decidim-decidim_awesome 0.12.0 → 0.12.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 29689a9ea7f9c930c3683f13c34ecf797b125dc8241ed704ca44174085d59a00
-  data.tar.gz: f3552ebb84814f2f854f7a9b9bb1f80a0d8b3739cd1fd9626c3cbc4f6a7c7a6e
+  metadata.gz: 85eb621adc0f8d42ade17d24162061418885a2d566fab94af0ede1a195c1cf06
+  data.tar.gz: ae6688521eb2a8f81d02f67790ea25e6ca1be0466e0874d6f624431b65a73c31
 SHA512:
-  metadata.gz: a521a9f071f71436ad251a7ce20c9a7d6202fe83518e291927ce4d9affdbc138238b2e5b618b505db66882beb3af2775f90993ca501c290b7f4152990a38d456
-  data.tar.gz: 28c137dced1adb31664299f427b55257877f56b4d06041de46a0194fb14b976adf6375dad4a17063ff155031ab4ba6ff6345b4bf2066bcfa9102a3f00a7a482a
+  metadata.gz: b4b183a80725bc02a7c518f1de438eb182e2b1108c4d2ab935d47cd959abf8890da6d587990dc5de64194a69513bf7d758c9d763084c853ae83b62998c0d850c
+  data.tar.gz: 75aa3a809688d9d5f8a4cfa51a2cea964b1deeb214d9ad774a6869dadc6c81bcf640182ec9577a7b3dd840f5a74916a73c28e1c1913f03ed30ab8b5569605bab

data/CHANGELOG.md

@@ -1,6 +1,51 @@
 CHANGELOG
 =========
 
+v0.12.4
+-------
+Compatibility:
+  - Decidim 0.29.x
+
+Features:
+  - Added application context for config constraints (whether the user is logged or not)
+  - Allow to granular permissions to forced verifications.
+    **NOTE** Config var `force_authorization_after_login` has changed to `force_authorizations`
+  - Fix use of Hashcash in loginModals
+  - Fix validation overrides in the admin for proposals
+
+v0.12.3
+-------
+
+Compatibility:
+  - Decidim 0.29.x
+
+Features:
+  - Fix custom styles loading order
+  - Fix for awesome map no loading in a component
+  - Fix "other" options in checkbox/radio custom fields
+  - Added Mobile Menu Override
+
+v0.12.2
+-------
+
+Compatibility:
+  - Decidim 0.29.x
+
+Features:
+  - Added HashCash anti-bot mechanism
+  - Fixed multi-tenant crossover in admin accountability
+
+v0.12.1
+-------
+
+Compatibility:
+  - Decidim 0.29.x
+
+Feature:
+  - Added formBuilder languages controller to avoid external CDN
+  - Fix cache hash in the global menu override
+  - Fix crash on updating empty boxes for scoped admins
+
 v0.12.0
 -------
 Compatibility:

data/README.md

@@ -121,21 +121,8 @@ Technically, the content is stored in the database as an XML document compatible
 ![Custom fields screenshot](examples/custom-fields-2.png)
 ![Custom fields screenshot](examples/custom-fields-1.gif)
 
-Note that the custom fields are build using the jQuery library [formBuilder](https://formbuilder.online). This package is included in Decidim Awesome but the i18n translations are not. By default they are dynamically downloaded from the CDN https://cdn.jsdelivr.net/npm/formbuilder-languages@1.1.0/.
-If you wish to provide an alternative place for those files, you can configure the variable `form_builder_langs_location` in an initializer:
 
-```ruby
-# config/initializers/awesome_defaults.rb
-
-# A URL where to obtain the translations for the FormBuilder component
-# you can a custom place if you are worried about the CDN geolocation
-# Download them from https://github.com/kevinchappell/formBuilder-languages
-
-# For instance, copy them to your /public/fb_locales/ directory and set the path here:
-Decidim::DecidimAwesome.configure do |config|
-  config.form_builder_langs_location = "/fb_locales/"
-end
-```
+Translations for this feature are extracted from the [NPM formBuilder-languages](https://github.com/kevinchappell/formBuilder-languages).
