poc: improve galaxy rendering

remove remaining `CanCreateMixin`

com/views.py

@@ -700,7 +700,7 @@ class PosterModerateView(PermissionRequiredMixin, ComTabsMixin, View):
             parsed = urlparse(referer)
             if parsed.netloc == settings.SITH_URL:
                 return redirect(parsed.path)
-        return redirect(reverse("com:poster_list"))
+        return redirect("com:poster_list")
 
 
 class ScreenListView(PermissionRequiredMixin, ComTabsMixin, ListView):

core/auth/mixins.py

@@ -24,7 +24,6 @@
 from __future__ import annotations
 
 import types
-import warnings
 from typing import TYPE_CHECKING, Any, LiteralString
 
 from django.contrib.auth.mixins import AccessMixin, PermissionRequiredMixin
@@ -147,45 +146,6 @@ class GenericContentPermissionMixinBuilder(View):
         return super().dispatch(request, *arg, **kwargs)
 
 
-class CanCreateMixin(View):
-    """Protect any child view that would create an object.
-
-    Raises:
-        PermissionDenied:
-            If the user has not the necessary permission
-            to create the object of the view.
-    """
-
-    def __init_subclass__(cls, **kwargs):
-        warnings.warn(
-            f"{cls.__name__} is deprecated and should be replaced "
-            "by other permission verification mecanism.",
-            DeprecationWarning,
-            stacklevel=2,
-        )
-        super().__init_subclass__(**kwargs)
-
-    def __init__(self, *args, **kwargs):
-        warnings.warn(
-            f"{self.__class__.__name__} is deprecated and should be replaced "
-            "by other permission verification mecanism.",
-            DeprecationWarning,
-            stacklevel=2,
-        )
-        super().__init__(*args, **kwargs)
-
-    def dispatch(self, request, *arg, **kwargs):
-        if not request.user.is_authenticated:
-            raise PermissionDenied
-        return super().dispatch(request, *arg, **kwargs)
-
-    def form_valid(self, form):
-        obj = form.instance
-        if can_edit_prop(obj, self.request.user):
-            return super().form_valid(form)
-        raise PermissionDenied
-
-
 class CanEditPropMixin(GenericContentPermissionMixinBuilder):
     """Ensure the user has owner permissions on the child view object.
 

docs/reference/core/auth.md

@@ -17,7 +17,6 @@
             - can_edit_prop
             - can_edit
             - can_view
-            - CanCreateMixin
             - CanEditMixin
             - CanViewMixin
             - CanEditPropMixin

docs/tutorial/perms.md

@@ -212,7 +212,7 @@ Pour les vues sous forme de fonction, il y a le décorateur
             obj = self.get_object()
             obj.is_moderated = True
             obj.save()
-            return redirect(reverse("com:news_list"))
+            return redirect("com:news_list")
     ```
 
 === "Function-based view"
@@ -233,7 +233,7 @@ Pour les vues sous forme de fonction, il y a le décorateur
         news = get_object_or_404(News, id=news_id)
         news.is_moderated = True
         news.save()
-        return redirect(reverse("com:news_list"))
+        return redirect("com:news_list")
     ```
 
 ## Accès à des éléments en particulier
@@ -447,10 +447,9 @@ l'utilisateur recevra une liste vide d'objet.
 Voici un exemple d'utilisation en reprenant l'objet Article crée précédemment :
 
 ```python
-from django.views.generic import CreateView, DetailView
-
-from core.auth.mixins import CanViewMixin, CanCreateMixin
+from django.views.generic import DetailView
 
+from core.auth.mixins import CanViewMixin
 from com.models import WeekmailArticle
 
 
@@ -459,48 +458,15 @@ from com.models import WeekmailArticle
 # d'une classe de base pour fonctionner correctement.
 class ArticlesDetailView(CanViewMixin, DetailView):
     model = WeekmailArticle
-
-
-# Même chose pour une vue de création de l'objet Article
-class ArticlesCreateView(CanCreateMixin, CreateView):
-    model = WeekmailArticle
 ```
 
