openproject

Commit Graph

Author	SHA1	Message	Date
ulferts	7ecf08e005	rework changed_by_system (#9043 ) Before, it was implemented by passing the changed attribut keys over to the contract to whitelist them. This lead to: * The contract interface becoming bloated * Having to rely on the knowledge of the developer not to falsely whitelist an attribute. The developer would also have to make sure to not perform a mass assignment after the attribute has been whitelisted The new approach it to integrate the behaviour into the model which is first altered in the service before it is scrutinized in the contract. The information about the changed attributes is now stored inside the model which removes the necessity to flag the whitelisted attribute separately. Additionally, the exact change is tracked. So if an attribute is set to one value inside a whitelisted block there is no risk in later on performing a mass assignment. This comes at the cost of extending the models which is weird also it is build into the default SetAttributesService so child classes do not have to worry. One might include the module into every AR model but currently we only need it for a very specific use case.	4 years ago
Wieland Lindenthal	c4c2149d98	Fix: 36299 -- Allow to modify login when global permission :manage_users present (#9026 ) * Refactoring: Create shared examples for user contracts * Users::UpdateContract spec added * Add spec for updating the login of a user * Add spec for permitted params when global permission to :manage_user * Remove spec for :login updates for user UpdateContractSpec The writability of the login attribute is not part of the contract (yet). * Use user contract for checking writability of user attributes * Fixing user contract specs. * use persisted user in spec Co-authored-by: ulferts <jens.ulferts@googlemail.com>	4 years ago
Oliver Günther	935cd02d33	[36294] Show authentication header only when any partial matches (#9044 ) * [36294] Show authentication header only when any partial matches * use collection_select for collection Co-authored-by: ulferts <jens.ulferts@googlemail.com>	4 years ago
Oliver Günther	0fa8b4a77b	Forward CSP extensions to login controller (#9047 ) * Forward CSP extensions to login controller * Extend spec for double auth code * stabilize spec On my machine, since I have an s3 bucket configured, the spec failed Co-authored-by: ulferts <jens.ulferts@googlemail.com>	4 years ago
Oliver Günther	65575d44f1	[36415] Add public filter to projects list (#9057 ) https://community.openproject.com/wp/36415	4 years ago
Aleix Suau	44cf9e0c5e	Epic/placeholder users frontend (#8977 ) * Add new button added to select-edit-field * Permissions Service + show button if canInviteUsersToProject * Permissions Service + show button if canInviteUsersToProject * Add initial invite user modal * Small change to invite user modal * Small use rmodal changes * Builds * Added invite user modal title translation * Changed modal to module * Figured out basic modal setup * Fixed build * Started adding option-list component * Adding reactive forms * vim * Reactive forms working for option-list * op-form-field is implemented, project-selection step works * Working on principal step * Basics of principal selection are done * Remove console logs * Added role step and role api bindings, updated directory structure * Added basics of message step * Added summary page * Add in-project check for selected principal * Add documentation for principal filters * Create modal-heading component * Fix principal emit * Add API calls to summary component * Work on translations, rework close fn * Added translations * Fixed styling * Add autofocus, fix typing * Improve typing * Add form-binding directive to fix form-field * Fixed typescript errors * Fix more translations * Codeclimate and TSLint errors * Failing test commented with TODO * Codeclimate fixes * Codeclimate fixes * Open invite user modal from user selection * Remove console and debugger calls * Opening modal from CreateAutocompleterComponent * Add new button added to select-edit-field * Permissions Service + show button if canInviteUsersToProject * Permissions Service + show button if canInviteUsersToProject * Codeclimate and TSLint errors * Failing test commented with TODO * Codeclimate fixes * Codeclimate fixes * Add initial invite user modal * Small change to invite user modal * Small use rmodal changes * Builds * Added invite user modal title translation * Changed modal to module * Figured out basic modal setup * Fixed build * Started adding option-list component * Adding reactive forms * vim * Reactive forms working for option-list * op-form-field is implemented, project-selection step works * Working on principal step * Basics of principal selection