decidim-trusted_ids 0.12.0

data/config/locales/it.yml

@@ -0,0 +1,168 @@
+---
+it:
+  activemodel:
+    errors:
+      messages:
+        invalid_icon_path_format: must be in the format media/images/filename
+        icon_path_not_found: the icon file does not exist in the registered asset paths
+    attributes:
+      trusted_ids_census_config:
+        census_expiration_apply_all_tenants: 'Apply to all tenants (this will set
+          the same expiration days for all organizations in this platform). Warning:
+          empty values are also propagated'
+        census_tos_apply_all_tenants: 'Apply to all tenants (this will set the same
+          "Terms of service" for all organizations in this platform). Warning: empty
+          values are also propagated'
+        settings:
+          expiration_days: Expires in (days). If empty, defaults to %{days} days.
+          ine: Requester identifier (INE)
+          municipal_code: Municipal code
+          nif: NIF
+          organization_name: Public organization name
+          province_code: Province code
+          tos: Terms of service for consulting the census
+        tos_if_empty_html: 'If empty, the default terms of service will be extracted
+          from the I18n key <code>decidim.via_oberta.verifications.tos.content_html</code>.
+          Currently:'
+      via_oberta_handler:
+        document_type: 'Could not be obtained automatically. Please select one from
+          the list:'
+  decidim:
+    authorization_handlers:
+      trusted_ids_handler:
+        explanation: This authorization is granted to all users who use a login method
+          with a trusted identifier.
+        fields:
+          extra: Additional information
+          provider: Provider
+          uid: ID
+        name: Trusted identifier
+      via_oberta_handler:
+        explanation: This authorization is granted to all users who are in the Via
+          Oberta census database.
+        fields:
+          document_id: DNI/NIF
+        name: Via Oberta
+    events:
+      trusted_ids:
+        verifications:
+          invalid:
+            email_intro: It has not been possible to grant you the "%{handler_name}"
+              authorization.
+            email_outro: Please, contact the support at your platform to check what
+              has gone wrong.
+            email_subject: Authorization error
+            notification_title: Invalid authorization with the "%{handler_name}" method
+          ok:
+            email_intro: You have been granted the "%{handler_name}" authorization.
+            email_outro: You can now perform all actions that require the "%{handler_name}"
+              authorization.
+            email_subject: Authorization successful
+            notification_title: Successful authorization with the "%{handler_name}"
+              method
+    system:
+      organizations:
+        omniauth_settings:
+          icon_path: Icon path. If is empty, the default icon will be used.
+          valid:
+            client_id: Client ID
+            client_secret: Client secret
+            scope: Scope
+            site: Provider URL
+    trusted_ids:
+      devise:
+        sessions:
+          new:
+            login: Log in
+            login_subtitle: Log in to Decidim and participate.
+            unverified_login: Other unverified identification methods
+            verified_identity: Digital identity verified with %{provider}
+            verified_identity_html: |
+              <p>Access with systems recognized by official providers that certify your identity on the network, for more secure authentications.</p>
+              <ul>
+                <li>idCat Mòbil</li>
+                <li>idCat Certificat</li>
+                <li>DNIe</li>
+                <li>Cl@ve PIN</li>
+              </ul>
+            verified_login: Continue with verified identification
+      providers:
+        default:
+          description: This authorization is granted to all users who use a login
+            method with a trusted identifier.
+          name: Trusted identifier
+        valid:
+          description: VÀLid is a service that AOC provides to Catalan public administrations
+            to integrate the different available digital identification mechanisms (idCAT
+            Mòbil, digital certificates and Cl@ve).
+          name: VÀLid
+      sessions:
+        different_omniauth_emails: You are trying to sign in with a different email
+          than the one in your account. Please sign in with the same email or log
+          out and sign up directly to create a new user.
+      system:
+        settings: "%{handler} settings"
+      verifications:
+        form:
+          cancel: Cancel verification
+          description_html: In order to obtain this authorization, you need to verify
+            your identity with the %{provider} service. To do that, please click on
+            the "%{link}" button.<br><br>
+          error_provider_html: "<b>%{provider} is not available.</b> It seems that
+            this login/authorization method has not been enabled. Please contact the
+            support team to fix this."