 Les mixins suivants sont implémentés :
 
-- [CanCreateMixin][core.auth.mixins.CanCreateMixin] : l'utilisateur peut-il créer l'objet ?
-  Ce mixin existe, mais est déprécié et ne doit plus être utilisé !
 - [CanEditPropMixin][core.auth.mixins.CanEditPropMixin] : l'utilisateur peut-il éditer les propriétés de l'objet ?
 - [CanEditMixin][core.auth.mixins.CanEditMixin] : L'utilisateur peut-il éditer l'objet ?
 - [CanViewMixin][core.auth.mixins.CanViewMixin] : L'utilisateur peut-il voir l'objet ?
 - [FormerSubscriberMixin][core.auth.mixins.FormerSubscriberMixin] : L'utilisateur a-t-il déjà été cotisant ?
 
-!!!danger "CanCreateMixin"
-
-    L'usage de `CanCreateMixin` est dangereux et ne doit en aucun cas être
-    étendu.
-    La façon dont ce mixin marche est qu'il valide le formulaire
-    de création et crée l'objet sans le persister en base de données, puis
-    vérifie les droits sur cet objet non-persisté.
-    Le danger de ce système vient de multiples raisons :
-
-    - Les vérifications se faisant sur un objet non persisté,
-      l'utilisation de mécanismes nécessitant une persistance préalable
-      peut mener à des comportements indésirés, voire à des erreurs.
-    - Les développeurs de django ayant tendance à restreindre progressivement
-      les actions qui peuvent être faites sur des objets non-persistés,
-      les mises-à-jour de django deviennent plus compliquées.
-    - La vérification des droits ne se fait que dans les requêtes POST,
-      à la toute fin de la requête.
-      Tout ce qui arrive avant n'est absolument pas protégé.
-      Toute opération (même les suppressions et les créations) qui ont
-      lieu avant la persistance de l'objet seront appliquées,
-      même sans permission.
-    - Si un développeur du site fait l'erreur de surcharger
-      la méthode `form_valid` (ce qui est plutôt courant,
-      lorsqu'on veut accomplir certaines actions 
-      quand un formulaire est valide), on peut se retrouver
-      dans une situation où l'objet est persisté sans aucune protection.
 
 !!!danger "Performance"
 

forum/views.py

@@ -27,14 +27,14 @@ from functools import partial
 
 from django import forms
 from django.conf import settings
-from django.contrib.auth.mixins import LoginRequiredMixin
-from django.core.exceptions import PermissionDenied
+from django.contrib.auth.mixins import LoginRequiredMixin, UserPassesTestMixin
 from django.core.paginator import EmptyPage, PageNotAnInteger, Paginator
 from django.db import IntegrityError
 from django.shortcuts import get_object_or_404
 from django.urls import reverse_lazy
 from django.utils import html, timezone
 from django.utils.decorators import method_decorator
+from django.utils.functional import cached_property
 from django.utils.translation import gettext_lazy as _
 from django.views.generic import DetailView, ListView, RedirectView
 from django.views.generic.detail import SingleObjectMixin
@@ -44,7 +44,6 @@ from honeypot.decorators import check_honeypot
 
 from club.widgets.ajax_select import AutoCompleteSelectClub
 from core.auth.mixins import (
-    CanCreateMixin,
     CanEditMixin,
     CanEditPropMixin,
     CanViewMixin,
@@ -180,11 +179,19 @@ class ForumForm(forms.ModelForm):
     )
 
 
-class ForumCreateView(CanCreateMixin, CreateView):
+class ForumCreateView(UserPassesTestMixin, CreateView):
     model = Forum
     form_class = ForumForm
     template_name = "core/create.jinja"
 
