Merge pull request #7207 from hotosm/staging

v5.5.2 release

Author: ramyaragupathy

.github/workflows/backend-build-deploy.yml

@@ -24,7 +24,7 @@ env:
 
 jobs:
   image-build-and-push:
-    uses: hotosm/gh-workflows/.github/workflows/image_build.yml@1.5.1
+    uses: hotosm/gh-workflows/.github/workflows/image_build.yml@3.6.0
     with:
       image_name: ghcr.io/${{ github.repository }}/backend
       build_target: prod

.github/workflows/pr_test_frontend.yml

@@ -74,7 +74,7 @@ jobs:
 
   frontend-dev-image-build:
     name: Build dev image for testing
-    uses: hotosm/gh-workflows/.github/workflows/image_build.yml@1.5.1
+    uses: hotosm/gh-workflows/.github/workflows/image_build.yml@3.6.0
     with:
       image_name: ghcr.io/${{ github.repository }}/frontend
       build_target: debug

README.md

@@ -20,8 +20,6 @@ This is Free and Open Source Software. You are welcome to use the code and set u
 
 ## Product Roadmap
 
-[Discussion](https://github.com/hotosm/tasking-manager/discussions/6688) | [Roadmap Kanban](https://github.com/orgs/hotosm/projects/41/views/1)
-
 
 ✅ Completed: Finished, available on [production instance](https://tasks.hotosm.org)
 
@@ -34,15 +32,45 @@ This is Free and Open Source Software. You are welcome to use the code and set u
 Status | Feature | Release
 -------|---------|---------
 ✅ | Up-to-date OSM Statistics: Integrated with [ohsome Now](https://stats.now.ohsome.org/) for real-time data insights.| Released in [v4.6.2](https://github.com/hotosm/tasking-manager/releases/tag/v4.6.2).
+
+
+### 2024
+
+Status | Feature | Release
+-------|---------|---------
 ✅ | Downloadable OSM Exports: Export data directly from each project. | Available in[ v4.7.0](https://github.com/hotosm/tasking-manager/releases/tag/v4.7.0).
 ✅ | Rapid Editor Upgrade: Enhanced mapping experience with the latest rapid editor updates.| Last updated in [v4.8.2](https://github.com/hotosm/tasking-manager/releases/tag/v4.8.2)
 ✅ | Public-Facing Partner Pages: Create and display dedicated pages for partners running remote mapathons.| [v4.8.2](https://github.com/hotosm/tasking-manager/releases/tag/v4.8.2)
 ✅ | Downloadable Project List View: Allow users to explore projects via a downloadable list. [View issue](https://github.com/hotosm/tasking-manager/issues/3394).| [v4.8.2](https://github.com/hotosm/tasking-manager/releases/tag/v4.8.2)
 ✅ | MapSwipe Stats Integration: Display MapSwipe statistics on Partner Pages.|[v4.8.2](https://github.com/hotosm/tasking-manager/releases/tag/v4.8.2)
-✅ | iD Editor Latest Features: Integrate the newest features of the iD editor.|[v5.0.5](https://github.com/hotosm/tasking-manager/releases/tag/v5.0.5)
+
+
+### 2025
+
+Status | Feature | Release
+-------|---------|---------
 ✅ | FastAPI Migration: Improve performance and scalability of Tasking Manager to handle large scale validation and mapping efforts.| [v5 launch 🎉](https://github.com/hotosm/tasking-manager/releases/tag/v5.0.0)
+✅ | iD Editor Latest Features: Integrate the newest features of the iD editor.|[v5.0.5](https://github.com/hotosm/tasking-manager/releases/tag/v5.0.5)
 ✅ | Super Mapper: Redefine Mapper Level Milestones | [v5.2.0](https://github.com/hotosm/tasking-manager/releases/tag/v5.2.0)
-🔄 | OSM Practice Projects: Enable users to engage in OSM practice projects within Tasking Manager workflow.
+✅ | Ability to unlink projects and subsequent team deletion | [v5.3.1](https://github.com/hotosm/tasking-manager/releases/tag/v5.3.1)
+✅ | User account deletion (self-service + admin initiated) | [v5.4.0](https://github.com/hotosm/tasking-manager/releases/tag/v5.4.0)
+
+### 2026
+
+Status | Feature | Release
+-------|---------|---------
+✅ | Markdown support in Project Q&A | [v5.4.1](https://github.com/hotosm/tasking-manager/releases/tag/v5.4.1)
+✅ | Improved panel arrangement in task contribution section | [v5.4.1](https://github.com/hotosm/tasking-manager/releases/tag/v5.4.1)
+✅ | OSM Practice Projects (sandbox): Enable users to engage in OSM practice projects within Tasking Manager workflow. |[v5.5](https://github.com/hotosm/tasking-manager/releases/tag/v5.5)
+✅ | Complete migration to MapLibre libraries | [v5.5](https://github.com/hotosm/tasking-manager/releases/tag/v5.5)
+✅ | [Digital Public Goods](https://www.digitalpublicgoods.net/registry) badge display | [v5.5](https://github.com/hotosm/tasking-manager/releases/tag/v5.5)
+✅ | Filter by imagery type using API | [v5.5](https://github.com/hotosm/tasking-manager/releases/tag/v5.5)
+✅ | Backend support for messaging all Campaign Contributors | [v5.5](https://github.com/hotosm/tasking-manager/releases/tag/v5.5)
+🔄 | Allow data downloads for sandbox projects through frontend |
+🔄 | Custom data reference layer for sandbox projects |
+🔄 | Choropleth layer to highlight most invalidated tasks |
+🔄 | Dependency & Framework health check |
+🔄 | Additional imagery filter under explore projects section |
 📅 | Expanding Project Types beyond basemap features
 📅 | AI Integration: task assignment, difficulty estimation, and validation
 📅 | External tools Integration: MapSwipe, uMap, Maproulette

