Merge remote-tracking branch 'upstream/pull/4226'

diff --combined Gemfile
index ebbebe4f9ddf8c5486dcebf19ebb0b6395e4d24b,b738fa1592bae068fb49312e2cd5971fdc7c4c6d..724dd3beccac75ba929b6ac55fa144ad97696215
--- 1/Gemfile
--- 2/Gemfile
+++ b/Gemfile
@@@ -10,9 -10,7 +10,9 @@@ gem "json
  gem "pg"
  
  # Use SCSS for stylesheets
 -gem "sassc-rails"
 +gem "dartsass-sprockets"
 +# Pin the dependentent sass-embedded to avoid deprecation warnings in bootstrap
 +gem "sass-embedded", "~> 1.64.0"
  
  # Use Terser as compressor for JavaScript assets
  gem "terser"
@@@ -45,7 -43,7 +45,7 @@@ gem "sprockets-exporters_pack
  gem "actionpack-page_caching", ">= 1.2.0"
  gem "activerecord-import"
  gem "active_record_union"
 -gem "bootstrap", "~> 5.1.0"
 +gem "bootstrap", :github => "gravitystorm/bootstrap-rubygem", :branch => "dartsass_5_2_3"
  gem "bootstrap_form", "~> 5.0"
  gem "cancancan"
  gem "composite_primary_keys", "~> 14.0.0"
@@@ -81,6 -79,7 +81,7 @@@ gem "omniauth-rails_csrf_protection", "
  # Doorkeeper for OAuth2
  gem "doorkeeper"
  gem "doorkeeper-i18n"
+ gem "doorkeeper-openid_connect"
  
  # Markdown formatting support
  gem "kramdown"
@@@ -150,6 -149,7 +151,7 @@@ group :test d
    gem "capybara", ">= 2.15"
    gem "erb_lint", :require => false
    gem "factory_bot_rails"
+   gem "jwt"
    gem "minitest", "~> 5.1"
    gem "puma", "~> 5.6"
    gem "rails-controller-testing"

