lato_spaces 3.1.24 → 3.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 36ee9aa758f48c9b1f32c5921701308a5ee3cc462728c2128e7029ec323e9454
-  data.tar.gz: e466dfc7f67349bd8fb4c190d27f59a0c5ae5bdc51b0360aa2c0c4d2a6e3c892
+  metadata.gz: 3444a3028e399641c312a023bf6ac4ac02815747ed0bb6185a07120800a6d4ee
+  data.tar.gz: e29d329206491723e51c31ce8a97a73b9c7d5410fa2653bbf12a576f605f6327
 SHA512:
-  metadata.gz: a293aa99cb50fbdd593eceaf096a74d1296bda6c222f4ff9411b51fb864ec11d9f65cd0917d082c4dcb2437c9238c51de15fb4f185b97470154e43c860708446
-  data.tar.gz: 4a16c6c4e6b9cdce284b0791132d5645a36d2227949b34dac41c2c18aea22ed6ce569d5fbb7aca9183d1e683eab0d196fbff8e81753363bd0dd181be1cf85e60
+  metadata.gz: 9f51a50f75322d535d2bae852ad86554069ca4c2f292cc6a750b69eb93082bfd07c6af2a9f4c72466372827338c79ab3803cdd119961ff35763c1e96291b2ad8
+  data.tar.gz: def89bea0b5460d7109c9e07fdc362fc220ae2b2b54e1ca43bfa56c81b4c6e31e7428754995913453b3bdbaf2b7981ae2594faf09bfbd955f98b2f35ee3eaea2

data/README.md

@@ -1,7 +1,11 @@
 # Lato Spaces
 Integrate different workspaces on Lato projects.
 
+Group selection requires a current membership. Every request protected by `authenticate_group` rechecks access and clears revoked selections. Users with `lato_spaces_admin` can select and manage all groups. When non-admin management is enabled, membership deletion and invitation resends are restricted to their own groups.
+
 ## Installation
+
+Requires Rails 8.1.3.1 or newer in the 8.1 series and Lato 3.25.0 or newer. Existing applications must install the new Lato session migration before deployment; previous sessions are invalidated.
 Add required dependencies to your application's Gemfile:
 
 ```ruby

data/app/controllers/concerns/lato_spaces/groupable.rb

@@ -2,7 +2,9 @@ module LatoSpaces::Groupable
   extend ActiveSupport::Concern
 
   def authenticate_group
-    if @session.get(:spaces_group_id).blank?
+    group_id = @session.get(:spaces_group_id)
+    unless group_id.present? && accessible_spaces_groups.exists?(id: group_id)
+      session_group_destroy if group_id.present?
       redirect_to lato_spaces.root_path
       return false
     end
@@ -11,16 +13,22 @@ module LatoSpaces::Groupable
   end
 
   def session_group_create(group_id)
-    cookies.encrypted[:lato_session] = { value: Lato::Session.generate_session_per_user(@session.user_id, spaces_group_id: group_id), expires: Lato.config.session_lifetime.from_now }
-    @session = Lato::Session.new(cookies.encrypted[:lato_session])
+    group = accessible_spaces_groups.find_by(id: group_id)
+    return false unless group
 
-    true
+    session_update(spaces_group_id: group.id)
   end
 
   def session_group_destroy
-    cookies.encrypted[:lato_session] = { value: Lato::Session.generate_session_per_user(@session.user_id), expires: Lato.config.session_lifetime.from_now }
-    @session = Lato::Session.new(cookies.encrypted[:lato_session])
+    session_update(spaces_group_id: nil)
+  end
 
-    true
+  private
+
+  def accessible_spaces_groups
+    return LatoSpaces::Group.none unless @session.really_valid?
+    return LatoSpaces::Group.all if @session.user.lato_spaces_admin
+
+    LatoSpaces::Group.where(id: LatoSpaces::Membership.where(lato_user_id: @session.user_id).select(:lato_spaces_group_id))
   end
 end

data/app/controllers/lato_spaces/groups_controller.rb

@@ -96,9 +96,7 @@ module LatoSpaces
     end
 
     def find_group
-      query = LatoSpaces::Group.all
-      query = query.joins(:lato_spaces_memberships).where(lato_spaces_memberships: { lato_user_id: @session.user_id }) unless @session.user.lato_spaces_admin
-      @group = query.find(params[:id])
+      @group = accessible_spaces_groups.find(params[:id])
     end
   end
-end
+end

data/app/controllers/lato_spaces/memberships_controller.rb

@@ -56,13 +56,11 @@ module LatoSpaces
     end
 
     def find_group
-      query = LatoSpaces::Group.all
-      query = query.joins(:lato_spaces_memberships).where(lato_spaces_memberships: { lato_user_id: @session.user_id }) unless @session.user.lato_spaces_admin
-      @group = query.find(params[:group_id])
+      @group = accessible_spaces_groups.find(params[:group_id])
     end
 
     def find_membership
-      @membership = LatoSpaces::Membership.find(params[:id])
+      @membership = LatoSpaces::Membership.where(lato_spaces_group_id: accessible_spaces_groups.select(:id)).find(params[:id])
     end
   end
-end
+end

data/lib/lato_spaces/version.rb

@@ -1,3 +1,3 @@
 module LatoSpaces
-  VERSION = "3.1.24"
+  VERSION = "3.2.0"
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: lato_spaces
 version: !ruby/object:Gem::Version
-  version: 3.1.24
+  version: 3.2.0
 platform: ruby
 authors:
 - Gregorio Galante
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-12-24 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -16,28 +15,34 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 7.1.1
+        version: 8.1.3.1
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '8.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 7.1.1
+        version: 8.1.3.1
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '8.2'
 - !ruby/object:Gem::Dependency
   name: lato
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 3.25.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 3.25.0
 description: A Rails engine to integrate different workspaces on Lato projects!
 email:
 - me@gregoriogalante.com
@@ -98,7 +103,6 @@ licenses:
 metadata:
   homepage_uri: https://github.com/Lato-org/lato_spaces
   source_code_uri: https://github.com/Lato-org/lato_spaces
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -113,8 +117,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.1
-signing_key:
+rubygems_version: 4.0.9
 specification_version: 4
 summary: Another engine for Lato projects
 test_files: []