are done * Remove console logs * Added role step and role api bindings, updated directory structure * Added basics of message step * Added summary page * Add in-project check for selected principal * Add documentation for principal filters * Create modal-heading component * Fix principal emit * Add API calls to summary component * Work on translations, rework close fn * Added translations * Fixed styling * Add autofocus, fix typing * Improve typing * Add form-binding directive to fix form-field * Fixed typescript errors * Fix more translations * Refactor/op modal (#8978) * Initial modal refactoring * Updated modal imports * More modal module imports * Fix one more import * Fixed some styles * Fixed failing modal specs * Fix more spec selectors * Fix more specs * Updated backend modals * Improved code style * Fix export modal styles * Fix wiki export modal * Fix more specs * Fix webhooks modal * Added loading indicator back into modals * Fixed wp preview modal * InviteUserButtonComponent in * InviteUserButtonComponent in * InviteUserButtonComponent in MultiSelectEditFieldComponent and SelectEditFieldComponent * Remove extraneous module * Add Dragula import * Remove empty spec * Fix option-list component * Remove group creation from invite user modal * Write feature spec * Fix TS errors * Add Placeholder and Group apis to the frontend * Better api typing * Remove unnecessary interface * Remove group creation call Co-authored-by: Benjamin Bädorf <b.baedorf@openproject.com> Co-authored-by: Oliver Günther <mail@oliverguenther.de> Co-authored-by: Benjamin Bädorf <hello@benjaminbaedorf.eu>	4 years ago
Oliver Günther	8122d05a66	Add visible scope for placeholder users (#9042 )	4 years ago
ulferts	b8ca382d34	Group API (#9034 ) * include group members into resource * GET /api/v3/groups endpoint * POST /api/v3/groups * PATCH /api/v3/groups/:id * DELETE /api/v3/groups/:id	4 years ago
ulferts	55acf25277	fix saving work package general settings	4 years ago
Oliver Günther	37bef43cea	Introduce visible scope to principals When a user has the manage_users permission in any project, they are eligible to view all users for inviting them to the project. This however is not reflected in the principals API, where only users in all visible projects are found.	4 years ago
Oliver Günther	34f8e9dff8	Validate admin guard for all settings writers (#9012 ) * Validate admin guard for all settings writers * Add spec to test access to all links under admin * Fix broken specs * Keep only UpdateContract and add spec * Move admin settings under their own namespace for clarity Move all admin related settings under ::Admin::SettingsController * Fix more paths and views for settings Adds another spec to ensure all links in admin can be viewed by admin * Fix wrongly changed settings path for repositories page * Use plugin name for plugin settings	4 years ago
ulferts	9edf745085	Fix/group mention links (#9036 ) * turn group mentioning into link * add profile button to group edit page * Include built ckeditor Co-authored-by: Oliver Günther <mail@oliverguenther.de>	4 years ago
Oliver Günther	4980b4fb4a	Allow LDAP filters and groups to individually sync users (#9031 )	4 years ago
Oliver Günther	9acd19de46	Revert removal of groups XML responses (#9024 )	4 years ago
ulferts	e832e626ab	use actual user display setting name `login` does not exist, `username` does	4 years ago
Wieland Lindenthal	ffa5ac84a8	Allow deletion of placeholder users when permission of :manage_placeholder_user give (#9018 ) * Refactoring: Rename permission :add_user and :add_placholder_user to :manage_user and :manage_placeholder_user * Add deletion to :manage_placeholder_user permission label * WIP: Check :manage_placeholder_user permission before deletion Specs still missing * In controller rely on authorize_global for deleting placeholder users * Add deletion_info for placeholder users * Extend specs * Set placeholder users to locked when deleting * Review feedback Co-authored-by: Oliver Günther <mail@oliverguenther.de>	4 years ago
Oliver Günther	af35670694	Make placeholder users EE (#9003 ) * Add global permission to manage (but not delete) placeholders https://community.openproject.com/work_packages/35508 * Show EE upsale and disable creation of placeholders without it * Review feedback	4 years ago
ulferts	244eae534e	display postgresql version No longer displaying the database name as that will always be the same	4 years ago
Oliver Günther	bbeae32698	[35508] Add global permission to manage placeholder users (#9000 ) * Add global permission to manage (but not delete) placeholders https://community.openproject.com/work_packages/35508 * Restore breadcrumbs for non-show routes * Remove permissions to memberships for add_placeholder_user permission * Allow non-admins with global permission to access membership * Remove permissions to memberships for add_placeholder_user permission * Rename shared_examples for admin contract validations Co-authored-by: ulferts <jens.ulferts@googlemail.com>	4 years ago