backend/config.py

@@ -280,6 +280,10 @@ def assemble_db_connection(
         "OHSOME_STATS_API_URL", "https://stats.now.ohsome.org/api"
     )
     OHSOME_STATS_TOPICS: str = os.getenv("OHSOME_STATS_TOPICS", None)
+    OSM_USER_AGENT: str = os.getenv(
+        "OSM_USER_AGENT",
+        "HOT-TaskingManager-API/5.0 (https://tasking-manager-production-api.hotosm.org)",
+    )
 
 
 class TestEnvironmentConfig(Settings):
@@ -297,6 +301,10 @@ class TestEnvironmentConfig(Settings):
     )
 
     LOG_LEVEL: str = "DEBUG"
+    OSM_USER_AGENT: str = os.getenv(
+        "OSM_USER_AGENT",
+        "HOT-TaskingManager-API/5.0 (https://tasking-manager-production-api.hotosm.org)",
+    )
 
 
 @lru_cache

backend/models/dtos/user_dto.py

@@ -54,6 +54,10 @@ class UserDTO(BaseModel):
     )
     projects_notifications: bool = Field(None, alias="projectsNotifications")
     tasks_notifications: bool = Field(None, alias="tasksNotifications")
+    task_validation_notification: bool = Field(None, alias="taskValidationNotification")
+    task_invalidation_notification: bool = Field(
+        None, alias="taskInvalidationNotification"
+    )
     tasks_comments_notifications: bool = Field(None, alias="taskCommentsNotifications")
     teams_announcement_notifications: bool = Field(
         None, alias="teamsAnnouncementNotifications"

backend/models/postgis/project_info.py

@@ -1,5 +1,6 @@
 from typing import List
 
+from backend.models.postgis.utils import sanitize_markdown
 from databases import Database
 from sqlalchemy import (
     Column,
@@ -57,11 +58,11 @@ async def create_from_dto(cls, dto: ProjectInfoDTO, project_id: int, db: Databas
         self.project_id = project_id
         self.project_id_str = str(project_id)  # Allows project_id to be searched
 
