decidim 0.27.4 → 0.28.0.rc5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c958dda215010278a0ce6582de78e72bf5cdaa8440e8fc8acf27d57d87993152
-  data.tar.gz: 22269d1f781eec322459c3e557957a9b732dabe6329c390eb99ae6628718761a
+  metadata.gz: 3542588e3abc24cec044c105541d37d63ef39f5a9cf95c921e6fe875407d0e4b
+  data.tar.gz: b2f86b20df91cf051c01716cca01ab8616a58ae6265de09434f8101964671ad1
 SHA512:
-  metadata.gz: 4b1c36edba7fd712611708e8dfda2d22f1a539907abd04459f7cd934946e0e986dbf5acfd4c9ef63487669854302fca2330df8de47afafbe49d134bd156bb9d1
-  data.tar.gz: f8e8da7daa58ac3ab893d6a8ba20bfb076c9bd8cccdf9d7113eefd47f8784fb38295a7cf264d2b8baff62cb190ab349acc7da31ee1a271341e20dbd3c41e721d
+  metadata.gz: 8282ba5c29c9ba4bae5d7dd99d5538e7f1574117a1600a48378b2ef97d4132a84b26e382b98db8af5410e152699c033643fec662bc5e8afc9198a1d1f2d7ede9
+  data.tar.gz: d0d44042b4c658135202150368ed2df54c3cf30089a7dfe5125384f1172922b9b3cb578bfe0578d29598ba0e7bd1e0211912a9f1aeeed246f662f6b268be1208

data/Rakefile

@@ -3,6 +3,7 @@
 require "bundler/gem_tasks"
 require "rspec/core/rake_task"
 require "decidim/gem_manager"
+require "decidim/release_manager"
 
 RSpec::Core::RakeTask.new(:spec)
 
@@ -57,24 +58,10 @@ task :uninstall_all do
 end
 
 desc "Pushes a new build for each gem and package."
-task release_all: [:update_versions, :check_uncommitted_changes, :check_locale_completeness] do
+task release_all: [:ensure_git_remote, :fetch_git_tags, :update_versions, :fetch_git_tags, :check_uncommitted_changes, :check_locale_completeness] do
   commands = {}
-  Decidim::GemManager.all_dirs do |dir|
-    next if dir.include? "decidim-accountability"
-    next if dir.include? "decidim-admin"
-    next if dir.include? "decidim-api"
-    next if dir.include? "decidim-assemblies"
-
-    commands[dir] = "rake release"
-  end
-  Decidim::GemManager.package_dirs do |dir|
-    next if dir.include? "decidim-accountability"
-    next if dir.include? "decidim-admin"
-    next if dir.include? "decidim-api"
-    next if dir.include? "decidim-assemblies"
-
-    commands[dir] = "npm publish --access public"
-  end
+  Decidim::GemManager.all_dirs { |dir| commands[dir] = "rake release[#{Decidim::ReleaseManager.git_remote}]" }
+  Decidim::GemManager.package_dirs { |dir| commands[dir] = "npm publish --access public" }
 
   commands.each do |dir, command|
     status = Decidim::GemManager.run_at(dir, command)
@@ -83,6 +70,19 @@ task release_all: [:update_versions, :check_uncommitted_changes, :check_locale_c
   end
 end
 
+task :ensure_git_remote do
+  unless Decidim::ReleaseManager.git_remote_set?
+    puts "ABORTING RELEASE"
+    puts ""
+    abort "Please set 'decidim/decidim' as one of your remotes to make a release."
+  end
+end
+
+desc "Fetches the git tags from the correct remote so that they are up to date before the release."
+task :fetch_git_tags do
+  system("git fetch #{Decidim::ReleaseManager.git_remote} --tags --force")
+end
+
 desc "Makes sure there are no uncommitted changes."
 task :check_uncommitted_changes do
   unless system("git diff --exit-code --quiet")
@@ -110,7 +110,7 @@ task development_app: "decidim:generate_external_development_app"
 
 desc "Bundle all Gemfiles"
 task :bundle do
-  [".", "decidim-generators", "decidim_app-design"].each do |dir|
+  [".", "decidim-generators"].each do |dir|
     Bundler.with_original_env do
       puts "Updating #{dir}...\n"
       system!("bundle install", dir)
@@ -118,26 +118,10 @@ task :bundle do
   end
 end
 
