Merged in r2-2683-develop-main (pull request #6585)

R2-2683: Merging develop into main 11.07.23

.eslintrc.js

@@ -1,3 +1,5 @@
+// Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 const developmentEnv = process.env.NODE_ENV === "development";
 
 module.exports = {

.github/workflows/app.yml

@@ -1,3 +1,5 @@
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 name: App
 on:
   pull_request:

.mochaignore.js

@@ -1,3 +1,5 @@
+// Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 import requireHacker from "require-hacker";
 
 const extensions = ["css", "gif", "jpg", "svg", "png"];

.nycrc.yml

@@ -1,3 +1,5 @@
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 nyc:
   extension:
     - '.jsx'

.pryrc

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 Pry.commands.alias_command 'c', 'continue'
 Pry.commands.alias_command 's', 'step'
 Pry.commands.alias_command 'n', 'next'

.rubocop.yml

@@ -1,3 +1,5 @@
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 AllCops:
   Exclude:
     - db/schema.rb

Gemfile

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 source 'https://rubygems.org'
 ruby '3.2.2'
 

LICENSE

@@ -4,7 +4,7 @@ data on vulnerable children and survivors of violence. Primero is
 freely available, but if you would access to the CPIMS+ and GBVIMS+ 
 configurations (JSON bundles), please contact: [email protected] 
 
-Copyright (C) 2017 UNICEF.
+Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU Affero General Public License as

README.md

@@ -1,3 +1,5 @@
+<!-- Copyright (c) 2014 - 2023 UNICEF. All rights reserved. -->
+
 Primero
 ========
 [![Build Status](https://api.travis-ci.org/primeroIMS/primero.svg?branch=master)](https://travis-ci.org/primeroIMS/primero/branches)
@@ -168,7 +170,8 @@ You can login with a preseeded admin account with credentials `primero`/`primer0
 For more on making code contributions, have a look at the file [CONTRIBUTING.md](CONTRIBUTING.md).
 
 ### Using WebPush
-To send push messages to web browsers you can enable webpush. For this, is required set some environment variables: `PRIMERO_WEBPUSH`, `PRIMERO_WEBPUSH_VAPID_PRIVATE` and `PRIMERO_WEBPUSH_VAPID_PUBLIC`
+To send push messages to web browsers you can enable webpush. For this, is required set some environment variables: `PRIMERO_WEBPUSH`, `PRIMERO_WEBPUSH_VAPID_PRIVATE` and `PRIMERO_WEBPUSH_VAPID_PUBLIC`.
+PRIMERO_WEBPUSH must be placed in `inventory` file, the other two must be in `secret.yml` file.
 
 To generate a valid VAPID key, you can execute the follow script and use for each variable
 

Rakefile

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 # Add your own tasks in files placed in lib/tasks ending in .rake,
 # for example lib/tasks/capistrano.rake, and they will automatically be available to Rake.
 

ansible/README.md

@@ -1,3 +1,5 @@
+<!-- Copyright (c) 2014 - 2023 UNICEF. All rights reserved. -->
+
 # Primero Ansible
 
 [TOC]
@@ -198,6 +200,7 @@ LC_ALL=C < /dev/urandom tr -dc '_A-Z-a-z-0-9' | head -c"${1:-32}"
 
 You also have the option of creating a variable for a private ssh key in order to clone configuration files from a private repo.  If you will not be including the private ssh
 key just leave the variable `ssh_private_key` out of the secrets.yml file.
+```
                 ---
                 primero_secret_key_base: 'generated_secret'
                 primero_message_secret: 'generated_secret'
@@ -207,6 +210,8 @@ key just leave the variable `ssh_private_key` out of the secrets.yml file.
                 secret_environment_variables:
                   SMTP_USER: 'secret'
                   SMTP_PASSWORD: 'secret'
+                  PRIMERO_WEBPUSH_VAPID_PRIVATE: 'secret'
+                  PRIMERO_WEBPUSH_VAPID_PUBLIC: 'secret'
                 ssh_private_key: |
                 -----BEGIN RSA PRIVATE KEY-----
                 klkdl;fk;lskdflkds;kf;kdsl;afkldsakf;kasd;f
@@ -222,10 +227,10 @@ key just leave the variable `ssh_private_key` out of the secrets.yml file.
                 klkdl;fk;lskdflkds;kf;kdsl;afkldsakf;kasd;f
                 afdnfdsnfjkndsfdsjkfjkdsjkfjdskljflajdfjdsl
                 -----END CERTIFICATE-----
-
+```
 The variables in the `inventory.yml` along with the `secrets.yml` will also be used to make the `local.env` file for the dokcer-compose files.
 