+    def test_func(self):
+        if self.request.user.has_perm("forum.add_forum"):
+            return True
+        parent = Forum.objects.filter(id=self.request.GET["parent"]).first()
+        if parent is not None:
+            return self.request.user.is_owner(parent)
+        return False
+
     def get_initial(self):
         init = super().get_initial()
         parent = Forum.objects.filter(id=self.request.GET["parent"]).first()
@@ -258,18 +265,19 @@ class TopicForm(forms.ModelForm):
 @method_decorator(
     partial(check_honeypot, field_name=settings.HONEYPOT_FIELD_NAME_FORUM), name="post"
 )
-class ForumTopicCreateView(CanCreateMixin, CreateView):
+class ForumTopicCreateView(LoginRequiredMixin, UserPassesTestMixin, CreateView):
     model = ForumMessage
     form_class = TopicForm
     template_name = "forum/reply.jinja"
 
-    def dispatch(self, request, *args, **kwargs):
-        self.forum = get_object_or_404(
-            Forum, id=self.kwargs["forum_id"], is_category=False
+    @cached_property
+    def forum(self):
+        return get_object_or_404(Forum, id=self.kwargs["forum_id"], is_category=False)
+
+    def test_func(self):
+        return self.request.user.has_perm("forum.add_forumtopic") or (
+            self.request.user.can_view(self.forum)
         )
-        if not request.user.can_view(self.forum):
-            raise PermissionDenied
-        return super().dispatch(request, *args, **kwargs)
 
     def form_valid(self, form):
         topic = ForumTopic(
@@ -404,7 +412,7 @@ class ForumMessageUndeleteView(SingleObjectMixin, RedirectView):
 @method_decorator(
     partial(check_honeypot, field_name=settings.HONEYPOT_FIELD_NAME_FORUM), name="post"
 )
-class ForumMessageCreateView(CanCreateMixin, CreateView):
+class ForumMessageCreateView(LoginRequiredMixin, UserPassesTestMixin, CreateView):
     model = ForumMessage
     form_class = forms.modelform_factory(
         model=ForumMessage,
@@ -413,11 +421,14 @@ class ForumMessageCreateView(CanCreateMixin, CreateView):
     )
     template_name = "forum/reply.jinja"
 
-    def dispatch(self, request, *args, **kwargs):
-        self.topic = get_object_or_404(ForumTopic, id=self.kwargs["topic_id"])
-        if not request.user.can_view(self.topic):
-            raise PermissionDenied
-        return super().dispatch(request, *args, **kwargs)
+    @cached_property
+    def topic(self):
+        return get_object_or_404(ForumTopic, id=self.kwargs["topic_id"])
+
+    def test_func(self):
+        return self.request.user.has_perm(
+            "forum.add_forummessage"
+        ) or self.request.user.can_view(self.topic)
 
     def get_initial(self):
         init = super().get_initial()

