decidim 0.4.4 → 0.5.0

data/decidim-core/app/controllers/concerns/decidim/impersonate_users.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module Decidim
+  # Shared behaviour for controllers that need user impersonation logic.
+  module ImpersonateUsers
+    extend ActiveSupport::Concern
+
+    included do
+      before_action :check_impersonation_log_expired
+
+      helper_method :impersonation_session_ends_at, :impersonation_session_remaining_duration_in_minutes
+
+      alias_method :real_user, :current_user
+
+      # Returns a manager user if the real user has an active impersonation
+      def current_user
+        managed_user || real_user
+      end
+
+      def impersonation_session_ends_at
+        @impersonation_session_ends_at ||= impersonation_log.started_at + Decidim::ImpersonationLog::SESSION_TIME_IN_MINUTES.minutes
+      end
+
+      def impersonation_session_remaining_duration_in_minutes
+        ((impersonation_session_ends_at - Time.current) / 60).round
+      end
+
+      private
+
+      # Returns the managed user impersonated by an admin if exists
+      def managed_user
+        return unless can_impersonate_users?
+        impersonation_log&.user
+      end
+
+      # Check if the active impersonation session has expired or not.
+      def check_impersonation_log_expired
+        return unless can_impersonate_users? && impersonation_log
+
+        if impersonation_log.expired?
+          impersonation_log.ended_at = Time.current
+          impersonation_log.save!
+          flash[:alert] = I18n.t("managed_users.expired_session", scope: "decidim")
+          redirect_to decidim_admin.managed_users_path
+        end
+      end
+
+      # Gets the ability instance for the real user logged in.
+      def real_ability
+        @real_ability ||= current_ability_klass.new(real_user, ability_context)
+      end
+
+      def can_impersonate_users?
+        real_user && real_ability.can?(:impersonate, :managed_users)
+      end
+
+      def impersonation_log
+        @impersonation_log ||= Decidim::ImpersonationLog
+                               .where(admin: real_user)
+                               .active
+                               .first
+      end
+    end
+  end
+end

data/decidim-core/app/controllers/concerns/decidim/locale_switcher.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module Decidim
+  # Common logic to switch between locales.
+  module LocaleSwitcher
+    extend ActiveSupport::Concern
+
+    included do
+      before_action :set_locale
+      helper_method :current_locale, :available_locales, :default_locale
+
+      # Sets the locale for the current session.
+      #
+      # Returns nothing.
+      def set_locale
+        locale = if params["locale"]
+                   params["locale"]
+                 elsif current_user && current_user.locale.present?
+                   current_user.locale
+                 end
+
+        I18n.locale = available_locales.include?(locale) ? locale : default_locale
+      end
+
+      # Adds the current locale to all the URLs generated by url_for so users
+      # experience a consistent behaviour if they copy or share links.
+      #
+      # Returns a Hash.
+      def default_url_options
+        return {} if current_locale == default_locale.to_s
+
+        { locale: current_locale }
+      end
+
+      # The current locale for the user. Available as a helper for the views.
+      #
+      # Returns a String.
+      def current_locale
+        @current_locale ||= I18n.locale.to_s
+      end
+
+      # The available locales in the application. Available as a helper for the
+      # views.
+      #
+      # Returns an Array of Strings.
+      def available_locales
+        @available_locales ||= current_organization.available_locales
+      end
+
+      # The default locale of this organization.
+      #
+      # Returns a String with the default locale.
+      def default_locale
+        @default_locale ||= (current_organization || Decidim).public_send(:default_locale)
+      end
+    end
+  end
+end

data/decidim-core/app/controllers/concerns/decidim/needs_authorization.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module Decidim
+  # Shared behaviour for controllers that need authorization to work.
+  module NeedsAuthorization
+    extend ActiveSupport::Concern
+
+    included do
+      check_authorization
+
+      rescue_from CanCan::AccessDenied, with: :user_not_authorized
+      rescue_from ActionAuthorization::Unauthorized, with: :user_not_authorized
+
+      private
+
+      # Overwrites `cancancan`'s method to point to the correct ability class,
+      # since the gem expects the ability class to be in the root namespace.
+      def current_ability
+        @current_ability ||= current_ability_klass.new(current_user, ability_context)
+      end
+
+      def ability_context
+        {
+          current_settings: try(:current_settings),
+          feature_settings: try(:feature_settings),
+          current_organization: try(:current_organization),
+          current_feature: try(:current_feature)
+        }
+      end
+
+      # Handles the case when a user visits a path that is not allowed to them.
+      # Redirects the user to the root path and shows a flash message telling
+      # them they are not authorized.
+      def user_not_authorized
+        flash[:alert] = t("actions.unauthorized", scope: "decidim.core")
+        redirect_to(request.referrer || user_not_authorized_path)
+      end
+
+      def user_not_authorized_path
+        raise NotImplementedError
+      end
+    end
+  end
+end

data/decidim-core/app/controllers/concerns/decidim/needs_organization.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module Decidim
+  # Shared behaviour for controllers that need an organization present in order
+  # to work. The organization is injected via the CurrentOrganization
+  # middleware.
+  module NeedsOrganization
+    def self.enhance_controller(instance_or_module)
+      instance_or_module.class_eval do
+        before_action :verify_organization
+        helper_method :current_organization
+      end
+    end
+
+    def self.extended(base)
+      base.extend InstanceMethods
+
+      enhance_controller(base)
+    end
+
+    def self.included(base)
+      base.include InstanceMethods
+
+      enhance_controller(base)
+    end
+
+    module InstanceMethods
+      # The current organization for the request.
+      #
+      # Returns an Organization.
+      def current_organization
+        @current_organization ||= request.env["decidim.current_organization"]
+      end
+
+      private
+
+      def verify_organization
+        redirect_to decidim_system.root_path unless current_organization
+      end
+    end
+  end
+end