+          warning_html: Please make sure that the email you have in this application
+            (<em>%{email}</em>) is the same as the one provided by the %{provider}
+            service. Otherwise the verification will fail.
+    verifications:
+      authorizations:
+        errors:
+          already_verified: You have already verified your identity with this method.
+          pending_authorization: This authorization method requires having the %{handler_name}
+            authorization previously granted.
+        first_login:
+          actions:
+            trusted_ids_generic: Verify with %{provider}
+            via_oberta_handler: Verify with Via Oberta
+      trusted_ids:
+        errors:
+          invalid_census: Could not verify you. The data provided to the census gateway
+            might not be valid.
+          invalid_id: Could not verify you. The document identifier is invalid or
+            not present in the census.
+          invalid_method: Could not verify you. OAuth2 verification method is not
+            supported.
+          invalid_status: Could not verify you. OAuth2 verification was not ok.
+          invalid_type: Could not verify you. The document type is invalid or not
+            present in the census.
+          no_identity: Could not verify you. OAuth2 verification did not return an
+            identification.
+    via_oberta:
+      verifications:
+        document_type:
+          nie: NIE
+          nif: NIF
+          others: Residence permit or others
+          passport: Passport
+        form:
+          code: 'Error code: %{code}'
+          data: 'Data that will be sent:'
+          description_html: <p>This authorization checks if you are in the <b>%{organization_name}</b>
+            census database.</p> <p>To perform this check, the following information
+            will be sent to the <a href="https://www.aoc.cat/serveis-aoc/via-oberta/"
+            target="_blank">Via Oberta Service</a>, provided by the <a href="https://www.aoc.cat"
+            target="_blank">Administració Oberta de Catalunya</a></p> <p>This information
+            will be used for the sole purpose of verifying your identity but records
+            of this transaction might be kept by the service provider.</p>
+          document_id: Document Number
+          document_type: Document type
+          error: 'Service error message:'
+        tos:
+          agreement: I accept the terms of use and service conditions
+          content_html: |
+            <p>In order to verify that you are registered as a person in the municipality, an automated query must be made through Via Oberta to the local data of the municipal population register.</p>
+            <ol>
+            <li>You can consult the specific data processing/protection policy at the <a href="https://www.aoc.cat/proteccio-dades/">following link</a></li>
+            <li>Do you give your consent?</li>
+            </ol>
+          title: Via Oberta terms of use and service

data/config/locales/oc.yml

@@ -0,0 +1,132 @@
+---
+oc:
+  activemodel:
+    errors:
+      messages:
+        invalid_icon_path_format: deu aver lo format media/images/filename
+        icon_path_not_found: lo fichièr d'icòna existís pas dins los camins d'assets registrats
+    attributes:
+      trusted_ids_census_config:
+        census_expiration_apply_all_tenants: 'Aplicar a totes los "tenants" (aquò establís los meteisses jorns de caducitat per a totas las organizacions d''aquesta plataforma). Avís: los valors voids tanben se propagan'
+        census_tos_apply_all_tenants: 'Aplicar a totes los "tenants" (aquò establís los meteisses "Tèrmes d''usatge e condicions" per a totas las organizacions d''aquesta plataforma). Avís: los valors voids tanben se propagan'
+        settings:
+          expiration_days: Expira en (jorns). Se es void, los jorns per defaut son %{days}.
+          ine: Identificador del solicitant (INE)
+          municipal_code: Còdi municipal
+          nif: NIF
+          organization_name: Nom public de l'organizacion
+          province_code: Còdi de província
+          tos: Tèrmes d'usatge e servici per consultar lo cens
+        tos_if_empty_html: 'Se es void, las condicions del servici predeterminadas se tiraràn de la clau I18n <code>decidim.via_oberta.verifications.tos.content_html</code>. Actualament:'
+      via_oberta_handler:
+        document_type: 'Se pòt pas obténer automaticament. Seleccionatz-ne un de la lista:'
+  decidim:
+    authorization_handlers:
+      trusted_ids_handler:
+        explanation: Aquesta autorizacion s'atorga a totes los utilizaires que utilizan un metòde d'inici de session amb identificador fidedigne.
+        fields:
+          extra: Informacion addicionala
+          provider: Provesidor
+          uid: ID
+        name: Identificador fidedigne
+      via_oberta_handler:
+        explanation: Aquesta autorizacion s'atorga a totes los utilizaires que son dins la basa de donadas del cens de Via Oberta.