-desc "Synchronize npm packages files on the whole repo"
-task :webpack do
-  FileUtils.rm_rf(decidim_app_design_path.join("package-lock.json"))
-  FileUtils.rm_rf(decidim_app_design_path.join("packages"))
-  FileUtils.cp_r(root_folder.join("package.json"), decidim_app_design_path)
-  FileUtils.cp_r(root_folder.join("package-lock.json"), decidim_app_design_path)
-  FileUtils.cp_r(root_folder.join("packages"), decidim_app_design_path)
-
-  system!("npm install", root_folder)
-  system!("npm install", decidim_app_design_path)
-end
-
 def root_folder
   @root_folder ||= Pathname.new(__dir__)
 end
 
-def decidim_app_design_path
-  @decidim_app_design_path ||= Pathname.new(root_folder.join("decidim_app-design"))
-end
-
 def system!(command, path)
   system("cd #{path} && #{command}") || abort("\n== Command #{command} failed ==")
 end

data/decidim-core/lib/decidim/webpacker/configuration.rb

@@ -20,7 +20,7 @@ module Decidim
         load_asset_configurations
 
         # Read the original configuration and append the paths
-        config = YAML.load_file(original_configuration_file_path)
+        config = YAML.load_file(original_configuration_file_path, aliases: true)
         default = config["default"] || {}
         all_additional_paths = default["additional_paths"] || []
         all_additional_paths += additional_paths
@@ -32,7 +32,8 @@ module Decidim
           config[environment] = env_config.merge(
             "additional_paths" => all_additional_paths,
             "entrypoints" => all_entrypoints,
-            "stylesheet_imports" => all_stylesheet_imports
+            "stylesheet_imports" => all_stylesheet_imports,
+            "compile" => (ENV.fetch("SHAKAPACKER_RUNTIME_COMPILE", "false") == "true")
           )
         end
 
@@ -67,7 +68,7 @@ module Decidim
       end
 
       def original_configuration_file_path
-        @original_configuration_file_path = File.join(app_path, "config/webpacker.yml")
+        @original_configuration_file_path = File.join(app_path, "config/shakapacker.yml")
       end
 
       def load_asset_configurations

data/decidim-core/lib/decidim/webpacker/postcss.config.js

@@ -3,14 +3,16 @@
 module.exports = {
   syntax: 'postcss-scss',
   plugins: [
-    require('autoprefixer'),
+    // postcss-import must be the very first plugin https://tailwindcss.com/docs/using-with-preprocessors#build-time-imports
     require('postcss-import'),
+    require('tailwindcss'),
     require('postcss-flexbugs-fixes'),
     require('postcss-preset-env')({
       autoprefixer: {
         flexbox: 'no-2009'
       },
       stage: 3
-    })
+    }),
+    require('autoprefixer')
   ]
 }

data/decidim-core/lib/decidim/webpacker/runner.rb

@@ -16,8 +16,13 @@ module Decidim
       private
 
       def decidim_initialize(_argv)
+        # Write runtime configuration for Tailwind
+        # This method is called here because in Decidim CSS compilation is done via Webpack.
+        # If CSS is decoupled from JS in the future, this call should be removed.
+        Decidim::Assets::Tailwind.write_runtime_configuration
+
         # Write the runtime configuration and override the configuration
-        @webpacker_config = Decidim::Webpacker.configuration.configuration_file
+        @shakapacker_config = Decidim::Webpacker.configuration.configuration_file
       end
     end
   end

data/decidim-core/lib/decidim/webpacker/{webpacker.yml → shakapacker.yml}

@@ -4,11 +4,15 @@
 default: &default
   source_path: app/packs
   source_entry_path: entrypoints
-  public_output_path: decidim-packs
+  nested_entries: true
+  css_extract_ignore_order_warnings: false
+
   public_root_path: public
+  public_output_path: decidim-packs
+  cache_path: tmp/shakapacker
   webpack_compile_output: true
-  cache_path: tmp/webpacker-cache
   extract_css: true
+  shakapacker_precompile: true
 
   additional_paths:
     - node_modules
@@ -17,9 +21,24 @@ default: &default
   # Reload manifest.json on all requests so we reload latest compiled packs
   cache_manifest: false
 