data/decidim-core/app/controllers/concerns/decidim/needs_participatory_process.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module Decidim
+  # This module, when injected into a controller, ensures there's a
+  # Participatory Process available and deducts it from the context.
+  module NeedsParticipatoryProcess
+    def self.enhance_controller(instance_or_module)
+      instance_or_module.class_eval do
+        helper_method :current_participatory_process
+      end
+    end
+
+    def self.extended(base)
+      base.extend NeedsOrganization, InstanceMethods
+
+      enhance_controller(base)
+    end
+
+    def self.included(base)
+      base.include NeedsOrganization, InstanceMethods
+
+      enhance_controller(base)
+    end
+
+    module InstanceMethods
+      # Public: Finds the current Participatory Process given this controller's
+      # context.
+      #
+      # Returns the current ParticipatoryProcess.
+      def current_participatory_process
+        @current_participatory_process ||= detect_participatory_process
+      end
+
+      private
+
+      def ability_context
+        super.merge(current_participatory_process: current_participatory_process)
+      end
+
+      def detect_participatory_process
+        request.env["current_participatory_process"] ||
+          OrganizationParticipatoryProcesses.new(current_organization).query.find(params[:participatory_process_id] || params[:id])
+      end
+    end
+  end
+end

data/decidim-core/app/controllers/concerns/decidim/paginable.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module Decidim
+  # Common logic to paginate resources
+  module Paginable
+    extend ActiveSupport::Concern
+
+    OPTIONS = [20, 50, 100].freeze
+
+    included do
+      helper_method :per_page
+
+      def paginate(resources)
+        resources.page(params[:page]).per(per_page)
+      end
+
+      def per_page
+        params[:per_page] || OPTIONS.first
+      end
+    end
+  end
+end

data/decidim-core/app/controllers/concerns/decidim/payload_info.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module Decidim
+  module PayloadInfo
+    extend ActiveSupport::Concern
+
+    included do
+      def append_info_to_payload(payload)
+        super
+        payload[:user_id] = try(:current_user).try(:id)
+        payload[:organization_id] = try(:current_organization).try(:id)
+        payload[:app] = try(:current_organization).try(:name)
+        payload[:remote_ip] = request.remote_ip
+        payload[:referer] = request.referer.to_s
+        payload[:request_id] = request.uuid
+        payload[:user_agent] = request.user_agent
+        payload[:xhr] = request.xhr? ? "true" : "false"
+      end
+    end
+  end
+end

data/decidim-core/app/controllers/concerns/decidim/settings.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module Decidim
+  # This concern groups methods and helpers related to accessing the settings
+  # of a feature from a controller.
+  module Settings
+    extend ActiveSupport::Concern
+
+    included do
+      helper_method :feature_settings, :current_settings
+
+      def feature_settings
+        @feature_settings ||= current_feature.settings
+      end
+
+      def current_settings
+        @current_settings ||= current_feature.active_step_settings
+      end
+    end
+  end
+end

data/decidim-core/app/controllers/concerns/decidim/user_profile.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module Decidim
+  # The UserProfile concern must be included in all the controllers
+  # that are shown in the user's profile settings. It adds the
+  # proper layout, as well as helper methods that help render the
+  # side menu, amongst others.
+  module UserProfile
+    extend ActiveSupport::Concern
+    include FormFactory
+
+    delegate :user_groups, to: :current_user, prefix: false
+
+    included do
+      helper Decidim::UserProfileHelper
+      layout "layouts/decidim/user_profile"
+
+      helper_method :available_authorization_handlers,
+                    :user_groups
+
+      before_action :current_user
+      authorize_resource :current_user
+    end
+
+    # Public: Available authorization handlers in order to conditionally
+    # show the menu element.
+    def available_authorization_handlers
+      current_organization.available_authorizations.map(&:constantize)
+    end
+  end
+end

data/decidim-core/app/controllers/decidim/account_controller.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+module Decidim
+  # The controller to handle the user's account page.
+  class AccountController < Decidim::ApplicationController
+    helper_method :authorizations
+    include Decidim::UserProfile
+
+    def show
+      authorize! :show, current_user
+      @account = form(AccountForm).from_model(current_user)
+    end
+
+    def update
+      authorize! :update, current_user
+      @account = form(AccountForm).from_params(account_params)
+
+      UpdateAccount.call(current_user, @account) do
+        on(:ok) do |email_is_unconfirmed|
+          flash[:notice] = if email_is_unconfirmed
+                             t("account.update.success_with_email_confirmation", scope: "decidim")
+                           else
+                             t("account.update.success", scope: "decidim")
+                           end
+
+          bypass_sign_in(current_user)
+          redirect_to account_path
+        end
+
+        on(:invalid) do
+          flash[:alert] = t("account.update.error", scope: "decidim")
+          render action: :show
+        end
+      end
+    end
+
+    def delete
+      authorize! :delete, current_user
+      @form = form(DeleteAccountForm).from_model(current_user)
+    end
+
+    def destroy
+      authorize! :delete, current_user
+      @form = form(DeleteAccountForm).from_params(params)
+
+      DestroyAccount.call(current_user, @form) do
+        on(:ok) do
+          sign_out(current_user)
+          flash[:notice] = t("account.destroy.success", scope: "decidim")
+        end
+
+        on(:invalid) do
+          flash[:alert] = t("account.destroy.error", scope: "decidim")
+        end
+      end
+
+      redirect_to decidim.root_path
+    end
+
+    private
+
+    def authorizations
+      @authorizations ||= current_user.authorizations
+    end
+
+    def account_params
+      { avatar: current_user.avatar }.merge(params[:user].to_unsafe_h)
+    end
+  end
+end