decidim-toggle 0.1.3

data/app/views/decidim_toggle/system/organizations/tabs/_language_tab.html.erb

@@ -0,0 +1,35 @@
+<% organization = local_assigns[:organization] %>
+<% tab = local_assigns[:tab] %>
+<%= decidim_toggle_settings_tab_form(organization, tab) do |tf| %>
+  <% tab_form = tf.object %>
+  <fieldset>
+    <legend class="form-legend"><%= t("decidim_toggle.system.organizations.language_tab.legend") %></legend>
+    <table class="table-fields">
+      <thead>
+        <tr>
+          <th><%= t("decidim_toggle.system.organizations.language_tab.locale") %></th>
+          <th><%= t("decidim_toggle.system.organizations.language_tab.enabled") %></th>
+          <th><%= t("decidim_toggle.system.organizations.language_tab.default") %></th>
+        </tr>
+      </thead>
+      <tbody>
+        <% localized_locales(I18n.available_locales).each do |locale| %>
+          <tr>
+            <td><%= locale.name %></td>
+            <td><%= check_box_tag "organization[available_locales][#{locale.id}]", locale.id, Array(tab_form.available_locales).map(&:to_s).include?(locale.id.to_s), class: "!m-0" %></td>
+            <td><%= radio_button_tag "organization[default_locale]", locale.id, tab_form.default_locale.to_s == locale.id.to_s, class: "!m-0" %></td>
+          </tr>
+        <% end %>
+      </tbody>
+    </table>
+  </fieldset>
+  <fieldset>
+    <legend class="form-legend"><%= t("decidim_toggle.system.organizations.language_tab.machine_translations_legend") %></legend>
+    <%= tf.fields_for_names(:enable_machine_translations) %>
+
+    <p>
+      <label class="form-legend" for="organization[machine_translation_display_priority]"><%= t("decidim_toggle.system.organizations.language_tab.machine_translation_display_priority_hint") %></label>
+      <%= tf.fields_for_names(:machine_translation_display_priority) %>
+    </p>
+  </fieldset>
+<% end %>

data/app/views/decidim_toggle/system/organizations/tabs/_omniauth_tab.html.erb

@@ -0,0 +1,5 @@
+<% organization = local_assigns[:organization] %>
+<% tab = local_assigns[:tab] %>
+<%= decidim_toggle_settings_tab_form(organization, tab) do |tf| %>
+  <%= render "decidim/system/organizations/omniauth_settings", f: tf %>
+<% end %>

data/app/views/decidim_toggle/system/organizations/tabs/_security_tab.html.erb

@@ -0,0 +1,20 @@
+<% organization = local_assigns[:organization] %>
+<% tab = local_assigns[:tab] %>
+<%= decidim_toggle_settings_tab_form(organization, tab) do |tf| %>
+  <fieldset>
+    <legend class="form-legend"><%= t("decidim_toggle.system.organizations.security_tab.access_legend") %></legend>
+
+    <p>
+      <%= tf.check_box :force_users_to_authenticate_before_access_organization %>
+    </p>
+    <p class="mt-6">
+      <label class="form-legend"><%= t("decidim_toggle.system.organizations.security_tab.sign_in_mode") %></label>
+      <%= tf.fields_for_names(:users_registration_mode) %>
+    </p>
+  </fieldset>
+
+  <fieldset>
+    <legend class="form-legend"><%= t("decidim_toggle.system.organizations.security_tab.csp_legend") %></legend>
+    <%= tf.fields_for_names("default-src", "img-src", "media-src", "script-src", "style-src", "frame-src", "font-src", "connect-src") %>
+  </fieldset>
+<% end %>

data/app/views/layouts/decidim/toggle/_javascript_config.html.erb

@@ -0,0 +1,3 @@
+<script nonce="<%= content_security_policy_nonce %>">
+  window.DecidimToggle = <%== decidim_toggle_javascript_config.to_json %>;
+</script>

