decidim-trusted_ids 0.12.0

data/app/forms/concerns/decidim/trusted_ids/system/organization_form_override.rb

@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+module Decidim
+  module TrustedIds
+    module System
+      module OrganizationFormOverride
+        extend ActiveSupport::Concern
+        include Decidim::AttributeObject::TypeMap
+
+        # Prepended into the form class so that super() correctly resolves to
+        # the core's encrypted_omniauth_settings. When icon_path is blank, sets the
+        # default path via the jsonb sub-attribute setter BEFORE calling super, so
+        # the core picks it up and encrypts it correctly. Empty string would be truthy
+        # in omniauth_settings and cause oauth_icon → external_icon("") to crash.
+        module EncryptedOmniauthSettingsOverride
+          def encrypted_omniauth_settings
+            provider = Decidim::TrustedIds.omniauth_provider
+            icon_attr = :"omniauth_settings_#{provider}_icon_path"
+            enabled_attr = :"omniauth_settings_#{provider}_enabled"
+
+            # Only normalize blank icon_path when the provider is being enabled.
+            # If not enabled, we leave all settings blank so the core can return nil
+            # (preserving ENV-var-based configuration).
+            if public_send(enabled_attr) && public_send(icon_attr).blank?
+              default = Decidim::TrustedIds.omniauth[:icon_path].presence ||
+                        "media/images/#{provider.downcase}-icon.png"
+              public_send(:"#{icon_attr}=", default)
+            end
+
+            super
+          end
+        end
+
+        included do
+          prepend EncryptedOmniauthSettingsOverride
+
+          jsonb_attribute :trusted_ids_census_settings, TrustedIds.census_config_attributes
+          attribute :trusted_ids_census_expiration_days, Integer
+          translatable_attribute :trusted_ids_census_tos, String
+          attribute :census_expiration_apply_all_tenants, Boolean
+          attribute :census_tos_apply_all_tenants, Boolean
+
+          validate :validate_icon_path
+
+          def map_model(model)
+            self.secondary_hosts = model.secondary_hosts.join("\n")
+            self.omniauth_settings = (model.omniauth_settings || {}).transform_values do |v|
+              Decidim::OmniauthProvider.value_defined?(v) ? Decidim::AttributeEncryptor.decrypt(v) : v
+            end
+            self.file_upload_settings = Decidim::System::FileUploadSettingsForm.from_model(model.file_upload_settings)
+
+            self.trusted_ids_census_settings = model.trusted_ids_census_config&.settings || {}
+            self.trusted_ids_census_expiration_days = model.trusted_ids_census_config&.expiration_days
+            self.trusted_ids_census_tos = model.trusted_ids_census_config&.tos || {}
+          end
+
+          def default_expiration_days
+            @default_expiration_days ||= Decidim::TrustedIds.verification_expiration_time.to_i / 86_400
+          end
+
+          def default_icon_path
+            Decidim::TrustedIds.omniauth[:icon_path].presence ||
+              "media/images/#{Decidim::TrustedIds.omniauth_provider.downcase}-icon.png"
+          end
+        end
+
+        private
+
+        def validate_icon_path
+          # jsonb_attribute generates a getter method for each sub-field that handles
+          # both string and symbol hash keys. Use it instead of direct hash access.
+          icon_key = :"omniauth_settings_#{Decidim::TrustedIds.omniauth_provider}_icon_path"
+          path = public_send(icon_key)
+          return if path.blank? # blank = will use default on save, always valid
+
+          # Must follow the media/images/ format expected by Shakapacker
+          unless path.start_with?("media/images/")
+            errors.add(icon_key, :invalid_icon_path_format)
+            return
+          end
+
+          # File must exist in the module's registered assets images directory.
+          # This is future-proof: any new icon added to app/packs/images/ will
+          # automatically pass this validation without needing code changes.
+          filename = path.delete_prefix("media/images/")
+          file_exists = Decidim::TrustedIds::Engine.root.join("app/packs/images", filename).exist?
+
+          errors.add(icon_key, :icon_path_not_found) unless file_exists
+        end
+      end
+    end
+  end
+end