+        fields:
+          document_id: DNI/NIF
+        name: Via Oberta
+    events:
+      trusted_ids:
+        verifications:
+          invalid:
+            email_intro: Es pas estat possible de vos concedir l'autorizacion "%{handler_name}".
+            email_outro: Se vos plai, metètz-vos en contacte amb lo supòrt de la plataforma per comprovar l'error que s'es produch.
+            email_subject: Error d'autorizacion
+            notification_title: Autorizacion pas valida amb lo metòde "%{handler_name}"
+          ok:
+            email_intro: Se vos a concedit l'autorizacion "%{handler_name}".
+            email_outro: Ara podètz realizar totas las accions que requerisson l'autorizacion "%{handler_name}".
+            email_subject: S'es autorizat corrèctament
+            notification_title: Autorizacion corrècta amb lo metòde "%{handler_name}"
+    system:
+      organizations:
+        omniauth_settings:
+          valid:
+            client_id: Client ID
+            client_secret: Clau secreta del client
+            icon_path: Icòna. Se es void, l'icòna per defaut serà utilizat.
+            scope: Encastre
+            site: URL del provesidor
+    trusted_ids:
+      devise:
+        sessions:
+          new:
+            login: Iniciatz la session
+            login_subtitle: Iniciatz la session a Decidim e participatz.
+            unverified_login: Autres metòdes d'identificacion pas verificada
+            verified_identity: Identificacion digitala verificada amb %{provider}
+            verified_identity_html: |
+              <p>Accedissètz amb de sistèmas reconeguts per de provesidors oficials que acreditan vòstra identitat sus la ret, per d'autenticacions mai seguras.</p>
+              <ul>
+                <li>idCat Mòbil</li>
+                <li>idCat Certificat</li>
+                <li>DNIe</li>
+                <li>Cl@ve PIN</li>
+              </ul>
+            verified_login: Contunhar amb identificacion verificada
+      providers:
+        default:
+          description: Aquesta autorizacion s'atorga a totes los utilizaires que utilizan un metòde d'inici de session amb identificador fidedigne.
+          name: Identificador fidedigne
+        valid:
+          description: VÀLid es un servici que l'AOC met a disposicion de las administracions publicas catalanas amb la finalitat d'integrar los diferents mecanismes d'identificacion digitala disponibles (idCAT Mòbil, certificats digitals e Cl@ve).
+          name: VÀLid
+      sessions:
+        different_omniauth_emails: Sètz a ensajar d'iniciar la session amb una adreça electronica diferenta de la de vòstre compte. Accedissètz amb la meteissa adreça electronica o tampatz la session e enregistratz-vos amb lo boton dirècte per crear un utilizaire novèl.
+      system:
+        settings: "configuracion de %{handler}"
+      verifications:
+        form:
+          cancel: Anullar la verificacion
+          description_html: Per obténer aquesta autorizacion, vos cal verificar vòstra identitat amb lo servici %{provider}. Per aquò, clicatz sul boton "%{link}".<br><br>
+          error_provider_html: "<b>%{provider} es pas disponible.</b> Sembla que aqueste metòde d'inici de session/autorizacion es pas estat activat. Metètz-vos en contacte amb lo supòrt de la plataforma per o resòlvre."
+          warning_html: Asseguratz-vos que l'adreça electronica qu'avètz dins aquesta aplicacion (<em>%{email}</em>) siá la meteissa que la que vos provesís lo servici %{provider}. Se non, la verificacion fracassarà.
+    verifications:
+      authorizations:
+        errors:
+          already_verified: Ja avètz verificat vòstra identitat amb aqueste metòde.
+          pending_authorization: Aqueste metòde d'autorizacion requerís d'aver prealablament l'autorizacion %{handler_name}.
+        first_login:
+          actions:
+            trusted_ids_generic: Verificatz-vos amb %{provider}
+            via_oberta_handler: Verificatz-vos amb Via Oberta
+      trusted_ids:
+        errors:
+          invalid_census: Se pòt pas verificar. Es possible que las donadas provesidas a la passarela del cens sián pas validas.
+          invalid_id: Se pòt pas verificar. L'identificador del document es pas valid o se tròba pas dins lo cens.
