Merge pull request #4193 from AntonKhorev/lookup-friend

Lookup friend user before make/remove friend action

Merge pull request #4197 from AntonKhorev/user-resources

Move user lookup/error methods from app controller to concerns

Merge pull request #4202 from tomhughes/changeset-comment-limit

Add rate limiting for changeset comments

Update bundle

Merge remote-tracking branch 'upstream/pull/4208'

Bump osm-community-index from 5.5.5 to 5.6.0

Bumps [osm-community-index](https://github.com/osmlab/osm-community-index) from 5.5.5 to 5.6.0.
- [Release notes](https://github.com/osmlab/osm-community-index/releases)
- [Changelog](https://github.com/osmlab/osm-community-index/blob/main/CHANGELOG.md)
- [Commits](https://github.com/osmlab/osm-community-index/compare/v5.5.5...v5.6.0)

---
updated-dependencies:
- dependency-name: osm-community-index
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/4198'

Restore ordering of results from the users#index API call

Merge remote-tracking branch 'upstream/pull/4203'

Add checks to ensure that the response is empty

Merge remote-tracking branch 'upstream/pull/4204'

Sort users by their ids

Change tests to expect a successful (empty) response even if the user is not visible anymore

Bump eslint from 8.47.0 to 8.48.0

Bumps [eslint](https://github.com/eslint/eslint) from 8.47.0 to 8.48.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v8.47.0...v8.48.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Use where instead of find to prevent 404

Add rate limiting for changeset comments

Fixes #4196

Test that suspended and deleted users can't use OAuth tokens

Logout while testing OAuth 1 token usage

This ensures we're not accidentally inheriting any session permissions.

Separate authenticating user from application owner in OAuth 1 tests

Localisation updates from https://translatewiki.net.

Make the TOTP cookie httponly

Update to rails 7.0.7.2

Update bundle

Add support for rate limiting signup requests

Lookup friend user before make/remove friend action

Lookup user before action in user's notes list

Render unknown user with concerns code in notes controller

Move user lookup and error render to concerns

Merge remote-tracking branch 'upstream/pull/4190'

Merge remote-tracking branch 'upstream/pull/4169'

Change provider name to "microsoft"

Add migration script

Update tests for microsoft_graph endpoints

Respond with plaintext when user not found in changeset query

The response used to be of type xml with empty body, which is not valid xml.

Merge remote-tracking branch 'upstream/pull/4187'

Merge remote-tracking branch 'upstream/pull/4186'

Replace links to donate.osm.org with supporting.osm.org

Expose note query limit values in api capabilities

Add missing changeset query limit capabilities test

Use max note query limit setting in tests

Move note query limit values to settings

Bump puma from 5.6.6 to 5.6.7

Bumps [puma](https://github.com/puma/puma) from 5.6.6 to 5.6.7.
- [Release notes](https://github.com/puma/puma/releases)
- [Changelog](https://github.com/puma/puma/blob/master/History.md)
- [Commits](https://github.com/puma/puma/compare/v5.6.6...v5.6.7)

---
updated-dependencies:
- dependency-name: puma
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/4185'

Make the versions call default to XML

Merge remote-tracking branch 'upstream/pull/4182'

Merge remote-tracking branch 'upstream/pull/4180'

Merge remote-tracking branch 'upstream/pull/4181'

Add 'User' to selectable types in issues search for moderators

Reported users are either directly assigned to moderators or ofter reassigned to them.

Add JSON output to /api/versions

Bump osm-community-index from 5.5.4 to 5.5.5

Bumps [osm-community-index](https://github.com/osmlab/osm-community-index) from 5.5.4 to 5.5.5.
- [Release notes](https://github.com/osmlab/osm-community-index/releases)
- [Changelog](https://github.com/osmlab/osm-community-index/blob/main/CHANGELOG.md)
- [Commits](https://github.com/osmlab/osm-community-index/compare/v5.5.4...v5.5.5)

---
updated-dependencies:
- dependency-name: osm-community-index
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Update to iD v2.27.1

Merge remote-tracking branch 'upstream/pull/4171'