data/app/forms/decidim/trusted_ids/verifications/trusted_ids_handler.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module Decidim
+  module TrustedIds
+    module Verifications
+      class TrustedIdsHandler < AuthorizationHandler
+        attribute :provider, String
+        attribute :uid, String
+        attribute :raw_data
+
+        validates :uid, presence: true
+        validate :trusted_ids_provider?
+        validate :exising_trusted_ids_identity?
+
+        def metadata
+          super.merge(
+            uid: uid,
+            provider: provider,
+            extra: extra_attributes
+          )
+        end
+
+        def unique_id
+          Digest::SHA512.hexdigest(
+            "#{uid}-#{user&.decidim_organization_id}-#{Rails.application.secret_key_base}"
+          )
+        end
+
+        # no public attributes
+        def form_attributes
+          attributes.except(:id, :user, :provider, :uid, :extra).keys
+        end
+
+        def to_partial_path
+          "decidim/trusted_ids/verifications/form"
+        end
+
+        private
+
+        def extra_attributes
+          return {} unless TrustedIds.authorization_metadata.respond_to? :map
+
+          TrustedIds.authorization_metadata.to_h do |key, parts|
+            parts = [parts] unless parts.is_a? Array
+            [key, raw_data.dig(*parts)]
+          end
+        end
+
+        def trusted_ids_provider?
+          return false if errors.any?
+          return false if provider == TrustedIds.omniauth_provider.to_s
+
+          errors.add(:base, I18n.t("decidim.verifications.trusted_ids.errors.invalid_method"))
+        end
+
+        def exising_trusted_ids_identity?
+          return false if errors.any?
+          return false if user&.identities&.exists?(provider: TrustedIds.omniauth_provider)
+
+          errors.add(:base, I18n.t("decidim.verifications.trusted_ids.errors.no_identity"))
+        end
+      end
+    end
+  end
+end

data/app/forms/decidim/via_oberta/verifications/via_oberta_handler.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+module Decidim
+  module ViaOberta
+    module Verifications
+      class ViaObertaHandler < AuthorizationHandler
+        # VALID:  1=NIF, 2=NIE, 3=Passaport, 4=Altres
+        # VIAOBERTA: 1=NIF, 2=passaport, 3=permís residència, 4=NIE
+        DOCUMENT_TYPE = {
+          1 => :nif,
+          2 => :nie,
+          3 => :passport,
+          4 => :others
+        }.freeze
+
+        attribute :document_id, String
+        attribute :document_type, Integer
+        attribute :tos_agreement, Boolean
+        validates :document_id, :document_type, presence: true
+        validates :tos_agreement, allow_nil: false, acceptance: true
+
+        validate :existing_via_oberta_identity
+
+        attr_reader :response_error, :response_code
+
+        def unique_id
+          return unless organization
+          return unless census_response.success?
+
+          Digest::SHA256.hexdigest(
+            "#{document_id}-#{user&.decidim_organization_id}-#{Rails.application.secret_key_base}"
+          )
+        end
+
+        # use from previous authorization metadata. We don't allow user input here to prevent spoofing
+        # not memoized because @document_id would be defined if sent via form
+        def document_id
+          trusted_authorization&.metadata&.dig("uid") || impersonated_document_id
+        end
+
+        # use from previous authorization metadata or use the one from the form as a fallback
+        # not memoized because @document_id would be defined if sent via form
+        def document_type
+          document_type_from_metadata || DOCUMENT_TYPE[attributes[:document_type]]
+        end
+
+        def document_type_from_metadata
+          @document_type_from_metadata ||= DOCUMENT_TYPE[trusted_authorization&.metadata&.dig("extra", "identifier_type").to_i]
+        end
+
+        def document_types
+          @document_types ||= DOCUMENT_TYPE.map { |k, v| [I18n.t("decidim.via_oberta.verifications.document_type.#{v}", default: v.to_s), k] }
+        end
+
+        def document_type_string
+          return "" unless document_type
+
+          I18n.t("decidim.via_oberta.verifications.document_type.#{document_type}", default: document_type.to_s)
+        end
+
+        def census_response
+          @census_response ||= ViaOberta::Api::Request.new(document_id: document_id, document_type: document_type, organization: organization).response
+        end
+
+        def existing_via_oberta_identity
+          return unless tos_agreement
+
+          return errors.add(:base, I18n.t("decidim.verifications.trusted_ids.errors.invalid_id")) if document_id.blank?
+          return errors.add(:base, I18n.t("decidim.verifications.trusted_ids.errors.invalid_type")) if document_type.blank?
+
+          return if census_response.found?
+
+          errors.add(:base, I18n.t("decidim.verifications.trusted_ids.errors.invalid_census"))
+          @response_error = census_response.error
+          @response_code = census_response.code
+        end
+
+        # # no public attributes
+        def form_attributes
+          attributes.except(:id, :user, :document_id, :document_type).keys
+        end
+
+        def to_partial_path
+          "decidim/via_oberta/verifications/form"
+        end
+
+        private
+
+        def impersonated_document_id
+          attributes[:document_id] if user&.managed?
+        end
+
+        def trusted_authorization
+          @trusted_authorization ||= Decidim::Authorization.find_by(name: "trusted_ids_handler", user: user)
+        end
+
+        def organization
+          user&.organization
+        end
+      end
+    end
+  end
+end