+          invalid_method: Vos avètz pas pogut verificar. Lo metòde de verificacion OAuth2 es pas suportat.
+          invalid_status: Vos avètz pas pogut verificar. La verificacion OAuth2 es estada incorrècta.
+          invalid_type: Se pòt pas verificar. Lo tipe de document es pas valid o es pas dins lo cens.
+          no_identity: Se pòt pas verificar. La verificacion OAuth2 a pas retornat cap d'identificacion.
+    via_oberta:
+      verifications:
+        document_type:
+          nie: NIE
+          nif: NIF
+          others: Permés de residéncia o autres
+          passport: Passapòrt
+        form:
+          code: 'Còdi d''error: %{code}'
+          data: 'Donadas que s''enviaràn:'
+          description_html: <p>Aquesta autorizacion verifica se sètz dins la basa de donadas del cens <b>%{organization_name}</b>.</p> <p>Per realizar aquesta comprovacion, s'enviarà l'informacion seguenta al <a href="https://www.aoc.cat/serveis-aoc/via-oberta/" target="_blank">Servici Via Oberta</a>, provesit per l'<a href="https://www.aoc.cat" target="_blank">Administració Oberta de Catalunya</a></p> <p>Aquesta informacion serà utilizada amb l'unic objectiu de verificar vòstra identitat, mas los registres d'aquesta transaccion pòdon èsser conservats pel provesidor de servicis.</p>
+          document_id: Numèro de document
+          document_type: Tipe de document
+          error: 'Messatge d''error del servici:'
+        tos:
+          agreement: Accepti los tèrmes d'usatge e condicions del servici
+          content_html: |
+            <p>Per poder verificar que constatz coma persona empadronada al municipi, cal far una consulta automatizada mejançant Via Oberta a las donadas localas del padrón municipal d'abitants.</p>
+            <ol>
+            <li>Podètz consultar la politica concreta de tractament/proteccion de donadas al <a href="https://www.aoc.cat/proteccio-dades/">ligam seguent</a></li>
+            <li>Balhatz vòstre consentiment?</li>
+            </ol>
+          title: Tèrmes d'usatge e servici Via Oberta

data/config/locales/zz_fallbacks.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+handler = {
+  decidim: {
+    authorization_handlers: {
+      trusted_ids_handler: {
+        name: lambda { |_key, _options|
+          I18n.t("decidim.trusted_ids.providers.#{Decidim::TrustedIds.omniauth_provider}.name",
+                 default: I18n.t("decidim.trusted_ids.providers.default.name"))
+        },
+        explanation: lambda { |_key, _options|
+          I18n.t("decidim.trusted_ids.providers.#{Decidim::TrustedIds.omniauth_provider}.description",
+                 default: I18n.t("decidim.trusted_ids.providers.default.description"))
+        }
+      },
+      trusted_ids_census_handler: {
+        name: lambda { |_key, _options|
+          I18n.t("decidim.authorization_handlers.#{Decidim::TrustedIds.census_authorization[:handler]}.name",
+                 default: Decidim::TrustedIds.census_authorization[:handler])
+        },
+        explanation: lambda { |_key, _options|
+          I18n.t("decidim.authorization_handlers.#{Decidim::TrustedIds.census_authorization[:handler]}.description",
+                 default: Decidim::TrustedIds.census_authorization[:handler])
+        }
+      }
+    },
+    verifications: {
+      authorizations: {
+        first_login: {
+          actions: {
+            trusted_ids_handler: lambda { |_key, _options|
+              I18n.t("decidim.verifications.authorizations.first_login.actions.trusted_ids_generic",
+                     provider: I18n.t("decidim.trusted_ids.providers.#{Decidim::TrustedIds.omniauth_provider}.name",
+                                      default: I18n.t("decidim.trusted_ids.providers.default.name")))
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+Decidim.available_locales.index_with do |_locale|
+  handler
+end

data/db/migrate/20230718082548_create_organization_trusted_ids_config.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+class CreateOrganizationTrustedIdsConfig < ActiveRecord::Migration[6.0]
+  def change
+    create_table :organization_trusted_ids_configs do |t|
+      t.integer :decidim_organization_id, null: false, index: { name: "index_decidim_trusted_ids_organization" }
+      t.string :handler
+      t.jsonb :settings, null: false, default: {}
+      t.integer :expiration_days
+      t.jsonb :tos, null: false, default: {}
+      t.timestamps
+    end
+  end
+end

data/lib/decidim/trusted_ids/engine.rb

@@ -0,0 +1,181 @@
+# frozen_string_literal: true
+
+require "omniauth/strategies"
+require "deface"
+
+module Decidim
+  module TrustedIds
+    # This is the engine that runs on the public interface of trusted_ids.
