permission_class_chain
           [::Decidim::DecidimAwesome::Admin::Permissions] + super
         end

data/app/controllers/decidim/decidim_awesome/admin/checks_controller.rb

@@ -8,17 +8,17 @@ module Decidim
       # System compatibility analyzer
       class ChecksController < DecidimAwesome::Admin::ApplicationController
         include NeedsAwesomeConfig
+        include MaintenanceContext
+
         helper ConfigConstraintsHelpers
         helper SystemCheckerHelpers
 
-        layout "decidim/decidim_awesome/admin/application"
-
         helper_method :head, :admin_head, :head_addons, :admin_addons
 
         def migrate_images
           Decidim::DecidimAwesome::MigrateLegacyImagesJob.perform_later(current_organization.id)
           flash[:notice] = I18n.t("image_migrations_started", scope: "decidim.decidim_awesome.admin.checks.index")
-          redirect_to checks_path
+          redirect_to checks_maintenance_index_path
         end
 
         private
@@ -34,30 +34,34 @@ module Decidim
         def head_addons(part)
           case part
           when :CSS
-            ['<%= stylesheet_pack_tag "decidim_decidim_awesome", media: "all" %>',
+            ['<%= append_stylesheet_pack_tag "decidim_decidim_awesome", media: "all" %>',
              '<%= render(partial: "layouts/decidim/decidim_awesome/custom_styles") if awesome_custom_styles %>'].join("\n")
           when :JavaScript
             ['<%= render partial: "layouts/decidim/decidim_awesome/awesome_config" %>',
-             '<%= javascript_pack_tag "decidim_decidim_awesome" %>',
-             '<%= javascript_pack_tag "decidim_decidim_awesome_custom_fields" if awesome_proposal_custom_fields %>'].join("\n")
+             '<%= append_javascript_pack_tag "decidim_decidim_awesome", defer: false %>',
+             '<%= append_javascript_pack_tag "decidim_decidim_awesome_custom_fields" if awesome_proposal_custom_fields %>'].join("\n")
           end
         end
 
         def admin_addons(part)
           case part
           when :CSS
-            '<%= stylesheet_pack_tag "decidim_admin_decidim_awesome", media: "all" %>'
+            '<%= append_stylesheet_pack_tag "decidim_admin_decidim_awesome", media: "all" %>'
           when :JavaScript
-            ['<%= javascript_pack_tag "decidim_admin_decidim_awesome", defer: false %>',
-             '<%= javascript_pack_tag "decidim_decidim_awesome_custom_fields" if awesome_proposal_custom_fields %>'].join("\n")
+            ['<%= append_javascript_pack_tag "decidim_admin_decidim_awesome", defer: false %>',
+             '<%= append_javascript_pack_tag "decidim_decidim_awesome_custom_fields" if awesome_proposal_custom_fields %>'].join("\n")
           end
         end
 
         def render_template(partial)
-          render_to_string(partial: partial)
+          render_to_string(partial:)
         rescue ActionView::Template::Error => e
           flash.now[:alert] = "Partial [#{partial}] has thrown an error: #{e.message}"
         end
+
+        def current_view
+          "checks"
+        end
       end
     end
   end

data/app/controllers/decidim/decidim_awesome/admin/config_controller.rb

@@ -9,8 +9,6 @@ module Decidim
         include ConfigConstraintsHelpers
         helper ConfigConstraintsHelpers
 
-        layout "decidim/decidim_awesome/admin/application"
-
         helper_method :constraints_for, :users_for, :config_var
         before_action do
           enforce_permission_to :edit_config, configs
@@ -19,7 +17,7 @@ module Decidim
         def show
           @form = form(ConfigForm).from_params(organization_awesome_config)
 
-          redirect_to decidim_admin_decidim_awesome.checks_path unless config_var
+          redirect_to decidim_admin_decidim_awesome.checks_maintenance_index_path unless config_var
         end
 
         def update
@@ -43,8 +41,13 @@ module Decidim
               if (term = params[:term].to_s).present?
                 query = current_organization.users.order(name: :asc)
                 query = query.where("name ILIKE :term OR nickname ILIKE :term OR email ILIKE :term", term: "%#{term}%")
-
-                render json: query.all.collect { |u| { id: u.id, text: format_user_name(u) } }
+                render json: query.all.collect { |u|
+                               {
+                                 value: u.id,
+                                 text: format_user_name(u),
+                                 is_admin: u.read_attribute("admin")
+                               }
+                             }
               else
                 render json: []
               end
@@ -88,14 +91,12 @@ module Decidim
           DecidimAwesome.config.keys
         end
 