diff --combined Gemfile.lock
index 03607e0619289c67859df609462526fc2c8259d8,35d67d32763a5aa5d880b811a6859219ff274246..c8784ed7c2d40195cd5c3f72c31d2a1f183fc4e0
--- 1/Gemfile.lock
--- 2/Gemfile.lock
+++ b/Gemfile.lock
@@@ -1,12 -1,3 +1,12 @@@
 +GIT
 +  remote: https://github.com/gravitystorm/bootstrap-rubygem.git
 +  revision: 7bd2caa8a2897a55892915a789d4e020906adb60
 +  branch: dartsass_5_2_3
 +  specs:
 +    bootstrap (5.2.3)
 +      autoprefixer-rails (>= 9.1.0)
 +      popper_js (>= 2.11.6, < 3)
 +
  GEM
    remote: https://rubygems.org/
    specs:
@@@ -95,16 -86,16 +95,16 @@@
      autoprefixer-rails (10.4.15.0)
        execjs (~> 2)
      aws-eventstream (1.2.0)
 -    aws-partitions (1.820.0)
 -    aws-sdk-core (3.181.0)
 +    aws-partitions (1.831.0)
 +    aws-sdk-core (3.185.0)
        aws-eventstream (~> 1, >= 1.0.2)
        aws-partitions (~> 1, >= 1.651.0)
        aws-sigv4 (~> 1.5)
        jmespath (~> 1, >= 1.6.1)
 -    aws-sdk-kms (1.71.0)
 -      aws-sdk-core (~> 3, >= 3.177.0)
 +    aws-sdk-kms (1.72.0)
 +      aws-sdk-core (~> 3, >= 3.184.0)
        aws-sigv4 (~> 1.1)
 -    aws-sdk-s3 (1.134.0)
 +    aws-sdk-s3 (1.136.0)
        aws-sdk-core (~> 3, >= 3.181.0)
        aws-sdk-kms (~> 1)
        aws-sigv4 (~> 1.6)
@@@ -126,9 -117,13 +126,9 @@@
        debug_inspector (>= 0.0.1)
      bootsnap (1.16.0)
        msgpack (~> 1.2)
 -    bootstrap (5.1.3)
 -      autoprefixer-rails (>= 9.1.0)
 -      popper_js (>= 2.9.3, < 3)
 -      sassc-rails (>= 2.0.0)
 -    bootstrap_form (5.2.3)
 -      actionpack (>= 6.0)
 -      activemodel (>= 6.0)
 +    bootstrap_form (5.3.2)
 +      actionpack (>= 6.1)
 +      activemodel (>= 6.1)
      brakeman (6.0.1)
      brotli (0.4.0)
      browser (5.3.1)
@@@ -157,15 -152,7 +157,15 @@@
      crack (0.4.5)
        rexml
      crass (1.0.6)
 -    dalli (3.2.5)
 +    dalli (3.2.6)
 +    dartsass-ruby (3.0.1)
 +      sass-embedded (~> 1.54)
 +    dartsass-sprockets (3.0.0)
 +      dartsass-ruby (~> 3.0)
 +      railties (>= 4.0.0)
 +      sprockets (> 3.0)
 +      sprockets-rails
 +      tilt
      date (3.3.3)
      debug_inspector (1.1.0)
      deep_merge (1.2.2)
@@@ -177,8 -164,11 +177,11 @@@
      docile (1.4.0)
      doorkeeper (5.6.6)
        railties (>= 5)
 -    doorkeeper-i18n (5.2.6)
 +    doorkeeper-i18n (5.2.7)
        doorkeeper (>= 5.2)
+     doorkeeper-openid_connect (1.8.7)
+       doorkeeper (>= 5.5, < 5.7)
+       jwt (>= 2.5)
      dry-configurable (1.1.0)
        dry-core (~> 1.0, < 2)
        zeitwerk (~> 2.6)
@@@ -219,7 -209,7 +222,7 @@@
        rubocop
        smart_properties
      erubi (1.12.0)
 -    execjs (2.9.0)
 +    execjs (2.9.1)
      exifr (1.4.0)
      factory_bot (6.2.1)
        activesupport (>= 5.0.0)
@@@ -231,11 -221,11 +234,11 @@@
        faraday-net_http (>= 2.0, < 3.1)
        ruby2_keywords (>= 0.0.4)
      faraday-net_http (3.0.2)
 -    ffi (1.15.5)
 +    ffi (1.16.2)
      ffi-compiler (1.0.1)
        ffi (>= 1.0.0)
        rake
 -    ffi-libarchive (1.1.3)
 +    ffi-libarchive (1.1.13)
        ffi (~> 1.0)