+  # Select loader to use, available options are 'babel' (default), 'swc' or 'esbuild'
+  webpack_loader: 'babel'
+
+  # Set to true to enable check for matching versions of shakapacker gem and NPM package - will raise an error if there is a mismatch or wildcard versioning is used
+  ensure_consistent_versioning: true
+
+  # Select whether the compiler will use SHA digest ('digest' option) or most most recent modified timestamp ('mtime') to determine freshness
+  compiler_strategy: digest
+
+  # Select whether the compiler will always use a content hash and not just in production
+  # Do not use contentHash except for production for performance
+  # https://webpack.js.org/guides/build-performance/#avoid-production-specific-tooling
+  useContentHash: false
+
 development:
   <<: *default
   compile: true
+  compiler_strategy: mtime
   # Compile test packs to decidim decidim-packs folder
 
   # Reference: https://webpack.js.org/configuration/dev-server/
@@ -31,6 +50,8 @@ development:
     port: 3035
     # Hot Module Replacement updates modules while the application is running without a full reload
     hmr: false
+    # mini-css-extract-plugin is a required dependency in both cases.
+    inline_css: true
     client:
       # Should we show a full-screen overlay in the browser when there are compiler errors or warnings?
       overlay: false
@@ -61,5 +82,8 @@ production:
   # Production depends on precompilation of packs prior to booting for performance.
   compile: false
 
+  # Use content hash for naming assets. Cannot be overridden by for production.
+  useContentHash: true
+
   # Cache manifest.json for performance
   cache_manifest: true

data/decidim-core/lib/decidim/webpacker/webpack/custom.js

@@ -1,17 +1,11 @@
 /* eslint-disable */
-const { config } = require("@rails/webpacker");
+const { config } = require("shakapacker");
 const { InjectManifest } = require("workbox-webpack-plugin");
+const TerserPlugin = require('terser-webpack-plugin')
 
 module.exports = {
   module: {
     rules: [
-      {
-        test: require.resolve("quill"),
-        loader: "expose-loader",
-        options: {
-          exposes: ["Quill"]
-        }
-      },
       {
         test: require.resolve("jquery"),
         loader: "expose-loader",
@@ -90,7 +84,29 @@ module.exports = {
   // https://github.com/rails/webpacker/issues/2932
   // As Decidim uses multiple packs, we need to enforce a single runtime, to prevent duplication
   optimization: {
-    runtimeChunk: false
+    minimizer: [
+      new TerserPlugin({
+        parallel: Number.parseInt(process.env.SHAKAPACKER_PARALLEL, 10) || true,
+        terserOptions: {
+          parse: {
+            // Let terser parse ecma 8 code but always output
+            // ES5 compliant code for older browsers
+            ecma: 8
+          },
+          compress: {
+            ecma: 5,
+            warnings: false,
+            comparisons: false
+          },
+          mangle: { safari10: true },
+          output: {
+            ecma: 5,
+            comments: false,
+            ascii_only: true
+          }
+        }
+      })
+    ].filter(Boolean)
   },
   entry: config.entrypoints,
   plugins: [

data/decidim-core/lib/decidim/webpacker/webpack/webpack.config.js

@@ -0,0 +1,10 @@
+/* eslint-disable */
+process.env.NODE_ENV ??= "development"
+
+const { webpackConfig, merge } = require("@decidim/webpacker")
+const customConfig = require("./custom")
+
+webpackConfig.optimization = {}
+const combinedConfig = merge(webpackConfig, customConfig)
+
+module.exports = combinedConfig

data/docs/README.adoc

@@ -1,6 +1,6 @@
 = Decidim Developer Documentation
 
-== What's this?
+== What is this?
 
