* Refactoring questions asked of user
In this pull request, I'm extracting and normalizing role-based
questions asked of the user.
Prior to this commit, our codebase has asked two very similar questions
of our user model:
- `user.has_role?(:admin)`
- `user.admin?`
In asking `has_role?(:admin)` we are relying on implementation details
of the rolify gem. In addition, the `has_role?` question asked
throughout controllers or views means that it's harder to create
hieararchies of permissions.
In favoring `user.admin?` as our question, we can use that indirection
as an opportunity to discuss and decide "Should someone with the
`:super_admin` role be `user.admin? == true`?"
The details of this commit is to do three primary things:
1. Ask the `has_role?` questions in "one place" in the code (e.g. the
`Authorizer` module)
2. Extract the role based questions that are on the `User` model and
provde backwards compatable delegation.
3. Structure the code so that it's harder to accidentally call
`user.has_role?` (e.g., make `User#has_role?` and `User#has_any_role?`
private).
This is related to #15624 and the updates are informed by discussion in
PR #15691. This commit supplants #15691.
* Refactoring the liquid tag policy tests
* Fixing typo
* Bump for travis
* Escape periods and display the group name properly
* Rename method to dom_safe_name and move to admin helper
* Replace beginning of string digit with underscore then digit
* Extracting container for allowed tags & attrs
Prior to this commit, we had several different locations in which we
specified ALLOWED_TAGS and ALLOWED_ATTRIBUTES for HTML rendering and
sanitization.
Curious to see how these either intersected or didn't, I opted to
create a container module that allows for us to more readily normalize
these allowed tags and attributes. It's possible that we won't do any
normalization, but this work helps make that easier.
Ideally, I'd love us to contextualize "why did we choose the
tags/attributes we chose?" But for now, I think consolidating these
tags and attributes will help make adding a `details` and `summary` tag
easier.
This relates to forem/rfcs#296
See [Google Sheet][1] for analysis of what tags/attributes are used, the
intersection and union.
[1]:https://docs.google.com/spreadsheets/d/1yj-a1qus1o0o4cj-_gOMP5yteeg-_f3s5z7kvK0Y7RM/edit#gid=0
* Fixing misnamed constant
* Fixing misnamed constant
* Extracting additional HtmlRendering use cases
* Adding comparative documentation for HTML tags
* Fixing broken parameter signature
* Moving constants into MarkdownProcessor
* drop pwa stuff
* this was breaking the build... shrug.gif
* Update app/assets/javascripts/initializers/runtime.js
Co-authored-by: Suzanne Aitchison <suzanne@forem.com>
* shorthand for if
Co-authored-by: Suzanne Aitchison <suzanne@forem.com>
* Refactoring away from instance variables
Having both `@tag` and `@tag_model` as variable names can be confusing.
Given that in the prior implementation `@tag_model.name == @tag`, I
figured I would refactor the controller to remove an instance variable.
In addition, this refactor addresses the temporal coupling of methods;
that is to say we call a method which sets an instance variable then
call another dependent on that instance variable.
Yes, ivars are useful to allow for implicit state. However, by favoring
parameters its easier to notice temporal dependencies in method calls.
This helps ensure that we're calling methods in the right order.
Futher, we have a guard clause in place, so let's avoid setting any
additional instance variables that aren't needed if the guard clause
executes.
Related to #15359
* Update app/controllers/stories/tagged_articles_controller.rb
Co-authored-by: Michael Kohl <citizen428@forem.com>
* Favoring constants and Rails where constructs
Prior to this commit, we had a magic array. That magic array was a
duplicate of the Timeframe constant. Likewise, we had a magic string.
This change removes that duplication.
Furthermore, this change favors the `where(key: range..)` construct
instead of "raw" SQL and parameter substition.
Co-authored-by: Michael Kohl <citizen428@forem.com>
* feat: update logo if, else if
* logo fixes
* .
