decidim 0.4.4 → 0.5.0

data/decidim-core/app/queries/decidim/published_participatory_processes.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module Decidim
+  # This query filters published processes only.
+  class PublishedParticipatoryProcesses < Rectify::Query
+    def query
+      ParticipatoryProcess.published
+    end
+  end
+end

data/decidim-core/app/queries/decidim/stats_users_count.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Decidim
+  # This query counts registered users from a collection of organizations
+  # in an optional interval of time.
+  class StatsUsersCount < Rectify::Query
+    def self.for(organization, start_at = nil, end_at = nil)
+      new(organization, start_at, end_at).query
+    end
+
+    def initialize(organization, start_at = nil, end_at = nil)
+      @organization = organization
+      @start_at = start_at
+      @end_at = end_at
+    end
+
+    def query
+      users = Decidim::User.where(organization: @organization)
+      users = users.where("created_at >= ?", @start_at) if @start_at.present?
+      users = users.where("created_at <= ?", @end_at) if @end_at.present?
+      users = users.where.not(confirmed_at: nil)
+      users.count
+    end
+  end
+end

data/decidim-core/app/services/decidim/action_authorizer.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+module Decidim
+  # This class is used to authorize a user against an action in the context of a
+  # feature.
+  class ActionAuthorizer
+    include Wisper::Publisher
+
+    # Initializes the ActionAuthorizer.
+    #
+    # user    - The user to authorize against.
+    # feature - The feature to authenticate against.
+    # action  - The action to authenticate.
+    def initialize(user, feature, action)
+      @user = user
+      @feature = feature
+      @action = action.to_s if action
+    end
+
+    # Public: Broadcasts different events given the status of the authentication.
+    #
+    # Broadcasts:
+    #   failed       - When no valid authorization can be found.
+    #   unauthorized - When an authorization was found, but didn't match the credentials.
+    #   incomplete   - An authorization was found, but lacks some required fields. User
+    #                  should re-authenticate.
+    #
+    # Returns nil.
+    def authorize
+      raise AuthorizationError, "Missing data" unless feature && action
+
+      return status(:ok) unless authorization_handler_name
+
+      return status(:missing, handler: authorization_handler_name) unless authorization
+      return status(:invalid, handler: authorization_handler_name, fields: unmatched_fields) if unmatched_fields.any?
+      return status(:incomplete, handler: authorization_handler_name, fields: missing_fields) if missing_fields.any?
+
+      status(:ok)
+    end
+
+    private
+
+    def status(status_code, data = {})
+      AuthorizationStatus.new(status_code, authorization_handler_name, data)
+    end
+
+    attr_reader :user, :feature, :action
+
+    def authorization
+      return nil unless user
+      return nil unless permission["authorization_handler_name"]
+
+      @authorization ||= user.authorizations.to_a.find do |authorization|
+        authorization.name == permission.fetch("authorization_handler_name")
+      end
+    end
+
+    def unmatched_fields
+      (permission_options.keys & authorization.metadata.to_h.keys).each_with_object({}) do |field, unmatched|
+        unmatched[field] = permission_options[field] if authorization.metadata[field] != permission_options[field]
+        unmatched
+      end
+    end
+
+    def missing_fields
+      permission_options.keys.each_with_object([]) do |field, missing|
+        missing << field if authorization.metadata[field].blank?
+        missing
+      end
+    end
+
+    def permission_options
+      permission["options"] || {}
+    end
+
+    def authorization_handler_name
+      permission&.fetch("authorization_handler_name", nil)
+    end
+
+    def permission
+      return nil unless feature
+      return nil unless action
+
+      @permission ||= feature.permissions&.fetch(action, nil)
+    end
+
+    class AuthorizationStatus
+      attr_reader :code, :handler_name, :data
+
+      def initialize(code, handler_name, data)
+        @code = code.to_sym
+        @handler_name = handler_name
+        @data = data.symbolize_keys
+      end
+
+      def ok?
+        @code == :ok
+      end
+    end
+
+    class AuthorizationError < StandardError; end
+  end
+end

data/decidim-core/app/services/decidim/authorization_handler.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+module Decidim
+  # This is the base class for authorization handlers, all implementations
+  # should inherit from it.
+  # Each AuthorizationHandler is a form that will be used to check if the
+  # authorization is valid or not. When it is valid a new authorization will
+  # be created for the user.
+  #
+  # Feel free to use validations to assert fields against a remote API,
+  # local database, or whatever.
+  #
+  # It also sets two default attributes, `user` and `handler_name`.
+  class AuthorizationHandler < Form
+    # The user that is trying to authorize, it's initialized with the
+    # `current_user` from the controller.
+    attribute :user, Decidim::User
+    # The String name of the handler, should not be modified since it's used to
+    # infer the class name of the authorization handler.
+    attribute :handler_name, String
+
+    # A unique ID to be implemented by the authorization handler that ensures
+    # no duplicates are created. This uniqueness check will be skipped if
+    # unique_id returns nil.
+    def unique_id
+      nil
+    end
+
+    # THe attributes of the handler that should be exposed as form input when
+    # rendering the handler in a form.
+    #
+    # Returns an Array of Strings.
+    def form_attributes
+      attributes.except(:id, :user).keys
+    end
+
+    # The String partial path so Rails can render the handler as a form. This
+    # is useful if you want to have a custom view to render the form instead of
+    # the default view.
+    #
+    # Example:
+    #
+    #   A handler named Decidim::CensusHandler would look for its partial in:
+    #   decidim/census/form
+    #
+    # Returns a String.
+    def to_partial_path
+      handler_name.sub!(/_handler$/, "") + "/form"
+    end
+
+    # Any data that the developer would like to inject to the `metadata` field
+    # of an authorization when it's created. Can be useful if some of the
+    # params the user sent with the authorization form want to be persisted for
+    # future use.
+    #
+    # Returns a Hash.
+    def metadata
+      {}
+    end
+
+    # A serialized version of the handler's name.
+    #
+    # Returns a String.
+    def self.handler_name
+      name.underscore
+    end
+
+    # Same as the class method but accessible from the instance.
+    #
+    # Returns a String.
+    def handler_name
+      self.class.handler_name
+    end
+
+    # Finds a handler class from a String. This is necessary when processing
+    # the form data. It will only look for valid handlers that have also been
+    # configured in `Decidim.authorization_handlers`.
+    #
+    # name - The String name of the class to find, usually in the same shape as
+    # the one returned by `handler_name`.
+    # params - An optional Hash with params to initialize the handler.
+    #
+    # Returns an AuthorizationHandler descendant.
+    # Returns nil when no handlers could be found.
+    def self.handler_for(name, params = {})
+      return unless name
+      handler_klass = name.classify
+      return unless Decidim.authorization_handlers.map(&:to_s).include?(handler_klass)
+      handler_klass.constantize.from_params(params || {})
+    end
+  end
+end

data/decidim-core/app/services/decidim/resource_search.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+module Decidim
+  # This is the base class to be used by other search services.
+  # Searchlight documentation: https://github.com/nathanl/searchlight
+  class ResourceSearch < Searchlight::Search
+    # Initialize the Searchlight::Search base class with the options provided.
+    #
+    # scope   - The scope used to create the base query
+    # options - A hash of options to modify the search. These options will be
+    #          converted to methods by SearchLight so they can be used on filter
+    #          methods. (Default {})
+    def initialize(scope, options = {})
+      super(options)
+      @scope = scope
+    end
+
+    # Creates the SearchLight base query.
+    # Check if the option feature was provided.
+    def base_query
+      # raise order_start_time.inspect
+      raise "Missing feature" unless feature
+
+      @scope.where(feature: feature)
+    end
+
+    # Handle the category_id filter
+    def search_category_id
+      query
+        .includes(:categorization)
+        .where(decidim_categorizations: { decidim_category_id: category_ids })
+    end
+
+    # Handles the scope_id filter. When we want to show only those that do not
+    # have a scope_id set, we cannot pass an empty String or nil because Searchlight
+    # will automatically filter out these params, so the method will not be used.
+    # Instead, we need to pass a fake ID and then convert it inside. In this case,
+    # in order to select those elements that do not have a scope_id set we use
+    # `"global"` as parameter, and in the method we do the needed changes to search
+    # properly.
+    def search_scope_id
+      clean_scope_ids = [scope_id].flatten
+
+      conditions = []
+      conditions << "decidim_scope_id IS NULL" if clean_scope_ids.delete("global")
+      conditions.concat(["? = ANY(decidim_scopes.part_of)"] * clean_scope_ids.count) if clean_scope_ids.any?
+
+      query.includes(:scope).references(:decidim_scopes).where(conditions.join(" OR "), *clean_scope_ids.map(&:to_i))
+    end
+
+    private
+
+    # Private: Creates an array of category ids.
+    # It contains categories' subcategories ids as well.
+    def category_ids
+      feature
+        .categories
+        .where(id: category_id)
+        .or(feature.categories.where(parent_id: category_id))
+        .pluck(:id)
+    end
+
+    # Private: Since feature is not used by a search method we need
+    # to define the method manually.
+    def feature
+      options[:feature]
+    end
+  end
+end

data/decidim-core/app/services/decidim/static_map_generator.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require "httparty"
+
+module Decidim
+  # This class generates a url to create a static map image for a geocoded resource
+  class StaticMapGenerator
+    def initialize(resource, options = {})
+      @resource = resource
+      @options = options
+
+      @options[:zoom] ||= 15
+      @options[:width] ||= 120
+      @options[:height] ||= 120
+    end
+
+    def data
+      return if Decidim.geocoder.nil?
+
+      Rails.cache.fetch(@resource.cache_key) do
+        request = HTTParty.get(uri, headers: { "Referer" => organization.host })
+        request.body
+      end
+    end
+
+    private
+
+    def uri
+      params = {
+        c: "#{@resource.latitude}, #{@resource.longitude}",
+        z: @options[:zoom],
+        w: @options[:width],
+        h: @options[:height],
+        f: "1",
+        app_id: Decidim.geocoder.fetch(:here_app_id),
+        app_code: Decidim.geocoder.fetch(:here_app_code)
+      }
+
+      URI.parse(Decidim.geocoder.fetch(:static_map_url)).tap do |uri|
+        uri.query = URI.encode_www_form params
+      end
+    end
+
+    def organization
+      @organization ||= @resource.feature.organization
+    end
+  end
+end

data/decidim-core/app/uploaders/decidim/application_uploader.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Decidim
+  # This class deals with uploading images to Decidim It is intended to just
+  # hold the uploads configuration, so you should inherit from this class and
+  # then tweak any configuration you need.
+  class ApplicationUploader < CarrierWave::Uploader::Base
+    # Override the directory where uploaded files will be stored.
+    # This is a sensible default for uploaders that are meant to be mounted:
+    def store_dir
+      default_path = "uploads/#{model.class.to_s.underscore}/#{mounted_as}/#{model.id}"
+
+      return File.join(Decidim.base_uploads_path, default_path) if Decidim.base_uploads_path.present?
+      default_path
+    end
+  end
+end

data/decidim-core/app/uploaders/decidim/attachment_uploader.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+module Decidim
+  # This class deals with uploading attachments to a ParticipatoryProcess.
+  class AttachmentUploader < ApplicationUploader
+    include CarrierWave::MiniMagick
+
+    process :set_content_type_and_size_in_model
+    process :validate_dimensions
+
+    version :thumbnail, if: :image? do
+      process resize_to_fit: [nil, 237]
+    end
+
+    version :big, if: :image? do
+      process resize_to_limit: [nil, 1000]
+    end
+
+    protected
+
+    # CarrierWave automatically calls this method and validates the content
+    # type fo the temp file to match against any of these options.
+    def content_type_whitelist
+      [
+        %r{image\/},
+        %r{application\/vnd.oasis.opendocument},
+        %r{application\/vnd.ms-},
+        %r{application\/msword},
+        %r{application\/vnd.ms-word},
+        %r{application\/vnd.openxmlformats-officedocument},
+        %r{application\/vnd.oasis.opendocument},
+        %r{application\/pdf},
+        %r{application\/rtf}
+      ]
+    end
+
+    # Checks if the file is an image based on the content type. We need this so
+    # we only create different versions of the file when it's an image.
+    #
+    # new_file - The uploaded file.
+    #
+    # Returns a Boolean.
+    def image?(new_file)
+      content_type = model.content_type || new_file.content_type
+      content_type.to_s.start_with? "image"
+    end
+
+    # Copies the content type and file size to the model where this is mounted.
+    #
+    # Returns nothing.
+    def set_content_type_and_size_in_model
+      model.content_type = file.content_type if file.content_type
+      model.file_size = file.size
+    end
+
+    # A simple check to avoid DoS with maliciously crafted images, or just to
+    # avoid reckless users that upload gigapixels images.
+    #
+    # See https://hackerone.com/reports/390
+    def validate_dimensions
+      return unless image?(self)
+
+      manipulate! do |image|
+        raise CarrierWave::IntegrityError, I18n.t("carrierwave.errors.image_too_big") if image.dimensions.any? { |dimension| dimension > max_image_height_or_width }
+        image
+      end
+    end
+
+    def max_image_height_or_width
+      8000
+    end
+  end
+end