Oliver Günther	f4dfd6c6c6	[36238] Extract and fix user references in other objects (#9007 ) * Move replacing invalid references into separate job for principals * Write migration to remove existing invalid custom values and responsible * Fix other specs * Fix other specs * rewrite replacing user in records * consolidate principal deletion * include placeholder users in spec Co-authored-by: ulferts <jens.ulferts@googlemail.com>	4 years ago
Oliver Günther	47d4bdd036	Ensure before_actions are executed for settings writers	4 years ago
Oliver Günther	5f8a9a1868	[35157] Fix backlogs settings validations to disallow task = story (#9009 ) Refactors the settings controller into its own controller to allow checking the parameters before saving. Also removes a JS snippet that is no longer being executed since CSP is enforced. https://community.openproject.com/wp/35157	4 years ago
Oliver Günther	0c9fb9b1af	[36206] Make force_no_page for ldap configurable https://community.openproject.com/wp/36206	4 years ago
Wieland Lindenthal	a18954b2c9	Placeholder user services and administration (#8944 ) * Adding placeholder user contracts * Adding create, update, and delete services for placeholder users * WIP: Adding Placeholder User contract specs [ci skip] * Extract contract validation into common helper * Add common validation in BaseContract + common example for admin checks * Introduce common ModelContract shared context for validations * WIP: PlaceholderUser controller, i18n, and routes [ci skip] * Placeholder users index page and query - moved all group related scopes from User to Principal to make them also available in PlaceholderUser. * end * Create PlaceholderUser * Feature spec for editing a placeholder user * Manage PlaceholderUser memberships The managment of memberships is pretty similar for User and PlaceholderUser. This commit extacts the similarities and uses them for both. * General partial and show view for PlaceholderUser * Delete obosolete partial * Allow RequireAdminGuard to be used as a module function * Fix I18n for confirmation text * Smaller code improvements * Fix: Syntax for accessing status enums was wrong. * Use UpdateService for updating a placeholder user * Add spec for PlaceholderUsersController * First code improvements after code review. - more improvements to come. * Further code improvements after review ... still more to come * Correct namespace of delete service * Fix: Make placeholder user contract validate * Remove :type attribute from base contract of User and PlaceholerUser ...and add it to the CreateContracts. Also add type validations. Further extract shared examples for placeholder user attribute validation * Refactor: Extract membership hook calls to helper * Fix redirect paths for membership controllers * Specs already present in shared exampels. * Fix duplicates routes for users and placeholder users * Fix user path * Add attribute name and lastname We don't need a writeable check as both are equally writable * Replace more references to tab_edit_user_path * Skip specs for PlaceholderUsers::DeletionService We will tackle that service in a separate PR. * Fix module usage of RequireAdminGuard * Fix group filter for placeholder users * Fix invalid reference to expect_valid * Fix: Fix tabbed edit path for placeholder users * Fix status filtering on users * Linting * Improve generalisation of individual principal filter cell - Check for presence of groups and statuses in order to toggle visibility of their UI element. - Remove groups from placeholder user controller and cell initialization and options * Fix selector on groups assign * Remove using_shared_fixtures Co-authored-by: Oliver Günther <mail@oliverguenther.de>	4 years ago
Markus Kahl	2cab0bedd7	CustomStyle uses this uploader and doesn't have a content_type method.	4 years ago
ulferts	1bdd2ab9ae	safe automatic fixes by rubocop (#8994 )	4 years ago
Oliver Günther	cdf3cf4c34	[36136] Rework members page to show name and avatars for principals (#8973 ) * Rewrite members page to output name column * Remove white-space nowrap for long login names in administration * Extend member specs * Allow query instance to be used in table cell * Fix memberships specs with changed columns * Add order for email * Review feedback * Allow x to close add member form * WIP sort firstname/lastname * Make status sortable * Extract order_by_name into the order class * Re-add but deprecate order_by_name It's still in use in combination with some special scopes (custom actions for example) that I don't want to remove right now * Rewrite order_by_name into scope	4 years ago