data/app/jobs/decidim/trusted_ids/application_job.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module Decidim
+  module TrustedIds
+    class ApplicationJob < ActiveJob::Base
+    end
+  end
+end

data/app/jobs/decidim/trusted_ids/omniauth_verification_job.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+module Decidim
+  module TrustedIds
+    class OmniauthVerificationJob < ApplicationJob
+      queue_as :default
+
+      def perform(data)
+        @data = data
+
+        unless data[:provider].to_s == Decidim::TrustedIds.omniauth_provider.to_s
+          Rails.logger.debug { "OmniauthVerificationJob: Omniauth [#{data[:provider]}] is not a valid trusted_ids provider (#{Decidim::TrustedIds.omniauth_provider})" }
+          return
+        end
+
+        unless trusted_ids_identity?
+          Rails.logger.error "OmniauthVerificationJob: User #{user.id} does not have a trusted_ids (#{Decidim::TrustedIds.omniauth_provider}) identity"
+          return
+        end
+
+        authorize_user!
+      end
+
+      private
+
+      attr_reader :data
+
+      def user
+        @user ||= Decidim::User.find(data[:user_id])
+      end
+
+      def trusted_ids_identity?
+        @trusted_ids_identity ||= user&.identities&.exists?(provider: Decidim::TrustedIds.omniauth_provider)
+      end
+
+      def handler
+        @handler ||= Decidim::AuthorizationHandler.handler_for("trusted_ids_handler", user: user, uid: data[:uid], provider: data[:provider], raw_data: data[:raw_data])
+      end
+
+      def authorization
+        @authorization ||= Decidim::Authorization.find_by(unique_id: handler.unique_id)
+      end
+
+      def authorize_user!
+        already_granted = authorization&.granted?
+        Decidim::Verifications::AuthorizeUser.call(handler, user.organization) do
+          on(:ok) do
+            notify_user(user, :ok) unless already_granted
+          end
+
+          on(:invalid) do
+            Rails.logger.error "OmniauthVerificationJob: User #{user.id} could not be authorized with #{handler.provider}. Errors: #{handler.errors.full_messages}"
+            notify_user(user, :invalid)
+          end
+        end
+      end
+
+      def notify_user(user, status)
+        return unless Decidim::TrustedIds.send_verification_notifications
+
+        notification_class = status == :ok ? Decidim::TrustedIds::Verifications::SuccessNotification : Decidim::TrustedIds::Verifications::InvalidNotification
+        Decidim::EventsManager.publish(
+          event: "decidim.events.trusted_ids.verifications.#{status}",
+          event_class: notification_class,
+          resource: authorization,
+          affected_users: [user],
+          extra: {
+            status: status.to_s,
+            errors: handler.errors.full_messages,
+            force_email: true
+          }
+        )
+      end
+    end
+  end
+end