 
 ##### 11.1. GraphQL types for custom fields
 
@@ -400,7 +387,7 @@ Admins can manage these settings in the Awesome admin panel under the "Verificat
 ![Forced verifications admin side](examples/forced_verifications_admin.png)
 ![Forced verifications public side](examples/forced_verifications_public.png)
 
-Note that some pages are allowed, you can even configure which controller are allowed by creating an initializer ("required_authorizations" and "authorizations" are always allowed):
+You can configure which controller are allowed by creating an initializer (some controllers like the login, terms and conditions, etc. are always allowed):
 
 ```ruby
 # config/initializers/decidim_awesome.rb
@@ -425,6 +412,19 @@ System configuration:
 ![Removing an authorization](examples/manual_verifications_2.png)
 ![Creating an authorization](examples/manual_verifications_3.png)
 
+#### 22. HashCash Anti-Bot login/registration
+
+This feature adds a HashCash-based anti-bot mechanism to the login and registration forms. HashCash is a proof-of-work system originally designed to limit email spam and denial-of-service attacks. When enabled, users must solve a computational puzzle (a "stamp") before submitting the form, making automated attacks significantly harder.
+
+The integration leverages the [ActiveHashcash](https://github.com/BaseSecrete/active_hashcash) gem to generate and verify HashCash stamps (although with some customizations). For more details on the HashCash protocol, see the [official documentation](http://www.hashcash.org/docs/hashcash.html).
+
+When this feature is active, each login or registration attempt requires a valid HashCash stamp, effectively reducing the risk of automated bot submissions.
+
+Note this feature is **disabled by default**, admins can enabled it under the "Surveys & Forms" menu in the Decidim Awesome admin dashboard.
+
+![Hashcash admin config](examples/haschcash_admin.png)
+![Hashcash public rendering](examples/hashcash_public.png)
+
 #### To be continued...
 
 We're not done! Please check the [issues](/decidim-ice/decidim-module-decidim_awesome/issues) (and participate) to see what's on our mind
@@ -567,6 +567,16 @@ can add the environment variables to the root directory of the project in a file
 named `.rbenv-vars`. If these are defined for the environment, you can omit
 defining these in the commands shown above.
 
+### Updating formBuilder languages
+
+There's a rake task to update the translations of the custom field's form builder interface:
+
+```
+bundle exec rake update_form_builder_i18n
+```
+
+This updates the `app/packs/src/vendor/form_builder_langs` folder.
+
 ### Code Styling
 
 Please follow the code styling defined by the different linters that ensure we

data/Rakefile

@@ -6,6 +6,7 @@ require "fileutils"
 def install_module(path)
   Dir.chdir(path) do
     system("bundle exec rake decidim_decidim_awesome:install:migrations")
+    system("bundle exec rake active_hashcash:install:migrations")
     system("bundle exec rake db:migrate")
   end
 end
@@ -55,3 +56,14 @@ task :development_app do
   override_webpacker_config_files("development_app")
   seed_db("development_app")
 end
+
+desc "Update languages for custom fields"
+task :update_form_builder_i18n do
+  puts "Updating languages for custom fields from formbuilder-languages NPM package..."
+  system("npm install formbuilder-languages")
+  puts "Copying files..."