Oliver Günther	109ade62da	Allow editing auth_source as a global user (#8954 )	4 years ago
Oliver Günther	2cde433326	Remove usages of AnyFixture (#8987 ) AnyFixture will create once instance of a factory for reuse in a number of specs. This will work fine until we require a clean slate for a specific example. As we have numerous tests that test like the database is empty, we get a number of disadvantages: - After an example with `with_clean_fixture` metadata, the fixture will only be regenerated after the next example that uses it. This means the order of execution will change the number of objects in the DB. - The more `with_clean_fixture` we have, the smaller the performance advantage of AnyFixture will result in. - You cannot use an AnyFixture in a spec that needs a clean slate. This should be obvious but was overlooked by myself.	4 years ago
Oliver Günther	a65992c354	Allow placeholder and group assignment to custom field (#8972 ) * Allow placeholder and group assignment to custom field * Review feedback	4 years ago
ulferts	e9692f85a5	add filtering for assignee with placeholder users	4 years ago
ulferts	441bb340ff	allow pageSize = 0 on manually sorted queries This allows fetching the query without the added burden of having to render the work packages. Rendering the work packages increases the response time heavily.	4 years ago
Oliver Günther	15a2716d95	[35012] Use reorder in table cell to correct sort order In the users table, an implicit order(ID asc) was added before passing to the table cell, which resulting in additional sort orders to only be appended and useless with ID order. To ensure we sort first by the request attribute, then by ID, a `reorder` is used. https://community.openproject.com/wp/35012	4 years ago
ulferts	cc4ed56e2a	use AR`s scope method instead of singleton class method (#8976 ) * use AR`s scope method instead of singleton class method By using the scope method, all of Rails` checks and method definition usually done on a method are now also performed on the extracted scope methods `5f3ff60084/activerecord/lib/active_record/scoping/named.rb (L154-L190)` * turn scope classes into modules	4 years ago
Oliver Günther	e484804645	[35506] Avoid notifications for assigned/responsible placeholders Right now, placeholder users cannot be watchers nor authors nor meeting participants, so the only notifications that can happen are work package assignees or responsibles. https://community.openproject.com/wp/35506	4 years ago
ulferts	5ea185ef66	Placeholder user project members (#8961 ) * remove intermediate placeholder scope Doing so, placeholder users will begin to show up in the system * remove scope without value * extract scope * use enum for status * allow placeholder users to become project members * display placeholder user member on members widget * remove now superfluous method The status name can simply be queried via #status now * replace possible_assignees/responsibles on project This also leads to placeholder users becoming eligible as assignees and responsibles. * fix aggregated scope on bulk edit * linting * remove IssueHelper	4 years ago
Oliver Günther	32d4af0bba	Restore users/new toolbar	4 years ago
Wieland Lindenthal	3044b5ce5e	Align ModelContract validate/valid? methods with ActiveModel::Validations (#8955 ) * Align ModelContract validate/valid? methods with ActiveModel::Validations * Add BaseContract to allow contracts on non ActiveRecord resources * Avoid using alias_method as that won't work with subclasses Co-authored-by: Oliver Günther <mail@oliverguenther.de>	4 years ago
Oliver Günther	4d17b19783	[36026] Ensure project filter only searches for active projects https://community.openproject.com/wp/36026	4 years ago
Oliver Günther	3c9be3bdbe	[35507] Allow global permission to add and edit users (#8937 ) * Add global permission for add_user * Rename fieldset for global roles to "Global" * Add permission to admin actions * Add index action to add_user permission * Redirect to first admin item if only one * Hide status action for non admins * Break down user form into partials for easier rendering * Disable some user form tabs for non-admins * Make users API and services conformant with endpoints * Fix references to DeleteService#deletion_allowed? * Authorize add_user on show as well * Only show invite user toolbar item with permission * Fix Delete Service spec * Fix the way user prefs are handled in service * Ensure session_id is treated as string This causes a cast error otherwise as it passes rack session locally * Fix service call on onboarding controller * Fix service call on users controller * Add delete spec for global user * Hide login attribute again when adding a new user * Render