-        # rubocop:disable Style/OpenStructUse
         def users_for(ids_list)
-          Decidim::User.where(id: ids_list).map { |user| OpenStruct.new(text: format_user_name(user), id: user.id) }
+          Decidim::User.where(id: ids_list).map { |user| [format_user_name(user), user.id, { data: { is_admin: user.read_attribute("admin") } }] }
         end
-        # rubocop:enable Style/OpenStructUse
 
         def format_user_name(user)
-          "<span class='#{"is-admin" if user.read_attribute("admin")}'>#{user.name} (@#{user.nickname} - #{user.email})</span>"
+          "#{user.name} (@#{user.nickname} - #{user.email})"
         end
       end
     end

data/app/controllers/decidim/decidim_awesome/admin/constraints_controller.rb

@@ -6,21 +6,22 @@ module Decidim
       # Constraints configuration controller for config keys
       class ConstraintsController < DecidimAwesome::Admin::ApplicationController
         include NeedsAwesomeConfig
+        include Decidim::Headers::HttpCachingDisabler
         helper ConfigConstraintsHelpers
 
         layout false
         before_action do
-          enforce_permission_to :edit_config, constraint_key
-        end
-
-        def new
-          @form = form(ConstraintForm).from_params(filtered_params, setting: current_setting)
+          render plain: "no permissions for #{constraint_key}" unless allowed_to? :edit_config, constraint_key
         end
 
         def show
           @form = form(ConstraintForm).from_params(constraint.settings.merge(filtered_params))
         end
 
+        def new
+          @form = form(ConstraintForm).from_params(filtered_params, setting: current_setting)
+        end
+
         def create
           @form = form(ConstraintForm).from_params(params, setting: current_setting)
           CreateConstraint.call(@form) do
@@ -39,11 +40,11 @@ module Decidim
 
             on(:invalid) do |message|
               render json: {
-                id: params[:id],
-                key: current_setting.var,
-                message: I18n.t("decidim_awesome.admin.constraints.create.error", scope: "decidim"),
-                error: message
-              },
+                       id: params[:id],
+                       key: current_setting.var,
+                       message: I18n.t("decidim_awesome.admin.constraints.create.error", scope: "decidim"),
+                       error: message
+                     },
                      status: :unprocessable_entity
             end
           end
@@ -67,11 +68,11 @@ module Decidim
 
             on(:invalid) do |message|
               render json: {
-                id: params[:id],
-                key: constraint.awesome_config.var,
-                message: I18n.t("decidim_awesome.admin.constraints.update.error", scope: "decidim"),
-                error: message
-              },
+                       id: params[:id],
+                       key: constraint.awesome_config.var,
+                       message: I18n.t("decidim_awesome.admin.constraints.update.error", scope: "decidim"),
+                       error: message
+                     },
                      status: :unprocessable_entity
             end
           end
@@ -94,11 +95,11 @@ module Decidim
 
             on(:invalid) do |message|
               render json: {
-                id: params[:id],
-                key: constraint.awesome_config.var,
-                message: I18n.t("decidim_awesome.admin.constraints.destroy.error", scope: "decidim"),
-                error: message
-              },
+                       id: params[:id],
+                       key: constraint.awesome_config.var,
+                       message: I18n.t("decidim_awesome.admin.constraints.destroy.error", scope: "decidim"),
+                       error: message
+                     },
                      status: :unprocessable_entity
             end
           end
@@ -131,6 +132,8 @@ module Decidim
             :scoped_admins
           when /^proposal_custom_field_/
             :proposal_custom_fields
+          when /^proposal_private_custom_field_/
+            :proposal_private_custom_fields
           else
             key
           end

data/app/controllers/decidim/decidim_awesome/admin/custom_redirects_controller.rb

@@ -8,8 +8,6 @@ module Decidim
         include NeedsAwesomeConfig
         include ConfigConstraintsHelpers
 
-        layout "decidim/decidim_awesome/admin/application"
-
         before_action do
           enforce_permission_to :edit_config, :menu
         end
@@ -23,6 +21,10 @@ module Decidim
           @form = form(CustomRedirectForm).instance
         end
 
+        def edit
+          @form = form(CustomRedirectForm).from_model(redirect_item)
+        end
+
         def create
           @form = form(CustomRedirectForm).from_params(params)
           CreateCustomRedirect.call(@form) do
@@ -38,10 +40,6 @@ module Decidim
           end
         end
 
