decidim-proposals 0.28.0 → 0.28.1

data/lib/decidim/proposals/test/factories.rb

@@ -7,9 +7,12 @@ require "decidim/meetings/test/factories"
 
 FactoryBot.define do
   factory :proposal_component, parent: :component do
-    name { Decidim::Components::Namer.new(participatory_space.organization.available_locales, :proposals).i18n_name }
+    transient do
+      skip_injection { false }
+    end
+    name { generate_component_name(participatory_space.organization.available_locales, :proposals) }
     manifest_name { :proposals }
-    participatory_space { create(:participatory_process, :with_steps, organization:) }
+    participatory_space { create(:participatory_process, :with_steps, organization:, skip_injection:) }
 
     trait :with_endorsements_enabled do
       step_settings do
@@ -251,40 +254,16 @@ FactoryBot.define do
       skip_injection { false }
     end
 
-    title do
-      if skip_injection
-        Decidim::Faker::Localized.localized { generate(:title) }
-      else
-        Decidim::Faker::Localized.localized { "<script>alert(\"Proposal TITLE\");</script> #{generate(:title)}" }
-      end
-    end
-    body do
-      if skip_injection
-        Decidim::Faker::Localized.localized { Faker::Lorem.sentences(number: 3).join("\n") }
-      else
-        Decidim::Faker::Localized.localized { "<script>alert(\"Proposal BODY\");</script> #{Faker::Lorem.sentences(number: 3).join("\n")}" }
-      end
-    end
-    component { create(:proposal_component) }
+    title { generate_localized_title(:proposal_title, skip_injection:) }
+    body { generate_localized_description(:proposal_body, skip_injection:) }
+    component { create(:proposal_component, skip_injection:) }
     published_at { Time.current }
     address { "#{Faker::Address.street_name}, #{Faker::Address.city}" }
     latitude { Faker::Address.latitude }
     longitude { Faker::Address.longitude }
     cost { 20_000 }
-    cost_report do
-      if skip_injection
-        Decidim::Faker::Localized.localized { generate(:title) }
-      else
-        Decidim::Faker::Localized.localized { "<script>alert(\"Proposal cost report\")</script> #{generate(:title)}" }
-      end
-    end
-    execution_period do
-      if skip_injection
-        Decidim::Faker::Localized.localized { generate(:title) }
-      else
-        Decidim::Faker::Localized.localized { "<script>alert(\"Proposal execution period\")</script> #{generate(:title)}" }
-      end
-    end
+    cost_report { generate_localized_title(:proposal_cost_report, skip_injection:) }
+    execution_period { generate_localized_title(:proposal_execution_period, skip_injection:) }
 
     after(:build) do |proposal, evaluator|
       proposal.title = if evaluator.title.is_a?(String)
@@ -302,7 +281,7 @@ FactoryBot.define do
       proposal.body = Decidim::ContentProcessor.parse_with_processor(:hashtag, proposal.body, current_organization: proposal.organization).rewrite
 
       if proposal.component
-        users = evaluator.users || [create(:user, :confirmed, organization: proposal.component.participatory_space.organization)]
+        users = evaluator.users || [create(:user, :confirmed, organization: proposal.component.participatory_space.organization, skip_injection: evaluator.skip_injection)]
         users.each_with_index do |user, idx|
           user_group = evaluator.user_groups[idx]
           proposal.coauthorships.build(author: user, user_group:)
@@ -319,18 +298,18 @@ FactoryBot.define do
     end
 
     trait :participant_author do
-      after :build do |proposal|
+      after :build do |proposal, evaluator|
         proposal.coauthorships.clear
-        user = build(:user, organization: proposal.component.participatory_space.organization)
+        user = build(:user, organization: proposal.component.participatory_space.organization, skip_injection: evaluator.skip_injection)
         proposal.coauthorships.build(author: user)
       end
     end
 
     trait :user_group_author do
-      after :build do |proposal|
+      after :build do |proposal, evaluator|
         proposal.coauthorships.clear
-        user = create(:user, organization: proposal.component.participatory_space.organization)
-        user_group = create(:user_group, :verified, organization: user.organization, users: [user])
+        user = create(:user, organization: proposal.component.participatory_space.organization, skip_injection: evaluator.skip_injection)
+        user_group = create(:user_group, :verified, organization: user.organization, users: [user], skip_injection: evaluator.skip_injection)
         proposal.coauthorships.build(author: user, user_group:)
       end
     end
@@ -343,10 +322,10 @@ FactoryBot.define do
     end
 
     trait :official_meeting do
-      after :build do |proposal|
+      after :build do |proposal, evaluator|
         proposal.coauthorships.clear
-        component = build(:meeting_component, participatory_space: proposal.component.participatory_space)
-        proposal.coauthorships.build(author: build(:meeting, component:))
+        component = build(:meeting_component, participatory_space: proposal.component.participatory_space, skip_injection: evaluator.skip_injection)
+        proposal.coauthorships.build(author: build(:meeting, component:, skip_injection: evaluator.skip_injection))
       end
     end
 