      frozen_record (0.27.0)
        activemodel
@@@ -244,7 -234,6 +247,7 @@@
        ffi (>= 1.0.0)
      globalid (1.2.1)
        activesupport (>= 6.1)
 +    google-protobuf (3.24.3)
      hashdiff (1.0.1)
      hashie (5.0.0)
      highline (2.1.0)
@@@ -327,7 -316,7 +330,7 @@@
        net-protocol
      net-protocol (0.2.1)
        timeout
 -    net-smtp (0.3.3)
 +    net-smtp (0.4.0)
        net-protocol
      nio4r (2.5.9)
      nokogiri (1.15.4)
@@@ -450,7 -439,7 +453,7 @@@
      rinku (2.0.6)
      rotp (6.3.0)
      rouge (4.1.3)
 -    rubocop (1.56.3)
 +    rubocop (1.56.4)
        base64 (~> 0.1.1)
        json (~> 2.3)
        language_server-protocol (>= 3.17.0)
@@@ -464,16 -453,16 +467,16 @@@
        unicode-display_width (>= 2.4.0, < 3.0)
      rubocop-ast (1.29.0)
        parser (>= 3.2.1.0)
 -    rubocop-capybara (2.18.0)
 +    rubocop-capybara (2.19.0)
        rubocop (~> 1.41)
 -    rubocop-factory_bot (2.23.1)
 +    rubocop-factory_bot (2.24.0)
        rubocop (~> 1.33)
 -    rubocop-minitest (0.31.1)
 +    rubocop-minitest (0.32.2)
        rubocop (>= 1.39, < 2.0)
 -    rubocop-performance (1.19.0)
 +    rubocop-performance (1.19.1)
        rubocop (>= 1.7.0, < 2.0)
        rubocop-ast (>= 0.4.0)
 -    rubocop-rails (2.21.0)
 +    rubocop-rails (2.21.2)
        activesupport (>= 4.2.0)
        rack (>= 1.1)
        rubocop (>= 1.33.0, < 2.0)
@@@ -485,14 -474,19 +488,14 @@@
        ffi (~> 1.12)
      ruby2_keywords (0.0.5)
      rubyzip (2.3.2)
 -    sanitize (6.0.2)
 +    sanitize (6.1.0)
        crass (~> 1.0.2)
        nokogiri (>= 1.12.0)
 -    sassc (2.4.0)
 -      ffi (~> 1.9)
 -    sassc-rails (2.1.2)
 -      railties (>= 4.0.0)
 -      sassc (>= 2.0)
 -      sprockets (> 3.0)
 -      sprockets-rails
 -      tilt
 +    sass-embedded (1.64.2)
 +      google-protobuf (~> 3.23)
 +      rake (>= 13.0.0)
      secure_headers (6.5.0)
 -    selenium-webdriver (4.12.0)
 +    selenium-webdriver (4.13.1)
        rexml (~> 3.2, >= 3.2.5)
        rubyzip (>= 1.2.2, < 3.0)
        websocket (~> 1.0)
@@@ -517,18 -511,18 +520,18 @@@
        actionpack (>= 5.2)
        activesupport (>= 5.2)
        sprockets (>= 3.0.0)
 -    strong_migrations (1.6.1)
 +    strong_migrations (1.6.3)
        activerecord (>= 5.2)
      terminal-table (3.0.2)
        unicode-display_width (>= 1.1.1, < 3)
      terser (1.1.18)
        execjs (>= 0.3.0, < 3)
      thor (1.2.2)
 -    tilt (2.2.0)
 +    tilt (2.3.0)
      timeout (0.4.0)
      tzinfo (2.0.6)
        concurrent-ruby (~> 1.0)
 -    unicode-display_width (2.4.2)
 +    unicode-display_width (2.5.0)
      validates_email_format_of (1.7.2)
        i18n
      vendorer (0.2.0)
@@@ -537,13 -531,13 +540,13 @@@
        addressable (>= 2.8.0)
        crack (>= 0.3.2)
        hashdiff (>= 0.4.0, < 2.0.0)
 -    websocket (1.2.9)
 +    websocket (1.2.10)
      websocket-driver (0.7.6)
        websocket-extensions (>= 0.1.0)
      websocket-extensions (0.1.5)
      xpath (3.2.0)
        nokogiri (~> 1.8)
 -    zeitwerk (2.6.11)
 +    zeitwerk (2.6.12)
  
