decidim-ub 0.1.0

data/README.md

@@ -0,0 +1,51 @@
+# Decidim::Ub
+
+[![[CI] Lint](https://github.com/Platoniq/decidim-module-ub/actions/workflows/lint.yml/badge.svg)](https://github.com/Platoniq/decidim-module-ub/actions/workflows/lint.yml)
+[![[CI] Test](https://github.com/Platoniq/decidim-module-ub/actions/workflows/test.yml/badge.svg)](https://github.com/Platoniq/decidim-module-ub/actions/workflows/test.yml)
+[![Maintainability](https://api.codeclimate.com/v1/badges/c975a347c58389448503/maintainability)](https://codeclimate.com/github/Platoniq/decidim-module-ub/maintainability)
+[![Coverage Status](https://coveralls.io/repos/github/Platoniq/decidim-module-ub/badge.svg?branch=main)](https://coveralls.io/github/Platoniq/decidim-module-ub?branch=main)
+
+A Decidim module to sync users from Universitat de Barcelona who connect to the platform.
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem "decidim-ub", git: "https://github.com/Platoniq/decidim-module-ub"
+```
+
+And then execute:
+
+```bash
+bundle
+bundle exec rails decidim_ub:install:migrations
+bundle exec rails db:migrate
+```
+
+## Configuration
+
+You need to configure some environment variables for the OAuth client:
+
+| ENV              | Description                               | Example                     | Default                    |
+|------------------|-------------------------------------------|-----------------------------|----------------------------|
+| UB_CLIENT_ID     | The OAuth2 client ID                      | `your-client-id`            |                            |
+| UB_CLIENT_SECRET | The OAuth2 client secret                  | `your-client-secret`        |                            |
+| UB_SITE          | The OAuth2 site                           | `https://example.org/oauth` |                            |
+| UB_AUTHORIZE_URL | The path for the authorization URL        | `/authorize`                |                            |
+| UB_TOKEN_URL     | The path for the token URL                | `/token`                    |                            |
+| UB_ICON          | The path for the icon shown in the button | `media/images/my_icon.svg`  | `media/images/ub_logo.svg` |
+
+## Contributing
+
+Contributions are welcome !
+
+We expect the contributions to follow the [Decidim's contribution guide](https://github.com/decidim/decidim/blob/develop/CONTRIBUTING.adoc).
+
+## Security
+
+Security is very important to us. If you have any issue regarding security, please disclose the information responsibly by sending an email to __francisco.bolivar [at] nazaries [dot] com__ and not by creating a Github issue.
+
+## License
+
+This engine is distributed under the GNU AFFERO GENERAL PUBLIC LICENSE.

data/Rakefile

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require "decidim/dev/common_rake"
+require "fileutils"
+
+def install_module(path)
+  Dir.chdir(path) do
+    system("bundle exec rake decidim_ub:install:migrations")
+    system("bundle exec rake db:migrate")
+  end
+end
+
+def install_initializer(path, env)
+  Dir.chdir(path) do
+    FileUtils.cp(
+      "#{__dir__}/lib/generators/decidim/app_templates/#{env}/initializer.rb",
+      "config/initializers/decidim_ub_config.rb"
+    )
+  end
+end
+
+def seed_db(path)
+  Dir.chdir(path) do
+    system("bundle exec rake db:seed")
+  end
+end
+
+desc "Generates a dummy app for testing"
+task test_app: "decidim:generate_external_test_app" do
+  ENV["RAILS_ENV"] = "test"
+  install_initializer("spec/decidim_dummy_app", "test")
+  install_module("spec/decidim_dummy_app")
+end
+
+desc "Generates a development app."
+task development_app: "decidim:generate_external_development_app" do
+  install_module("development_app")
+end

data/app/commands/decidim/ub/sync_user.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module Decidim
+  module Ub
+    class SyncUser < Decidim::Command
+      # Public: Initializes the command.
+      #
+      # user - A decidim user
+      # roles - The roles of the user
+      def initialize(user, roles)
+        @user = user
+        @roles = roles
+      end
+
+      # Executes the command. Broadcasts these events:
+      #
+      # - :ok when everything is valid.
+      # - :invalid if we couldn't proceed.
+      #
+      # Returns nothing.
+      def call
+        update_user!
+        ActiveSupport::Notifications.publish("decidim.ub.user.updated", user.id)
+        broadcast(:ok)
+      rescue StandardError => e
+        broadcast(:invalid, e.message)
+      end
+
+      private
+
+      attr_reader :user, :roles
+
+      def update_user!
+        return unless user.ub_identity?
+
+        user.ub_roles = roles
+        user.save!
+      end
+    end
+  end
+end

data/app/controllers/concerns/decidim/devise_authentication_methods.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Decidim
+  module DeviseAuthenticationMethods
+    def first_login_and_not_authorized?(user)
+      return false if user.ub_identity?
+
+      super
+    end
+  end
+end