-        def edit
-          @form = form(CustomRedirectForm).from_model(redirect_item)
-        end
-
         def update
           @form = form(CustomRedirectForm).from_params(params)
           UpdateCustomRedirect.call(@form, redirect_item) do
@@ -63,7 +61,7 @@ module Decidim
               flash[:notice] = I18n.t("custom_redirects.destroy.success", scope: "decidim.decidim_awesome.admin")
             end
             on(:invalid) do |error|
-              flash[:alert] = I18n.t("custom_redirects.destroy.error", scope: "decidim.decidim_awesome.admin", error: error)
+              flash[:alert] = I18n.t("custom_redirects.destroy.error", scope: "decidim.decidim_awesome.admin", error:)
             end
           end
           redirect_to decidim_admin_decidim_awesome.custom_redirects_path
@@ -75,13 +73,11 @@ module Decidim
           origin, item = current_config.find { |origin, _| md5(origin) == params[:id] }
           raise ActiveRecord::RecordNotFound unless item
 
-          # rubocop:disable Style/OpenStructUse
           OpenStruct.new(
-            origin: origin,
+            origin:,
             destination: item["destination"],
             active: item["active"]
           )
-          # rubocop:enable Style/OpenStructUse
         end
 
         def current_config

data/app/controllers/decidim/decidim_awesome/admin/maintenance_controller.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+require "decidim/decidim_awesome/version"
+
+module Decidim
+  module DecidimAwesome
+    module Admin
+      # System compatibility analyzer
+      class MaintenanceController < DecidimAwesome::Admin::ApplicationController
+        include NeedsAwesomeConfig
+        include MaintenanceContext
+        include Decidim::Admin::Filterable
+        include ActionView::Helpers::DateHelper
+
+        helper ConfigConstraintsHelpers
+        helper_method :collection, :resource, :present, :time_ago
+
+        before_action do
+          enforce_permission_to :edit_config, :private_data, private_data:
+        end
+
+        def show
+          respond_to do |format|
+            format.json do
+              render json: private_data_finder.for(params[:resources].to_s.split(",")).map { |resource| present(resource) }
+            end
+            format.all do
+              render :show
+            end
+          end
+        end
+
+        def destroy_private_data
+          if private_data && private_data.total.to_i.positive?
+            Decidim::ActionLogger.log("destroy_private_data", current_user, resource, nil, count: private_data.total)
+
+            Lock.new(current_organization).get!(resource)
+            DestroyPrivateDataJob.set(wait: 1.second).perform_later(resource)
+          end
+          redirect_to decidim_admin_decidim_awesome.maintenance_path("private_data"),
+                      notice: I18n.t("destroying_private_data", scope: "decidim.decidim_awesome.admin.maintenance.private_data", title: present_private_data(resource).name)
+        end
+
+        private
+
+        def resource
+          @resource ||= Component.find_by(id: params[:resource_id])
+        end
+
+        def private_data
+          @private_data ||= present_private_data(resource) if resource
+        end
+
+        def collection
+          filtered_collection
+        end
+
+        def base_query
+          private_data_finder.query
+        end
+
+        def present(resource)
+          present_private_data(resource)
+        end
+
+        def private_data_finder
+          @private_data_finder ||= PrivateDataFinder.new
+        end
+
+        def time_ago
+          @time_ago ||= time_ago_in_words(Time.current - Decidim::DecidimAwesome.private_data_expiration_time)
+        end
+      end
+    end
+  end
+end

data/app/controllers/decidim/decidim_awesome/admin/menu_hacks_controller.rb

@@ -8,8 +8,6 @@ module Decidim
         include NeedsAwesomeConfig
         include ConfigConstraintsHelpers
 
-        layout "decidim/decidim_awesome/admin/application"
-
         helper ConfigConstraintsHelpers
         helper_method :current_items, :visibility_options, :target_options
 
@@ -23,6 +21,10 @@ module Decidim
           @form = form(MenuForm).instance
         end
 
+        def edit
+          @form = form(MenuForm).from_model(menu_item)
+        end
+
         def create
           @form = form(MenuForm).from_params(params)
           CreateMenuHack.call(@form, current_menu_name) do
@@ -38,10 +40,6 @@ module Decidim
           end
         end
 
