DGNum/demarches-normaliennes
13
1
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity

Merge branch 'dev'

Browse source
This commit is contained in:
gregoirenovel 2018-10-11 14:19:42 +02:00
commit 3f95312e73
7 changed files with 195 additions and 79 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
app/assets/stylesheets/new_design/auth.scss
View file

@ -97,8 +97,8 @@ $auth-breakpoint: $two-columns-breakpoint;
}
hr {
margin-top: 60px;
margin-bottom: 20px;
margin-top: 30px;
margin-bottom: 30px;
background-color: $grey;
border: none;
height: 1px;

2
app/dashboards/procedure_dashboard.rb
View file

@ -45,7 +45,7 @@ class ProcedureDashboard < Administrate::BaseDashboard
:id,
:created_at,
:libelle,
:organisation,
:service,
:dossiers,
:published_at
].freeze

27
app/models/procedure_presentation.rb
View file

@ -20,6 +20,14 @@ class ProcedurePresentation < ApplicationRecord
field_hash('Demandeur', 'user', 'email')
]
if procedure.for_individual
fields.push(
field_hash("Prénom", "individual", "prenom"),
field_hash("Nom", "individual", "nom"),
field_hash("Civilité", "individual", "gender")
)
end
if !procedure.for_individual || (procedure.for_individual && procedure.individual_with_siret)
fields.push(
field_hash('SIREN', 'etablissement', 'entreprise_siren'),
@ -87,7 +95,7 @@ class ProcedurePresentation < ApplicationRecord
.where("champs.type_de_champ_id = #{sort['column'].to_i}")
.order("champs.value #{order}")
.pluck(:id)
else
when 'user', 'individual', 'etablissement'
return dossiers
.includes(table)
.order("#{column} #{order}")
@ -102,13 +110,8 @@ class ProcedurePresentation < ApplicationRecord
column = sanitized_column(filter)
case table
when 'self'
dossiers.where("? ILIKE ?", filter['column'], "%#{filter['value']}%")
when 'france_connect_information'
dossiers
.includes(user: :france_connect_information)
.where("? ILIKE ?", "france_connect_informations.#{filter['column']}", "%#{filter['value']}%")
date = filter['value'].to_date rescue nil
dossiers.where("DATE_TRUNC('day', #{column}) = ?", date)
when 'type_de_champ', 'type_de_champ_private'
relation = table == 'type_de_champ' ? :champs : :champs_private
dossiers
@ -126,7 +129,7 @@ class ProcedurePresentation < ApplicationRecord
.includes(table)
.where("#{column} ILIKE ?", "%#{filter['value']}%")
end
when 'user'
when 'user', 'individual'
dossiers
.includes(table)
.where("#{column} ILIKE ?", "%#{filter['value']}%")
@ -183,10 +186,8 @@ class ProcedurePresentation < ApplicationRecord
case table
when 'self'
dossier.send(column)
when 'user'
dossier.user.send(column)
when 'etablissement'
dossier.etablissement&.send(column)
when 'user', 'individual', 'etablissement'
dossier.send(table)&.send(column)
when 'type_de_champ'
dossier.champs.find { |c| c.type_de_champ_id == column.to_i }.value
when 'type_de_champ_private'

4
app/views/new_gestionnaire/procedures/show.html.haml
View file

@ -106,7 +106,9 @@
- @procedure_presentation.displayed_field_values(dossier).each do |value|
%td
= link_to(value, gestionnaire_dossier_path(@procedure, dossier), class: 'cell-link')
/ FIXME: value should automatically fallback to `""` instead of nil
/ #get_value should call to_s on the champ
= link_to(value || "", gestionnaire_dossier_path(@procedure, dossier), class: 'cell-link')
%td.status-col
= link_to(gestionnaire_dossier_path(@procedure, dossier), class: 'cell-link') do

15
app/views/users/sessions/new.html.haml
View file

@ -23,6 +23,14 @@
= h simple_format(@dossier.procedure.description)
.column.auth-form
- if resource_name == :user
%p.register
%span
Nouveau sur demarches-simplifiees.fr ?
= link_to "Créer un compte", new_registration_path(resource_name), class: "button primary auth-signup-button"
%hr
= form_for @user, url: user_session_path, html: { class: "form" } do |f|
%h1 Connectez-vous
@ -51,10 +59,3 @@
.center
= link_to "Qu’est-ce que FranceConnect ?", "https://app.franceconnect.gouv.fr/en-savoir-plus", target: "_blank", class: "link"
- if resource_name == :user
%hr
%p.register
%span
Nouveau sur demarches-simplifiees.fr ?
= link_to "Créer un compte", new_registration_path(resource_name), class: "button auth-signup-button"