  PLATFORMS
    ruby
@@@ -560,7 -554,7 +563,7 @@@ DEPENDENCIE
    better_errors
    binding_of_caller
    bootsnap (>= 1.4.2)
 -  bootstrap (~> 5.1.0)
 +  bootstrap!
    bootstrap_form (~> 5.0)
    brakeman
    browser
@@@ -572,11 -566,11 +575,12 @@@
    config
    connection_pool
    dalli
 +  dartsass-sprockets
    debug_inspector
    delayed_job_active_record
    doorkeeper
    doorkeeper-i18n
+   doorkeeper-openid_connect
    erb_lint
    factory_bot_rails
    faraday
@@@ -592,6 -586,7 +596,7 @@@
    jbuilder (~> 2.7)
    jquery-rails
    json
+   jwt
    kgio
    kramdown
    libxml-ruby (>= 2.0.5)
@@@ -629,7 -624,7 +634,7 @@@
    rubocop-rails
    rubocop-rake
    sanitize
 -  sassc-rails
 +  sass-embedded (~> 1.64.0)
    secure_headers
    selenium-webdriver
    simplecov
@@@ -642,4 -637,4 +647,4 @@@
    webmock
  
  BUNDLED WITH
 -   2.3.26
 +   2.4.19

diff --combined config/locales/en.yml
index da346e8e89abb15497867e4e8fd30db39824d1a1,aca571d53a586a4b2975cde54188a892d2184131..cd7d67947b7b2127b5472fe58ff563597bc52770
--- 1/config/locales/en.yml
--- 2/config/locales/en.yml
+++ b/config/locales/en.yml
@@@ -5,8 -5,6 +5,8 @@@ en
      formats:
        friendly: "%e %B %Y at %H:%M"
        blog: "%e %B %Y"
 +  count:
 +    at_least_pattern: "%{count}+"
    helpers:
      file:
        prompt: Choose file
@@@ -559,10 -557,31 +559,31 @@@
        newer_comments: "Newer Comments"
        older_comments: "Older Comments"
    doorkeeper:
+     errors:
+       messages:
+         account_selection_required: "The authorization server requires end-user account selection"
+         consent_required: "The authorization server requires end-user consent"
+         interaction_required: "The authorization server requires end-user interaction"
+         login_required: "The authorization server requires end-user authentication"
      flash:
        applications:
          create:
            notice: Application Registered.
+     openid_connect:
+       errors:
+         messages:
+           # Configuration error messages
+           auth_time_from_resource_owner_not_configured: "Failure due to Doorkeeper::OpenidConnect.configure.auth_time_from_resource_owner missing configuration."
+           reauthenticate_resource_owner_not_configured: "Failure due to Doorkeeper::OpenidConnect.configure.reauthenticate_resource_owner missing configuration."
+           resource_owner_from_access_token_not_configured: "Failure due to Doorkeeper::OpenidConnect.configure.resource_owner_from_access_token missing configuration."
+           select_account_for_resource_owner_not_configured: "Failure due to Doorkeeper::OpenidConnect.configure.select_account_for_resource_owner missing configuration."
+           subject_not_configured: "ID Token generation failed due to Doorkeeper::OpenidConnect.configure.subject missing configuration."
+     scopes:
+       address: "View your physical address"
+       email: "View your email address"
+       openid: "Authenticate your account"
+       phone: "View your phone number"
+       profile: "View your profile information"
    errors:
      contact:
        contact_url: https://wiki.openstreetmap.org/wiki/Contact
@@@ -2530,6 -2549,7 +2551,7 @@@
      permissions:
        missing: "You have not permitted the application access to this facility"
      scopes:
+       openid: Sign-in using OpenStreetMap
        read_prefs: Read user preferences
        write_prefs: Modify user preferences
        write_diary: Create diary entries, comments and make friends
@@@ -2968,7 -2988,6 +2990,7 @@@
          cyclosm: CyclOSM
          cycle_map: Cycle Map
          transport_map: Transport Map
 +        tracestracktop_topo: Tracestrack Topo
          hot: Humanitarian
          opnvkarte: ÖPNVKarte
        layers:
@@@ -2989,8 -3008,6 +3011,8 @@@
        andy_allan: Andy Allan
        opnvkarte_credit: "Tiles courtesy of %{memomaps_link}"
        memomaps: MeMoMaps
 +      tracestrack_credit: "Tiles courtesy of %{tracestrack_link}"
 +      tracestrack: Tracestrack
        hotosm_credit: "Tiles style by %{hotosm_link} hosted by %{osm_france_link}"
        hotosm_name: Humanitarian OpenStreetMap Team
      site:

diff --combined config/settings.yml
index 214f8a284e000168234913326293f7760c96c08d,f30331b0713c9d555c29eec561f2b991600e2dd7..cffd3bd316e5f53fcf3e4a5b07eb4c04a15f0de6
--- 1/config/settings.yml
--- 2/config/settings.yml
+++ b/config/settings.yml
@@@ -43,8 -43,6 +43,8 @@@ max_note_request_area: 2
  default_note_query_limit: 100
  # Maximum limit on the number of notes returned by the note search api method
  max_note_query_limit: 10000
 +# Maximum value of open issues counter for moderators, anything equal or greater to this value "n" is shown as "n+"
 +max_issues_count: 99
  # Zoom level to use for postcode results from the geocoder
  postcode_zoom: 15
  # Timeout for API calls in seconds
@@@ -119,8 -117,6 +119,8 @@@ fossgis_valhalla_url: "https://valhalla
  #wikipedia_auth_secret: ""
  # Thunderforest authentication details
  #thunderforest_key: ""
 +# Tracestrack authentication details
 +#tracestrack_key: ""
  # Key for generating TOTP tokens
  #totp_key: ""
  # Enforce Content-Security-Policy
@@@ -154,3 -150,8 +154,8 @@@ smtp_password: nul
  #signup_ip_max_burst:
  #signup_email_per_day:
  #signup_email_max_burst:
+ # Private key for signing id_tokens
+ #doorkeeper_signing_key: |
+ #  -----BEGIN PRIVATE KEY-----
+ #  ...
+ #  -----END PRIVATE KEY-----