decidim-department_admin 0.8.0

data/README.md

@@ -0,0 +1,132 @@
+# Decidim::DepartmentAdmin
+
+This Dedicim's module produces a new \"department admin\" role which restricts the permissions of an Admin into participatory spaces of a given Area.
+
+The module currently only affects the following participatory spaces and admin blocks:
+
+- Participatory Processes: administer processes with the same area as the user's one.
+- Assemblies: administer assemblies with the same area as the user's one.
+- Newsletters: send newsletters to participants in the spaces with the same area as user's one.
+- Conferences: administer conferences with the same area as the user's one.
+
+## Usage
+
+DepartmentAdmin will only affect users with the "department admin" role. The rest of the users should behave as usual.
+
+To create a user with a department admin role, go to admin panel/PARTICIPANTS/Administrators/New Participant. There, select the "Administrador de departament" role, and then the area. Finally Invite the user.
+
+## Installation
+
+Add this line to your application's Gemfile if you would like to always have the latest (edge) version:
+
+```ruby
+gem "decidim-department_admin", git: "https://github.com/gencat/decidim-module-department-admin.git"
+```
+
+Or, add a line like the following to your application's Gemfile if you would like to have the latest stable from the version of your choice, in this case `0.4.x`:
+
+```ruby
+gem "decidim-department_admin", "~> 0.4.2", git: "https://github.com/gencat/decidim-module-department-admin.git"
+```
+
+Edit your app's `config/application.rb` file to enforce railties ordering:
+```ruby
+module YourDecidimApp
+  class Application < Rails::Application
+
+...
+    config.railties_order = [:main_app, ::Decidim::DepartmentAdmin::Engine, :all]
+...
+
+  end
+end
+```
+
+And then execute:
+
+```bash
+bundle
+bundle exec rails decidim_department_admin:install:migrations
+bundle exec rails db:migrate
+```
+
+## Overrides
+Beware that this module overrides many core features of Decidim. Thus, modified features may have required to override, change or extend source code from Decidim.
+
+Most of the times the overrides and modifications will be found in `app/decorators`.
+
+## How it works
+Although some other artifacts exist, the key places to search for in this module are 3:
+- lib/decidim/department_admin/engine.rb
+- app/permissions/decidim/department_admin/permissions.rb
+- app/decorators
+
+### Engine
+The mission of the Engine in this module is to reconfigure the permissions_registry for some artifacts so that they depend upon `Decidim::DepartmentAdmin::Permissions` instead of their standard permissions chain.
+
+The engine also configures de `app/decorators` directory to be loaded during rails initialization.
+
+### Custom Permissions
+The `Decidim::DepartmentAdmin::Permissions` class is the responsible to allow all permissions related with the "departmen admin" role.
+
+`Decidim::Assemblies::ParticipatorySpacePermissions`, `Decidim::ParticipatoryProcesses::ParticipatorySpacePermissions` and
+`Decidim::Conferences::ParticipatorySpacePermissions` are subclassing `Decidim::DepartmentAdmin::Permissions` in order to force the permissions classes where they delegate.
+
+### Decorators
+Inside `app/decorators` there are all the tricks done in order for department_admin module to work.
+
+All decorator artifacts are extensions or modifications to the standard Decidim behavior.
+
+### Temporal fixes
+
+#### Temporal fix: added & in case role_name check.
+
+Currently, in the file:
+- lib/decidim/participatory_space_resourceable.rb
+we have overridden `user_role_config_for` method, in role_name case check.
+
+The reason for this, is that this method is called from `user_role_config` in `Decidim::Admin::UserRolesHelper` file, with second param `role_name` that can be nil as it is called as `role&.role`.
+This happens only when logged in user is Departmental Admin type and this can be possible because this module is only available in this repo.
+So, to avoid error when role_name passed is nil, we override this param check with a simple `role_name&.to_sym`
+
+In next versions, this issue will be patched in `decidim/decidim`, so this override could be removed:
+- lib/decidim/participatory_space_resourceable.rb
+
+### Run tests
+
+Create a dummy app in your application (if not present):
+
+```bash
+bin/rails decidim:generate_external_test_app
+cd spec/decidim_dummy_app/
+bundle exec rails decidim_department_admin:install:migrations
+RAILS_ENV=test bundle exec rails db:migrate
+sed -ie '/^  class Application < Rails::Application/a config.railties_order = [:main_app, ::Decidim::DepartmentAdmin::Engine, :all]' config/application.rb
+```
+
+This last line modifies dummy_app's `config/application.rb` file to enforce railties ordering, adding:
+```ruby
+module DecidimDepartmentAdminTestApp
+  class Application < Rails::Application
+    config.railties_order = [:main_app, ::Decidim::DepartmentAdmin::Engine, :all]
+...
+
+  end
+end
+```
+
+And run tests:
+
+```bash
+bundle exec rspec spec
+```
+
+## Contributing
+
+See [Decidim](https://github.com/decidim/decidim).
+
+## License
+
+This engine is distributed under the GNU AFFERO GENERAL PUBLIC LICENSE.
+
+Authored by [CodiTramuntana](http://coditramuntana.com).