+    class Engine < ::Rails::Engine
+      isolate_namespace Decidim::TrustedIds
+
+      config.to_prepare do
+        # Non-controller overrides here
+        Decidim::Organization.include(Decidim::TrustedIds::OrganizationOverride)
+        Decidim::Authorization.include(Decidim::TrustedIds::AuthorizationOverride)
+        Decidim::System::RegisterOrganizationForm.include(Decidim::TrustedIds::System::OrganizationFormOverride)
+        Decidim::System::UpdateOrganizationForm.include(Decidim::TrustedIds::System::OrganizationFormOverride)
+        Decidim::System::UpdateOrganization.include(Decidim::TrustedIds::System::UpdateOrganizationOverride)
+        Decidim::System::CreateOrganization.include(Decidim::TrustedIds::System::CreateOrganizationOverride)
+      end
+
+      initializer "decidim_trusted_ids.controller_addons", after: "decidim.action_controller" do
+        config.to_prepare do
+          # Adds some global css/javascript to the application
+          Decidim::Devise::SessionsController.include(Decidim::TrustedIds::NeedsTrustedIdsSnippets)
+          Decidim::Devise::OmniauthRegistrationsController.include(Decidim::TrustedIds::CheckOmniauthEmailOnLogin)
+          Decidim::Verifications::AuthorizationsController.include(Decidim::TrustedIds::NeedsTrustedIdsSnippets)
+          Decidim::Verifications::AuthorizationsController.include(Decidim::TrustedIds::CheckExistingAuthorizations)
+          Decidim::Admin::ImpersonationsController.include(Decidim::TrustedIds::Admin::ImpersonationsControllerOverride)
+        end
+      end
+
+      # This initializer is used to configure using ENV variables
+      # Done here to make it compatible with gems like dotenv-rails/figaro/figjam that load configur is initialized
+      initializer "decidim_trusted_ids.configuration" do
+        set_default = lambda do |attribute, value|
+          Decidim::TrustedIds.public_send(attribute).nil? &&
+            Decidim::TrustedIds.public_send("#{attribute}=", value)
+        end
+
+        set_default.call(
+          :omniauth_provider,
+          ENV.fetch("OMNIAUTH_PROVIDER", "valid")
+        )
+
+        set_default.call(
+          :authorization_metadata,
+          Decidim::TrustedIds.omniauth_metadata_attributes || {
+            expires_at: [:credentials, :expires_at],
+            identifier_type: [:extra, :identifier_type],
+            method: [:extra, :method],
+            assurance_level: [:extra, :assurance_level]
+          }
+        )
+
+        set_default.call(
+          :omniauth,
+          {
+            enabled: Decidim::TrustedIds.to_bool(
+              ENV.fetch(
+                "OMNIAUTH_ENABLED_BY_DEFAULT",
+                Decidim::TrustedIds.omniauth_env("CLIENT_ID").present?