data/bin/check

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# RuboCop + erblint + RSpec (matches CI ruby::rubocop, ruby::erb, ruby::rspec).
+# Does not run Prettier or Crowdin — see README / CONTRIBUTING "bin/check vs CI".
+set -euo pipefail
+cd "$(dirname "$0")/.."
+unset DATABASE_URL
+export RAILS_ENV=test
+bundle exec rubocop .
+bundle exec erblint --lint-all --enable-all-linters
+bundle exec rspec "$@"

data/bin/i18n-tasks

@@ -0,0 +1,27 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+#
+# This file was generated by Bundler.
+#
+# The application 'i18n-tasks' is installed as part of a gem, and
+# this file is here to facilitate running it.
+#
+
+ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../Gemfile", __dir__)
+
+bundle_binstub = File.expand_path("bundle", __dir__)
+
+if File.file?(bundle_binstub)
+  if File.read(bundle_binstub, 300).include?("This file was generated by Bundler")
+    load(bundle_binstub)
+  else
+    abort("Your `bin/bundle` was not generated by Bundler, so this binstub cannot run.
+Replace `bin/bundle` by running `bundle binstubs bundler --force`, then run this command again.")
+  end
+end
+
+require "rubygems"
+require "bundler/setup"
+
+load Gem.bin_path("i18n-tasks", "i18n-tasks")

data/bin/postversion

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+#
+# Syncs lib/decidim/toggle/version.rb with package.json version (single source: npm version).
+#
+set -euo pipefail
+
+PACKAGE_VERSION=$(jq -r '.version' package.json)
+
+file="lib/decidim/toggle/version.rb"
+if [[ -f "$file" ]]; then
+  sed -i "/# DO NOT UPDATE MANUALLY/s/\".*\"/\"${PACKAGE_VERSION}\"/" "$file"
+fi
+
+echo "$PACKAGE_VERSION"

data/config/assets.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+base_path = File.expand_path("..", __dir__)
+
+Decidim::Webpacker.register_path("#{base_path}/app/packs")
+Decidim::Webpacker.register_entrypoints(
+  decidim_toggle: "#{base_path}/app/packs/entrypoints/decidim_toggle.js"
+)