data/Rakefile

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+require "decidim/dev/common_rake"
+
+desc "Generates a dummy app for testing"
+task test_app: "decidim:generate_external_test_app"
+
+desc "Generates a development app."
+task development_app: "decidim:generate_external_development_app"

data/app/controllers/decidim/department_admin/admin/application_controller.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Decidim
+  module DepartmentAdmin
+    module Admin
+      # This controller is the abstract class from which all other controllers of
+      # this engine inherit.
+      #
+      # Note that it inherits from `Decidim::Admin::Components::BaseController`, which
+      # override its layout and provide all kinds of useful methods.
+      class ApplicationController < Decidim::Admin::Components::BaseController
+      end
+    end
+  end
+end

data/app/controllers/decidim/department_admin/application_controller.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Decidim
+  module DepartmentAdmin
+    # This controller is the abstract class from which all other controllers of
+    # this engine inherit.
+    #
+    # Note that it inherits from `Decidim::Components::BaseController`, which
+    # override its layout and provide all kinds of useful methods.
+    class ApplicationController < Decidim::Components::BaseController
+    end
+  end
+end

data/app/decorators/decidim/admin/newsletters_controller_decorator.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require_dependency "decidim/admin/newsletters_controller"
+
+module Decidim::Admin::NewslettersControllerDecorator
+  # Sort Admins by role and area
+  def self.decorate
+    ::Decidim::Admin::NewslettersController.class_eval do
+      alias_method :original_collection, :collection
+
+      private
+
+      def collection
+        return original_collection unless current_user.department_admin?
+
+        @collection ||= Decidim::Newsletter.where(organization: current_organization)
+                                           .joins(author: :areas)
+                                           .where(department_admin_areas: { decidim_area_id: current_user_areas.pluck(:id) })
+      end
+
+      def current_user_areas
+        return unless current_user.department_admin?
+
+        current_user.areas
+      end
+    end
+  end
+end
+
+Decidim::Admin::NewslettersControllerDecorator.decorate