data/app/jobs/decidim/trusted_ids/system/propagate_census_config_job.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module Decidim
+  module TrustedIds
+    module System
+      class PropagateCensusConfigJob < ApplicationJob
+        queue_as :default
+
+        def perform(config_id, keys)
+          @config = Decidim::TrustedIds::OrganizationConfig.find_by(id: config_id)
+          return unless @config
+          return if keys.blank?
+
+          propagate_config!(@config.organization, keys)
+        end
+
+        def propagate_config!(organization, keys)
+          Decidim::Organization.where.not(id: organization).find_each do |tenant|
+            config = Decidim::TrustedIds::OrganizationConfig.find_or_create_by(organization: tenant)
+            config.expiration_days = @config.expiration_days if keys.include?(:expiration_days)
+            config.tos = @config.tos if keys.include?(:tos)
+
+            config.save!
+          end
+        end
+      end
+    end
+  end
+end

data/app/jobs/decidim/trusted_ids/system/propagate_census_settings_job.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module Decidim
+  module TrustedIds
+    module System
+      class PropagateCensusSettingsJob < ApplicationJob
+        queue_as :default
+
+        def perform(config_id, keys)
+          @config = Decidim::TrustedIds::OrganizationConfig.find_by(id: config_id)
+          return unless @config
+
+          propagate_settings!(@config.organization, keys)
+        end
+
+        def propagate_settings!(organization, keys)
+          Decidim::Organization.where.not(id: organization).find_each do |tenant|
+            conf = Decidim::TrustedIds::OrganizationConfig.find_or_create_by(organization: tenant)
+            keys.each do |key|
+              conf.settings[key] = @config.settings[key]
+            end
+
+            conf.save!
+          end
+        end
+      end
+    end
+  end
+end

data/app/models/concerns/decidim/trusted_ids/authorization_override.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Decidim
+  module TrustedIds
+    module AuthorizationOverride
+      extend ActiveSupport::Concern
+
+      included do
+        # allows to configure the expiration time with the organization config properties
+        def expires_at
+          return unless workflow_manifest
+
+          expires_in = organization.trusted_ids_census_config&.expiration_days&.days&.to_i || workflow_manifest.expires_in # rubocop:disable Style/SafeNavigationChainLength
+          return if expires_in.zero?
+
+          (granted_at || created_at) + expires_in
+        end
+      end
+    end
+  end
+end

data/app/models/concerns/decidim/trusted_ids/organization_override.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Decidim
+  module TrustedIds
+    module OrganizationOverride
+      extend ActiveSupport::Concern
+
+      included do
+        has_one :trusted_ids_census_config,
+                foreign_key: "decidim_organization_id",
+                class_name: "Decidim::TrustedIds::OrganizationConfig",
+                inverse_of: :organization,
+                dependent: :destroy
+      end
+    end
+  end
+end

data/app/models/decidim/trusted_ids/organization_config.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module Decidim
+  module TrustedIds
+    class OrganizationConfig < ApplicationRecord
+      include Decidim::TranslatableResource
+      include Decidim::TranslatableAttributes
+      self.table_name = "organization_trusted_ids_configs"
+
+      belongs_to :organization,
+                 foreign_key: "decidim_organization_id",
+                 class_name: "Decidim::Organization"
+      translatable_fields :tos
+
+      def translated_tos
+        translated_attribute(tos, organization).presence || I18n.t("content_html", scope: "decidim.via_oberta.verifications.tos")
+      end
+    end
+  end
+end

data/app/overrides/decidim/devise/sessions/new/add_trusted_id_buttons.html.erb.deface