+              )
+            ),
+            client_id: Decidim::TrustedIds.omniauth_env("CLIENT_ID"),
+            client_secret: Decidim::TrustedIds.omniauth_env("CLIENT_SECRET"),
+            site: Decidim::TrustedIds.omniauth_env("SITE", "https://valid.aoc.cat"),
+            icon_path: Decidim::TrustedIds.omniauth_env(
+              "ICON",
+              "media/images/#{Decidim::TrustedIds.omniauth_provider.downcase}-icon.png"
+            ),
+            scope: Decidim::TrustedIds.omniauth_env("SCOPE", "autenticacio_usuari")
+          }
+        )
+
+        set_default.call(
+          :omniauth_global_attributes,
+          ENV.fetch("OMNIAUTH_GLOBAL_ATTRIBUTES", "site scope").split.map(&:to_sym)
+        )
+
+        set_default.call(
+          :custom_login_screen,
+          Decidim::TrustedIds.to_bool(
+            ENV.fetch("CUSTOM_LOGIN_SCREEN", true)
+          )
+        )
+
+        set_default.call(
+          :verification_expiration_time,
+          ENV.fetch("VERIFICATION_EXPIRATION_TIME", 90).to_i.days
+        )
+
+        set_default.call(
+          :send_verification_notifications,
+          if ENV.has_key?("SEND_VERIFICATION_NOTIFICATIONS")
+            Decidim::TrustedIds.to_bool(ENV.fetch("SEND_VERIFICATION_NOTIFICATIONS"))
+          else
+            true
+          end
+        )
+
+        set_default.call(
+          :census_authorization,
+          {
+            handler: if ENV.has_key?("CENSUS_AUTHORIZATION_HANDLER")
+                       ENV.fetch("CENSUS_AUTHORIZATION_HANDLER").to_sym
+                     else
+                       :via_oberta_handler
+                     end,
+            form: ENV.fetch(
+              "CENSUS_AUTHORIZATION_FORM",
+              "Decidim::ViaOberta::Verifications::ViaObertaHandler"
+            ),
+            env: ENV.fetch("CENSUS_AUTHORIZATION_ENV", "production"),
+            api_url: ENV.fetch("CENSUS_AUTHORIZATION_API_URL", nil),
+            system_attributes: ENV.fetch(
+              "CENSUS_AUTHORIZATION_SYSTEM_ATTRIBUTES",
+              "nif ine municipal_code province_code organization_name"
+            ).split
+          }
+        )
+      end
+
+      initializer "decidim_trusted_ids.omniauth" do
+        omniauth = Decidim::TrustedIds.omniauth
+        next unless omniauth && Decidim::TrustedIds.omniauth_provider.present?
+
+        omniauth[:icon_path] = "media/images/#{Decidim::TrustedIds.omniauth_provider.downcase}-icon.png" if omniauth[:icon_path].blank?
+        omniauth[:scope] = "autenticacio_usuari" if omniauth[:scope].blank?
+
+        global_attributes = Decidim::TrustedIds.omniauth_global_attributes
+        # Decidim configuration decide whether to show the omniauth provider
+        Decidim.omniauth_providers[Decidim::TrustedIds.omniauth_provider.to_sym] = omniauth.except(*global_attributes)
+
+        Rails.application.config.middleware.use OmniAuth::Builder do
+          provider Decidim::TrustedIds.omniauth_provider,
+                   setup: lambda { |env|
+                     request = Rack::Request.new(env)
+                     organization = Decidim::Organization.find_by(host: request.host)
+                     provider_config = organization.omniauth_settings&.filter_map do |key, value|
+                       next unless key.start_with?("omniauth_settings_#{Decidim::TrustedIds.omniauth_provider}")
+
+                       attribute = Decidim::OmniauthProvider.extract_setting_key(key, Decidim::TrustedIds.omniauth_provider)
+                       [attribute, value.presence ? Decidim::AttributeEncryptor.decrypt(value) : omniauth[attribute]]
+                     end.to_h
+
+                     omniauth.each do |key, value|
+                       env["omniauth.strategy"].options[key] = provider_config[key].presence || value
+                     end
+                   }
+        end
+      end
+
+      initializer "decidim_trusted_ids.authorizations" do
+        # Triggers user verification after login/registration
+        ActiveSupport::Notifications.subscribe(/decidim\.user\.omniauth_(registration|login)/) do |_name, data|
+          Decidim::TrustedIds::OmniauthVerificationJob.perform_later(data)
+        end
+
+        # Generic verification method for the integrated OAuth mechanism
+        Decidim::Verifications.register_workflow(:trusted_ids_handler) do |workflow|
+          workflow.form = "Decidim::TrustedIds::Verifications::TrustedIdsHandler"
+          workflow.expires_in = Decidim::TrustedIds.verification_expiration_time.to_i
+        end
+        # Census verification
+        if Decidim::TrustedIds.census_authorization[:handler].present?