-        # Note project info not bleached on basis that admins are trusted users and shouldn't be doing anything bad
-        self.short_description = dto.short_description
-        self.description = dto.description
-        self.instructions = dto.instructions
-        self.per_task_instructions = dto.per_task_instructions
+        self.short_description = sanitize_markdown(dto.short_description)
+        self.description = sanitize_markdown(dto.description)
+        self.instructions = sanitize_markdown(dto.instructions)
+        self.per_task_instructions = sanitize_markdown(dto.per_task_instructions)
+
         columns = {
             c.key: getattr(self, c.key) for c in inspect(self).mapper.column_attrs
         }
@@ -75,11 +76,11 @@ async def update_from_dto(self, dto: ProjectInfoDTO, db: Database):
         self.name = dto.name
         self.project_id_str = str(self.project_id)  # Allows project_id to be searched
 
-        # Note project info not bleached on basis that admins are trusted users and shouldn't be doing anything bad
-        self.short_description = dto.short_description
-        self.description = dto.description
-        self.instructions = dto.instructions
-        self.per_task_instructions = dto.per_task_instructions
+        self.short_description = sanitize_markdown(dto.short_description)
+        self.description = sanitize_markdown(dto.description)
+        self.instructions = sanitize_markdown(dto.instructions)
+        self.per_task_instructions = sanitize_markdown(dto.per_task_instructions)
+
         columns = {
             c.key: getattr(self, c.key) for c in inspect(self).mapper.column_attrs
         }

backend/models/postgis/user.py

@@ -77,6 +77,8 @@ class User(Base):
     projects_comments_notifications = Column(Boolean, default=False, nullable=False)
     projects_notifications = Column(Boolean, default=True, nullable=False)
     tasks_notifications = Column(Boolean, default=True, nullable=False)
+    task_validation_notification = Column(Boolean, default=True, nullable=False)
+    task_invalidation_notification = Column(Boolean, default=True, nullable=False)
     tasks_comments_notifications = Column(Boolean, default=False, nullable=False)
     teams_announcement_notifications = Column(Boolean, default=True, nullable=False)
     date_registered = Column(DateTime, default=timestamp)
@@ -503,6 +505,8 @@ async def as_dto(self, logged_in_username: str, db: Database) -> UserDTO:
         user_dto.projects_notifications = self.projects_notifications
         user_dto.projects_comments_notifications = self.projects_comments_notifications
         user_dto.tasks_notifications = self.tasks_notifications
+        user_dto.task_validation_notification = self.task_validation_notification
+        user_dto.task_invalidation_notification = self.task_invalidation_notification
         user_dto.tasks_comments_notifications = self.tasks_comments_notifications
         user_dto.teams_announcement_notifications = (
             self.teams_announcement_notifications

backend/models/postgis/utils.py

@@ -1,9 +1,11 @@
 import datetime
 import json
-import re
 from geoalchemy2 import Geometry
 from geoalchemy2.functions import GenericFunction
 from loguru import logger
+import re
+from markdown import markdown
+import bleach
 
 
 class NotFound(Exception):
@@ -156,6 +158,100 @@ def parse_duration(time_str):
     return datetime.timedelta(**time_params)
 