46
config/brakeman.ignore
View file

@ -1,25 +1,5 @@
{
"ignored_warnings": [
{
"warning_type": "SQL Injection",
"warning_code": 0,
"fingerprint": "030551e51e29561702bcb9760bdeeed15e1936d4a9537f27e5d1d13a0ebb34ef",
"check_name": "SQL",
"message": "Possible SQL injection",
"file": "app/models/procedure_presentation.rb",
"line": 130,
"link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
"code": "dossiers.includes(sort[\"table\"]).order(\"#{sanitized_column(sort)} #{sort[\"order\"]}\")",
"render_path": null,
"location": {
"type": "method",
"class": "ProcedurePresentation",
"method": "sorted_ids"
},
"user_input": "sanitized_column(sort)",
"confidence": "Weak",
"note": "Not an injection because of `sanitized_column`"
},
{
"warning_type": "SQL Injection",
"warning_code": 0,
@ -27,7 +7,7 @@
"check_name": "SQL",
"message": "Possible SQL injection",
"file": "app/models/procedure_presentation.rb",
"line": 119,
"line": 90,
"link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
"code": "dossiers.order(\"#{sanitized_column(sort)} #{sort[\"order\"]}\")",
"render_path": null,
@ -47,7 +27,7 @@
"check_name": "SQL",
"message": "Possible SQL injection",
"file": "app/models/procedure_presentation.rb",
"line": 125,
"line": 96,
"link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
"code": "dossiers.includes(((\"type_de_champ\" == \"type_de_champ\") ? (:champs) : (:champs_private))).where(\"champs.type_de_champ_id = #{sort[\"column\"].to_i}\").order(\"champs.value #{sort[\"order\"]}\")",
"render_path": null,
@ -59,8 +39,28 @@
"user_input": "sort[\"order\"]",
"confidence": "Weak",
"note": "Not an injection because `sort[\"order\"]` has passed `check_allowed_sort_order`"
},
{
"warning_type": "SQL Injection",
"warning_code": 0,
"fingerprint": "e0e5b55126891df8fe144835ea99367ffd7a92ae6d7227a923fe79f4a79f67f4",
"check_name": "SQL",
"message": "Possible SQL injection",
"file": "app/models/procedure_presentation.rb",
"line": 101,
"link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
"code": "dossiers.includes(\"user\").order(\"#{sanitized_column(sort)} #{sort[\"order\"]}\")",
"render_path": null,
"location": {
"type": "method",
"class": "ProcedurePresentation",
"method": "sorted_ids"
},
"user_input": "sanitized_column(sort)",
"confidence": "Weak",
"note": "Not an injection because of `sanitized_column`"
}
],
"updated": "2018-10-05 16:12:32 +0200",
"updated": "2018-10-11 12:09:03 +0200",
"brakeman_version": "4.3.1"
}