Merge remote-tracking branch 'upstream/pull/4179'

Merge remote-tracking branch 'upstream/pull/4178'

Add color keys to note tables

Remove right leaflet toolbar position override

Has no effect, doesn't take rtl into account.
Was added in https://github.com/openstreetmap/openstreetmap-website/commit/537d72b0f66562475808249a1a2ef3223df5dd52#diff-fe520170ce0c939dc1e59f3395a360a1866b4da19b474c9f0b35112f72e952d8R117

Replace references to windowslive with microsoft_graph

Use omniauth-microsoft_graph instead of omniauth-windowslive

Omniauth-microsoft_graph correctly populates 'email' and 'name' fields used by OpenStreetMap.
It also  uses updated endpoints for Microsoft identity provider.

Use email address returned by microsoft_graph provider as a verified address.

Upgrading exisiting users from windowslive to microsoft_graph:
 - upon next login existing `windowslive` users will have to authorizei
   OpenStreetMap application to "Read Your Profile," required for proper reading
   of display name field.

The name of the identity provider in OSM is kept to 'windowslive':
 - the entries in users table with `provider == 'windowslive'`
   can be reused for microsoft_graph provider, since
   the uid field is preserved. Users will not need to repeat the sign up process.
 - OAuth2 callback is still `/auth/windowslive`, no updates to Microsoft Identity Provider portal
   App registration are necessary.

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/4174'

Update to iD v2.27.0

Merge pull request #4133 from AntonKhorev/flex-leaflet-controls

Use multiple columns for map controls if they don't fit vertically

Merge pull request #4150 from AntonKhorev/note-table-bootstrap-highlight

Use Bootstrap highlight class in note tables

Merge pull request #4156 from AntonKhorev/bootstrap-code-direction-fix

Don't do direction override from Bootstrap reboot of <code>

Merge pull request #4148 from tomhughes/avatar-image

Use correct extension and type for avatar images attached to mails

Merge pull request #4173 from AntonKhorev/comments

Small changes of diary comments

Merge pull request #4172 from tomhughes/user-predicates

Fix predicate method names in the user model

Replace top margin on comments with bottom padding on diary posts

Remove empty comments anchor

Fix predicate method names in the user model

Fix new rubocop warnings

Update bundle

Add 'from' and 'to' changeset query parameters

Revert misleading comment about time restriction

Was added in https://github.com/openstreetmap/openstreetmap-website/commit/afe8dd51ece21325eea8a108515b9426764de5b2#diff-22d3daaccac3ac960d6dbb47e9c6a9d15b0b4cffbbf9ad32d525600f562827f1R420

Disallow changesets query with both time and order=oldest

Sort changesets by creation time

Add tests for changeset order + from..to queries

Localisation updates from https://translatewiki.net.

Make the close icon on banners more visible

Fixes #4165

Add support for dark banner images that need a white close icon

Remove SotM 2022 banner, add fundraising banner

Closes #4162

Sort changesets by close time to match selection

This ensures that the sort can be optimised using the index
when selecting by time.

Make the capabilities call default to XML

Merge remote-tracking branch 'upstream/pull/4144'

Merge remote-tracking branch 'upstream/pull/4159'

Check that the /api/0.6/capabilities.json route is recognised

Merge remote-tracking branch 'upstream/pull/4158'

Merge remote-tracking branch 'upstream/pull/4161'

Allow a srcset to be specified for banners

Use Settings.generator string in tests

Merge remote-tracking branch 'upstream/pull/4155'

Merge remote-tracking branch 'upstream/pull/4149'

Merge remote-tracking branch 'upstream/pull/4157'

Add JSON output to /api/0.6/capabilities

Add order parameter to changeset query api entry point

Add ordered changeset test method

Bump eslint from 8.46.0 to 8.47.0

Bumps [eslint](https://github.com/eslint/eslint) from 8.46.0 to 8.47.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v8.46.0...v8.47.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Don't do direction override from Bootstrap reboot of <code>

Later versions of Bootstrap don't have it.
See https://github.com/twbs/bootstrap/pull/35230

Use article html elements for diary posts