 
+def sanitize_markdown(text: str | None) -> str | None:
+    """Convert markdown to sanitized HTML. Returns None for empty input."""
+    if not text:
+        return None
+
+    # Extended allowed tags to support markdown features
+    allowed_tags = [
+        "a",
+        "abbr",
+        "acronym",
+        "b",
+        "blockquote",
+        "br",
+        "code",
+        "em",
+        "h1",
+        "h2",
+        "h3",
+        "h4",
+        "h5",
+        "h6",
+        "img",
+        "i",
+        "li",
+        "ol",
+        "p",
+        "pre",
+        "strong",
+        "ul",
+        "div",
+        "table",
+        "thead",
+        "tbody",
+        "tfoot",
+        "tr",
+        "td",
+        "th",
+        "iframe",
+        "input",
+        "hr",
+        "del",
+        "s",
+        "strike",
+        "span",
+        "caption",
+        "col",
+        "colgroup",
+    ]
+
+    allowed_attributes = {
+        "a": ["href", "rel", "target", "title"],
+        "img": ["src", "alt", "title", "width", "height"],
+        "iframe": [
+            "width",
+            "height",
+            "src",
+            "title",
+            "frameborder",
+            "allow",
+            "referrerpolicy",
+            "allowfullscreen",
+        ],
+        "input": ["type", "checked", "disabled"],
+        "th": ["align", "scope"],
+        "td": ["align", "colspan", "rowspan"],
+        "table": ["class"],
+        "code": ["class"],
+        "pre": ["class"],
+    }
+
+    # Support markdown ~~strike~~ -> <del>
+    text = re.sub(r"~~(.*?)~~", r"<del>\1</del>", text)
+
+    html_content = markdown(
+        text,
+        extensions=[
+            "markdown.extensions.tables",
+            "markdown.extensions.fenced_code",
+            "markdown.extensions.nl2br",
+            "markdown.extensions.sane_lists",
+            "markdown.extensions.codehilite",
+        ],
+    )
+
+    clean_message = bleach.clean(
+        html_content, tags=allowed_tags, attributes=allowed_attributes, strip=False
+    )
+
+    # Turn URLs into links and parse emails
+    clean_message = bleach.linkify(clean_message, parse_email=True)
+
+    return clean_message
+
+
 class DateTimeEncoder(json.JSONEncoder):
     """
     Custom JSON Encoder that handles Python date/times

backend/services/messaging/message_service.py

@@ -206,12 +206,16 @@ async def _push_messages(messages: list, db: Database):
                 and obj.message_type == MessageType.TASK_COMMENT_NOTIFICATION.value
             ):
                 continue
+            if (
+                user.task_validation_notification is False
+                and obj.message_type == MessageType.VALIDATION_NOTIFICATION.value
+            ):
+                continue
 
-            if user.tasks_notifications is False and obj.message_type in (
-                MessageType.VALIDATION_NOTIFICATION.value,
-                MessageType.INVALIDATION_NOTIFICATION.value,
+            if (
+                user.task_invalidation_notification is False
+                and obj.message_type == MessageType.INVALIDATION_NOTIFICATION.value
             ):
-                messages_objs.append(obj)
                 continue
             # If the notification is enabled, send an email
             messages_objs.append(obj)
@@ -726,6 +730,38 @@ async def resend_email_validation(user_id: int, db: Database):
             raise ValueError("EmailNotSet- User does not have an email address")
         await SMTPService.send_verification_email(user.email_address, user.username)
 
+    @staticmethod
+    async def get_all_tasks_mappers(
+        project_id: int, task_id: int, db: Database
+    ) -> List[str]:
+        query = """
+            SELECT DISTINCT u.username
+            FROM task_history th
+            JOIN users u ON th.user_id = u.id
+            WHERE th.project_id = :project_id
+            AND th.task_id = :task_id
+            AND th.action = 'STATE_CHANGE'
+            AND th.action_text = 'MAPPED'
+        """
+        rows = await db.fetch_all(
+            query,
+            {"project_id": project_id, "task_id": task_id},
+        )
+        return [r["username"] for r in rows]
+
+    @staticmethod
+    async def get_all_project_mappers(project_id: int, db: Database) -> List[str]:
+        query = """
+            SELECT DISTINCT u.username
+            FROM task_history th
+            JOIN users u ON th.user_id = u.id
+            WHERE th.project_id = :project_id
+            AND th.action = 'STATE_CHANGE'
+            AND th.action_text = 'MAPPED'
+        """
+        rows = await db.fetch_all(query, {"project_id": project_id})
+        return [r["username"] for r in rows]
+
     @staticmethod
     async def _parse_message_for_bulk_mentions(
         message: str, project_id: int, task_id: int = None, db: Database = None
@@ -796,6 +832,16 @@ async def _parse_message_for_bulk_mentions(
                 project_id, task_id, db
             )
             usernames.extend(contributors)
+
+        if "mappers" in parsed:
+            if task_id:
+                mappers = await MessageService.get_all_tasks_mappers(
+                    project_id, task_id, db
+                )
+            else:
+                mappers = await MessageService.get_all_project_mappers(project_id, db)
+            usernames.extend(mappers)
+
         return list(set(usernames))
 
     @staticmethod