* Basic add remove functionality with few tests
* Updated cypress test and added more unit tests
* Rename display ads vars in the views (#19877)
* Renamed display_ads vars to billboards
* Rename local vars in the feed view
* Renamed display-ad in the comment
Co-authored-by: Rajat Talesra <rajattalesra4914@gmail.com>
* Renamed variables in the views
---------
Co-authored-by: Rajat Talesra <rajattalesra4914@gmail.com>
* Update js-routes to version 2.2.7 (#19883)
Co-authored-by: depfu[bot] <23717796+depfu[bot]@users.noreply.github.com>
* add field for billboard target geolocations, with unit and e2e tests (#19855)
Co-authored-by: depfu[bot] <23717796+depfu[bot]@users.noreply.github.com>
Co-authored-by: Duke Greene <dukegreene@gmail.com>
Co-authored-by: PJ <pj@forem.com>
Co-authored-by: Anna Buianova <lightallloy@gmail.com>
Co-authored-by: Mac Siri <mac@forem.com>
Co-authored-by: zhangted <tedcbook@gmail.com>
Co-authored-by: Josh Klar <jklar@forem.com>
* Added autocomplete value off (#19882)
* Bust cache of organization page when new member is added (#19861)
* Remove unused freezeScrolling (#19808)
* Remove unused freezeScrolling
* chore: try see if this helps to skip the flakey test that wasn't being skipped
* chore: try see if this helps to skip the flakey test that wasn't being skipped
* oops: revert the gemfile changes
---------
Co-authored-by: Mai Irie <mai@forem.com>
Co-authored-by: Mac Siri <mac@forem.com>
Co-authored-by: Ridhwana <ridhwana.khan16@gmail.com>
* ci: Allow workflow_dispatch runs to log in to GHCR. (#19885)
* ci: Fix base image builder... the right way... (#19889)
* Update postcss to version 8.4.27 (#19888)
Co-authored-by: depfu[bot] <23717796+depfu[bot]@users.noreply.github.com>
* Replace uses of toBeDefined with toExist (#19862)
* Replaced toBeDefined with toExist
* Revert db changes
* Rename display ads to billboards: css and js code (#19887)
* Renamed js vars/css names
* Renamed display_ads to billboards in js functions, variables, components
* [ruby] Update sidekiq-unique-jobs 7.1.29 → 7.1.30 (patch) (#19902)
Co-authored-by: depfu[bot] <23717796+depfu[bot]@users.noreply.github.com>
* Update oj to version 3.15.1 (#19901)
Co-authored-by: depfu[bot] <23717796+depfu[bot]@users.noreply.github.com>
* Updated failing cypress test
* Removed commented code
* Attempt at fixing tests
* Fixed failing tests
* Added more tests
* Basic color and design changes part -1
* Disable/Enable buttons correctly
* Various design updates in Tag adjustement mod UI
* I18N and documentation
* Updated mod panel
* Fixed mod related cypress tests
* Minor design fixes
* Dark mode designs
* Test update
* Mod UI with some bugs
* Updated/simplified code fully-working
* Updated tests
* Added more tests
* Accessibility improvements
* hr line code fix
* Close mod icon bug fix
* Nit fixes
* Design fixes as suggested by Anuj.
* Design fixes
* Dark mode file usage
* Design fixes
* Nit fixes
---------
Co-authored-by: Anna Buianova <lightallloy@gmail.com>
Co-authored-by: depfu[bot] <23717796+depfu[bot]@users.noreply.github.com>
Co-authored-by: Duke Greene <dukegreene@gmail.com>
Co-authored-by: PJ <pj@forem.com>
Co-authored-by: Mac Siri <mac@forem.com>
Co-authored-by: zhangted <tedcbook@gmail.com>
Co-authored-by: Josh Klar <jklar@forem.com>
Co-authored-by: Joshua Wehner <joshua@forem.com>
Co-authored-by: Mai Irie <mai@forem.com>
Co-authored-by: Ridhwana <ridhwana.khan16@gmail.com>
* Try renaming moderator -> super_moderator
* Still finding 'moderator' words
* Fixes for failing specs
* Update test with new role name
* Update app/services/moderator/manage_activity_and_roles.rb
Co-authored-by: Suzanne Aitchison <suzanne@forem.com>
Co-authored-by: Suzanne Aitchison <suzanne@forem.com>
* Encapsulating the "why we hide/show" something
Prior to this commit, we were relying on our views/templates to
understand why it might want to append the "hidden" dom class. That is
not ideal, because it required repeating knowledge about the conditions
of the policy outside of the policy's domain.
With this commit, we're removing a duplication of knowledge; or more
appropriately asking the steward responsible for the knowledge to
produce the answer.
* Refining the note to not describe a course of action
Prior to this commit
This would have been a bug, if someone had:
1. Toggled on the :limit_post_creation_to_admins feature flag
2. Wasn't an admin
3. Already had a published post
4. Went to edit the post and attempted to preview it
Related to the following issues:
- forem/forem#16908
- forem/forem#16944
- forem/forem#16837
- forem/forem#16942
* Adding ArticlePolicy#has_existing_articles_or_can_create_new_ones?