data/app/decorators/decidim/admin/users_controller_decorator.rb

@@ -0,0 +1,128 @@
+# frozen_string_literal: true
+
+require_dependency "decidim/admin/users_controller"
+
+# This decorator adds the capability to the controller to query users
+# filtering by User role `department_admin`.
+module Decidim::Admin::UsersControllerDecorator
+  # rubocop: disable Metrics/CyclomaticComplexity
+  # rubocop: disable Metrics/PerceivedComplexity
+  def self.decorate
+    # Sort Admins by role and area
+    ::Decidim::Admin::UsersController.class_eval do
+      alias_method :original_collection, :collection
+
+      include ::Decidim::DepartmentAdmin::ApplicationHelper
+      helper_method :roles_with_title, :filtered_collection
+
+      before_action :read_params, only: :index
+
+      def read_params
+        @role = params[:role]
+        @by_process_name = params[:filter_search] == "by_process_name"
+        term = params.dig(:q, :name_or_nickname_or_email_cont)
+        @search_text = term
+      end
+
+      def collection
+        @collection ||= begin
+          filtered = if @by_process_name
+                       ::Decidim::Admin::UserAdminBySpaceNameFilter.for(@search_text, current_organization, current_locale)
+                     else
+                       ::Decidim::Admin::UserAdminFilter.for(original_collection, @search_text, @role, current_organization)
+                     end
+          if current_user.department_admin?
+            filtered.joins(:areas)
+                    .where("'department_admin' = ANY(roles)")
+                    .where("decidim_areas.id": current_user.areas.pluck(:id))
+          else
+            filtered
+          end
+        end
+      end
+
+      # override decidim-admin/app/controllers/concerns/decidim/admin/filterable.rb#filtered_collection default behavior.
+      def filtered_collection
+        @filtered_collection ||= begin
+          users = @by_process_name ? collection : query.result
+          sorted_users = users.uniq.sort { |u_1, u_2| "#{u_1.active_role}||#{u_1.areas.first&.name}" <=> "#{u_2.active_role}||#{u_2.areas.first&.name}" }
+          paginate(Kaminari.paginate_array(sorted_users))
+        end
+      end
+
+      def show
+        locale = params[:locale] || "ca"
+        @user ||= original_collection.find(params[:id])
+        @spaces = []
+        @user.participatory_processes.each do |process|
+          type = if process.participatory_process_group
+                   process.participatory_process_group&.title&.[](locale).presence || process.participatory_process_group&.title&.[]("ca")
+                 else
+                   t("models.user.fields.process_type", scope: "decidim.admin")
+                 end
+          process_title = process.title[locale]
+          process_title = process.title["ca"] if process_title.blank?
+
+          @spaces.push("title" => process_title,
+                       "type" => type,
+                       "area" => process.area.nil? ? "" : process.area&.name&.[](locale),
+                       "created_at" => process.created_at,
+                       "private" => process.private_space?,
+                       "published" => process.published?)
+        end
+
+        @user.assemblies.each do |assembly|
+          area_name = if assembly.area && assembly.area.name
+                        assembly.area.name[locale]
+                      else
+                        ""
+                      end
+
+          assembly_title = assembly.title[locale]
+          assembly_title = assembly.title["ca"] if assembly_title.blank?
+
+          @spaces.push("title" => assembly_title,
+                       "type" => t("models.user.fields.assembly_type", scope: "decidim.admin"),
+                       "area" => area_name,
+                       "created_at" => assembly.created_at,
+                       "private" => assembly.private_space?,
+                       "published" => assembly.published?)
+        end
+
+        if Decidim::DepartmentAdmin.conferences_defined?
+          @user.conferences.each do |conference|
+            area_name = conference.area&.name.try(:[], locale) || ""
+
+            conference_title = conference.title[locale]
+            conference_title = conference.title["ca"] if conference_title.blank?
+
+            @spaces.push("title" => conference_title,
+                         "type" => t("models.user.fields.conference_type", scope: "decidim.admin"),
+                         "area" => area_name,
+                         "created_at" => conference.created_at,
+                         "private" => conference.private_space?,
+                         "published" => conference.published?)
+          end
+        end
+
+        # rubocop: disable Style/NestedTernaryOperator
+        if (params[:sort_column] == "published" || params[:sort_column] == "private") && params[:sort_order] == "asc"
+          @spaces.sort! { |x, y| x[params[:sort_column]] ? 0 : (1 <=> y[params[:sort_column]] ? 0 : 1) }
+        elsif (params[:sort_column] == "published" || params[:sort_column] == "private") && params[:sort_order] == "desc"
+          @spaces.sort! { |x, y| y[params[:sort_column]] ? 0 : 1 <=> x[params[:sort_column]] ? 0 : 1 }
+        elsif params[:sort_column] && params[:sort_order] && params[:sort_order] == "asc"
+          @spaces.sort! { |x, y| x[params[:sort_column]] <=> y[params[:sort_column]] }
+        elsif params[:sort_column] && params[:sort_order] && params[:sort_order] == "desc"
+          @spaces.sort! { |x, y| y[params[:sort_column]] <=> x[params[:sort_column]] }
+        else
+          @spaces.sort! { |x, y| y["title"] <=> x["title"] }
+        end
+        # rubocop: enable Style/NestedTernaryOperator
+      end
+    end
+  end
+  # rubocop: enable Metrics/CyclomaticComplexity
+  # rubocop: enable Metrics/PerceivedComplexity
+end
+
+Decidim::Admin::UsersControllerDecorator.decorate