@@ -395,78 +374,89 @@ FactoryBot.define do
     end
 
     trait :hidden do
-      after :create do |proposal|
-        create(:moderation, hidden_at: Time.current, reportable: proposal)
+      after :create do |proposal, evaluator|
+        create(:moderation, hidden_at: Time.current, reportable: proposal, skip_injection: evaluator.skip_injection)
       end
     end
 
     trait :with_votes do
-      after :create do |proposal|
-        create_list(:proposal_vote, 5, proposal:)
+      after :create do |proposal, evaluator|
+        create_list(:proposal_vote, 5, proposal:, skip_injection: evaluator.skip_injection)
       end
     end
 
     trait :with_endorsements do
-      after :create do |proposal|
+      after :create do |proposal, evaluator|
         5.times.collect do
-          create(:endorsement, resource: proposal, author: build(:user, organization: proposal.participatory_space.organization))
+          create(:endorsement, resource: proposal, author: build(:user, organization: proposal.participatory_space.organization, skip_injection: evaluator.skip_injection),
+                               skip_injection: evaluator.skip_injection)
         end
       end
     end
 
     trait :with_amendments do
-      after :create do |proposal|
-        create_list(:proposal_amendment, 5, amendable: proposal)
+      after :create do |proposal, evaluator|
+        create_list(:proposal_amendment, 5, amendable: proposal, skip_injection: evaluator.skip_injection)
       end
     end
 
     trait :with_photo do
-      after :create do |proposal|
-        proposal.attachments << create(:attachment, :with_image, attached_to: proposal)
+      after :create do |proposal, evaluator|
+        proposal.attachments << create(:attachment, :with_image, attached_to: proposal, skip_injection: evaluator.skip_injection)
       end
     end
 
     trait :with_document do
-      after :create do |proposal|
-        proposal.attachments << create(:attachment, :with_pdf, attached_to: proposal)
+      after :create do |proposal, evaluator|
+        proposal.attachments << create(:attachment, :with_pdf, attached_to: proposal, skip_injection: evaluator.skip_injection)
       end
     end
   end
 
   factory :proposal_vote, class: "Decidim::Proposals::ProposalVote" do
-    proposal { build(:proposal) }
-    author { build(:user, organization: proposal.organization) }
+    transient do
+      skip_injection { false }
+    end
+    proposal { build(:proposal, skip_injection:) }
+    author { build(:user, organization: proposal.organization, skip_injection:) }
   end
 
   factory :proposal_amendment, class: "Decidim::Amendment" do
-    amendable { build(:proposal) }
-    emendation { build(:proposal, component: amendable.component) }
-    amender { build(:user, organization: amendable.component.participatory_space.organization) }
+    transient do
+      skip_injection { false }
+    end
+    amendable { build(:proposal, skip_injection:) }
+    emendation { build(:proposal, component: amendable.component, skip_injection:) }
+    amender { build(:user, organization: amendable.component.participatory_space.organization, skip_injection:) }
     state { Decidim::Amendment::STATES.keys.sample }
   end
 
   factory :proposal_note, class: "Decidim::Proposals::ProposalNote" do
+    transient do
+      skip_injection { false }
+    end
     body { Faker::Lorem.sentences(number: 3).join("\n") }
-    proposal { build(:proposal) }
-    author { build(:user, organization: proposal.organization) }
+    proposal { build(:proposal, skip_injection:) }
+    author { build(:user, organization: proposal.organization, skip_injection:) }
   end
 
   factory :collaborative_draft, class: "Decidim::Proposals::CollaborativeDraft" do
     transient do
+      skip_injection { false }
       users { nil }
       # user_groups correspondence to users is by sorting order
       user_groups { [] }
     end
 
-    title { "<script>alert(\"TITLE\");</script> #{generate(:title)}" }
-    body { "<script>alert(\"BODY\");</script>\n#{Faker::Lorem.sentences(number: 3).join("\n")}" }
-    component { create(:proposal_component) }
+    title { generate_localized_title(:collaborative_draft_title, skip_injection:)["en"] }
+    body { generate_localized_description(:collaborative_draft_body, skip_injection:)["en"] }
+    component { create(:proposal_component, skip_injection:) }
     address { "#{Faker::Address.street_name}, #{Faker::Address.city}" }
     state { "open" }
 