+
+  Dir.glob("node_modules/formbuilder-languages/*.lang").each do |file_lang|
+    FileUtils.cp(file_lang, "app/packs/src/vendor/form_builder_langs", verbose: true)
+  end
+end

data/app/cells/concerns/decidim/decidim_awesome/global_menu_cell_override.rb

@@ -6,14 +6,26 @@ module Decidim
       extend ActiveSupport::Concern
 
       included do
+        private
+
         def cache_hash
-          [
+          @decidim_awesome_cache_hash ||= [
             "decidim/content_blocks/global_menu",
             current_organization.cache_key_with_version,
             I18n.locale,
-            awesome_config[:home_content_block_menu].to_s
+            *extra_cache_keys
           ].join(Decidim.cache_key_separator)
         end
+
+        def extra_cache_keys
+          [].tap do |array|
+            array << awesome_config[:home_content_block_menu].to_s
+            if defined?(current_user) && current_user
+              array << current_user.id
+              array << Decidim::Authorization.find_by(user: current_user)&.cache_key_with_version
+            end
+          end
+        end
       end
     end
   end

data/app/cells/concerns/decidim/decidim_awesome/proposal_l_cell_override.rb

@@ -15,10 +15,11 @@ module Decidim
         end
 
         def cache_hash
-          all_extra_fields = memoize("extra_fields")
-          extra_fields = all_extra_fields ? all_extra_fields[resource.id] : resource.extra_fields
-
-          @cache_hash ||= "#{decidim_original_cache_hash}#{Decidim.cache_key_separator}#{extra_fields&.vote_weight_totals}"
+          @decidim_awesome_cache_hash ||= begin
+            all_extra_fields = memoize("extra_fields")
+            extra_fields = all_extra_fields ? all_extra_fields[resource.id] : resource.extra_fields
+            "#{decidim_original_cache_hash}#{Decidim.cache_key_separator}#{extra_fields&.vote_weight_totals}"
+          end
         end
       end
     end

data/app/cells/decidim/decidim_awesome/voting/voting_cards_proposal/show.erb

@@ -12,9 +12,9 @@
                                   voted_for?(0) ? t("decidim.decidim_awesome.voting.voting_cards.abstained") : proposal.manifest.label_for(0),
                                   proposal_vote_path(0),
                                   link_options(0).merge({
-                                    title: t("decidim.decidim_awesome.voting.voting_cards.voting_for", proposal: sanitized_title, type: proposal.manifest.label_for(0)),
-                                    class: "button button__sm button__transparent-secondary mb-4 vote-action abstain-button #{classes_for(0)}"
-                                    }) %>
+                                                          title: t("decidim.decidim_awesome.voting.voting_cards.voting_for", proposal: sanitized_title, type: proposal.manifest.label_for(0)),
+                                                          class: "button button__sm button__transparent-secondary mb-4 vote-action abstain-button #{classes_for(0)}"
+                                                        }) %>
   <% end %>
 
   <% if voted_for_any? && !current_settings.votes_blocked? %>

data/app/cells/decidim/decidim_awesome/voting/voting_cards_proposal/vote_block_for.erb

@@ -9,7 +9,7 @@
       <span class="vote-label"><%= proposal.manifest.label_for(weight) %></span>
       <%= content_tag :svg, role: "img" do
         content_tag(:title, t("decidim.decidim_awesome.voting.voting_cards.voting_for", proposal: sanitized_title, type: proposal.manifest.label_for(weight))) +
-        content_tag(:use, "", "href" => svg_path(weight))
+          content_tag(:use, "", "href" => svg_path(weight))
       end %>
     <% end %>
   </div>

data/app/commands/concerns/decidim/decidim_awesome/admin/needs_constraint_helpers.rb

@@ -6,12 +6,46 @@ module Decidim
       module NeedsConstraintHelpers
         private
 
-        def create_constraint_never(var)
-          settings = { "participatory_space_manifest" => "none" }
-          subconfig = AwesomeConfig.find_or_initialize_by(var: "#{var}_#{@ident}", organization: @organization)
+        attr_reader :organization, :config_var
+
+        def ident
+          @ident ||= rand(36**8).to_s(36)
+        end
+
+        def find_var
+          @find_var ||= AwesomeConfig.find_or_initialize_by(var: config_var, organization:)
+        end
+
+        def find_sub_var
+          @find_sub_var ||= AwesomeConfig.find_or_initialize_by(var: "#{config_var.to_s.singularize}_#{ident}", organization:)
+        end
+
+        def create_array_config!(default_attributes = nil)
+          find_var.value = [] unless find_var.value.is_a?(Array)
+          find_var.value << default_attributes if default_attributes
+          find_var.save!