-        def edit
-          @form = form(MenuForm).from_model(menu_item)
-        end
-
         def update
           @form = form(MenuForm).from_params(params)
           UpdateMenuHack.call(@form, current_menu_name) do
@@ -63,7 +61,7 @@ module Decidim
               flash[:notice] = I18n.t("menu_hacks.destroy.success", scope: "decidim.decidim_awesome.admin")
             end
             on(:invalid) do |error|
-              flash[:alert] = I18n.t("menu_hacks.destroy.error", scope: "decidim.decidim_awesome.admin", error: error)
+              flash[:alert] = I18n.t("menu_hacks.destroy.error", scope: "decidim.decidim_awesome.admin", error:)
             end
           end
           redirect_to decidim_admin_decidim_awesome.menu_hacks_path
@@ -71,7 +69,6 @@ module Decidim
 
         private
 
-        # rubocop:disable Style/OpenStructUse
         def menu_item
           item = current_items.find { |i| md5(i.url) == params[:id] }
           raise ActiveRecord::RecordNotFound unless item
@@ -85,7 +82,6 @@ module Decidim
             native?: !item.respond_to?(:overrided?)
           )
         end
-        # rubocop:enable Style/OpenStructUse
 
         def current_items
           @current_items ||= current_menu.items(include_invisible: true)
@@ -96,7 +92,7 @@ module Decidim
         end
 
         def current_menu_name
-          :menu
+          params[:menu_id].to_sym
         end
 
         def visibility_options

data/app/controllers/decidim/decidim_awesome/admin/proposal_custom_fields_controller.rb

@@ -6,9 +6,9 @@ module Decidim
       # Global configuration controller
       class ProposalCustomFieldsController < DecidimAwesome::Admin::ConfigController
         def create
-          CreateProposalCustomField.call(current_organization) do
+          CreateProposalCustomField.call(current_organization, config_var) do
             on(:ok) do |key|
-              flash[:notice] = I18n.t("config.create_proposal_custom_field.success", key: key, scope: "decidim.decidim_awesome.admin")
+              flash[:notice] = I18n.t("config.create_proposal_custom_field.success", key:, scope: "decidim.decidim_awesome.admin")
             end
 
             on(:invalid) do |message|
@@ -16,13 +16,13 @@ module Decidim
             end
           end
 
-          redirect_to decidim_admin_decidim_awesome.config_path(:proposal_custom_fields)
+          redirect_to decidim_admin_decidim_awesome.config_path(config_var)
         end
 
         def destroy
-          DestroyProposalCustomField.call(params[:key], current_organization) do
+          DestroyProposalCustomField.call(params[:key], current_organization, config_var) do
             on(:ok) do |key|
-              flash[:notice] = I18n.t("config.destroy_proposal_custom_field.success", key: key, scope: "decidim.decidim_awesome.admin")
+              flash[:notice] = I18n.t("config.destroy_proposal_custom_field.success", key:, scope: "decidim.decidim_awesome.admin")
             end
 
             on(:invalid) do |message|
@@ -30,7 +30,15 @@ module Decidim
             end
           end
 
-          redirect_to decidim_admin_decidim_awesome.config_path(:proposal_custom_fields)
+          redirect_to decidim_admin_decidim_awesome.config_path(config_var)
+        end
+
+        private
+
+        def config_var
+          return :proposal_private_custom_fields if params[:private] == "true"
+
+          :proposal_custom_fields
         end
       end
     end

data/app/controllers/decidim/decidim_awesome/admin/scoped_admins_controller.rb

@@ -8,7 +8,7 @@ module Decidim
         def create
           CreateScopedAdmin.call(current_organization) do
             on(:ok) do |key|
-              flash[:notice] = I18n.t("config.create_scoped_admin.success", key: key, scope: "decidim.decidim_awesome.admin")
+              flash[:notice] = I18n.t("config.create_scoped_admin.success", key:, scope: "decidim.decidim_awesome.admin")
             end
 
             on(:invalid) do |message|
@@ -22,7 +22,7 @@ module Decidim
         def destroy
           DestroyScopedAdmin.call(params[:key], current_organization) do
             on(:ok) do |key|
-              flash[:notice] = I18n.t("config.destroy_scoped_admin.success", key: key, scope: "decidim.decidim_awesome.admin")
+              flash[:notice] = I18n.t("config.destroy_scoped_admin.success", key:, scope: "decidim.decidim_awesome.admin")
             end
 
             on(:invalid) do |message|

data/app/controllers/decidim/decidim_awesome/admin/scoped_styles_controller.rb

@@ -8,7 +8,7 @@ module Decidim
         def create
           CreateScopedStyle.call(current_organization) do
             on(:ok) do |key|
-              flash[:notice] = I18n.t("config.create_scoped_style.success", key: key, scope: "decidim.decidim_awesome.admin")
+              flash[:notice] = I18n.t("config.create_scoped_style.success", key:, scope: "decidim.decidim_awesome.admin")
             end
 