galaxy/static/bundled/galaxy/galaxy-index.js

@@ -1,138 +0,0 @@
-import { default as ForceGraph3D } from "3d-force-graph";
-import { forceX, forceY, forceZ } from "d3-force-3d";
-// biome-ignore lint/style/noNamespaceImport: This is how it should be imported
-import * as Three from "three";
-import SpriteText from "three-spritetext";
-
-/**
- * @typedef GalaxyConfig
- * @property {number} nodeId id of the current user node
- * @property {string} dataUrl url to fetch the galaxy data from
- **/
-
-/**
- * Load the galaxy of an user
- * @param {GalaxyConfig} config
- **/
-window.loadGalaxy = (config) => {
-  window.getNodeFromId = (id) => {
-    return Graph.graphData().nodes.find((n) => n.id === id);
-  };
-
-  window.getLinksFromNodeId = (id) => {
-    return Graph.graphData().links.filter(
-      (l) => l.source.id === id || l.target.id === id,
-    );
-  };
-
-  window.focusNode = (node) => {
-    highlightNodes.clear();
-    highlightLinks.clear();
-
-    hoverNode = node || null;
-    if (node) {
-      // collect neighbors and links for highlighting
-      for (const link of window.getLinksFromNodeId(node.id)) {
-        highlightLinks.add(link);
-        highlightNodes.add(link.source);
-        highlightNodes.add(link.target);
-      }
-    }
-
-    // refresh node and link display
-    Graph.nodeThreeObject(Graph.nodeThreeObject())
-      .linkWidth(Graph.linkWidth())
-      .linkDirectionalParticles(Graph.linkDirectionalParticles());
-
-    // Aim at node from outside it
-    const distance = 42;
-    const distRatio = 1 + distance / Math.hypot(node.x, node.y, node.z);
-
-    const newPos =
-      node.x || node.y || node.z
-        ? { x: node.x * distRatio, y: node.y * distRatio, z: node.z * distRatio }
-        : { x: 0, y: 0, z: distance }; // special case if node is in (0,0,0)
-
-    Graph.cameraPosition(
-      newPos, // new position
-      node, // lookAt ({ x, y, z })
-      3000, // ms transition duration
-    );
-  };
-
-  const highlightNodes = new Set();
-  const highlightLinks = new Set();
-  let hoverNode = null;
-
-  const grpahDiv = document.getElementById("3d-graph");
-  const Graph = ForceGraph3D();
-  Graph(grpahDiv);
-  Graph.jsonUrl(config.dataUrl)
-    .width(
-      grpahDiv.parentElement.clientWidth > 1200
-        ? 1200
-        : grpahDiv.parentElement.clientWidth,
-    ) // Not perfect at all. JS-fu master from the future, please fix this :-)
-    .height(1000)
-    .enableNodeDrag(false) // allow easier navigation
-    .onNodeClick((node) => {
-      const camera = Graph.cameraPosition();
-      const distance = Math.sqrt(
-        (node.x - camera.x) ** 2 + (node.y - camera.y) ** 2 + (node.z - camera.z) ** 2,
-      );
-      if (distance < 120 || highlightNodes.has(node)) {
-        window.focusNode(node);
-      }
-    })
-    .linkWidth((link) => (highlightLinks.has(link) ? 0.4 : 0.0))
-    .linkColor((link) =>
-      highlightLinks.has(link) ? "rgba(255,160,0,1)" : "rgba(128,255,255,0.6)",
-    )
-    .linkVisibility((link) => highlightLinks.has(link))
-    .nodeVisibility((node) => highlightNodes.has(node) || node.mass > 4)
-    // .linkDirectionalParticles(link => highlightLinks.has(link) ? 3 : 1) // kinda buggy for now, and slows this a bit, but would be great to help visualize lanes
-    .linkDirectionalParticleWidth(0.2)
-    .linkDirectionalParticleSpeed(-0.006)
-    .nodeThreeObject((node) => {
-      const sprite = new SpriteText(node.name);
-      sprite.material.depthWrite = false; // make sprite background transparent
-      sprite.color = highlightNodes.has(node)
-        ? node === hoverNode
-          ? "rgba(200,0,0,1)"
-          : "rgba(255,160,0,0.8)"
-        : "rgba(0,255,255,0.2)";
-      sprite.textHeight = 2;
-      sprite.center = new Three.Vector2(1.2, 0.5);
-      return sprite;
-    })
-    .onEngineStop(() => {
-      window.focusNode(window.getNodeFromId(config.nodeId));
-      Graph.onEngineStop(() => {
-        /* nope */
-      }); // don't call ourselves in a loop while moving the focus
-    });
-
-  // Set distance between stars
-  Graph.d3Force("link").distance((link) => link.value);
-
-  // Set high masses nearer the center of the galaxy
-  // TODO: quick and dirty strength computation, this will need tuning.
-  Graph.d3Force(
-    "positionX",
-    forceX().strength((node) => {
-      return 1 - 1 / node.mass;
-    }),
-  );
-  Graph.d3Force(
-    "positionY",
-    forceY().strength((node) => {
-      return 1 - 1 / node.mass;
-    }),
-  );
-  Graph.d3Force(
-    "positionZ",
-    forceZ().strength((node) => {
-      return 1 - 1 / node.mass;
-    }),
-  );
-};