auth source correctly in simple form * Fix creating invited users through service The invitation requires the mail attribute to be present. Previously, there was a manual error added to the mail. As the errors are now determined by the contract + model, we now end up with all missing properties as errors. * Properly constraint attributes for non-admins * Add specs for global user * Start working on how to update password from UsersController that code is a mess... * Change permitted_params spec to include non-admin params * Fix create user service spec * Remove mail_notification param from users controller It's not part of the contract/params passed to user * Remove todos * Extend docs * Correct the way backlogs patches into the user settings * Remove superfluous UpdateUserService * Rewrite duplicated update service examples into common shared example * Remove duplicate password writable check * Base Users::DeleteContract on base delete contract * Move checks for active users into the UserAllowedService * Restore password writable check as it is not an attribute * Fix menus for global user * Allow global users to add custom fields * Allow global user add permission to reinvite user * Fix changed var name in update service spec * Ensure also invited or registered users can be authroized This ensure that e.g., invited users can also be set as watchers * fix typo Co-authored-by: ulferts <jens.ulferts@googlemail.com>	4 years ago
Oliver Günther	e4c9506e56	[36081] Increase max lengths of user/group names (#8948 ) * Unset DB limits for user attributes * Validate groups in synchronized groups * Extend limitations and fix specs	4 years ago
Oliver Günther	769be47723	[35815] Add visible show page for all users to groups (#8949 ) To that end, move the show group routes out of /admin, that requires we use a different path helper for it as `group_path` will still link to the first admin resource.	4 years ago
Wieland Lindenthal	efbd3e9b41	Placeholder user backend (#8935 ) * Add missing copyright note to AnonymousUser [ci skip] * Addin PlaceholderUser model and its associations * Ensure PlaceholderUser do not "leak out" uncontrolled * Extract Associations for User and PlaceholderUser. - remove obsolete #assigned_issues - remove obsoete #:responsible_for_issues - add specs and factory for PlaceholderUser Adding specs to PlaceholderModel * Migration: enforce uniqueness of lastname for Group and PlaceholderUser * Remove obsolete callback `after_add` on groups association. The association of principals and groups still had a callback `after_add` that called a method `user_added` on the group. That method was not defined anymore as it was removed in commit `d93ff52a27`. * Move validation for #groupname to the right spec. * Cleanup placeholder and group specs * Remove Setting `workpackage_group_assignment` * Refactoring: Extract assignable scope from Project to Member * Refactor: Add Member scope not_locked. * deprecate hacky scope * remove wp_group_assignment specific test case Co-authored-by: ulferts <jens.ulferts@googlemail.com>	4 years ago
Markus Kahl	1c8aaf031f	Maintenance: ruby patch level update to 2.7.2 (#8951 ) * Update ruby to 2.7.2 * make sure to pull latest base image * minor comment update	4 years ago
luzpaz	4ff8169d33	FIx typo nucleous-> nucleus in app/ and modules/ (#8947 )	4 years ago
Markus Kahl	af48244ffd	make download URL expiry configurable, use safer default	4 years ago
Markus Kahl	51a40c97eb	set content type of attachments in S3 (#8938 ) * set content type of attachments in S3 * refactoring to allow amending and reading given metadata more easily * confirm attachment content type is sent to S3	4 years ago
luz paz	3683042c9b	Fix typos in user facing and non-user facing code Found via `codespell v2.1.dev0`	4 years ago
ulferts	8af2d6e582	fix version links on roadmap (#8936 ) * adds an id to the version link to be anchorable * adds an achor element to the link in the version list * whitelists the possible filter parameters for the version list links The solution has an insufficiency in that the browser unnecessarily reloads the page if the user had filtered before and then clicks on a link. I find that acceptable.	4 years ago
ulferts	2744673ec8	avoid updating the lock version on finishing an attachment upload (#8934 ) If the lock version is increased, it might happen while the user is still editing the description. The user might have added an image to the description and continues typing. In the backend, the FinishDirectUploadJob is run before the user presses the checkmark to send the updated description. In that case, a 409 conflict would be signaled if the lock version were to be updated in the meantime.	4 years ago

1 2 3 4 5 ...

18427 Commits (b9b249aa2fa131f14ab3bb2be105fefd402002fd)