data/config/locales/decidim_toggle_en.yml

@@ -0,0 +1,58 @@
+en:
+  # Field labels for ModuleConfigForm tabs live under decidim_toggle.system.<module_config_name>
+  # in each integrating gem (e.g. decidim_geo, spaces). This file holds built-in org settings UI only.
+  decidim_toggle:
+    system:
+      organizations:
+        invitation_pending_title: "Invitation pending"
+        invitation_pending_body: "The first administrator of the organization still did not accept the invitation"
+        encryption_not_configured: "Error: Please configure SECRET_KEY_BASE or master.key to edit this organization."
+        encryption_not_configured_title: "Encryption not configured"
+        settings_tabs:
+          name: "Name"
+          omniauth: "OmniAuth"
+          emails: "Emails"
+          language: "Language"
+          security: "Security"
+          authorizations: "Authorizations"
+          file_upload: "File upload"
+          language_placeholder: "Default and available locales (configured in the form above)."
+        form_tab:
+          save: "Save"
+          cancel: "Cancel"
+          success: "Settings updated successfully."
+        authorizations_tab:
+          legend: "Verification workflows"
+          hint: "Choose which verification methods participants can use in this organization."
+        language_tab:
+          legend: "Available and default locale"
+          locale: "Locale"
+          enabled: "Enabled"
+          default: "Default"
+          save: "Save locales"
+          success: "Locales updated successfully."
+          error: "Could not update locales."
+          machine_translations_legend: "Machine translations"
+          machine_translation_display_priority_hint: "Text version participant will see first"
+        tabs:
+          language_tab:
+            machine_translations_legend: "Machine translations"
+            machine_translation_display_priority_hint: "Text version participant will see first"
+        security_tab:
+          access_legend: "Access to the organization"
+          force_auth_label: "Force users to authenticate before accessing the organization"
+          sign_in_mode: "Sign in mode"
+          csp_legend: "Content security policy"
+
+  activemodel:
+    attributes:
+      organization:
+        helptext:
+          "default-src": "Fallback directive used when no other *-src directive matches. Mostly used to set a secure baseline for all resource types. Examples: 'self' https: ; 'none' ; 'self' https: data:"
+          "img-src": "Sources allowed to load images (e.g. <img>, favicons, CSS background images). Use for image CDNs or when you need data/blob URIs. Examples: 'self' https: data: blob: ; https://*.fbcdn.net https://*.instagram.com"
+          "media-src": "Sources allowed to load audio/video (e.g. <video>, <audio>). Use for media hosting/CDNs and blob URLs from uploads. Examples: 'self' https: blob: ; https://media.example.com"
+          "script-src": "Sources allowed to execute scripts (e.g. <script src>, imports, inline scripts when enabled). Use for third-party scripts such as Matomo. Examples: 'self' https://*.matomo.cloud ; 'self' 'nonce-<nonce>'"
+          "style-src": "Sources allowed to load CSS (e.g. <link rel='stylesheet'> and style attributes). Use for CSS from CDNs and, if needed, inline styles. Examples: 'self' https: 'unsafe-inline' ; https://fonts.googleapis.com https://fonts.gstatic.com"
+          "frame-src": "Sources allowed to embed iframes/frames (including embedded players). Use for embeds such as YouTube and Google Scholar. Examples: 'self' https://www.youtube.com https://scholar.google.com ; https://*.trusted-partner.com"
+          "font-src": "Sources allowed to load fonts (e.g. @font-face). Use for external font providers such as Google Fonts. Examples: 'self' https: data: ; https://fonts.gstatic.com"
+          "connect-src": "Sources allowed to make network connections from the page (fetch/XHR, EventSource, WebSocket). Use for endpoints such as Matomo. Examples: 'self' https: wss: ; https://*.matomo.cloud wss://realtime.example.com ; blob:"

data/crowdin.yml

@@ -0,0 +1,15 @@
+# Crowdin — set api_token / project_id via CI or local env as needed.
+#
+base_path: .
+base_url: https://api.crowdin.com
+api_token: "insecure_api_token"
+project_id: "project_id"
+
+preserve_hierarchy: true
+
+files: [
+  {
+    "source": "/config/locales/en.yml",
+    "translation": "/config/locales/decidim_toggle_%two_letters_code%.yml",
+  }
+]

data/db/migrate/20260321120000_create_decidim_toggle_organization_module_configs.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+class CreateDecidimToggleOrganizationModuleConfigs < ActiveRecord::Migration[7.0]
+  def change
+    create_table :decidim_toggle_organization_module_configs do |t|
+      t.belongs_to :decidim_organization,
+                   null: false,
+                   foreign_key: { to_table: :decidim_organizations, on_delete: :cascade },
+                   index: { name: "idx_dtoggle_omc_on_org" }
+      t.string :module_name, null: false
+      t.jsonb :config, null: false, default: {}
+      t.timestamps
+    end
+
+    add_index :decidim_toggle_organization_module_configs,
+              [:decidim_organization_id, :module_name],
+              unique: true,
+              name: "idx_dtoggle_org_module_configs_unique"
+  end
+end