             on(:invalid) do |message|
@@ -22,7 +22,7 @@ module Decidim
         def destroy
           DestroyScopedStyle.call(params[:key], current_organization) do
             on(:ok) do |key|
-              flash[:notice] = I18n.t("config.destroy_scoped_style.success", key: key, scope: "decidim.decidim_awesome.admin")
+              flash[:notice] = I18n.t("config.destroy_scoped_style.success", key:, scope: "decidim.decidim_awesome.admin")
             end
 
             on(:invalid) do |message|

data/app/controllers/decidim/decidim_awesome/blank_component_controller.rb

@@ -6,13 +6,18 @@ module Decidim
     class BlankComponentController < Decidim::Components::BaseController
       # just redirects to settings
       def settings
-        redirect_to EngineRouter.admin_proxy(component.participatory_space).edit_component_path(id: component)
+        redirect_to EngineRouter.admin_proxy(current_component.participatory_space).edit_component_path(id: current_component)
       end
 
       private
 
-      def component
-        Decidim::Component.find(params[:component_id])
+      def set_component_breadcrumb_item
+        context_breadcrumb_items << {
+          label: current_component.name,
+          url: EngineRouter.admin_proxy(current_component.participatory_space).edit_component_path(id: current_component),
+          active: false,
+          resource: current_component
+        }
       end
     end
   end

data/app/controllers/decidim/decidim_awesome/editor_images_controller.rb

@@ -2,7 +2,7 @@
 
 module Decidim
   module DecidimAwesome
-    # This controller handles image uploads for the hacked Quill editor
+    # This controller handles image uploads for the Tiptap editor
     class EditorImagesController < DecidimAwesome::ApplicationController
       include FormFactory
       include NeedsAwesomeConfig
@@ -11,14 +11,14 @@ module Decidim
       rescue_from Decidim::ActionForbidden, with: :ajax_user_has_no_permission
 
       def create
-        enforce_permission_to :create, :editor_image, awesome_config: awesome_config
+        enforce_permission_to(:create, :editor_image, awesome_config:)
 
         @form = form(EditorImageForm).from_params(form_values)
         CreateEditorImage.call(@form) do
           on(:ok) do |image|
             url = image.attached_uploader(:file).path
             url = "#{request.base_url}#{url}" unless url&.start_with?("http")
-            render json: { url: url, message: I18n.t("decidim_awesome.editor_images.create.success", scope: "decidim") }
+            render json: { url:, message: I18n.t("decidim_awesome.editor_images.create.success", scope: "decidim") }
           end
 
           on(:invalid) do |_message|

data/app/controllers/decidim/decidim_awesome/iframe_component/iframe_controller.rb

@@ -5,7 +5,8 @@ module Decidim
     module IframeComponent
       class IframeController < DecidimAwesome::BlankComponentController
         ALLOWED_ATTRIBUTES = %w(src width height frameborder title allow allowpaymentrequest name referrerpolicy sandbox srcdoc allowfullscreen).freeze
-        helper_method :iframe, :remove_margins?, :viewport_width?
+        helper_method :iframe, :viewport_width?
+        before_action :add_additional_csp_directives, only: :show
 
         def show; end
 
@@ -17,16 +18,28 @@ module Decidim
 
         def sanitize(html)
           sanitizer = Rails::Html::SafeListSanitizer.new
-          sanitizer.sanitize(html, tags: %w(iframe), attributes: ALLOWED_ATTRIBUTES)
-        end
+          partially_sanitized_html = sanitizer.sanitize(html, tags: %w(iframe), attributes: ALLOWED_ATTRIBUTES)
+
+          document = Nokogiri::HTML::DocumentFragment.parse(partially_sanitized_html)
+          document.css("iframe").each do |iframe|
+            iframe["srcdoc"] = Loofah.fragment(iframe["srcdoc"]).scrub!(:prune).to_s if iframe["srcdoc"]
+          end
 
-        def remove_margins?
-          current_component.settings.no_margins
+          document.to_s
         end
 
         def viewport_width?
           current_component.settings.viewport_width
         end
+
+        def add_additional_csp_directives
+          iframe_urls = Nokogiri::HTML::DocumentFragment.parse(iframe).children.select { |x| x.name == "iframe" }.filter_map { |x| x.attribute("src")&.value }
+          return if iframe_urls.blank?
+
+          iframe_urls.each do |url|
+            content_security_policy.append_csp_directive("frame-src", url)
+          end
+        end
       end
     end
   end