galaxy/static/bundled/galaxy/galaxy-index.ts

@@ -0,0 +1,137 @@
+import { exportToHtml } from "#core:utils/globals";
+
+import cytoscape from "cytoscape";
+import d3Force, { type D3ForceLayoutOptions } from "cytoscape-d3-force";
+
+cytoscape.use(d3Force);
+
+interface GalaxyConfig {
+  nodeId: number;
+  dataUrl: string;
+}
+
+async function getGraphData(dataUrl: string) {
+  const response = await fetch(dataUrl);
+  if (!response.ok) {
+    return [];
+  }
+
+  const content = await response.json();
+  const nodes = content.nodes.map((node, i) => {
+    return {
+      group: "nodes",
+      data: {
+        id: node.id,
+        name: node.name,
+        mass: node.mass,
+      },
+    };
+  });
+
+  const edges = content.links.map((link) => {
+    return {
+      group: "edges",
+      data: {
+        id: `edge_${link.source}_${link.value}`,
+        source: link.source,
+        target: link.target,
+        value: link.value,
+      },
+    };
+  });
+
+  return { nodes: nodes, edges: edges };
+}
+
+exportToHtml("loadGalaxy", async (config: GalaxyConfig) => {
+  const graphDiv = document.getElementById("3d-graph");
+  const elements = await getGraphData(config.dataUrl);
+  const cy = cytoscape({
+    container: graphDiv,
+    elements: elements,
+    style: [
+      {
+        selector: "node",
+        style: {
+          label: "data(name)",
+          "background-color": "red",
+        },
+      },
+      {
+        selector: ".focused",
+        style: {
+          "border-width": "5px",
+          "border-style": "solid",
+          "border-color": "black",
+          "target-arrow-color": "black",
+          "line-color": "black",
+        },
+      },
+      {
+        selector: "edge",
+        style: {
+          width: 0.1,
+        },
+      },
+      {
+        selector: ".direct",
+        style: {
+          width: "5px",
+          "line-color": "red",
+        },
+      },
+    ],
+    layout: {
+      name: "d3-force",
+      animate: true,
+      fit: false,
+      ungrabifyWhileSimulating: true,
+      fixedAfterDragging: true,
+
+      linkId: (node) => {
+        return node.id;
+      },
+
+      linkDistance: (link) => {
+        return elements.nodes.length * 10;
+      },
+
+      linkStrength: (link) => {
+        return 1 / Math.max(1, link?.value);
+      },
+
+      linkIterations: 10,
+
+      manyBodyStrength: (node) => {
+        return node?.mass;
+      },
+
+      // manyBodyDistanceMin: 500,
+      collideRadius: () => {
+        return 50;
+      },
+
+      ready: (e) => {
+        // Center on current user node at the start of the simulation
+        // Color all direct paths from that citizen to it's neighbor
+        const citizen = e.cy.nodes(`#${config.nodeId}`)[0];
+        citizen.addClass("focused");
+        citizen.connectedEdges().addClass("direct");
+        e.cy.center(citizen);
+      },
+
+      tick: () => {
+        // Center on current user node during simulation
+        const citizen = cy.nodes(`#${config.nodeId}`)[0];
+        cy.center(citizen);
+      },
+
+      stop: (e) => {
+        // Disable user grabbing of nodes
+        // This has to be disabled after the simulation is done
+        // Otherwise the simulation can't move nodes
+        e.cy.autolock(true);
+      },
+    } as D3ForceLayoutOptions,
+  });
+});

galaxy/templates/galaxy/user.jinja

@@ -5,14 +5,14 @@
 {% endblock %}
 
 {% block additional_js %}
-  <script type="module" src="{{ static('bundled/galaxy/galaxy-index.js') }}"></script>
+  <script type="module" src="{{ static('bundled/galaxy/galaxy-index.ts') }}"></script>
 {% endblock %}
 
 
 {% block content %}
   {% if object.current_star %}
     <div style="display: flex; flex-wrap: wrap;">
-      <div id="3d-graph"></div>
+      <div style="width: 100%; height: 70vh; display: block" id="3d-graph"></div>
 