data/decidim-toggle.gemspec

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+$LOAD_PATH.push File.expand_path("lib", __dir__)
+
+require "decidim/toggle/version"
+
+Gem::Specification.new do |s|
+  s.version = Decidim::Toggle.version
+  s.authors = ["hadrien@octree.ch"]
+  s.email = ["hadrien@octree.ch"]
+  s.license = "AGPL-3.0"
+  s.homepage = "https://octree-gva.github.io/decidim-toggle"
+  s.required_ruby_version = ">= 3.2"
+  s.name = "decidim-toggle"
+  s.summary = "Feature toggle for Decidim system administration"
+  s.description = "Tabbed System organization settings (OmniAuth, emails, language, security, other) " \
+                  "with an API for other modules to add tabs. Overrides decidim-system organization views via prepended paths."
+
+  s.files = Dir.chdir(__dir__) do
+    tracked = `git ls-files -z 2>/dev/null`.split("\x0").reject(&:empty?)
+    if tracked.any?
+      tracked
+    else
+      Dir["{app,config,lib}/**/*", "Rakefile", "README.md", "CONTRIBUTING.md"].reject { |f| f.match(%r{^(spec|decidim_dummy_app)/}) }
+    end
+  end
+
+  s.require_paths = ["lib"]
+
+  s.add_dependency "decidim-core", Decidim::Toggle.decidim_version
+  s.add_dependency "decidim-system", Decidim::Toggle.decidim_version
+  s.add_dependency "deface", "~> 1.9.0"
+
+  s.metadata["rubygems_mfa_required"] = "true"
+end

data/docker-compose.yml

@@ -0,0 +1,41 @@
+services:
+  toggle:
+    command: bash -c "sleep infinity"
+    image: octree/decidim-dev:0.29
+    entrypoint: ""
+    working_dir: /home/module
+    volumes:
+      - .:/home/module
+      - bundle:/home/decidim/vendor
+      - node_modules:/home/decidim/node_modules
+    environment:
+      - PORT=3000
+      - DATABASE_URL=postgresql://decidim:pleaseChangeMe@toggle_db:5432/decidim
+      - DATABASE_HOST=toggle_db
+      - DATABASE_USERNAME=decidim
+      - DATABASE_PASSWORD=pleaseChangeMe
+      - DEV_MODULE=decidim-toggle
+      - RAILS_ENV=development
+      - DISABLED_DOCKER_COMPOSE=true
+      - DECIDIM_FORCE_SSL=false
+      - RAILS_FORCE_SSL=false
+    depends_on:
+      - toggle_db
+    ports:
+      - 3000:3000
+    links:
+      - toggle_db
+
+  toggle_db:
+    image: postgres:17
+    volumes:
+      - toggle-pg-data:/var/lib/postgresql/data
+    environment:
+      - POSTGRES_DATABASE=decidim
+      - POSTGRES_USER=decidim
+      - POSTGRES_PASSWORD=pleaseChangeMe
+
+volumes:
+  node_modules: {}
+  bundle: {}
+  toggle-pg-data: {}

data/lib/decidim/toggle/engine.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require "rails"
+require "deface"
+require "decidim/core"
+require "decidim/system"
+# After core so Decidim::FormBuilder autoload pulls Map, TranslatableAttributes, etc.
+require "decidim/toggle/settings_form_builder"
+require "decidim/toggle/organization_settings_tabs"
+require "decidim/toggle/expose_attributes_to_js_validator"
+
+module Decidim
+  module Toggle
+    class Engine < ::Rails::Engine
+      isolate_namespace Decidim::Toggle
+
+      routes do
+        scope path: "system" do
+          patch "organizations/:organization_id/settings_tab/:tab_id",
+                controller: "/decidim_toggle/system/settings_tab",
+                action: :update,
+                as: :update_settings_tab_organization
+        end
+      end
+
+      initializer "decidim_toggle.ignore_deface_overrides_in_zeitwerk" do
+        overrides_path = root.join("app/overrides").to_s
+        Rails.autoloaders.main.ignore(overrides_path) if defined?(Rails.autoloaders) && Dir.exist?(overrides_path)
+      end
+
+      initializer "decidim_toggle.mount_routes" do
+        Rails.application.routes.append do
+          mount Decidim::Toggle::Engine, at: "/decidim_toggle", as: "decidim_toggle"
+        end
+      end
+
+      initializer "decidim_toggle.organization_settings_tabs" do
+        Decidim::Toggle::OrganizationSettingsTabs.register!
+      end
+
+      initializer "decidim_toggle.webpacker.assets_path" do
+        Decidim.register_assets_path File.expand_path("app/packs", root)
+      end
+
+      # So System::OrganizationsController resolves this before decidim-system's partial.
+      initializer "decidim_toggle.prepend_views" do
+        ActiveSupport.on_load(:action_controller) do
+          prepend_view_path Decidim::Toggle::Engine.root.join("app/views")
+        end
+      end
+
+      config.to_prepare do
+        Decidim::Toggle::ExposeAttributesToJsValidator.validate! if Rails.env.development? || Rails.env.test?
+
+        ActiveSupport.on_load(:action_view) do
+          include Decidim::Toggle::SystemSettingsTabHelper
+          include Decidim::Toggle::JavascriptConfigHelper
+        end
+      end
+    end
+  end
+end