* Update app/views/layouts/_logo.html.erb
Co-authored-by: Michael Kohl <citizen428@forem.com>
* object fit
Co-authored-by: Paweł Ludwiczak <ludwiczakpawel@gmail.com>
Co-authored-by: Michael Kohl <citizen428@forem.com>
* Reduces width of community_name field and finish button
* Slightly adjusts util classes on necessary fields
* Adjusts field widths to be larger for appearance
* Remove util classes entirely from fields
* WIP: add a creatore settings form
* WIP: updat the controller to use the Creator Settings FOREM
* feat: use the creator settings form for the new action
* feat: add some default values for the new action
* a note about form data
* update the initiaize function to set some default values
* feat: update the form to use the model data
* feat: permit adn use the attributes within creator_settings_form
* update the flash error
* refactor: require and permit parameters
* chore: use booleans, set defaults and validate the form
* spec: update all the creator_settings tests
* chore: remove comment
* refactor: use self
* feat: aggregate failures'
* chore: remove the logo uploader in the controller
* refactor: update error handling
* feat: update the wasy the controller handles success and error
* chore: remove the resource errors
* feat: show flash message on new line
* fix: use a redirect so that we can get back to /new
* refactor: pass these values through as they seem to be caching whne setting them as default
* chore: change default values
* spec: update tests
* Fix CreatorSettingsForm specs
* fix: use a boolean for public
* spec: add another test for the success var
* fix: radio button labels to correspond + cyress specs
* spec: update based on new changes
* spec: update the params and the expected output
* spec: update the comments and status
* feat: no need for the initialize as we use Active Record Attributes
* feat: update the tac and coc to be persisted when ticked
* fix: amend spec
* blank space
* Message
Co-authored-by: Michael Kohl <me@citizen428.net>
* User decorator (and spec) should use `trusted?`
Fixes a few issues seen in an rspec run that show as:
DEPRECATION WARNING: User#trusted is deprecated, favor
User#trusted? (called from config_body_class at
/opt/apps/forem/app/decorators/user_decorator.rb:58)
And here:
/opt/apps/forem/spec/decorators/user_decorator_spec.rb:112
/opt/apps/forem/spec/decorators/user_decorator_spec.rb:121
/opt/apps/forem/spec/decorators/user_decorator_spec.rb:130
/opt/apps/forem/spec/decorators/user_decorator_spec.rb:139
* prefer User trusted? to trusted
DEPRECATION WARNING: User#trusted is deprecated, favor
User#trusted? (called from permissions at
/opt/apps/forem/app/models/rating_vote.rb:25)
* Prefer trusted? to trusted in user spec
* Use warned? rather than warned in admin article partial
* use trusted? rather than trusted in moderator requests spec
* Prefer trusted? to trusted in moderations controller
* Prefer trusted? to trusted in moderations view
* User auditable? should call trusted? and not trusted
Deprecations go rolling right along.
* Invert guard clause logic to be positive
The original "return unless multiple negated conditions hold" guard
was cumbersome.
Invert to return if any of the exceptions apply, namely:
- this is a comment or readinglist rating (rather than explicit),
allowed for all
- this rating is from a moderator/trusted user (allowed)
- this rating is offered by the article's author (allowed)
I had intended to also remove the safe navigation operators (since it
wasn't clear why there would be a null user or null article, as
rating_vote joins users to articles with a score), but the builtin
validation tests (is expected to validate ...) build objects with
missing attributes, and raise errors when the spec is run.
Solves an issue where a moderator 'vomit' action on a subsequently
deleted user causes the privileged reactions page to raise a
NoMethodError accessing the reactable's details.
I tried to accomplish this in the controller but it seems the
`paginate` helper requires a relation rather than an array.
* Conditionally renders links within the COC via a creator_settings_form? method
* Updates the creator_settings_form? method within application_helper.rb
* Replaces current_user with a custom creator var
* Adds feature flag check to guard clause in application_helper.rb
* Wake up, Travis
* Removing the stackbit integration
The feature didn't quite work and Stackbit no longer supports this
integration.
Yes there are a few places where the webhooks has a string of "stackbit"
but I'm hesitant to remove that, as they are the part of the Webhooks
tests.