 This is the internal Decidim documentation.
 If you want to see it in a nice UI you can do it at the https://docs.decidim.org[Decidim Documentation Site].
@@ -10,7 +10,7 @@ Some of the sections are available on https://github.com/decidim/documentation[D
 
 This is made with https://antora.org/[Antora].
 It uses https://asciidoc.org/[AsciiDoc] mark-up document format.
-It's pretty similar to Markdown, although is more standarized and can do more complex things.
+It is pretty similar to Markdown, although is more standarized and can do more complex things.
 Read more about https://asciidoctor.org/docs/asciidoc-vs-markdown/[Markdown vs AsciiDoc].
 
 If you want to convert from Markdown to AsciiDoc:
@@ -56,7 +56,7 @@ Then the result would be:
      branches: develop
 ----
 
-If building locally doesn't show any change, then check also that the branch corresponds with the one that you're working locally.
+If building locally does not show any change, then check also that the branch corresponds with the one that you are working locally.
 
 == Add a new link in the sidebar
 

data/docs/antora.yml

@@ -1,6 +1,6 @@
 name: en
 title: "Decidim Documentation"
-version: v0.27
+version: v0.28
 asciidoc:
   attributes:
     page-lang: en@

data/docs/modules/configure/pages/environment_variables.adoc

@@ -1,6 +1,6 @@
 = Environment Variables
 
-We try to let most of the things defined through Environment Variables, as https://12factor.net/config[12factor applications's config]. You'll need to configure through your hosting provider (for example in Heroku), through a gem like `figaro` or through docker-compose `env_file`.
+We try to let most of the things defined through Environment Variables, as https://12factor.net/config[12factor applications's config]. You will need to configure through your hosting provider (for example in Heroku), through a gem like `figaro` or through docker-compose `env_file`.
 
 This is an extensive list of all the Env variables supported for an application created with the default `decidim` generator (ie: `decidim my-application`). Custom applications may modify or customize the default decidim initializer (`config/initializers/decidim.rb`) in such a a way that this will have no effect.
 
@@ -29,7 +29,7 @@ The next tables show all the default Env Vars available when running a default D
 |No
 
 |_DATABASE_USERNAME_
-|Username for the Postgres database. Note that database name is autogenerated in development mode thus there's no config var here.
+|Username for the Postgres database. Note that database name is autogenerated in development mode thus there is no config var here.
 |
 |No
 
@@ -39,12 +39,12 @@ The next tables show all the default Env Vars available when running a default D
 |No
 
 |*RAILS_ENV*
-|Environment for Ruby on Rails. If it's on your local machine for development, then it should be `development`. If it's on server it should be `production`. Please take care that this has security implications. You DON'T want to be running a production application on development mode.
+|Environment for Ruby on Rails. If it is on your local machine for development, then it should be `development`. If it is on server it should be `production`. Please take care that this has security implications. You DO NOT want to be running a production application on development mode.
 |development
 |No
 
 |*SECRET_KEY_BASE*
-|Secret key base for the Application. It's specially important that this is kept secret from the outside word; do NOT publish it on GitHub/GitLab/BitBucket.
+|Secret key base for the Application. It is specially important that this is kept secret from the outside word; do NOT publish it on GitHub/GitLab/BitBucket.
 |
 |No
 
@@ -270,7 +270,7 @@ Also some more refined configurations:
 |MAPS_API_KEY
 |For a simple geolocation and tile maps service configuration define this value in case the provider needs it (if you are using Here Maps, you will need an API key). See xref:services:maps.adoc[Maps].
 
-*Note that if you are using the `here` service you don't need to do anything else. If using `osm` however check the rest of env vars related to maps for a proper configuration*
+*Note that if you are using the `here` service you do not need to do anything else. If using `osm` however check the rest of env vars related to maps for a proper configuration*
 |
 |No
 
@@ -289,7 +289,7 @@ Also some more refined configurations:
 |No
 
 |MAPS_ATTRIBUTION
-|If you are using a `osm` as a provider, you need to define this variable. OpenStreeMap requires you to show the credits and that's what this does. See xref:services:maps.adoc[Maps].
+|If you are using a `osm` as a provider, you need to define this variable. OpenStreeMap requires you to show the credits and that is what this does. See xref:services:maps.adoc[Maps].
 