data/lib/decidim/toggle/expose_attributes_to_js.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Decidim
+  module Toggle
+    # Opt-in DSL to expose module config form attributes to +window.DecidimToggle+.
+    # To add this in your form, you need to add the following:
+    # ```ruby
+    # include Decidim::Toggle::ExposeAttributesToJs
+    # expose_to_javascript :enabled, :search_bar
+    # ```
+    module ExposeAttributesToJs
+      extend ActiveSupport::Concern
+
+      class_methods do
+        def expose_to_javascript(*names)
+          javascript_exposed_attribute_names.concat(names.map(&:to_s))
+          javascript_exposed_attribute_names.uniq!
+        end
+
+        def javascript_exposed_attribute_names
+          @javascript_exposed_attribute_names ||= []
+        end
+      end
+    end
+  end
+end

data/lib/decidim/toggle/expose_attributes_to_js_validator.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module Decidim
+  module Toggle
+    module ExposeAttributesToJsValidator
+      module_function
+
+      def validate!
+        registry = SettingsTabRegistry.find(:organization_settings)
+        return unless registry
+
+        registry.ensure_configurations_applied!
+        registry.module_configs.each_value do |entry|
+          validate_form!(entry[:form])
+        end
+      end
+
+      def validate_form!(form_class)
+        return unless form_class
+        return unless form_class.included_modules.include?(ExposeAttributesToJs)
+
+        form_class.javascript_exposed_attribute_names.each do |attr|
+          next if form_class.attribute_names.include?(attr)
+
+          Rails.logger.warn(
+            "[decidim-toggle] #{form_class} exposes unknown attribute #{attr.inspect} to JS"
+          )
+        end
+      end
+    end
+  end
+end

data/lib/decidim/toggle/gem_registry.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Decidim
+  module Toggle
+    # Detects whether a Ruby gem is loaded in the current Bundler bundle.
+    class GemRegistry
+      def self.present?(gem_name)
+        name = gem_name.to_s
+        return false if name.blank?
+
+        Bundler.load.specs.any? { |spec| spec.name == name }
+      end
+    end
+  end
+end