data/app/decorators/decidim/area_decorator.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require_dependency "decidim/area"
+
+module Decidim::AreaDecorator
+  def self.decorate
+    Decidim::Area.class_eval do
+      before_destroy :abort_if_department_admins
+
+      has_and_belongs_to_many :users,
+                              -> { where('\'department_admin\'=ANY("decidim_users"."roles")') },
+                              join_table: :department_admin_areas,
+                              foreign_key: :decidim_area_id,
+                              association_foreign_key: :decidim_user_id,
+                              validate: false
+
+      has_many :participatory_process,
+               class_name: "ParticipatoryProcess",
+               foreign_key: "decidim_department_id"
+
+      has_many :assemblies,
+               class_name: "Assemblies",
+               foreign_key: "decidim_area_id"
+
+      if Decidim::DepartmentAdmin.conferences_defined?
+        has_many :conferences,
+                 class_name: "Conferences",
+                 foreign_key: "decidim_area_id"
+      end
+
+      def has_department_admins?
+        Decidim::User.where(organization:).any? do |u|
+          u.areas.exists?(id)
+        end
+      end
+
+      def abort_if_department_admins
+        throw(:abort) if has_department_admins?
+      end
+    end
+  end
+end
+
+Decidim::AreaDecorator.decorate

data/app/decorators/decidim/assemblies/admin/assemblies_controller_decorator.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Decidim::Assemblies::Admin::AssembliesControllerDecorator
+  #
+  # This decorator adds the capability to the controller to query assemblies
+  # filtering by User role `department_admin`.
+  #
+  def self.decorate
+    Decidim::Assemblies::Admin::AssembliesController.class_eval do
+      private
+
+      alias_method :original_organization_assemblies, :collection
+
+      def collection
+        if current_user.department_admin?
+          ::Decidim::Assemblies::AssembliesWithUserRole.for(current_user)
+        else
+          original_organization_assemblies
+        end
+      end
+    end
+  end
+end
+
+Decidim::Assemblies::Admin::AssembliesControllerDecorator.decorate

data/app/decorators/decidim/assemblies/admin/assemblies_helper_decorator.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module Decidim::Assemblies::Admin::AssembliesHelperDecorator
+  #
+  # This decorator sends current_user as argument when it's a department admin.
+  #
+  def self.decorate
+    Decidim::Assemblies::Admin::AssembliesHelper.class_eval do
+      alias_method :parent_assemblies_for_select_original, :parent_assemblies_for_select
+
+      # Public: A collection of Assemblies that can be selected as parent
+      # assemblies for another assembly; to be used in forms.
+      def parent_assemblies_for_select
+        if current_user.department_admin?
+          @parent_assemblies_for_select ||= Decidim::Assemblies::ParentAssembliesForSelect.for(current_organization, current_assembly, current_user)
+        else
+          parent_assemblies_for_select_original
+        end
+      end
+    end
+  end
+end
+
+Decidim::Assemblies::Admin::AssembliesHelperDecorator.decorate

data/app/decorators/decidim/assemblies/create_assembly_decorator.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Decidim::Assemblies::CreateAssemblyDecorator
+  # Intercepts the `call` method and forces the Area of the user if it is a
+  # department_admin user.
+  def self.decorate
+    Decidim::Assemblies::Admin::CreateAssembly.class_eval do
+      alias_method :original_call, :call
+
+      def call
+        author = form.current_user
+        form.area_id = author.areas.first.id if author.department_admin?
+        original_call
+      end
+    end
+  end
+end
+
+Decidim::Assemblies::CreateAssemblyDecorator.decorate

data/app/decorators/decidim/assemblies/parent_assemblies_for_select_decorator.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module Decidim::Assemblies::ParentAssembliesForSelectDecorator
+  # This decorator adds current_user as an argument to be able to check
+  # it's department in the query and filter the assemblies by area.
+  def self.decorate
+    Decidim::Assemblies::ParentAssembliesForSelect.class_eval do
+      # Syntactic sugar to initialize the class and return the queried objects.
+      def self.for(organization, assembly, current_user = nil)
+        new(organization, assembly, current_user).query
+      end
+
+      # Initializes the class.
+      def initialize(organization, assembly, current_user)
+        @organization = organization
+        @assembly = assembly
+        @current_user = current_user
+      end
+
+      # Finds the available assemblies
+      #
+      # Returns an ActiveRecord::Relation.
+      def query
+        available_assemblies = if @current_user.present? && @current_user.department_admin?
+                                 Decidim::Assembly.where(area: @current_user.areas).where.not(id: @assembly)
+                               else
+                                 Decidim::Assembly.where(organization: @organization).where.not(id: @assembly)
+                               end
+
+        return available_assemblies if @assembly.blank?
+
+        available_assemblies.where.not(id: descendant_ids)
+      end
+    end
+  end
+end
+
+Decidim::Assemblies::ParentAssembliesForSelectDecorator.decorate