 *You need to define this variable if using `osm` as a provider, the next text is a pretty common value: `<a href="https://www.openstreetmap.org/copyright" target="_blank">&copy; OpenStreetMap</a> contributors`*
 |
@@ -312,28 +312,28 @@ Also some more refined configurations:
 |MAPS_DYNAMIC_PROVIDER
 |For advanced cases, you can define this value instead or in combination of MAPS_PROVIDER (which will be the default). This allows to set up different providers for the static tile provider than the dynamic. See xref:services:maps.adoc[Maps].
 
-*Note that you don't need to define this variable for the most common, simple, one provider cases.*
+*Note that you do not need to define this variable for the most common, simple, one provider cases.*
 |
 |No
 
 |MAPS_STATIC_PROVIDER
 |For advanced cases, you can define this value instead or in combination of MAPS_PROVIDER (which will be the default). This allows to set up different providers for the static tile provider than the dynamic. See xref:services:maps.adoc[Maps].
 
-*Note that you don't need to define this variable for the most common, simple, one provider cases.*
+*Note that you do not need to define this variable for the most common, simple, one provider cases.*
 |
 |No
 
 |MAPS_STATIC_API_KEY
 |For advanced cases, you can define this value instead or in combination of MAPS_API_KEY (which will be the default). This allows to set up different providers for the static tile provider than the dynamic requiring different API KEYS. See xref:services:maps.adoc[Maps].
 
-*Note that you don't need to define this variable for the most common, simple, one provider cases.*
+*Note that you do not need to define this variable for the most common, simple, one provider cases.*
 |
 |No
 
 |MAPS_DYNAMIC_API_KEY
 |For advanced cases, you can define this value instead or in combination of MAPS_API_KEY (which will be the default). This allows to set up different providers for the static tile provider than the dynamic requiring different API KEYS. See xref:services:maps.adoc[Maps].
 
-*Note that you don't need to define this variable for the most common, simple, one provider cases.*
+*Note that you do not need to define this variable for the most common, simple, one provider cases.*
 |
 |No
 
@@ -490,7 +490,7 @@ Also some more refined configurations:
 
 `true`: Will redirect to HTTPS always
 
-`false`: Won't redirect to HTTPS
+`false`: Will not redirect to HTTPS
 
 |auto
 |No
@@ -608,7 +608,7 @@ Notice that this is also maximum time that user can idle before getting automati
 |DECIDIM_ENABLE_REMEMBER_ME
 |If set to true, users have option to "remember me".
 
-Notice that expire_session_after won't take effect when the user wants to be remembered.
+Notice that expire_session_after will not take effect when the user wants to be remembered.
 |true
 |No
 
@@ -631,14 +631,26 @@ This does not affect comments as its length can be configured by administrators
 |1000
 |No
 
-|DECIDIM_PASSWORD_BLACKLIST
-|Blacklisted passwords. Array may contain strings and regex entries.
+|DECIDIM_DENIED_PASSWORDS
+|List of Denied passwords. Array may contain strings and regex entries.
 
 Separate each item of the array with a comma AND a space, for instance:
-`i-dont-like-this-password, i-dont-like-this-one-either, password123456`
+`i-do-not-like-this-password, i-do-not-like-this-one-either, password123456`
 |
 |No
 
+|DECIDIM_PASSWORD_SIMILARITY_LENGTH
+|Amount of characters required by parts of a domain (site or email / separated by a dot) for them to be taken into account during a password validation
+|4
+|No
+
+|DECIDIM_SOCIAL_SHARE_SERVICES
+|The social networking services that will be available when using the "Share" feature on some resources.
+
+See xref:customize:social_shares.adoc[Social shares services documentation]
+|X, Facebook, WhatsApp, Telegram
+|No
+
 |DECIDIM_ALLOW_OPEN_REDIRECTS
 |Disable the redirection to the external host when performing redirect back.
 