data/lib/decidim/toggle/informative_callouts.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+module Decidim
+  module Toggle
+    # Declare form-level informative callouts (info, warning, danger) on toggle settings forms.
+    #
+    #   class MyForm < Decidim::Form
+    #     include Decidim::Toggle::InformativeCallouts
+    #
+    #     info :management_callout_html
+    #     warning :conditional_callout, if_predicate: ->(form) { form.some_flag? }
+    #
+    #     def management_callout_html
+    #       I18n.t("...")
+    #     end
+    #   end
+    #
+    # +message+ is always a Symbol naming an instance method on the form.
+    # Messages are rendered as HTML (sanitized by the announcement cell), wrapped in
+    # +decidim_toggle_informative_callout+ for system typography styles.
+    module InformativeCallouts
+      extend ActiveSupport::Concern
+
+      WRAPPER_CLASS = "decidim_toggle_informative_callout"
+      CALLOUT_TYPES = [:info, :warning, :danger].freeze
+
+      class InformativeEntry
+        attr_reader :type, :message, :if_predicate
+
+        def initialize(type:, message:, if_predicate: nil)
+          @type = type
+          @message = message
+          @if_predicate = if_predicate
+        end
+
+        def visible?(form)
+          return true if if_predicate.nil?
+
+          if_predicate.call(form)
+        end
+
+        def message_for(form)
+          form.public_send(message)
+        end
+      end
+
+      class_methods do
+        def informative_callouts
+          @informative_callouts ||= []
+        end
+
+        def info(message, if_predicate: nil)
+          register_informative(:info, message, if_predicate:)
+        end
+
+        def warning(message, if_predicate: nil)
+          register_informative(:warning, message, if_predicate:)
+        end
+
+        def danger(message, if_predicate: nil)
+          register_informative(:danger, message, if_predicate:)
+        end
+
+        private
+
+        def register_informative(type, message, if_predicate: nil)
+          informative_callouts << InformativeEntry.new(type:, message:, if_predicate:)
+        end
+      end
+
+      def visible_informative_callouts
+        self.class.informative_callouts.select { |entry| entry.visible?(self) }
+      end
+    end
+  end
+end

data/lib/decidim/toggle/javascript_config.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+module Decidim
+  module Toggle
+    class JavascriptConfig
+      SUPPORTED_VALUE_CLASSES = [TrueClass, FalseClass, String, Integer, Float, NilClass].freeze
+
+      class << self
+        def for(organization, registry_name: :organization_settings)
+          return {} if organization.blank?
+
+          registry = SettingsTabRegistry.find(registry_name)
+          return {} unless registry
+
+          registry.ensure_configurations_applied!
+          build_from_registry(organization, registry)
+        end
+
+        private
+
+        def build_from_registry(organization, registry)
+          registry.module_configs.each_with_object({}) do |(module_name, entry), flat_config|
+            form_class = entry[:form]
+            next unless form_class&.included_modules&.include?(ExposeAttributesToJs)
+
+            exposed = form_class.javascript_exposed_attribute_names
+            next if exposed.empty?
+
+            module_config = Decidim::Toggle.config_for(organization, module_name, registry_name: registry.registry_name)
+            merge_exposed_attributes!(flat_config, module_name, module_config, form_class, exposed)
+          end
+        end
+
+        def merge_exposed_attributes!(flat_config, module_name, module_config, form_class, exposed)
+          exposed.each do |attr|
+            type = form_class.attribute_types[attr]
+            raw = module_config[attr]
+            value = serialize_value(raw, type)
+            next if value.nil? && !supported_scalar?(raw)
+
+            flat_config["#{module_name}.#{attr}"] = value
+          end
+        end
+
+        def serialize_value(value, _type)
+          return value if supported_scalar?(value)
+          return value.map { |element| serialize_element(element) } if value.is_a?(Array)
+          return stringify_hash(value) if value.is_a?(Hash)
+
+          warn_unsupported_type(value)
+          nil
+        end
+
+        def supported_scalar?(value)
+          SUPPORTED_VALUE_CLASSES.any? { |klass| value.is_a?(klass) }
+        end
+
+        def serialize_element(element)
+          return stringify_hash(element) if element.is_a?(Hash)
+
+          element
+        end
+
+        def stringify_hash(hash)
+          hash.to_h.transform_keys(&:to_s).transform_values do |value|
+            case value
+            when Hash
+              stringify_hash(value)
+            when Array
+              value.map { |element| serialize_element(element) }
+            else
+              value
+            end
+          end
+        end
+
+        def warn_unsupported_type(value)
+          return unless Rails.env.development? || Rails.env.test?
+
+          Rails.logger.warn(
+            "[decidim-toggle] Skipping unsupported JavaScript config value #{value.class}"
+          )
+        end
+      end
+    end
+  end
+end