+          find_var
+        end
+
+        def create_hash_config!(default_attributes = nil)
+          find_var.value = {} unless find_var.value.is_a?(Hash)
+          find_var.value[ident] = default_attributes if default_attributes
+          find_var.save!
+          find_var
+        end
+
+        def destroy_hash_ident!
+          find_var.value.except!(ident)
+          find_var.save!
+
+          # remove associated sub var (dependents will be destroyed automatically via ActiveRecord triggers)
+          find_sub_var.destroy! if find_sub_var.present?
+        end
+
+        def create_constraint_never!
           @constraint = ConfigConstraint.create!(
-            awesome_config: subconfig,
-            settings:
+            awesome_config: find_sub_var,
+            settings: { "participatory_space_manifest" => "none" }
           )
         end
 

data/app/commands/decidim/decidim_awesome/admin/create_authorization_group.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module Decidim
+  module DecidimAwesome
+    module Admin
+      class CreateAuthorizationGroup < Command
+        include NeedsConstraintHelpers
+        # Public: Initializes the command.
+        #
+        def initialize(organization, config_var = :force_authorizations)
+          @organization = organization
+          @config_var = config_var
+        end
+
+        # Executes the command. Broadcasts these events:
+        #
+        # - :ok when everything is valid.
+        # - :invalid if we couldn't proceed.
+        #
+        # Returns nothing.
+        def call
+          create_hash_config!(attributes)
+
+          create_constraint_never!
+
+          broadcast(:ok, ident)
+        rescue StandardError => e
+          broadcast(:invalid, e.message)
+        end
+
+        private
+
+        def attributes
+          {
+            "authorization_handlers" => {},
+            "force_authorization_help_text" => {}
+          }
+        end
+      end
+    end
+  end
+end

data/app/commands/decidim/decidim_awesome/admin/create_custom_redirect.rb

@@ -4,11 +4,14 @@ module Decidim
   module DecidimAwesome
     module Admin
       class CreateCustomRedirect < Command
+        include NeedsConstraintHelpers
         # Public: Initializes the command.
         #
         def initialize(form)
           @form = form
-          @redirections = AwesomeConfig.find_or_initialize_by(var: :custom_redirects, organization: form.current_organization)
+          @ident = form.to_params[0]
+          @organization = form.current_organization
+          @config_var = :custom_redirects
         end
 
         # Executes the command. Broadcasts these events:
@@ -21,7 +24,8 @@ module Decidim
           return broadcast(:invalid) if form.invalid?
           return broadcast(:invalid, I18n.t("custom_redirects.origin_exists", scope: "decidim.decidim_awesome.admin")) if url_exists?
 
-          create_redirection!
+          create_hash_config!(form.to_params[1])
+
           broadcast(:ok)
         rescue StandardError => e
           broadcast(:invalid, e.message)
@@ -29,21 +33,13 @@ module Decidim
 
         private
 
-        attr_reader :form, :redirections
-
-        delegate :to_params, to: :form
-
-        def create_redirection!
-          redirections.value = {} unless redirections.value.is_a? Hash
-          redirections.value[to_params[0]] = to_params[1]
-          redirections.save!
-        end
+        attr_reader :form
 
         def url_exists?
-          return false unless redirections
-          return false unless redirections.value.is_a? Hash
+          return false unless find_var
+          return false unless find_var.value.is_a? Hash
 
-          redirections.value[form.origin].present?
+          find_var.value[form.origin].present?
         end
       end
     end

data/app/commands/decidim/decidim_awesome/admin/create_menu_hack.rb

@@ -4,11 +4,13 @@ module Decidim
   module DecidimAwesome
     module Admin
       class CreateMenuHack < Command
+        include NeedsConstraintHelpers
         # Public: Initializes the command.
         #
         def initialize(form, menu_name)
           @form = form
-          @menu = AwesomeConfig.find_or_initialize_by(var: menu_name, organization: form.current_organization)
+          @config_var = menu_name
+          @organization = form.current_organization
         end
 
         # Executes the command. Broadcasts these events:
@@ -21,22 +23,21 @@ module Decidim
           return broadcast(:invalid) if form.invalid?
           return broadcast(:invalid, I18n.t("menu_hacks.url_exists", scope: "decidim.decidim_awesome.admin")) if url_exists?