@@ -0,0 +1,3 @@
+<!-- replace "erb[loud]:contains('decidim/devise/shared/omniauth_buttons')" -->
+
+<%= render "decidim/trusted_ids/devise/sessions/login_box" %>

data/app/overrides/decidim/devise/sessions/new/wrap_default_login_form.html.erb.deface

@@ -0,0 +1,4 @@
+<!-- replace "erb[loud]:contains('decidim_form_for')" -->
+
+<% override_login = Decidim::TrustedIds.custom_login_screen? && Devise.mappings[:user].omniauthable? && current_organization.enabled_omniauth_providers&.include?(Decidim::TrustedIds.omniauth_provider&.to_sym) %>
+<%= decidim_form_for(resource, namespace: "session", as: resource_name, url: session_path(resource_name), html: {class: "new_user decidim-login #{'hide' if override_login}"}) do |f| %>

data/app/overrides/decidim/devise/shared/_omniauth_buttons/replace_button_content.html.erb.deface

@@ -0,0 +1,17 @@
+<!-- replace "erb[loud]:contains('oauth_icon provider')" -->
+
+<%= begin
+  if provider.to_s == Decidim::TrustedIds.omniauth_provider.to_s
+    # For the VÀLid provider, fall back to the default PNG icon when
+    # icon_path is not configured in the organization's omniauth settings or in the module's omniauth settings.
+    settings = current_organization.enabled_omniauth_providers[provider]
+    icon_path = settings&.dig(:icon_path).presence ||
+                Decidim::TrustedIds.omniauth[:icon_path].presence ||
+                "media/images/#{Decidim::TrustedIds.omniauth_provider.downcase}-icon.png"
+    external_icon(icon_path)
+  else
+    oauth_icon provider
+  end
+rescue ::Shakapacker::Manifest::MissingEntryError
+  nil
+end %>

data/app/overrides/decidim/devise/shared/_omniauth_buttons/skip_trusted_ids_provider.html.erb.deface

@@ -0,0 +1,3 @@
+<!-- insert_after "erb[silent]:contains('current_organization.enabled_omniauth_providers.keys.each')" -->
+
+<% next if controller_name == "sessions" && action_name == "new" && provider == Decidim::TrustedIds.omniauth_provider&.to_sym && Decidim::TrustedIds.custom_login_screen? %>

data/app/overrides/decidim/system/organizations/_advanced_settings/settings_form.html.erb.deface

@@ -0,0 +1,3 @@
+<!-- insert_top "#advanced-settings-panel" -->
+
+<%= render "decidim/trusted_ids/system/organizations/settings_form", f: f %>

data/app/overrides/decidim/system/organizations/_omniauth_provider/add_icon_placeholder.html.erb.deface

@@ -0,0 +1,3 @@
+<!-- replace "erb[loud]:contains(':icon_path')" -->
+
+<%= render "decidim/trusted_ids/system/organizations/icon_path_placeholder", f: f, setting: setting, i18n_scope: i18n_scope, provider: provider  %>

data/app/overrides/layouts/decidim/_head/add_trusted_ids_tags.html.erb.deface

@@ -0,0 +1,11 @@
+
+<!-- insert_after "erb[loud]:contains('append_stylesheet_pack_tag')" -->
+
+<%#
+  The CSS must be added to the header because the CSS files are not loaded on all screens.
+  To avoid making a more complex override of the Devise view, it is added to the header as is done
+  in other modules like Decidim Awesome.
+%>
+
+<% append_stylesheet_pack_tag "decidim_trusted_ids", media: "all" %>
+

data/app/packs/entrypoints/decidim_trusted_ids.js

@@ -0,0 +1,3 @@
+import "../stylesheets/decidim/trusted_ids/oauth_icons.scss";
+// Images
+require.context("../images", true)