@@ -657,7 +669,7 @@ Additional context: This has been revealed as an issue during a security audit o
 |No
 
 |DECIDIM_ADMIN_PASSWORD_EXPIRATION_DAYS
-|Defines how many days admin passwords are valid before they need to be reset.
+|Defines how many days admin passwords are valid before they need to be reset. If you want to disable password expiration, you can set this value to `0`.
 |90
 |No
 
@@ -672,7 +684,7 @@ Additional context: This has been revealed as an issue during a security audit o
 |No
 
 |*DECIDIM_SERVICE_WORKER_ENABLED*
-|Enable/Disable the service worker. This is used to enable offline support and to deliver push notifications. In development it's recommended to be disabled because its aggresive cache configuration might cause some issues when submitting forms.
+|Enable/Disable the service worker. This is used to enable offline support and to deliver push notifications. In development it is recommended to be disabled because its aggresive cache configuration might cause some issues when submitting forms.
 |false
 |No
 
@@ -813,7 +825,7 @@ After this time the initiative will be moved to discarded state.
 
 |INITIATIVES_PRINT_ENABLED
 |Print functionality enabled. Allows users to get a printed version of the initiative.
-|true
+|false
 |No
 
 |INITIATIVES_DO_NOT_REQUIRE_AUTHORIZATION
@@ -829,12 +841,12 @@ After this time the initiative will be moved to discarded state.
 |Name |Value |Default value|Multitenant's System configurable
 
 |RAILS_LOG_TO_STDOUT
-|If defined (value is indifferent) it'll show the log content on the shell Standard Out. It's special relevant on certain hosting providers (for example, Heroku or Docker). It's also part of https://12factor.net/logs[12factor's recommendations].
+|If defined (value is indifferent) it will show the log content on the shell Standard Out. It is special relevant on certain hosting providers (for example, Heroku or Docker). It is also part of https://12factor.net/logs[12factor's recommendations].
 |
 |No
 
 |RAILS_SERVE_STATIC_FILES
-|If defined (value is indifferent) it'll serve static files present in the `public` folder of Rails. It's special relevant on certain hosting providers (for example, Heroku or Docker).
+|If defined (value is indifferent) it will serve static files present in the `public` folder of Rails. It is special relevant on certain hosting providers (for example, Heroku or Docker).
 |
 |No
 

data/docs/modules/configure/pages/initializer.adoc

@@ -1,6 +1,6 @@
 = Initializer
 
-There are some settings that you'll need to change in the `config/initializer/decidim.rb` file. We recommend that, whenever it is possible, you use xref:configure:environment_variables.adoc[Environment Variables], as just cleaner and easier to work with.
+There are some settings that you will need to change in the `config/initializer/decidim.rb` file. We recommend that, whenever it is possible, you use xref:configure:environment_variables.adoc[Environment Variables], as just cleaner and easier to work with.
 
 If you need to add special logic or if you feel more comfortable working with Ruby code instead of Environment Variables, then you can of course do all the changes that you need directly in the initializer file. Take into account that this file could be published in a Version Control System (like `git`) so you should be careful with the secrets/API keys that you add here.
 
@@ -8,7 +8,7 @@ Remember to restart your server when making changes in this file.
 
 This is where you can change the behaviour defined on the different components (most notably from `decidim-core`).
 
-After making changes to this file you'll need to also restart your application server.
+After making changes to this file you will need to also restart your application server.
 
 == Application name
 
@@ -268,10 +268,11 @@ An example class would be something like:
 [source,ruby]
 ....
 class MySMSGatewayService
-  attr_reader :mobile_phone_number, :code
-  def initialize(mobile_phone_number, code)
+  attr_reader :mobile_phone_number, :code, :context
+  def initialize(mobile_phone_number, code, context = {})
     @mobile_phone_number = mobile_phone_number
     @code = code
+    @context = context
   end
   def deliver_code
     # Actual code to deliver the code
@@ -280,7 +281,7 @@ class MySMSGatewayService
 end
 ....
 
-Then you'll need to configure it in the Decidim initializer:
+Then you will need to configure it in the Decidim initializer:
 
 [source,ruby]
 ....
@@ -312,7 +313,7 @@ class MyTimestampService
 end
 ....
 
-Then you'll need to configure it in the Decidim initializer:
+Then you will need to configure it in the Decidim initializer:
 
 [source,ruby]
 ....
@@ -440,3 +441,70 @@ To customize export fields, you can subscribe to any serialize event. Every seri
   end
 ....
 