     after(:build) do |collaborative_draft, evaluator|
       if collaborative_draft.component
-        users = evaluator.users || [create(:user, organization: collaborative_draft.component.participatory_space.organization)]
+        users = evaluator.users || [create(:user, organization: collaborative_draft.component.participatory_space.organization, skip_injection: evaluator.skip_injection)]
         users.each_with_index do |user, idx|
           user_group = evaluator.user_groups[idx]
           collaborative_draft.coauthorships.build(author: user, user_group:)
@@ -475,9 +465,9 @@ FactoryBot.define do
     end
 
     trait :participant_author do
-      after :build do |draft|
+      after :build do |draft, evaluator|
         draft.coauthorships.clear
-        user = build(:user, organization: draft.component.participatory_space.organization)
+        user = build(:user, organization: draft.component.participatory_space.organization, skip_injection: evaluator.skip_injection)
         draft.coauthorships.build(author: user)
       end
     end
@@ -501,32 +491,20 @@ FactoryBot.define do
       skip_injection { false }
     end
 
-    title do
-      if skip_injection
-        Decidim::Faker::Localized.localized { generate(:title) }
-      else
-        Decidim::Faker::Localized.localized { "<script>alert(\"Meetings TITLE\")</script> #{generate(:title)}" }
-      end
-    end
-
-    description do
-      Decidim::Faker::Localized.wrapped("<p>", "</p>") do
-        if skip_injection
-          Decidim::Faker::Localized.localized { Faker::Lorem.sentences(number: 3).join("\n") }
-        else
-          Decidim::Faker::Localized.localized { "<script>alert(\"Meetings description\");</script> #{Faker::Lorem.sentences(number: 3).join("\n")}" }
-        end
-      end
-    end
-    component { create(:proposal_component) }
+    title { generate_localized_title(:participatory_text_title, skip_injection:) }
+    description { generate_localized_description(:participatory_text_description, skip_injection:) }
+    component { create(:proposal_component, skip_injection:) }
   end
 
   factory :valuation_assignment, class: "Decidim::Proposals::ValuationAssignment" do
+    transient do
+      skip_injection { false }
+    end
     proposal
     valuator_role do
       space = proposal.component.participatory_space
       organization = space.organization
-      build :participatory_process_user_role, role: :valuator, user: build(:user, organization:)
+      build :participatory_process_user_role, role: :valuator, skip_injection:, user: build(:user, organization:, skip_injection:)
     end
   end
 end

data/lib/decidim/proposals/valuatable.rb

@@ -8,7 +8,8 @@ module Decidim
       include Decidim::Comments::Commentable
 
       included do
-        has_many :valuation_assignments, foreign_key: "decidim_proposal_id", dependent: :destroy
+        has_many :valuation_assignments, foreign_key: "decidim_proposal_id", dependent: :destroy,
+                                         counter_cache: :valuation_assignments_count, class_name: "Decidim::Proposals::ValuationAssignment"
 
         def valuators
           valuator_role_ids = valuation_assignments.where(proposal: self).pluck(:valuator_role_id)

data/lib/decidim/proposals/version.rb

@@ -4,7 +4,7 @@ module Decidim
   # This holds decidim-proposals version.
   module Proposals
     def self.version
-      "0.28.0"
+      "0.28.1"
     end
   end
 end