data/app/decorators/decidim/assemblies/permissions_decorator.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module Decidim::Assemblies::PermissionsDecorator
+  def self.decorate
+    Decidim::Assemblies::Permissions.class_eval do
+      # Intercept the `has_manageable_assemblies?` method
+      # always returns true if the user is a department_admin. Otherwise delegates to the original method.
+      # This is a fix to avoid permissions crashing when there are no assemblies with the user's area.
+      alias_method :original_has_manageable_assemblies?, :has_manageable_assemblies?
+
+      # rubocop: disable Lint/UnusedMethodArgument
+      def has_manageable_assemblies?(role: :any)
+        return unless user
+
+        user.department_admin? || original_has_manageable_assemblies?
+      end
+      # rubocop: enable Lint/UnusedMethodArgument
+    end
+  end
+end
+
+Decidim::Assemblies::PermissionsDecorator.decorate

data/app/decorators/decidim/assemblies/update_assembly_decorator.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Decidim::Assemblies::UpdateAssemblyDecorator
+  # Intercepts the `call` method and forces the Area of the user if it is a
+  # department_admin user.
+  def self.decorate
+    Decidim::Assemblies::Admin::UpdateAssembly.class_eval do
+      alias_method :original_call, :call
+
+      def call
+        author = form.current_user
+        form.area_id = author.areas.first.id if author.department_admin?
+        original_call
+      end
+    end
+  end
+end
+
+Decidim::Assemblies::UpdateAssemblyDecorator.decorate

data/app/decorators/decidim/assemblies_decorator.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require_dependency "decidim/assembly"
+
+module Decidim::AssembliesDecorator
+  #
+  # This decorator adds required associations between Decidim::ParticipatoryProcess and Departaments.
+  #
+  def self.decorate
+    Decidim::Assembly.class_eval do
+      has_and_belongs_to_many :users_with_any_role,
+                              class_name: "Decidim::User",
+                              join_table: :decidim_assembly_user_roles,
+                              foreign_key: :decidim_assembly_id,
+                              association_foreign_key: :decidim_user_id,
+                              validate: false
+    end
+  end
+end
+
+Decidim::AssembliesDecorator.decorate

data/app/decorators/decidim/assemblies_with_user_role_decorator.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Decidim::AssembliesWithUserRoleDecorator
+  #
+  # This decorator adds the capability to query participatory_processes
+  # filtering by User role `department_admin`.
+  #
+  def self.decorate
+    Decidim::Assemblies::AssembliesWithUserRole.class_eval do
+      private
+
+      alias_method :assembly_ids_by_assemblies_user_table, :assembly_ids
+
+      def assembly_ids
+        ids = [assembly_ids_by_assemblies_user_table]
+        if user&.department_admin?
+          ids << ::Decidim::Assembly
+                 .where("decidim_area_id" => user.areas.pluck(:id)).pluck(:id)
+        end
+
+        ::Decidim::Assembly.where(id: ids.flatten.uniq)
+      end
+    end
+  end
+end
+
+Decidim::AssembliesWithUserRoleDecorator.decorate

data/app/decorators/decidim/conference_form_decorator.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Decidim::ConferenceFormDecorator
+  #
+  # This decorator adds the attribute area_id to the ConferenceForm and
+  # extends it with utility methods for the view and command.
+  #
+  def self.decorate
+    return unless Decidim::DepartmentAdmin.conferences_defined?
+
+    Decidim::Conferences::Admin::ConferenceForm.class_eval do
+      attribute :area_id, Integer
+
+      validates :area, presence: true, if: proc { |object| object.area_id.present? }
+
+      def area
+        @area ||= current_organization.areas.find_by(id: area_id)
+      end
+    end
+  end
+end
+
+Decidim::ConferenceFormDecorator.decorate

data/app/decorators/decidim/conferences/admin/conferences_controller_decorator.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Decidim::Conferences::Admin::ConferencesControllerDecorator
+  #
+  # This decorator adds the capability to the controller to query conferences
+  # filtering by User role `department_admin`.
+  #
+  def self.decorate
+    return unless Decidim::DepartmentAdmin.conferences_defined?
+
+    Decidim::Conferences::Admin::ConferencesController.class_eval do
+      private
+
+      alias_method :original_collection, :collection
+
+      def collection
+        @collection ||= if current_user.admin?
+                          original_collection
+                        else
+                          ::Decidim::Conferences::ConferencesWithUserRole.for(current_user)
+                        end
+      end
+    end
+  end
+end
+
+Decidim::Conferences::Admin::ConferencesControllerDecorator.decorate