 
-          menu.value = [] unless menu.value.is_a? Array
-          menu.value << to_params
-          menu.save!
-          broadcast(:ok, menu)
+          create_array_config!(to_params)
+
+          broadcast(:ok, find_var)
         rescue StandardError => e
           broadcast(:invalid, e.message)
         end
 
         private
 
-        attr_reader :form, :menu
+        attr_reader :form
 
         def url_exists?
-          return false unless menu
+          return false unless find_var
 
-          menu.value&.detect { |i| i["url"] == form.url.gsub(/\?.*/, "") }
+          find_var.value&.detect { |i| i["url"] == form.url.gsub(/\?.*/, "") }
         end
 
         def to_params

data/app/commands/decidim/decidim_awesome/admin/create_proposal_custom_field.rb

@@ -10,7 +10,6 @@ module Decidim
         #
         def initialize(organization, config_var = :proposal_custom_fields)
           @organization = organization
-          @ident = rand(36**8).to_s(36)
           @config_var = config_var
         end
 
@@ -21,15 +20,11 @@ module Decidim
         #
         # Returns nothing.
         def call
-          fields = AwesomeConfig.find_or_initialize_by(var: @config_var, organization: @organization)
-          fields.value = {} unless fields.value.is_a? Hash
-          # TODO: prevent (unlikely) colisions with exisiting values
-          fields.value[@ident] = default_definition
-          fields.save!
+          create_hash_config!(default_definition)
 
-          create_constraint_never(@config_var == :proposal_custom_fields ? :proposal_custom_field : :proposal_private_custom_field)
+          create_constraint_never!
 
-          broadcast(:ok, @ident)
+          broadcast(:ok, ident)
         rescue StandardError => e
           broadcast(:invalid, e.message)
         end

data/app/commands/decidim/decidim_awesome/admin/create_scoped_admin.rb

@@ -10,7 +10,7 @@ module Decidim
         #
         def initialize(organization)
           @organization = organization
-          @ident = rand(36**8).to_s(36)
+          @config_var = :scoped_admins
         end
 
         # Executes the command. Broadcasts these events:
@@ -20,15 +20,11 @@ module Decidim
         #
         # Returns nothing.
         def call
-          admins = AwesomeConfig.find_or_initialize_by(var: :scoped_admins, organization: @organization)
-          admins.value = {} unless admins.value.is_a? Hash
-          # TODO: prevent (unlikely) colisions with exisiting values
-          admins.value[@ident] = []
-          admins.save!
+          create_hash_config!([])
 
-          create_constraint_never(:scoped_admin)
+          create_constraint_never!
 
-          broadcast(:ok, @ident)
+          broadcast(:ok, ident)
         rescue StandardError => e
           broadcast(:invalid, e.message)
         end

data/app/commands/decidim/decidim_awesome/admin/create_scoped_style.rb

@@ -4,11 +4,11 @@ module Decidim
   module DecidimAwesome
     module Admin
       class CreateScopedStyle < Command
+        include NeedsConstraintHelpers
         # Public: Initializes the command.
         #
         def initialize(organization, config_var = :scoped_styles)
           @organization = organization
-          @ident = rand(36**8).to_s(36)
           @config_var = config_var
         end
 
@@ -19,13 +19,9 @@ module Decidim
         #
         # Returns nothing.
         def call
-          styles = AwesomeConfig.find_or_initialize_by(var: @config_var, organization: @organization)
-          styles.value = {} unless styles.value.is_a? Hash
-          # TODO: prevent (unlikely) colisions with exisiting values
-          styles.value[@ident] = ""
-          styles.save!