       <div style="margin: 1em;">
         <p><a onclick="window.focusNode(window.getNodeFromId({{ object.id }}))">Reset on {{ object.get_display_name() }}</a></p>

package-lock.json

@@ -25,6 +25,7 @@
         "country-flag-emoji-polyfill": "^0.1.8",
         "cytoscape": "^3.33.1",
         "cytoscape-cxtmenu": "^3.5.0",
+        "cytoscape-d3-force": "^1.1.4",
         "cytoscape-klay": "^3.1.4",
         "d3-force-3d": "^3.0.6",
         "easymde": "^2.20.0",
@@ -46,6 +47,7 @@
         "@rollup/plugin-inject": "^5.0.5",
         "@types/alpinejs": "^3.13.11",
         "@types/cytoscape-cxtmenu": "^3.4.5",
+        "@types/cytoscape-d3-force": "^1.0.0",
         "@types/cytoscape-klay": "^3.1.5",
         "@types/js-cookie": "^3.0.6",
         "typescript": "^5.9.3",
@@ -2890,6 +2892,16 @@
         "cytoscape": "^3.31"
       }
     },
+    "node_modules/@types/cytoscape-d3-force": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/@types/cytoscape-d3-force/-/cytoscape-d3-force-1.0.0.tgz",
+      "integrity": "sha512-1eRd9xr/DvJ4MIA5lCEG8DMX2Ha87qAbpP7irpuKZun0ZCBQPpoOBo9mPl0WrkJbXH+hHwG8s3E2CpUz3HxLrw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/cytoscape": "^3.0.9"
+      }
+    },
     "node_modules/@types/cytoscape-klay": {
       "version": "3.1.5",
       "resolved": "https://registry.npmjs.org/@types/cytoscape-klay/-/cytoscape-klay-3.1.5.tgz",
@@ -3559,6 +3571,18 @@
         "cytoscape": "^3.2.0"
       }
     },
+    "node_modules/cytoscape-d3-force": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/cytoscape-d3-force/-/cytoscape-d3-force-1.1.4.tgz",
+      "integrity": "sha512-8NjI/yEoB3YqVsdf7ud7Oh8Kyi+C9Lhh1fICmtemIo6EC1ZUtm8KcPNLkQySYO8nRS2mQKj5eVdCr7W0L8ONoQ==",
+      "license": "MIT",
+      "dependencies": {
+        "d3-force": "^2.0.1"
+      },
+      "peerDependencies": {
+        "cytoscape": "^3.2.0"
+      }
+    },
     "node_modules/cytoscape-klay": {
       "version": "3.1.4",
       "resolved": "https://registry.npmjs.org/cytoscape-klay/-/cytoscape-klay-3.1.4.tgz",
@@ -3607,6 +3631,17 @@
         "node": ">=12"
       }
     },
+    "node_modules/d3-force": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/d3-force/-/d3-force-2.1.1.tgz",
+      "integrity": "sha512-nAuHEzBqMvpFVMf9OX75d00OxvOXdxY+xECIXjW6Gv8BRrXu6gAWbv/9XKrvfJ5i5DCokDW7RYE50LRoK092ew==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "d3-dispatch": "1 - 2",
+        "d3-quadtree": "1 - 2",
+        "d3-timer": "1 - 2"
+      }
+    },
     "node_modules/d3-force-3d": {
       "version": "3.0.6",
       "resolved": "https://registry.npmjs.org/d3-force-3d/-/d3-force-3d-3.0.6.tgz",
@@ -3623,6 +3658,24 @@
         "node": ">=12"
       }
     },
+    "node_modules/d3-force/node_modules/d3-dispatch": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/d3-dispatch/-/d3-dispatch-2.0.0.tgz",
+      "integrity": "sha512-S/m2VsXI7gAti2pBoLClFFTMOO1HTtT0j99AuXLoGFKO6deHDdnv6ZGTxSTTUTgO1zVcv82fCOtDjYK4EECmWA==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/d3-force/node_modules/d3-quadtree": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/d3-quadtree/-/d3-quadtree-2.0.0.tgz",
+      "integrity": "sha512-b0Ed2t1UUalJpc3qXzKi+cPGxeXRr4KU9YSlocN74aTzp6R/Ud43t79yLLqxHRWZfsvWXmbDWPpoENK1K539xw==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/d3-force/node_modules/d3-timer": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/d3-timer/-/d3-timer-2.0.0.tgz",
+      "integrity": "sha512-TO4VLh0/420Y/9dO3+f9abDEFYeCUr2WZRlxJvbp4HPTQcSylXNiL6yZa9FIUvV1yRiFufl1bszTCLDqv9PWNA==",
+      "license": "BSD-3-Clause"
+    },
     "node_modules/d3-format": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/d3-format/-/d3-format-3.1.0.tgz",