Closes#15700
* Update lib/data_update_scripts/20211206222716_remove_stackbit_page.rb
Co-authored-by: Michael Kohl <citizen428@forem.com>
Co-authored-by: Michael Kohl <citizen428@forem.com>
`User#trusted?` is more Ruby idiomatic than `User#trusted`. This helps
align the various "User#question?" methods.
I've added a deprecation warning, but don't believe that this is active
in the code-base.
* wip - Got logo upload working
* Now have the logo rendering in the header and in the admin image config section.
* Small layout tweak for admin -> config -> images -> logo.
* feat: create a logo uploader with some tests
* feat: use the logoUploader instead of the ArticleImageUploader
* feat: return early because svg's do not contain exif or gps data
* chore: we can move the raise outside the transaction as the rest of the transaction won't execute if we raise an error
* feat: add a size range
* WIP: resize an image to a random number for now
* hid the logo behind a feature flag and kept logo_svg as is in the site header.
* Added the jpe file type to the logo uploader.
* Skipped the resizing of an image if it's an SVG in the logo uploader.
* Added content types to the content type logo uploader allow list.
* Synced logo validation with frontend and backend.
* Removed unnecessary ALLOWED_PARAMS elements.
* feat: update the logo upoader and tests
* chore: remove comments
* chore: remove comments
* feat: update the resizing for the images + add the correct content type
* spec: test the versions
* fix: update the Constant
* feat: add the versions of the logo
* feat: populate the settings correctly and consistently
* feat: add an random string to the file name to avoid caching issues
* feat: amend the logo layout
* chore: remove comments
* spec: update
* feat: image type whitelist
* feat: update the logo css and also just use resized_logo and remove mobile resize
* feat: add a max-height
* only add site-logo if the feature flag is off
* Renamed IMAGE_TYPE_WHITELIST to IMAGE_TYPE_ALLOWLIST
* Update app/controllers/admin/creator_settings_controller.rb
Co-authored-by: Michael Kohl <citizen428@forem.com>
* Update app/uploaders/logo_uploader.rb
Co-authored-by: Michael Kohl <citizen428@forem.com>
* Update app/uploaders/logo_uploader.rb
Co-authored-by: Michael Kohl <citizen428@forem.com>
* Update app/uploaders/logo_uploader.rb
Co-authored-by: Michael Kohl <citizen428@forem.com>
* Update spec/uploaders/logo_uploader_spec.rb
Co-authored-by: Julianna Tetreault <32834804+juliannatetreault@users.noreply.github.com>
* Update spec/uploaders/logo_uploader_spec.rb
Co-authored-by: Julianna Tetreault <32834804+juliannatetreault@users.noreply.github.com>
* chore: revert admin change
* refactor: use a static value for directory
* feat: freeze constants
* feat: remove the logo requirement
* chore: spacing
* remove logo requirement
Co-authored-by: Ridhwana <ridhwana.khan16@gmail.com>
Co-authored-by: Michael Kohl <citizen428@forem.com>
Co-authored-by: Julianna Tetreault <32834804+juliannatetreault@users.noreply.github.com>
* feat: add a color contrast utility
* feat: add an error when the color contrast is low
* feat: add form validations
* refactor: treat WCAGColorContrast as a library that can be intercanged at any time
* fix: styling
* test: add a test for the contrast
* feat: add test for WCAGColorContrast
* feat: update cypress tests for brand color and color contrast ratios
* feat: update the message to read better
* chore: update the styling
* refactor: address all feedback/suggestions
* Update cypress/integration/creatorOnboardingFlows/creatorSettings.spec.js
Co-authored-by: Nick Taylor <nick@iamdeveloper.com>
* Replaced other .trigger('change')s with .blur()
Co-authored-by: Nick Taylor <nick@iamdeveloper.com>
Co-authored-by: Nick Taylor <nick@dev.to>
* Add view test for change submit button
Expect a quoted string for the button values.
* Quote button text in calls to changeSubmitButton
This fixes a parse error (locally now I get an error about not having
a stripe publishing id, which is expected).