data/app/forms/decidim/ub/verifications/ub.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+require "digest"
+
+module Decidim
+  module Ub
+    module Verifications
+      class Ub < Decidim::AuthorizationHandler
+        validate :user_valid
+
+        def unique_id
+          Digest::SHA512.hexdigest("#{role}/#{uid}-#{Rails.application.secrets.secret_key_base}")
+        end
+
+        protected
+
+        def organization
+          current_organization || user&.organization
+        end
+
+        def uid
+          user.ub_identity
+        end
+
+        def user_valid
+          errors.add(:user, "decidim.ub.errors.missing_role") unless user.ub_roles.include?(role)
+        end
+
+        def role = raise NotImplementedError
+      end
+    end
+  end
+end

data/app/forms/decidim/ub/verifications/ub_ant.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Decidim
+  module Ub
+    module Verifications
+      class UbAnt < Ub
+        def role = "ANT"
+      end
+    end
+  end
+end

data/app/forms/decidim/ub/verifications/ub_est.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Decidim
+  module Ub
+    module Verifications
+      class UbEst < Ub
+        def role = "EST"
+      end
+    end
+  end
+end

data/app/forms/decidim/ub/verifications/ub_pas.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Decidim
+  module Ub
+    module Verifications
+      class UbPas < Ub
+        def role = "PAS"
+      end
+    end
+  end
+end

data/app/forms/decidim/ub/verifications/ub_pdi.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Decidim
+  module Ub
+    module Verifications
+      class UbPdi < Ub
+        def role = "PDI"
+      end
+    end
+  end
+end

data/app/forms/decidim/ub/verifications/ub_pex.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Decidim
+  module Ub
+    module Verifications
+      class UbPex < Ub
+        def role = "PEX"
+      end
+    end
+  end
+end

data/app/helpers/decidim/ub/omniauth_helper_override.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Decidim
+  module Ub
+    module OmniauthHelperOverride
+      extend ActiveSupport::Concern
+
+      included do
+        alias_method :original_normalize_provider_name, :normalize_provider_name
+
+        def normalize_provider_name(provider)
+          return "Universitat de Barcelona" if provider == :ub
+
+          original_normalize_provider_name(provider)
+        end
+      end
+    end
+  end
+end

data/app/jobs/decidim/ub/auto_verification_job.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module Decidim
+  module Ub
+    class AutoVerificationJob < ApplicationJob
+      queue_as :default
+
+      def perform(user_id)
+        @user = Decidim::User.find(user_id)
+        @auths = Decidim::Ub.roles_to_auth_name(@user.ub_roles & Decidim::Ub::ROLES)
+        update_auths
+      rescue ActiveRecord::RecordNotFound
+        Rails.logger.error "AutoVerificationJob: ERROR: model not found for user #{user_id}"
+      end
+
+      private
+
+      def update_auths
+        current_auths = user_auths.pluck(:name)
+        (current_auths - @auths).each { |name| remove_auth(user_auths.find_by(name:)) }
+        (@auths - current_auths).each { |name| create_auth(name) }
+      end
+
+      def create_auth(name)
+        return unless (handler = Decidim::AuthorizationHandler.handler_for(name, user: @user))
+
+        Decidim::Verifications::AuthorizeUser.call(handler, @user.organization) do
+          on(:ok) do
+            Rails.logger.info "AutoVerificationJob: Success: created auth #{name} for user #{handler.user.id}"
+          end
+
+          on(:invalid) do
+            Rails.logger.error "AutoVerificationJob: ERROR: not created auth #{name} for user #{handler.user&.id}"
+          end
+        end
+      end
+
+      def remove_auth(auth)
+        Decidim::Verifications::DestroyUserAuthorization.call(auth) do
+          on(:ok) do
+            Rails.logger.info "AutoVerificationJob: Success: removed auth #{auth.name} for user #{auth.user.id}"
+          end
+
+          on(:invalid) do
+            Rails.logger.error "AutoVerificationJob: ERROR: not removed auth #{auth.name} for user #{auth.user&.id}"
+          end
+        end
+      end
+
+      def user_auths
+        @user_auths ||= Decidim::Authorization.where(user: @user, name: Decidim::Ub.authorizations)
+      end
+    end
+  end
+end

data/app/jobs/decidim/ub/omniauth_user_sync_job.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module Decidim
+  module Ub
+    class OmniauthUserSyncJob < ApplicationJob
+      queue_as :default
+
+      def perform(data)
+        user = Decidim::User.find(data[:user_id])
+        return unless user.ub_identity?
+
+        Decidim::Ub::SyncUser.call(user, data.dig(:raw_data, :info, :roles)) do
+          on(:ok) do
+            Rails.logger.info "OmniauthUserSyncJob: Success: Ub roles updated for user #{user.id}"
+          end
+
+          on(:invalid) do |message|
+            Rails.logger.error "OmniauthUserSyncJob: ERROR: Error updating ub roles '#{message}'"
+          end
+        end
+      end
+    end
+  end
+end

data/app/models/concerns/decidim/ub/user_override.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Decidim
+  module Ub
+    module UserOverride
+      extend ActiveSupport::Concern
+
+      included do
+        def ub_identity
+          identities.find_by(provider: Decidim::Ub::OMNIAUTH_PROVIDER_NAME)
+        end
+
+        def ub_identity?
+          identities.exists?(provider: Decidim::Ub::OMNIAUTH_PROVIDER_NAME)
+        end
+      end
+    end
+  end
+end

data/app/packs/entrypoints/decidim_ub.js

@@ -0,0 +1,2 @@
+// Images
+require.context("../images", true)