112
spec/models/procedure_presentation_spec.rb
View file

@ -49,6 +49,7 @@ describe ProcedurePresentation do
end
describe "#fields" do
context 'when the procedure can have a SIRET number' do
let(:procedure) { create(:procedure, :with_type_de_champ, :with_type_de_champ_private, :types_de_champ_count => 4, :types_de_champ_private_count => 4) }
let(:tdc_1) { procedure.types_de_champ[0] }
let(:tdc_2) { procedure.types_de_champ[1] }
@ -87,6 +88,19 @@ describe ProcedurePresentation do
it { expect(subject.fields).to eq(expected) }
end
context 'when the procedure is for individuals' do
let(:name_field) { { "label" => "Prénom", "table" => "individual", "column" => "prenom" } }
let(:surname_field) { { "label" => "Nom", "table" => "individual", "column" => "nom" } }
let(:gender_field) { { "label" => "Civilité", "table" => "individual", "column" => "gender" } }
let(:procedure) { create(:procedure, :for_individual) }
let(:procedure_presentation) { create(:procedure_presentation, assign_to: create(:assign_to, procedure: procedure)) }
subject { procedure_presentation.fields }
it { is_expected.to include(name_field, surname_field, gender_field) }
end
end
describe "#fields_for_select" do
subject { create(:procedure_presentation) }
@ -133,6 +147,29 @@ describe ProcedurePresentation do
it { is_expected.to eq('bla@yopmail.com') }
end
context 'for individual table' do
let(:table) { 'individual' }
let(:dossier) { create(:dossier, procedure: procedure, individual: create(:individual, nom: 'Martin', prenom: 'Jacques', gender: 'M.')) }
context 'for prenom column' do
let(:column) { 'prenom' }
it { is_expected.to eq('Jacques') }
end
context 'for nom column' do
let(:column) { 'nom' }
it { is_expected.to eq('Martin') }
end
context 'for gender column' do
let(:column) { 'gender' }
it { is_expected.to eq('M.') }
end
end
context 'for etablissement table' do
let(:table) { 'etablissement' }
let(:column) { 'code_postal' } # All other columns work the same, no extra test required
@ -249,6 +286,34 @@ describe ProcedurePresentation do
it { is_expected.to eq([biere_dossier, vin_dossier].map(&:id)) }
end
context 'for individual table' do
let(:table) { 'individual' }
let(:order) { 'asc' } # Desc works the same, no extra test required
let(:procedure) { create(:procedure, :for_individual) }
let!(:first_dossier) { create(:dossier, procedure: procedure, individual: create(:individual, gender: 'M', prenom: 'Alain', nom: 'Antonelli')) }
let!(:last_dossier) { create(:dossier, procedure: procedure, individual: create(:individual, gender: 'Mme', prenom: 'Zora', nom: 'Zemmour')) }
context 'for gender column' do
let(:column) { 'gender' }
it { is_expected.to eq([first_dossier, last_dossier].map(&:id)) }
end
context 'for prenom column' do
let(:column) { 'prenom' }
it { is_expected.to eq([first_dossier, last_dossier].map(&:id)) }
end
context 'for nom column' do
let(:column) { 'nom' }
it { is_expected.to eq([first_dossier, last_dossier].map(&:id)) }
end
end
context 'for other tables' do
# All other columns and tables work the same so it’s ok to test only one
let(:table) { 'etablissement' }
@ -267,6 +332,29 @@ describe ProcedurePresentation do
subject { procedure_presentation.filtered_ids(procedure.dossiers, 'suivis') }
context 'for self table' do
context 'for created_at column' do
let!(:kept_dossier) { create(:dossier, procedure: procedure, created_at: DateTime.new(2018, 9, 18, 14, 28)) }
let!(:discarded_dossier) { create(:dossier, procedure: procedure, created_at: DateTime.new(2018, 9, 17, 23, 59)) }
let(:filter) { [{ 'table' => 'self', 'column' => 'created_at', 'value' => '18/9/2018' }] }
it { is_expected.to contain_exactly(kept_dossier.id) }
end
context 'for updated_at column' do
let(:kept_dossier) { create(:dossier, procedure: procedure) }
let(:discarded_dossier) { create(:dossier, procedure: procedure) }
let(:filter) { [{ 'table' => 'self', 'column' => 'updated_at', 'value' => '18/9/2018' }] }
before do
kept_dossier.touch(time: DateTime.new(2018, 9, 18, 14, 28))
discarded_dossier.touch(time: DateTime.new(2018, 9, 17, 23, 59))
end
it { is_expected.to contain_exactly(kept_dossier.id) }
end
end
context 'for type_de_champ table' do
let(:kept_dossier) { create(:dossier, procedure: procedure) }
let(:discarded_dossier) { create(:dossier, procedure: procedure) }
@ -322,5 +410,29 @@ describe ProcedurePresentation do
it { is_expected.to contain_exactly(kept_dossier.id) }
end
context 'for individual table' do
let(:procedure) { create(:procedure, :for_individual) }
let!(:kept_dossier) { create(:dossier, procedure: procedure, individual: create(:individual, gender: 'Mme', prenom: 'Josephine', nom: 'Baker')) }
let!(:discarded_dossier) { create(:dossier, procedure: procedure, individual: create(:individual, gender: 'M', prenom: 'Jean', nom: 'Tremblay')) }
context 'for gender column' do
let(:filter) { [{ 'table' => 'individual', 'column' => 'gender', 'value' => 'Mme' }] }
it { is_expected.to contain_exactly(kept_dossier.id) }
end
context 'for prenom column' do
let(:filter) { [{ 'table' => 'individual', 'column' => 'prenom', 'value' => 'Josephine' }] }
it { is_expected.to contain_exactly(kept_dossier.id) }
end
context 'for nom column' do
let(:filter) { [{ 'table' => 'individual', 'column' => 'nom', 'value' => 'Baker' }] }
it { is_expected.to contain_exactly(kept_dossier.id) }
end
end
end
end