-The optional dictionary `secret_environment_variables` can contain key/value pairs of secret environment variables. It can be used in conjuunction with the optional `environment_variables` dictionary in the inventory file, and will override those values. A good use of this dictionary is to specify SMTP settings.
+The optional dictionary `secret_environment_variables` can contain key/value pairs of secret environment variables. It can be used in conjuunction with the optional `environment_variables` dictionary in the inventory file, and will override those values. A good use of this dictionary is to specify SMTP settings. Here we can add PRIMERO_WEBPUSH_VAPID_PRIVATE and PRIMERO_WEBPUSH_VAPID_PUBLIC, these keys together with PRIMERO_WEBPUSH allow us to enable webpush notifications. To generate VAPID keys follow the instruction in [README.md](../README.md) file. if we are enabling Webpush on an existing server, we must modify the `inventory.yml` and `secrets.yml` with the 3 variables, then re-execute the ansible command `local-env`
 
 ## Config promotion
 
@@ -319,3 +324,19 @@ If you change your hostname and you want to update your letsencrypt certificate,
 ```
   ​(venv) $ ansible-playbook application-primero.yml --tags "start"
 ```
+
+## Apply database migrations
+
+Database migrations are only present in major and minor version updates (2.7, 2.8) never in patch versions (v2.7.1).
+
+Make sure to execute the migrations every time you upgrade Primero.
+
+To execute the migrations, run:
+
+```
+​(venv) $ ansible-playbook application-primero.yml --tags "configure,start"
+```
+
+This command will execute migrations and also attempt to run the configuration indicated in `primero_configuration_repo_branch`.
+
+**Please be cautious as this could overwrite the current system configuration**. if you want to prevent a configuration from being applied, make sure to set the configuration version that is applied to the system.

ansible/application-primero.yml

@@ -1,3 +1,5 @@
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 ---
 - hosts: 'all:localhost'
   environment:

ansible/bootstrap.yml

@@ -1,3 +1,5 @@
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 ---
 - hosts: '!vpc:!first_run'
   gather_facts: no

ansible/certbot.yml

@@ -1,3 +1,5 @@
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 ---
 - hosts: 'all'
   roles:

ansible/ecr-login.yml

@@ -1,3 +1,5 @@
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 ---
 - hosts: 'all:localhost'
   roles:

ansible/external-certs.yml

@@ -1,3 +1,5 @@
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 ---
 - hosts: 'all'
   roles:

ansible/group_vars/all/vars.yml

@@ -1,3 +1,5 @@
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 ---
 ansible_python_interpreter: '/usr/bin/python3'
 qi_install_python3_docker_pip_names:

ansible/group_vars/primero/vars.yml

@@ -1,3 +1,5 @@
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 ---
 nginx_container_username: 'nginx'
 application_container_username: 'primero'

ansible/install-docker.yml

@@ -1,3 +1,5 @@
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 ---
 - hosts: 'all'
   roles:

ansible/inventory/inventory.yml.template

@@ -37,3 +37,5 @@ all:
         RUN_DEFAULT_PRIMERO_SEEDS: 'false' # Set to true if you want to run default seeds
         PRIMERO_DEFAULT_USERS: 'true' # Seed default users when using the managed Primero SaaS configs
         # LOCALE_DEFAULT: 'ar' # Optionally override English as the default locale.
+        PRIMERO_WEBPUSH: 'true'
+        PRIMERO_WEBPUSH_CONTACT: '[email protected]'

ansible/requirements.yml

@@ -1,3 +1,5 @@
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 ---
 collections:
 - name: 'git+https://github.com/Quoin/ansible-infrastructure.git#quoin/infrastructure'

ansible/roles/application-primero/defaults/main.yml

@@ -1,2 +1,4 @@
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 ---
 primero_postgres_version: "14"

ansible/roles/application-primero/files/primero-docker-cleanup.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
 
 version=$(</srv/primero/docker-app-version.txt)
 

ansible/roles/application-primero/meta/main.yml

@@ -1,3 +1,5 @@
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 ---
 dependencies:
 

ansible/roles/application-primero/tasks/main.yml

@@ -1,3 +1,5 @@
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 ---
 - name: 'Copy Primero deployment private SSH key to remote host'
   copy:

ansible/roles/manage-users/tasks/main.yml

@@ -1,3 +1,5 @@
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 ---
 - name: 'Ensure group {{ application_container_username }} exists'
   group:

ansible/roles/primero-certbot/tasks/main.yml

@@ -1,3 +1,5 @@
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 ---
 - name: 'create the /srv/primero/bin directory'
   file:

ansible/roles/primero-external-certs/tasks/main.yml

@@ -1,3 +1,5 @@
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 ---
 - name: 'create the /srv/external-certs directory'
   file:

ansible/roles/prune/tasks/main.yml

@@ -1,3 +1,5 @@
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 ---
 - name: 'prune dangling Docker images'
   command: |

app/assets/javascripts/application.js

@@ -1,2 +1,4 @@
+// Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 //= require i18n
 //= require i18n/translations

app/assets/javascripts/translations.js

@@ -1,2 +1,4 @@
+// Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 //= require i18n
 //= require i18n/translations

app/auth/idp_token.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 # Encapsulates the logic to decode and validate a JWT token
 # generated by an external identity provider.
 class IdpToken

app/auth/idp_token_strategy.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 require 'warden'
 
 # This strategy is used when Primero needs to authorize a JWT token from an external identity provider.

app/controllers/api/v2/activity_log_controller.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 # API to fetch the list of activities
 class Api::V2::ActivityLogController < ApplicationApiController
   include Api::V2::Concerns::Pagination

app/controllers/api/v2/agencies_controller.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 # API endpoint for Agency CRUD
 class Api::V2::AgenciesController < ApplicationApiController
   include Api::V2::Concerns::Pagination

app/controllers/api/v2/alerts_controller.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 # Class for Alert Controller
 class Api::V2::AlertsController < Api::V2::RecordResourceController
   def bulk_index
@@ -15,6 +17,17 @@ def index
     @alerts = @record.alerts
   end
 
+  def destroy
+    authorize! :remove_alert, @record
+    alert_id = params[:id]
+    alert = @record.alerts.find { |a| a.unique_id == alert_id }
+    if alert.present?
+      alert.destroy!
+      return
+    end
+    raise ActiveRecord::RecordNotFound
+  end
+
   def index_action_message
     'show_alerts'
   end

app/controllers/api/v2/approvals_controller.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 # Create, approve, or deny an approval request
 class Api::V2::ApprovalsController < Api::V2::RecordResourceController
   before_action :approval_params, only: [:update]

app/controllers/api/v2/assigns_controller.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 # API endpoints that handle record reassignment
 class Api::V2::AssignsController < Api::V2::RecordResourceController
   def index

app/controllers/api/v2/attachments_controller.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 # API endpoints for adding and removing attachments on Primero resources (usually records)
 class Api::V2::AttachmentsController < Api::V2::RecordResourceController
   before_action { authorize!(:update, @record) }

app/controllers/api/v2/audit_logs_controller.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 # Audit logs query API
 class Api::V2::AuditLogsController < ApplicationApiController
   include Api::V2::Concerns::Pagination

app/controllers/api/v2/bulk_exports_controller.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 # API endpoint for generating exports, in bulk or for individual records
 class Api::V2::BulkExportsController < ApplicationApiController
   include Api::V2::Concerns::Pagination

app/controllers/api/v2/children_controller.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 # Main API controller for Case records
 class Api::V2::ChildrenController < ApplicationApiController
   include Api::V2::Concerns::Pagination
@@ -16,20 +18,18 @@ def traces
   alias select_updated_fields_super select_updated_fields
   def select_updated_fields
     changes = @record.saved_changes_to_record.keys
-    @updated_field_names = select_updated_fields_super + @record.current_care_arrangements_changes(changes)
-    @updated_field_names << 'family_details_section' if @record.family&.family_members_changed?
+    @updated_field_names = select_updated_fields_super + @record.current_care_arrangements_changes(changes) +
+                           @record.family_changes(changes)
   end
 
-  def family
-    authorize! :create, Child
+  def create_family
+    authorize! :case_from_family, Child
     @current_record = Child.find(family_params[:case_id])
     @record = FamilyLinkageService.new_family_linked_child(
       current_user, @current_record, family_params[:family_detail_id]
     )
     @current_record.save! if @current_record.has_changes_to_save?
     @record.save!
-
-    select_updated_fields
     select_fields_for_show
   end
 

app/controllers/api/v2/children_incidents_controller.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 # API endpoint for listing the incidents associated with a case
 class Api::V2::ChildrenIncidentsController < Api::V2::RecordResourceController
   before_action :permit_fields

app/controllers/api/v2/codes_of_conduct_controller.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+# Copyright (c) 2014 - 2023 UNICEF. All rights reserved.
+
 # API endpoint for code of conduct
 class Api::V2::CodesOfConductController < ApplicationApiController
   include Api::V2::Concerns::JsonValidateParams