+== Content Security Policy
+Defines additional content security policies following the structure keys are the CSP directives and the values are arrays of allowed sources
+
+List of additional content security policies to be appended to the default ones
+This is useful for adding custom CSPs for external services like Here Maps, YouTube, X (former Twitter) etc.
+
+Below you will find a the recepy of enabling X (former Twitter) timelines, based on https://content-security-policy.com/examples/twitter/[Content Security Policy (CSP) Examples Twitter example].
+The format is a Hash with the following structure:
+[source,ruby]
+....
+  {
+    "script-src": %w(platform.twitter.com syndication.twitter.com),
+    "style-src": %w('sha256-5g0QXxO6NfvHJ6Uf5BK/hqQHtso8ZOdjlnbyKtYLvwc='),
+    "frame-src": %w(platform.twitter.com),
+    "img-src": %w(syndication.twitter.com),
+  }
+....
+
+Additionally, the following example, will allow you to enable Decidim to properly load YouTube videos:
+
+[source,ruby]
+....
+  {
+      "frame-src" => %w(https://www.youtube-nocookie.com/),
+  }
+....
+
+The keys are the CSP directives and the values are arrays of allowed sources
+See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy[CSP in MDN] for more information
+
+Please note, we strongly recommend not to use the wildcard (*) as a allowed source!
+
+The default value for this setting is an empty Hash
+
+We are starting from the following rules defined in `decidim-core` gem:
+[source,ruby]
+....
+  {
+    "default-src" => %w('self' 'unsafe-inline'),
+    "script-src" => %w('self' 'unsafe-inline' 'unsafe-eval'),
+    "style-src" => %w('self' 'unsafe-inline'),
+    "img-src" => %w('self'),
+    "font-src" => %w('self'),
+    "connect-src" => %w('self'),
+    "frame-src" => %w('self'),
+    "media-src" => %w('self')
+  }
+....
+
+And we automatically add the assets host to the `media-src`, `img-src`, `script-src`, `style-src` directives, and the `wss` protocol to the `connect-src` directive.
+To the those rules we are appending the additional content security policies defined at the organization level, if any.
+The order of the directives is the following:
+
+1. The default rules defined in `decidim-core` gem
+2. The content security policies required for serving the assets (defined by asset_host rails config)
+3. The additional content security policies defined by this setting
+4. The additional content security policies defined at the organization level
+
+[source,ruby]
+....
+  config.content_security_policies_extra = {}
+....
+
+Additional Reading:
+
+* https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy[Content-Security-Policy in MDN web docs]
+* xref:customize:content_security_policy.adoc[Customize Content Security Policy]

data/docs/modules/customize/pages/authorizations.adoc

@@ -11,16 +11,22 @@ There are several use cases for this, such as
 * Checking some information through other systems (as a Municipal Census on the case of Municipalities, Cities or Towns)
 * Having a list of valid users emails
 
-Right now Decidim supports only a few of these cases, but we have an internal API where you can program your own kind of authorizations.
-Introduction
+Currently Decidim supports only a few of these cases, but we have an internal API where you can program your own kind of authorizations.
 
-Each decidim instance is in full control of its authorizations, and can customize:
+== Introduction
+
+Each Decidim instance is in full control of its authorizations, and can customize:
 
 * The different methods to be used by users to get verified. For example, through a census, by uploading their identity documents, or by receiving a verification home at their address.
 * The different actions in decidim that require authorization, and which authorization method they require. For example, a decidim instance might choose to require census authorization to create proposals, but a fully verified address via a verification code sent by postal mail for voting on proposals.
 
 See https://github.com/decidim/decidim/blob/develop/decidim-verifications/README.md[decidim-verifications's README] and https://decidim.org/modules[Decidim's Modules page].
 
+The default Decidim application comes pre-configured with some example authorization strategies that you can test to get familiar with the system. If you want to verify yourself with these strategies, please follow these instructions:
+
+- For the "Example authorization" strategy, use a document number ended with "X". Other details can be as you wish.
+- For the "Another example authorization", use a passport number starting with "A". Other details can be as you wish.
+
 == Examples
 
 Here are some examples: