lato_spaces 3.1.23 → 3.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 962be7a6c98c4e07eb3b02e4e4c7747de019863f60ef35246855a0db34d25475
-  data.tar.gz: b6196760168336ebf3817fb12977b0b44f1ea7aae546ae46b7cbd52c8ad2e231
+  metadata.gz: 3444a3028e399641c312a023bf6ac4ac02815747ed0bb6185a07120800a6d4ee
+  data.tar.gz: e29d329206491723e51c31ce8a97a73b9c7d5410fa2653bbf12a576f605f6327
 SHA512:
-  metadata.gz: e8e60a1a44ec88200bf32f67b0b32877777e8fbabcfd664021ae473170d0d5673a3ac6dbe49777e71fa288b24f61f02b77228020479118c92de17318d47752fa
-  data.tar.gz: 4f568b5532fce79862f4161a03cc02cd9f86f5d8b9bc7b2b872cd0633eb53fcbb2402d7946b4660cc73b4af89d4d11d1f95f223103116aa5bc00c3b56b13b01f
+  metadata.gz: 9f51a50f75322d535d2bae852ad86554069ca4c2f292cc6a750b69eb93082bfd07c6af2a9f4c72466372827338c79ab3803cdd119961ff35763c1e96291b2ad8
+  data.tar.gz: def89bea0b5460d7109c9e07fdc362fc220ae2b2b54e1ca43bfa56c81b4c6e31e7428754995913453b3bdbaf2b7981ae2594faf09bfbd955f98b2f35ee3eaea2

data/README.md

@@ -1,7 +1,11 @@
 # Lato Spaces
 Integrate different workspaces on Lato projects.
 
+Group selection requires a current membership. Every request protected by `authenticate_group` rechecks access and clears revoked selections. Users with `lato_spaces_admin` can select and manage all groups. When non-admin management is enabled, membership deletion and invitation resends are restricted to their own groups.
+
 ## Installation
+
+Requires Rails 8.1.3.1 or newer in the 8.1 series and Lato 3.25.0 or newer. Existing applications must install the new Lato session migration before deployment; previous sessions are invalidated.
 Add required dependencies to your application's Gemfile:
 
 ```ruby

data/Rakefile

@@ -3,6 +3,4 @@ require "bundler/setup"
 APP_RAKEFILE = File.expand_path("test/dummy/Rakefile", __dir__)
 load "rails/tasks/engine.rake"
 
-load "rails/tasks/statistics.rake"
-
 require "bundler/gem_tasks"

data/app/controllers/concerns/lato_spaces/groupable.rb

@@ -2,7 +2,9 @@ module LatoSpaces::Groupable
   extend ActiveSupport::Concern
 
   def authenticate_group
-    if @session.get(:spaces_group_id).blank?
+    group_id = @session.get(:spaces_group_id)
+    unless group_id.present? && accessible_spaces_groups.exists?(id: group_id)
+      session_group_destroy if group_id.present?
       redirect_to lato_spaces.root_path
       return false
     end
@@ -11,16 +13,22 @@ module LatoSpaces::Groupable
   end
 
   def session_group_create(group_id)
-    cookies.encrypted[:lato_session] = { value: Lato::Session.generate_session_per_user(@session.user_id, spaces_group_id: group_id), expires: Lato.config.session_lifetime.from_now }
-    @session = Lato::Session.new(cookies.encrypted[:lato_session])
+    group = accessible_spaces_groups.find_by(id: group_id)
+    return false unless group
 
-    true
+    session_update(spaces_group_id: group.id)
   end
 
   def session_group_destroy
-    cookies.encrypted[:lato_session] = { value: Lato::Session.generate_session_per_user(@session.user_id), expires: Lato.config.session_lifetime.from_now }
-    @session = Lato::Session.new(cookies.encrypted[:lato_session])
+    session_update(spaces_group_id: nil)
+  end
 
-    true
+  private
+
+  def accessible_spaces_groups
+    return LatoSpaces::Group.none unless @session.really_valid?
+    return LatoSpaces::Group.all if @session.user.lato_spaces_admin
+
+    LatoSpaces::Group.where(id: LatoSpaces::Membership.where(lato_user_id: @session.user_id).select(:lato_spaces_group_id))
   end
 end

data/app/controllers/lato_spaces/groups_controller.rb

@@ -96,9 +96,7 @@ module LatoSpaces
     end
 
     def find_group
-      query = LatoSpaces::Group.all
-      query = query.joins(:lato_spaces_memberships).where(lato_spaces_memberships: { lato_user_id: @session.user_id }) unless @session.user.lato_spaces_admin
-      @group = query.find(params[:id])
+      @group = accessible_spaces_groups.find(params[:id])
     end
   end
-end
+end

data/app/controllers/lato_spaces/memberships_controller.rb

@@ -56,13 +56,11 @@ module LatoSpaces
     end
 
     def find_group
-      query = LatoSpaces::Group.all
-      query = query.joins(:lato_spaces_memberships).where(lato_spaces_memberships: { lato_user_id: @session.user_id }) unless @session.user.lato_spaces_admin
-      @group = query.find(params[:group_id])
+      @group = accessible_spaces_groups.find(params[:group_id])
     end
 
     def find_membership
-      @membership = LatoSpaces::Membership.find(params[:id])
+      @membership = LatoSpaces::Membership.where(lato_spaces_group_id: accessible_spaces_groups.select(:id)).find(params[:id])
     end
   end
-end
+end

data/app/views/lato_spaces/application/index.html.erb

@@ -3,35 +3,49 @@
 <% end %>
 
 <%= turbo_frame_tag 'index' do %>
-  <div class="row">
-    <% @groups.each do |group| %>
-      <% is_selected = @session.get(:spaces_group_id)&.to_i == group.id %>
-      <% is_preferred = @memberships.find { |m| m.lato_spaces_group_id == group.id }&.preferred %>
+  <%
+
+    groups = @groups.map do |group|
+      is_selected = @session.get(:spaces_group_id)&.to_i == group.id
+      is_preferred = @memberships.find { |m| m.lato_spaces_group_id == group.id }&.preferred
+
+      {
+        id: group.id,
+        name: group.name,
+        is_selected: is_selected,
+        is_preferred: is_preferred
+      }
+    end
 
+    groups = groups.sort_by { |g| [g[:is_preferred] ? 0 : 1, g[:name].downcase] }
+  %>
+
+  <div class="row">
+    <% groups.each do |group| %>
       <div class="col col-12 col-lg-6 col-lg-4 col-xl-3 mb-3">
-        <div class="card h-100 border border-4 position-relative <%= is_selected ? 'border-success' : 'border-light' %>">
-          <%= link_to lato_spaces.setgroup_path(group), class: "position-absolute top-0 left-0 w-100 h-100", data: { turbo_method: :post } do %><% end %>
+        <div class="card h-100 border border-4 position-relative <%= group[:is_selected] ? 'border-success' : 'border-light' %>">
+          <%= link_to lato_spaces.setgroup_path(group[:id]), class: "position-absolute top-0 left-0 w-100 h-100", data: { turbo_method: :post } do %><% end %>
           <div class="card-body">
             <div class="d-flex align-items-center justify-content-between d-lg-block">
               <div class="d-flex align-items-center d-lg-block text-center">
                 <i class="<%= LatoSpaces.config.group_icon %> fs-1 me-2 me-lg-0"></i><br>
-                <span class="fw-bold"><%= group.name %></span>
+                <span class="fw-bold"><%= group[:name] %></span>
               </div>
               <div class="d-flex justify-content-center align-items-center mt-lg-2 position-relative">
                 <% if @session.user.lato_spaces_admin || LatoSpaces.config.permit_group_management %>
-                  <%= link_to lato_spaces.groups_show_path(group), class: "btn btn-light me-1", data: { turbo_frame: '_top' } do %>
+                  <%= link_to lato_spaces.groups_show_path(group[:id]), class: "btn btn-light me-1", data: { turbo_frame: '_top' } do %>
                     <i class="bi bi-gear"></i>
                   <% end %>
                 <% end %>
 
                 <% if LatoSpaces.config.permit_group_preferred %>
-                  <%= link_to lato_spaces.setpreferred_path(group), class: "btn btn-#{is_preferred ? 'warning' : 'light'} ms-1 me-1", data: { turbo_method: :post } do %>
-                    <i class="bi bi-star<%= is_preferred ? '-fill' : '' %>"></i>
+                  <%= link_to lato_spaces.setpreferred_path(group[:id]), class: "btn btn-#{group[:is_preferred] ? 'warning' : 'light'} ms-1 me-1", data: { turbo_method: :post } do %>
+                    <i class="bi bi-star<%= group[:is_preferred] ? '-fill' : '' %>"></i>
                   <% end %>
                 <% end %>
 
-                <%= link_to lato_spaces.setgroup_path(group), class: "btn btn-#{is_selected ? 'success' : 'primary'} ms-1", data: { turbo_method: :post } do %>
-                  <i class="bi bi-check-circle<%= is_selected ? '-fill' : '' %>"></i>
+                <%= link_to lato_spaces.setgroup_path(group[:id]), class: "btn btn-#{group[:is_selected] ? 'success' : 'primary'} ms-1", data: { turbo_method: :post } do %>
+                  <i class="bi bi-check-circle<%= group[:is_selected] ? '-fill' : '' %>"></i>
                 <% end %>
               </div>
             </div>

data/lib/lato_spaces/version.rb

@@ -1,3 +1,3 @@
 module LatoSpaces
-  VERSION = "3.1.23"
+  VERSION = "3.2.0"
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: lato_spaces
 version: !ruby/object:Gem::Version
-  version: 3.1.23
+  version: 3.2.0
 platform: ruby
 authors:
 - Gregorio Galante
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-11-16 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -16,28 +15,34 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 7.1.1
+        version: 8.1.3.1
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '8.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 7.1.1
+        version: 8.1.3.1
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '8.2'
 - !ruby/object:Gem::Dependency
   name: lato
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 3.25.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 3.25.0
 description: A Rails engine to integrate different workspaces on Lato projects!
 email:
 - me@gregoriogalante.com
@@ -98,7 +103,6 @@ licenses:
 metadata:
   homepage_uri: https://github.com/Lato-org/lato_spaces
   source_code_uri: https://github.com/Lato-org/lato_spaces
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -113,8 +117,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.1
-signing_key:
+rubygems_version: 4.0.9
 specification_version: 4
 summary: Another engine for Lato projects
 test_files: []