data/app/packs/images/idcat_mobil-icon.svg

@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="44" height="56" viewBox="0 0 44 56">
+  <g id="valid-fill" fill="#FFF" fill-rule="evenodd">
+    <path fill-rule="nonzero" d="M11.53 6.73L2.07 6.73 2.07.09 11.53.09 11.53 6.73zM2.07 9.4L11.53 9.4 11.53 34.19 2.07 34.19 2.07 9.4zM42.71 34.19L33.59 34.19 33.59 31.47 33.5 31.47C32.3 33.04 30.87 34.81 26.24 34.81 19.24 34.81 15.82 27.89 15.82 21.68 15.82 15.85 18.07 8.78 26.38 8.78 29.05573 8.70308662 31.5954717 9.95797374 33.16 12.13L33.26 12.13 33.26.13 42.71.13 42.71 34.19zM29.44 15.66C26.04 15.66 25.28 18.86 25.28 21.77 25.28 24.68 26.04 27.93 29.44 27.93 32.84 27.93 33.59 24.73 33.59 21.77 33.59 18.81 32.83 15.66 29.44 15.66z"/>
+    <path d="M10.94,46.13 C10.8353818,44.8627645 9.77151075,43.8904562 8.5,43.9 C6.31,43.9 5.61,46.02 5.61,48.06 C5.61,50.1 6.31,52.22 8.5,52.22 C10.07,52.22 10.68,51.12 10.96,49.69 L15.55,49.69 C15.55,52.75 13.06,56 8.62,56 C3.72,56 0.94,52.54 0.94,48.06 C0.94,43.28 3.94,40.12 8.62,40.12 C12.79,40.12 15.08,42.32 15.48,46.12 L10.94,46.13 Z"/>
+    <path fill-rule="nonzero" d="M21.7,40.48 L26.27,40.48 L31.79,55.64 L27,55.64 L26.36,53.47 L21.49,53.47 L20.81,55.64 L16.12,55.64 L21.7,40.48 Z M25.38,50.22 L24,45.55 L22.53,50.22 L25.38,50.22 Z"/>
+    <polygon points="34.93 44.36 30.68 44.36 30.68 40.48 43.85 40.48 43.85 44.36 39.6 44.36 39.6 55.64 34.93 55.64"/>
+  </g>
+</svg>

data/app/packs/stylesheets/decidim/trusted_ids/oauth_icons.scss

@@ -0,0 +1,75 @@
+/* Decidim has a bug when using external_icon method that automatically adds a display:none inline css */
+
+.social-register,
+.button--social,
+.button--unverified-login {
+  display: flex;
+  padding: 0 1.5rem 0 0;
+  min-width: 250px;
+  color: #fff;
+  height: 50px;
+  text-decoration-line: none;
+  font-weight: normal;
+
+  .button--social__icon {
+    img.icon.external-icon {
+      display: inline-block !important;
+    }
+  }
+}
+
+.login__omniauth-button {
+  background-color: var(--secondary) !important;
+  border-color: var(--secondary) !important;
+
+  img.icon.external-icon {
+    display: inline-block !important;
+  }
+}
+
+.login__omniauth-button > span {
+  color: white !important;
+}
+
+.button--social,
+.button--valid {
+  background-color: var(--secondary);
+  justify-content: center;
+  align-items: center;
+  gap: 0.5rem;
+  padding: 0 0.5rem;
+}
+
+.button--unverified-login {
+  border-color: var(--secondary);
+  background-color: var(--secondary);
+  color: white;
+}
+
+.trusted-ids-login-box {
+  background: #fff;
+  border: 1px solid #ccc;
+  border-radius: 15px;
+  padding: 2em !important;
+  margin-top: 2em;
+
+  h6 {
+    font-size: 1em;
+    font-weight: 600;
+    margin-top: 2em;
+  }
+
+  hr {
+    width: 80%;
+    margin: 2em auto;
+  }
+
+  ul {
+    margin-left: 1.25rem;
+    list-style-type: disc !important;
+  }
+}
+
+.hide {
+  display: none;
+}