As part of our aspirations to only show users what is relevant to them
and "hiding" what is not, this method will help us with the edge case of
"should we show the user a dashboard listing of posts?"
Related to forem/forem#16837
* Adding further documentation
* Adding clarifying comment
* Penciling in a Default Spaces section
This delivers two primary things:
1. Extracting shared policy examples
2. Providing a functioning skeleton for toggling on the
"limit_post_creation_to_admins" feature.
Important is that once merged, it would be possible for this code to
"leak" out. But how that leaks out is also how you can test that the
feature works.
First, to orient, there is a constraint for a new route. That
constraint checks if the feature flag exists (e.g. has been explicitly
enabled or explicitly disabled). In other words, at this point, you
can't accidentally enable the feature via the UI. But once you have
enabled the feature, you can then toggle the feature on and off.
So, to test this in the browser:
1. Pull down this branch
2. Run `rails runner "FeatureFlag.disable(:limit_post_creation_to_admins)"`
3. Startup your the web server.
4. Login as an administrator
5. Goto /admin/content_manager/spaces
a. Bask in the glory of a plain HTML form
6. With another browser, login as another non-admin user
7. Go to /settings/extensions, you should see a section Publishing from RSS.
8. Now with the admin's session, update the form to turn on
"limit_post_creation_to_admins"
9. Back to the non-admin browser, refresh /settings/extensions, you
should no longer see the section Publishing from RSS.
Note: I have not included an admin menu item as that is related to and
dependent on some refactors I'm working on (see forem/forem#16888 and
forem/forem#16847). So a bit of "security through obsurity"
Note: In the future, once we resolveforem/forem#16490, we'll start
toggling the "Create a Post" button.
Note: I am not including Cypress tests nor request tests for this
feature because the implementation details related to the testing via
that approach are a little too volitale.
Related to forem/forem#16842
* Updating copy based on forem/forem#16893
* styles
* styles
* dark styles
Co-authored-by: Paweł Ludwiczak <ludwiczakpawel@gmail.com>
This commit does three things:
1) Adds and tests the ArticlePolicy#moderate? feature
2) Refactors the spec helpers to be a bit more flexible
3) Adds a few more edge case tests around ArticlePolicy
My apologies for conflating these changes, as it makes this commit
more challenging to review.
The goal is to adequate demonstrate the logic around users who can or
cannot moderate. At present, the rules for who can moderate is here:
841491c6ee/app/javascript/packs/articleModerationTools.js (L17-L27)
```js
if (user?.trusted) {
if (user?.id !== articleAuthorId && !isModerationPage()) {
initializeActionsPanel(user, path);
initializeFlagUserModal(articleAuthorId);
// "/mod" page
} else if (isModerationPage()) {
initializeActionsPanel(user, path);
initializeFlagUserModal(articleAuthorId);
}
}
```
- Related to forem/forem#16783
- Closesforem/forem#16784
* Only fetch RSS of users who can create articles
This commit leverages changes from forem/forem#16732 and
forem/forem#16763 to ensure that we're only fetching RSS feeds for
folks who have permission to create articles.
In addition, I chose to rename the variable `user_scope` to
`users_scope` to bring consistency in the variable names.
I also chose to refactor a private method so that it wasn't setting two
instance variables but was instead returning a value that could be used
to set an instance variable.
Closesforem/forem#16487
* Amending method name
As I'm looking at limiting feed fetching only for users who are able to
create articles, I needed a means of querying "Who are the users who can
create articles?" This bit of work was the smallest chunk that I could
think of.
These kinds of questsions are going to propogate (e.g. give me a list of
all the people who can comment? who can create articles in this space?)
For now, this pattern should suffice.
Yes, there's duplication of knowledge between the policy's instance
method and class method. And there's a bit of knowledge bleed between a
user's method (e.g. `user.any_admin?` and
`*Authorizer::RoleBasedQueries::ANY_ADMIN`) but that's a small "evil".
Related to #16486
* Adjusting ArticlePolicy for admin only posting
The goal of this commit is actually two fold:
1) To add documentation regarding my current emerging understanding of
our caching implementation as it relates to our authorization and
authentication.
2) Flippiing "on" the feature's core authorization check.
Buried within this is the desired normalization of the authorization
between the `ArticlePolicy`'s `#create?`, `#preview?`, `#new?`.
My testing plan for this is to ask for SRE to spin-up a canary, then
test. What does that look like? I'm uncertain because this is nudge
closer towards our edge-caching strategy. Which makes robust testing
more difficult.