metadata

@@ -1,16 +1,16 @@
 --- !ruby/object:Gem::Specification
 name: decidim-proposals
 version: !ruby/object:Gem::Version
-  version: 0.28.0
+  version: 0.28.1
 platform: ruby
 authors:
 - Josep Jaume Rey Peroy
 - Marc Riera Casals
 - Oriol Gual Oliva
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-12-20 00:00:00.000000000 Z
+date: 2024-04-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: decidim-comments
@@ -18,28 +18,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.0
+        version: 0.28.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.0
+        version: 0.28.1
 - !ruby/object:Gem::Dependency
   name: decidim-core
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.0
+        version: 0.28.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.0
+        version: 0.28.1
 - !ruby/object:Gem::Dependency
   name: doc2text
   requirement: !ruby/object:Gem::Requirement
@@ -80,98 +80,98 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.0
+        version: 0.28.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.0
+        version: 0.28.1
 - !ruby/object:Gem::Dependency
   name: decidim-assemblies
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.0
+        version: 0.28.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.0
+        version: 0.28.1
 - !ruby/object:Gem::Dependency
   name: decidim-budgets
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.0
+        version: 0.28.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.0
+        version: 0.28.1
 - !ruby/object:Gem::Dependency
   name: decidim-conference
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.0
+        version: 0.28.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.0
+        version: 0.28.1
 - !ruby/object:Gem::Dependency
   name: decidim-dev
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.0
+        version: 0.28.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.0
+        version: 0.28.1
 - !ruby/object:Gem::Dependency
   name: decidim-meetings
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.0
+        version: 0.28.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.0
+        version: 0.28.1
 - !ruby/object:Gem::Dependency
   name: decidim-participatory_processes
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.0
+        version: 0.28.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.28.0
+        version: 0.28.1
 description: A proposals component for decidim's participatory spaces.
 email:
 - josepjaume@gmail.com
@@ -441,8 +441,6 @@ files:
 - app/views/decidim/proposals/proposals/show.html.erb
 - app/views/decidim/proposals/versions/show.html.erb
 - config/assets.rb
-- config/brakeman.ignore
-- config/environment.rb
 - config/locales/am-ET.yml
 - config/locales/ar-SA.yml
 - config/locales/ar.yml
@@ -475,6 +473,7 @@ files:
 - config/locales/ga-IE.yml
 - config/locales/gl.yml
 - config/locales/gn-PY.yml
+- config/locales/he-IL.yml
 - config/locales/hr-HR.yml
 - config/locales/hr.yml
 - config/locales/hu.yml
@@ -579,6 +578,8 @@ files:
 - db/migrate/20210318082934_fix_counters_for_copied_proposals.rb
 - db/migrate/20230427105700_change_states_on_collaborative_drafts.rb
 - db/migrate/20230427105700_change_states_on_proposals.rb
+- db/migrate/20240404202756_add_valuation_assignments_count_to_decidim_proposals_proposals.rb
+- decidim-proposals.gemspec
 - lib/decidim/api/proposal_input_filter.rb
 - lib/decidim/api/proposal_input_sort.rb
 - lib/decidim/api/proposal_type.rb
@@ -617,23 +618,23 @@ metadata:
   funding_uri: https://opencollective.com/decidim
   homepage_uri: https://decidim.org
   source_code_uri: https://github.com/decidim/decidim
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - "~>"
     - !ruby/object:Gem::Version
-      version: '3.1'
+      version: 3.1.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.22
-signing_key:
+rubygems_version: 3.5.9
+signing_key: 
 specification_version: 4
 summary: Decidim proposals module
 test_files: []

data/config/brakeman.ignore

@@ -1,63 +0,0 @@
-{
-  "ignored_warnings": [
-    {
-      "warning_type": "Mass Assignment",
-      "warning_code": 70,
-      "fingerprint": "8eeee9ad33162a80c7cf7a87d597f4cc108b0874d40ddabd1f5241f460a9519a",
-      "check_name": "MassAssignment",
-      "message": "Specify exact keys allowed for mass assignment instead of using `permit!` which allows any keys",
-      "file": "app/controllers/decidim/proposals/admin/participatory_texts_controller.rb",
-      "line": 50,
-      "link": "https://brakemanscanner.org/docs/warning_types/mass_assignment/",
-      "code": "params.require(:preview_participatory_text).permit!",
-      "render_path": null,
-      "location": {
-        "type": "method",
-        "class": "Decidim::Proposals::Admin::ParticipatoryTextsController",
-        "method": "update"
-      },
-      "user_input": null,
-      "confidence": "Medium",
-      "cwe_id": [
-        915
-      ],
-      "note": ""
-    },
-    {
-      "warning_type": "Cross-Site Scripting",
-      "warning_code": 2,
-      "fingerprint": "ee8cfc06595219681fe264fb8977fb9b0bab6750e694ec9dea82324c02fbc5f4",
-      "check_name": "CrossSiteScripting",
-      "message": "Unescaped parameter value",
-      "file": "app/views/decidim/proposals/proposals/show.html.erb",
-      "line": 53,
-      "link": "https://brakemanscanner.org/docs/warning_types/cross_site_scripting",
-      "code": "cell(\"decidim/proposals/proposal_metadata\", Proposal.published.not_hidden.where(:component => current_component).find_by(:id => params[:id])).state_item.dig(:text).html_safe",
-      "render_path": [
-        {
-          "type": "controller",
-          "class": "Decidim::Proposals::ProposalsController",
-          "method": "show",
-          "line": 69,
-          "file": "app/controllers/decidim/proposals/proposals_controller.rb",
-          "rendered": {
-            "name": "decidim/proposals/proposals/show",
-            "file": "app/views/decidim/proposals/proposals/show.html.erb"
-          }
-        }
-      ],
-      "location": {
-        "type": "template",
-        "template": "decidim/proposals/proposals/show"
-      },
-      "user_input": "params[:id]",
-      "confidence": "Weak",
-      "cwe_id": [
-        79
-      ],
-      "note": ""
-    }
-  ],
-  "updated": "2023-07-27 19:05:49 +0200",
-  "brakeman_version": "5.4.1"
-}

data/config/environment.rb

@@ -1,3 +0,0 @@
-# frozen_string_literal: true
-
-# Empty line for playing nice with tpope/vim-rails