+          Decidim::Verifications.register_workflow(Decidim::TrustedIds.census_authorization[:handler].to_sym) do |workflow|
+            workflow.form = Decidim::TrustedIds.census_authorization[:form]
+            workflow.expires_in = Decidim::TrustedIds.verification_expiration_time.to_i
+          end
+        end
+
+        Decidim.icons.register(name: "valid-fill", icon: "valid-fill", category: "social icon", description: "", engine: :core)
+      end
+
+      initializer "decidim_trusted_ids.webpacker.assets_path" do
+        Decidim.register_assets_path File.expand_path("app/packs", root)
+      end
+    end
+  end
+end

data/lib/decidim/trusted_ids/test/factories.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require "decidim/core/test/factories"
+require "decidim/system/test/factories"
+
+FactoryBot.define do
+  factory :trusted_ids_organization_config, class: "Decidim::TrustedIds::OrganizationConfig" do
+    organization
+    handler { "via_oberta_handler" }
+    settings do
+      {
+        nif: "12345678Z",
+        ine: "123456789",
+        municipal_code: "9999",
+        province_code: "08"
+      }
+    end
+    expiration_days { 30 }
+    tos { Decidim::Faker::Localized.wrapped("<p>", "</p>") { generate_localized_title } }
+  end
+end

data/lib/decidim/trusted_ids/verifications.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+# require_relative "verifications/trusted_ids_authorizer"
+
+module Decidim
+  module TrustedIds
+    module Verifications
+    end
+  end
+end

data/lib/decidim/trusted_ids/version.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module Decidim
+  # This holds the decidim-trusted_ids version.
+  module TrustedIds
+    VERSION = "0.12.0"
+    DECIDIM_VERSION = "0.31.7"
+    COMPAT_DECIDIM_VERSION = [">= 0.31", "< 0.32"].freeze
+  end
+end

data/lib/decidim/trusted_ids.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+require "decidim/trusted_ids/verifications"
+require "decidim/trusted_ids/engine"
+
+module Decidim
+  module TrustedIds
+    include ActiveSupport::Configurable
+
+    def self.omniauth_env(key, default = nil)
+      ENV.fetch("#{TrustedIds.omniauth_provider.upcase}_#{key}", default)
+    end
+
+    def self.to_bool(val)
+      ActiveRecord::Type::Boolean.new.deserialize(val.to_s.downcase)
+    end
+
+    def self.omniauth_metadata_attributes
+      valid_keys = ENV.keys.filter { |key| key.starts_with?("#{TrustedIds.omniauth_provider.upcase}_METADATA_") }
+      return nil if valid_keys.blank?
+
+      valid_keys.to_h do |key|
+        [key.gsub("#{TrustedIds.omniauth_provider.upcase}_METADATA_", "").downcase.to_sym, ENV[key].split.map(&:to_sym)]
+      end
+    end
+
+    # The name of the omniauth provider, must be registered in Decidim.
+    # Leave it empty to disable omniauth authentication.
+    config_accessor :omniauth_provider
+
+    # From the data obtained we extract metadata to be saved as part of the authorization
+    # This data can later be used by the census_authorization handler as to call the webservice
+    # A hash with keys and how to find it inside hash comming from the OAuth
+    config_accessor :authorization_metadata
+
+    # setup a hash with :client_id, :client_secret and :site to enable omniauth authentication
+    config_accessor :omniauth
+
+    # which of the former attributes can not set a the /system configuration, there are all the same for all tenants
+    config_accessor :omniauth_global_attributes
+
+    # wheter to use a custom login screen or the default one
+    config_accessor :custom_login_screen
+
+    # how long the verification will be valid, defaults to 90 days
+    # if empty or nil, the verification will never expire
+    config_accessor :verification_expiration_time
+
+    # if false, no notifications will be send to users when automatic verifications are performed
+    config_accessor :send_verification_notifications
+
+    # Linked authorization method that will automatically verify users after getting a valid TrustedIds verification
+    config_accessor :census_authorization
+
+    def self.census_config_attributes
+      return [] if TrustedIds.census_authorization[:handler].blank?
+      return [] if TrustedIds.census_authorization[:system_attributes].blank?
+      return [] unless TrustedIds.census_authorization[:system_attributes].is_a?(Array)
+
+      TrustedIds.census_authorization[:system_attributes].map do |prop|
+        [prop.to_sym, String]
+      end
+    end
+
+    def self.custom_login_screen?
+      Decidim::TrustedIds.omniauth_provider.present? && Decidim::TrustedIds.custom_login_screen.present?
+    end
+  end
+end