Closes forem/forem#16483
Related to #16529, #16571, #16536, #16529
Informs #16490, #16606
* Update spec/requests/editor_spec.rb
Co-authored-by: Jamie Gaskins <jgaskins@hey.com>
Co-authored-by: Jamie Gaskins <jgaskins@hey.com>
* Initial hack
* Begin functionality implementation
* Add proper route
* Finish up
* Fix test and formatting
* Fix test vars
* Update app/views/moderations/actions_panel.html.erb
Co-authored-by: Suzanne Aitchison <suzanne@forem.com>
* Update app/views/moderations/actions_panel.html.erb
Co-authored-by: Suzanne Aitchison <suzanne@forem.com>
* Update app/views/moderations/actions_panel.html.erb
Co-authored-by: Suzanne Aitchison <suzanne@forem.com>
* Update app/controllers/articles_controller.rb
Co-authored-by: Michael Kohl <me@citizen428.net>
* Update file to not use keys that are not needed
* Finalize featured logic
Co-authored-by: Suzanne Aitchison <suzanne@forem.com>
Co-authored-by: Michael Kohl <me@citizen428.net>
* Removing Articles::Builder making policy decision
This change is a refactoring through triangulation. Given that
`ArticlePolicy#new?` returned true, I'm prepared to assume that calling
`authorize(Article)` in all cases is acceptable.
So to narrow the Builder making a policy decision I renamed the returned
value to reflect what it was actually doing in the logic. And in
renaming, flipped the polarity of the boolean. Why the flip? Because
`needs_authorization == !store_location`.
In consultation with Allison and Jennie, I'm proceeding with a short-cut
to get me unstuck. That unstuck is namely "I need to ensure that the
articles#new action can go through authorization."
Given that I'll be spending time in the authorization layer, I hope
these noted short-cuts and comments will be useful in future spelunking
efforts regarding authorization.
Closes#16529
* Update app/policies/article_policy.rb
Co-authored-by: Michael Kohl <me@citizen428.net>
* Disabling spec
* Update app/policies/article_policy.rb
Co-authored-by: Dwight Scott <dwight@forem.com>
* Update app/policies/article_policy.rb
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Michael Kohl <me@citizen428.net>
Co-authored-by: Dwight Scott <dwight@forem.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
As written in the comments, we're looking at making the smallest change
to deliver on the feature. The other goal is to move from our
`user.admin?` paradigm towards leveraging Pundit policies.
If we need to move beyond Pundit, it will be easier once we've moved
all of our `user.something_something?` to policy questions. And please
note, I don't know if we'll move past pundit.
See [Authorization System: use case 1-1 project][1] for details on the
project.
Closes#16483
[1]:https://github.com/orgs/forem/projects/46/views/1
* Rename banned and comment_banned roles
* Add data update script to rename roles containing 'ban'
* Add named error for Suspended users
* Update unidiomatic method names
* Rename misc banned to suspended
* Apply suggestions from code review
Co-authored-by: Michael Kohl <me@citizen428.net>
* Add unit tests for suspended methods
This commit also adds TODO comments for removing banned and
comment_banned from the codebase after data update scripts have
successfully run on all of our Forems.
Co-authored-by: Michael Kohl <me@citizen428.net>
* Set up basic /manage route
* Add basic article manage page
* Add tips and finalize permissions for /manage
* Add final test and add manage button to article show
* Update failing specs
* Remove deprecated analytics role
* Make anchor tag a bit more readable
* Add OrganizationMembership table and model
* Add organization_membership associations
* Add unique indices for user_id and org_id
* Wrap update and create calls in transactions
* Remove specs of deprecated analytics_beta_tester
* Use a slightly faster call for user_id
* Remove unused file
* Test receive notifications functionality
* Notify when receive_notifications is true
* Test receiving reaction notifications
* Do not notify if receive_notifications is false
* Fix test for parent comment notification
* Add article mute notifications feature
* Remove deprecated specs
* Prevent email when receive_notification is false
* Update button messaging
* Use RESTful /article_mutes patch request
* Use parent or root article instead
* added organization policy + spec
* user specs for is_org_admin?
* added authroize to organization controller
* admin policy + specs
* deleted enforce admin due to pundit policy redundancy
* applied admin policy to entire admin namespace
* refactoring analytics controller WIP - wanna test codeship
* Add protection against reactions to unpublished articles (#473)
* Add chat channel policy and spec (#474)
* Add comment policy and specs (#475)
* Fix edge case with apostrophes
* Add comment policy and specs
* Add login for deleting comment spec
* Change test to raise pundit error instead of 404
* Clean up comment destroy request specs
* Remove redundant raise
* Whitelist columns on to_json call (#477)
* Add pundit policy for several controllers (#476)
* Add pundit policy for several controllers
* Adjust video spec
* Fix tag request specs
* Add proper twilio tokens request specs
* Remove puts statements
* Add a couple basic request specs (#478)
* Add a few tests and fix user tag color bug (#482)
* Refactor handle_tag_index in stories_controller (#481)
* Modify valid_request_origin? (#483)
* Add misc specs and remove banned attribute from user model (#484)
* Fix missing Cloudinary tags and misc specs (#486)
* removing current_user_is_admin? to use .is_admin? method
* added missing org policy routes
* Add comment for all public controllers
* Fix edge case for test
* Authorize mod controller and add specs
* Refactor methods via inheritance and use only super_admin role
* Create policy method for analytics via article_policy and refactor
* Capitalize all buttons in dashboard page
* Fix org tests and remove old admin test
* Use only happy path for analytics
* Fix tests to use Pundit error
* Update org_policy spec