+          create_hash_config!("")
 
-          broadcast(:ok, @ident)
+          broadcast(:ok, ident)
         rescue StandardError => e
           broadcast(:invalid, e.message)
         end

data/app/commands/decidim/decidim_awesome/admin/destroy_authorization_group.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module Decidim
+  module DecidimAwesome
+    module Admin
+      class DestroyAuthorizationGroup < Command
+        include NeedsConstraintHelpers
+        # Public: Initializes the command.
+        #
+        # key - the key to destroy inside force_authorizations
+        # organization - the organization to which the config belongs
+        def initialize(key, organization, config_var = :force_authorizations)
+          @ident = key
+          @organization = organization
+          @config_var = config_var
+        end
+
+        # Executes the command. Broadcasts these events:
+        #
+        # - :ok when everything is valid.
+        # - :invalid if we couldn't proceed.
+        #
+        # Returns nothing.
+        def call
+          return broadcast(:invalid, "Not a hash") unless find_var&.value.is_a?(Hash)
+          return broadcast(:invalid, "#{ident} key invalid") unless find_var.value.has_key?(ident)
+
+          destroy_hash_ident!
+
+          broadcast(:ok, ident)
+        rescue StandardError => e
+          broadcast(:invalid, e.message)
+        end
+      end
+    end
+  end
+end

data/app/commands/decidim/decidim_awesome/admin/destroy_custom_redirect.rb

@@ -4,14 +4,15 @@ module Decidim
   module DecidimAwesome
     module Admin
       class DestroyCustomRedirect < Command
+        include NeedsConstraintHelpers
         # Public: Initializes the command.
         #
-        # item - the redirections item to destroy
+        # item - the redirects item to destroy
         # organization
         def initialize(item, organization)
           @item = item
           @organization = organization
-          @redirections = AwesomeConfig.find_by(var: :custom_redirects, organization:)
+          @config_var = :custom_redirects
         end
 
         # Executes the command. Broadcasts these events:
@@ -23,23 +24,23 @@ module Decidim
         def call
           return broadcast(:invalid) unless url_exists?
 
-          redirections.value&.except!(item.origin)
-          redirections.save!
+          find_var.value&.except!(item.origin)
+          find_var.save!
 
-          broadcast(:ok, @item)
+          broadcast(:ok, item)
         rescue StandardError => e
           broadcast(:invalid, e.message)
         end
 
         private
 
-        attr_reader :organization, :item, :redirections
+        attr_reader :item
 
         def url_exists?
-          return false unless redirections
-          return false unless redirections.value.is_a? Hash
+          return false unless find_var
+          return false unless find_var.value.is_a? Hash
 
-          redirections.value[item.origin].present?
+          find_var.value[item.origin].present?
         end
       end
     end

data/app/commands/decidim/decidim_awesome/admin/destroy_menu_hack.rb

@@ -4,6 +4,7 @@ module Decidim
   module DecidimAwesome
     module Admin
       class DestroyMenuHack < Command
+        include NeedsConstraintHelpers
         # Public: Initializes the command.
         #
         # item - the menu item to destroy
@@ -11,7 +12,7 @@ module Decidim
         def initialize(item, menu_name, organization)
           @item = item
           @organization = organization
-          @menu = AwesomeConfig.find_by(var: menu_name, organization:)
+          @config_var = menu_name
         end
 
         # Executes the command. Broadcasts these events:
@@ -23,8 +24,8 @@ module Decidim
         def call
           return broadcast(:invalid) unless url_exists?
 
-          menu.value&.reject! { |i| i["url"] == item.url }
-          menu.save!
+          find_var.value&.reject! { |i| i["url"] == item.url }
+          find_var.save!
 
           broadcast(:ok, @item)
         rescue StandardError => e
@@ -33,13 +34,13 @@ module Decidim
 
         private
 
-        attr_reader :organization, :item, :menu
+        attr_reader :organization, :item
 
         def url_exists?
-          return false unless menu
-          return false unless menu.value.is_a? Array
+          return false unless find_var
+          return false unless find_var.value.is_a? Array
 
-          menu.value&.detect { |i| i["url"] == item.url }
+          find_var.value&.detect { |i| i["url"] == item.url }
         end
       end
     end