package.json

@@ -31,6 +31,7 @@
     "@rollup/plugin-inject": "^5.0.5",
     "@types/alpinejs": "^3.13.11",
     "@types/cytoscape-cxtmenu": "^3.4.5",
+    "@types/cytoscape-d3-force": "^1.0.0",
     "@types/cytoscape-klay": "^3.1.5",
     "@types/js-cookie": "^3.0.6",
     "typescript": "^5.9.3",
@@ -55,6 +56,7 @@
     "country-flag-emoji-polyfill": "^0.1.8",
     "cytoscape": "^3.33.1",
     "cytoscape-cxtmenu": "^3.5.0",
+    "cytoscape-d3-force": "^1.1.4",
     "cytoscape-klay": "^3.1.4",
     "d3-force-3d": "^3.0.6",
     "easymde": "^2.20.0",

trombi/views.py

@@ -27,7 +27,7 @@ from datetime import date
 from django import forms
 from django.conf import settings
 from django.contrib import messages
-from django.contrib.auth.mixins import LoginRequiredMixin
+from django.contrib.auth.mixins import LoginRequiredMixin, UserPassesTestMixin
 from django.contrib.messages.views import SuccessMessageMixin
 from django.core.exceptions import PermissionDenied
 from django.db import IntegrityError
@@ -35,17 +35,13 @@ from django.forms.models import modelform_factory
 from django.http import Http404, HttpResponseRedirect
 from django.shortcuts import get_object_or_404, redirect
 from django.urls import reverse, reverse_lazy
+from django.utils.functional import cached_property
 from django.utils.translation import gettext_lazy as _
 from django.views.generic import DetailView, RedirectView, TemplateView, View
 from django.views.generic.edit import CreateView, DeleteView, UpdateView
 
 from club.models import Club
-from core.auth.mixins import (
-    CanCreateMixin,
-    CanEditMixin,
-    CanEditPropMixin,
-    CanViewMixin,
-)
+from core.auth.mixins import CanEditMixin, CanEditPropMixin, CanViewMixin
 from core.models import User
 from core.views.forms import SelectDate
 from core.views.mixins import TabedViewMixin
@@ -117,19 +113,25 @@ class TrombiForm(forms.ModelForm):
         widgets = {"subscription_deadline": SelectDate, "comments_deadline": SelectDate}
 
 
-class TrombiCreateView(CanCreateMixin, CreateView):
+class TrombiCreateView(UserPassesTestMixin, CreateView):
     """Create a trombi for a club."""
 
     model = Trombi
     form_class = TrombiForm
     template_name = "core/create.jinja"
 
+    @cached_property
+    def club(self):
+        return get_object_or_404(Club, id=self.kwargs["club_id"])
+
+    def test_func(self):
+        return self.request.user.can_edit(self.club)
+
     def post(self, request, *args, **kwargs):
         """Affect club."""
         form = self.get_form()
         if form.is_valid():
-            club = get_object_or_404(Club, id=self.kwargs["club_id"])
-            form.instance.club = club
+            form.instance.club = self.club
             ret = self.form_valid(form)
             return ret
         else: